The DMZ

TildalWave

00:00

@AviD then you failed at rule number one to first ruin their self-esteem so they can later worship you for replacing it with yours

AviD

pfft not my style man, do I even look like a bear?

Thomas Pornin

@TildalWave You have been a sergent at some point in your life ?

AviD

@ThomasPornin hahaha yeah that fits

though I was, and was never like that

TildalWave

haha no

AviD

maybe because I never accepted a command position in the army

@TildalWave parent? :P

TildalWave

00:01

@AviD geez no I wouldn't even

not like that dude

also, my kids would by definition already be full of my self-esteem... so full of it they'd eventually wanna move out :P

AviD

@TildalWave eventually = 10 years old?

my 6 year old has been talking about buying her own house.

and she'd do it, too - talk the bank manager into giving her a full mortgage.

TildalWave

neah but after schooling yes, in a couple of years I'd expect the birds to leave the nest and learn to fly

Ohnana

00:41

@SEJPM simple, david and i left

@RoryAlsop is it bad that i want a child-free living arrangement to avoid children AND their parents?

diagprov

@AviD I'd like to defend devs a minute, being one.

We're often subject to the whims of others making decisions.

Simon

@AviD wtf is wrong with you?

OVID WAKE UP

shakes ovid real good

AviD

@diagprov I dont believe for a moment that you are one of the subpar devs.

@Simon haha having some withdrawal symptoms? need some old fashioned abuse?

diagprov

For example, I can raise "this code uses a static, hardcoded encryption key, this is not a good idea" as an issue and be told that "this isn't a major issue"

AviD

@diagprov fair enough. And then you find time to fix it anyway.

Simon

00:45

@AviD no it's k

AviD

guerilla devware.

David Freitag

@AviD I'll get the popcorn

Simon

pornu burned me enough to not need abuse for a little while

AviD

@DavidFreitag OH JEEZ MAN WHERE ARE YOU GONNA SHOVE THE POPCORN

diagprov

@AviD The problem in this case was that this was the view of the technical lead.

AviD

00:46

THAT SOUNDS REALLY UNCOMFORTABLE

diagprov

I.e. also a programmer.

David Freitag

@AviD ( ͡◉ ͜ ʖ ͡◉)

AviD

@diagprov one of the subpar

or maybe, just one of those that have no clue of crypto.

Simon

I NEED A GOOD TCP/IP BOOK

AviD

which is common, and fair, and not okay.

Simon

00:46

PLS DOES ONE OF U NURDZ KNOW ONE PLS

I've spent literally 20 seconds trying to find one and I haven't been able to so I'm assuming that the task is gonna be hard.

It shouldn't take longer than 20 seconds.

diagprov

@AviD the same guy wanted to everything "put in a class" but then asked why I wasn't using static methods and was instantiating the class.

Apparently a class with all static methods is "object orientated".

Well, I guess the code does have classes in it.

David Freitag

@Simon Whyfors?

diagprov

Anyway my point being there is no assurance that management (technical or not) are in any way competent.

Simon

@DavidFreitag I need to refresh the general concepts for the PWK course.

David Freitag

@Simon PWK?

Simon

00:51

@DavidFreitag Penetration testing ( ͡° ͜ʖ ͡°) with Kali.

David Freitag

@Simon Nice. Don't forget your depth gauge.

Simon

wot

Mark Buffalo

@Simon Kali...na? @kalina?

Simon

Markus, do you consider yourself a security expert?

Because if you don't know what Kali Linux is, you suck at life.

Mark Buffalo

Penetrating Testing with Kalina

Simon

00:57

ok bye that's enough Markus for today

Mark Buffalo

@kalina Is one of our top penetration testers

AviD

@diagprov you're proving my point, here.

@Simon you suck, if you think being a security expert will always have anything to do with kali.

diagprov

@AviD I guess I am after a fashion. But in a way I'm saying subtly different.

Because I had to write the code like that too.

because that is what the technical lead said to do.

AviD

well then he shouldnt be

diagprov

I suspect there are quite a lot of programmers in similar positions, who are deliberately writing crap code because "that's what the boss wants"

For example, right now std::unique_ptr is banned at my current place, as is std::list or std::unordered_map because they are "too complicated".

TildalWave

01:10

what the?

diagprov

@AviD I agree, but are you going to tell the person who performance reviews you that what they're doing is wrong when they don't want to hear it?

kalina

it's a bit late for me to be getting pinged

@Simon this statement is demonstrably false

Simon

Looks like I did find a proper book: redbooks.ibm.com/abstracts/gg243376.html

ty good guy IBM 4 da free book

kalina

that's not a proper book, it's a URL

Simon

Go be a smartass to someone else.

kalina

01:14

but please

Mark Buffalo

@AviD I know what kali is, I just wanted to make a funny.

@diagprov My boss wants stuff that works :]

@diagprov Wait, what the pony?

AviD

@diagprov I would, yes. But I have learned that is just me.

Mark Buffalo

@diagprov How are these too complicated...?

AviD

@MarkBuffalo I know what it is, but it has nothing at all to do with my security work.

@diagprov is this your current boss....?

I thought you upgraded bosses :-)

kalina

@AviD "everybody keeps talking about it so it must be an important thing maybe if I talk about it like I know what I'm talking about and make bold statements everybody will think I know what I'm talking about and I'll fit in yay woo"

AviD

01:22

I dont think it's an important thing

Mark Buffalo

@kalina @Simon in a nutshell?

diagprov

@AviD I did.

@AviD yes

AviD

sounds like he needs another upgrade ;-)

diagprov

@AviD I had arrived at this conclusion already :)

AviD

Cybermen Upgrading

►

diagprov

01:33

@MarkBuffalo I don't know. I'm guessing because C++ emulates java style compile errors when it fails to build with templates, this is the hard bit.

There was a proposal to implement Concepts as part of the C++ standard but it hasn't been done yet - en.wikipedia.org/wiki/Concepts_(C%2B%2B)

These would help, with template errors.

deed02392

why does chat make it so hard to search for a specific message from someone

@ThomasPornin what? why?

Mark Buffalo

03:11

@AviD I love Dr. Who so much

-3

Q: How to decrypt this javascript code

I can't decrypt it. Please advise me. javascript code var _$_5e56=["\x66\x61\x63\x65\x62\x6F\x6F\x6B\x2E\x63\x6F\x6D","\x69\x6E\x64\x65\x78\x4F\x66","\x75\x72\x6C","\x69\x64","\x6D\x75\x6B\x61\x2E\x6F\x70\x65\x6E\x28\x29","\x65\x78\x65\x63\x75\x74\x65\x53\x63\x72\x69\x70\x74","\x74\x61\x62\x73...

vtc

Yes, even I am vtcing this one. :|

diagprov

@MarkBuffalo I absolutely detest it. It's like someone said "how can we make a worse plot than power rangers, with a time machine".

Mark Buffalo

03:30

@diagprov guess who's going to hell when he dies

I'll give you a hint

name starts with d, ends with iagprov

@RoryAlsop Are you going to allow this?!

David Freitag

It's an interesting sight to see pretty much everything you own in one room

diagprov

Challenge accepted. @RoryAlsop can you make the doctor who theme tune sound this good: youtube.com/watch?v=9wBid6HlGL8 ?

Mark Buffalo

@DavidFreitag Or one car :(

David Freitag

@MarkBuffalo It'd have to be a pretty big car, I've got a decent bit of stuff.

Mark Buffalo

Couple years ago, that's all we had... the clothes on our back

Now our place is packed with stuff... I don't want to move again

David Freitag

03:36

My mouse is pissing me off /╲/\╭(ರωರೃ)╮/\╱\

diagprov

@DavidFreitag After several moves etc I'm now at the stage where I can't do that any more (fit everything I own in a room).

If you don't count the furniture I could.

David Freitag

@diagprov And technically since I don't even own my car, pretty damn much everything is in that room but my desk and computer stuff

diagprov

Basically my next move will have to involve movers. This is quite scary.

deed02392

legal take on Apple lawfareblog.com/not-slippery-slope-jump-cliff

diagprov

@MarkBuffalo See the comment for Rory :)

Mark Buffalo

03:39

i.imgur.com/8v2hP1Q.webm

you focking wot m8

diagprov

Basically, Doctor Who could be brought on par with the power rangers by replacing the theme tune with a 6 minute guitar solo.

Mark Buffalo

www.jebbush.com LMAO

www.tedcruzforamerica.com

lol

David Freitag

@MarkBuffalo hax

@MarkBuffalo Fail

Mark Buffalo

I know I'm late on this, but Trump snatched the domains for these sites

David Freitag

6 secs ago, by David Freitag

@MarkBuffalo Fail

Mark Buffalo

03:42

that's grade A trolling right there

David Freitag

@MarkBuffalo That's grade B failing. You failed so bad you failed at failing.

Mark Buffalo

oh, I see. unaffiliated domains

David Freitag

@MarkBuffalo No, you forgot the https://

Mark Buffalo

jebbush.com

David Freitag

u.wot.m8

Mark Buffalo

03:43

tedcruzforamerica.com

David Freitag

Pizza place closes in 10 minutes

Online order, left a $10 tip

For an $11 pizza and a soda

Mark Buffalo

$10 tip?

This is why you don't have money DOT JAY PEG

David Freitag

03:59

yeah well i wanted to be sure it would get here

and it did

Mark Buffalo

@ThomasPornin security.stackexchange.com/questions/114964/…

diagprov

06:50

@DavidFreitag I'm guessing you're the best person to ask in here - best SPI flashing device? Dediprog?

AviD

08:09

@diagprov FOR SHAME

@MarkBuffalo not dr.who, he's already been there

twice

@diagprov which one? it changes often....

@diagprov you dont even know.

@diagprov that was the premiere of Series 9. But on a tank.

@MarkBuffalo great, so not only is the next president a racist mysiogynst homophobe idiot, he's also a typical phisher.

M'vy

@AviD we already know where he goes when he dies. S6 :)

Ah shoot the layman question migrated :S

AviD

@M'vy hmm? He didnt die in S6?

@M'vy THERE WAS A QUESTION ABOUT SHOOTING THE LAWMAN??

I shot the sheriff, but I did not touch the deputy.

Journeyman Geek

08:25

I was about to say that...

M'vy

@AviD no but he went to his grave :) or was it S7 ?

29

Q: Layman's explanation of encryption backdoors

Some times I read about "backdoors" in encryption algorithms in the media. I'd like to understand what such a backdoor actually consist of. Is it: a) a hidden weakness in the math formulas that affects the security so that it can be broken by brute force in a reasonable amount of time rather tha...

encryption

AviD

@M'vy ah not his grave, but where he died. Or will have died,

Arperum

@MarkBuffalo except he didn't. Check who owns the domains. Different registrar than the ones of his own domains. Also the jebbush domain was announced on twitter by a fake trump account. Trump is an idiot, but this is done by followers.

Journeyman Geek

or someone thought it would be funny

kalina

08:41

WHHHHHHHHHHHHHYYYYYYYYYYYYYYYYYYYYYY SLEEP WAS SO NICE

M'vy

08:57

you mean "why? Sleep was so nice!" or "why sleep was so nice?"

Arperum

@M'vy So technical in the morning. People are still half asleep...

diagprov

@AviD any of them! :D

@AviD hummmm???

AviD

I get the feeling you've only watched classic who. And not the good ones either.

Matthew

Sometimes I think we should have a specific close reason of "point to:"

AviD

@diagprov yes exactly.

Matthew

09:04

69

Q: How do I deal with a compromised server?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism: What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I pr...

system-compromise

AviD

cant find a good clip of it though

diagprov

@AviD No no... I've had the new ones inflicted on me mostly. I do vaguely remember the Eighth Doctor. I remember my parents telling me it was the last ever doctor who.

M'vy

@Arperum yeah well, I just had my coffee you know

Arperum

@M'vy Think about the people who didn't. I haven't had coffee in years.

Moslty because I don't like it though.

M'vy

Yeah well...

linkedin.com/pulse/…

^ interesting article about apple situation

Though they could have chosen number that at least looked like prime number multiplication and not a multiple of 2

and 5

diagprov

09:09

An article on LinkedIn that isn't about millenials... is it possible?

kalina

@M'vy euuuuuughhhhhhhhhh

diagprov

@AviD I saw the ninth doctor one with Billie Piper in it. That wasn't so bad.

AviD

@diagprov oh pls. It only got better from there.

M'vy

@diagprov You sure you didn't mistake the shop where you bought that DVD

Celeritas

Hi

M'vy

09:15

@kalina ok, ok. I leave you to your zombified state a while :)

AviD

@M'vy the lady in the shop gave him that number ;-)

M'vy

@Celeritas heya fast one

@AviD lol

Celeritas

Does anyone here have CISSP certification?

AviD

@M'vy btw, ftr - I had a completely different theory about that (no spoilers), I thought it was rather obvious, I did not like that explanation :-(

@Celeritas had, let it expire several years ago

Celeritas

@AviD I know it's supposed to be for people with 5 years experience, but does it really matter? Can't anyone take the exam and if you pass then you're certified?

diagprov

09:17

@AviD I didn't watch it on DVD, sorry :) It was broadcast on the BBC.

M'vy

@AviD yeah. I have to agree. Generally speaking S8 was more a starter than a real season to me.

AviD

@Celeritas I thought 4? anyway I think there ARE provisions to take the test before you have the requisite amount of experience, but you are not certified until you have both.

I think there is also an exception for 3 years experience plus BSc, or something like that.

diagprov

@AviD hmmm I've definitely seen later ones and they definitely weren't very good.

Celeritas

ok thanks

AviD

@diagprov hmm I think you're confused

or maybe you just dont like scifi

"Doctor Who sucks! its so unrealistic!"

"I bet most of those things never even really happened!"

M'vy

09:20

"Com'on, time can't be rewritten!"

Matthew

@M'vy How do you know? Yesterday, you were all in favour of rewriting time!

Arperum

@M'vy But what if your brain is rewritten so you can only think time cannot be rewritten?

has never seen anything from Doctor Who

M'vy

Hey hey. Easy tigers. I'm just bringing water to @Avid's mill

AviD

for those that missed it, Rory Williams is now in DC's Legends of Tomorrow, playing Rip Hunter.... Time Master.

@M'vy is that a euphemism?

diagprov

@AviD Nope nope :) Dr Who episodes all have the same format: 1) teaser where we see bad thing plotting. 2) Scenes of normalness 3) bad stuff happens 4) the doctor can't sort it out, the pen thing doesn't work 5) oh no bad things are going to happen forever 6) the doctor finds a deus-ex-machina way out 7) happily ever after.

AviD

09:24

THE PEN THING DOESNT WORK

M'vy

@AviD it's a French expression meaning "to give more arguments to your argumentation"

Rоry McCune

@diagprov ahh if you've not seen it since the Billie piper era, things have changed

AviD

its a SCREWDRIVER

Rоry McCune

now moffat runs the show, rather than Russell "Deus Ex" Davies

diagprov

Somewhere in Israel there is one very angry Tigger right now.

AviD

09:25

@diagprov also, there is no normalness in Dr.Who.

another thing - the Doctor is the deus ex machina.

@diagprov pffft

Arperum

@AviD He's a robot god?

Or a god robot?

AviD

Doctor Who Thats screwdriver! / Doomsday clip

►

diagprov

@RоryMcCune Ah Ok has it got significantly better, or just a little better?

AviD

Doesn't kill, doesn't wound, doesn't maim.

@RоryMcCune not a fan of Russel are you?

Rоry McCune

@diagprov well Moffat has his own problems, but I'd say it's better, last series was probably best of the new ones

M'vy

09:28

Moffat wrote "blink" isn't that enough ?

AviD

@M'vy OH EMM GEEE

Rоry McCune

@AviD I quite liked some of his stories, but whenever he painted himself into a corner he just whipped out the Deus Ex machine

AviD

SHUDDUP

Rоry McCune

@AviD got a bit predictable

AviD

@RоryMcCune yeah but thats the point of Who, innit

the whole concept is a DEM

Rоry McCune

09:29

@AviD that two-parter with the master and the missiles I mean cummon that was a lame outcome

AviD

all of time and space, everything that ever was or will be

kalina

oh gosh my eyes hurt so much

it's like I haven't even slept

Rоry McCune

@AviD well not all who stories end up with deus Ex, sometimes the conclusion is doctor based smartness or luck or something else

AviD

@RоryMcCune still

Rоry McCune

@kalina Early kid based alarm call?

kalina

09:30

doctor who isn't as good as deus ex

AviD

tbf the doctor's personality has changed quite a bit too

kalina

no actually this morning they stayed well away

M'vy

@AviD that's the point too

kalina

although that didn't stop them from turning on the TV

Rоry McCune

@AviD well it's meant to, that's the delight of using new actors periodically, doesn't get too samey

AviD

09:31

and companions

kalina

samey wamey lamey camey

Rоry McCune

@AviD exactly

AviD

but really, the general arc is there, themes are there, but it really has such a wide spread

kalina

like aids

AviD

my eldest is watching now, up to S3. such a range of stories - the whole point of DW is that you can literally write anything you can imagine, and the platform will support it.

kalina

09:32

or just rip it off other people

like doctor who does

AviD

@kalina or the same people

kalina

or all the peoples

diagprov

@RоryMcCune Ok I'm going to guess not much better then.

Rоry McCune

@diagprov well I liked the early parts of the new series, and I'd say it's generally improved over time with the odd less good series

@kalina nothing new under the sun

kalina

I am biased though because I don't like doctor who

while speaking of doctor who

did anybody see the bush tweet of the handgun that has gone semi viral on twatter

where he tweeted "America" with a picture of his new gun

M'vy

09:42

bushes can tweet?

kalina

if the gun represents america then the sonic screwdriver represents gallifrey

M'vy

@kalina I bet the FBI would like one of these for Apple devices

kalina

everybody knows apple already gave them access, they're just doing this pr circus for the love

M'vy

yeah I said that already I think

no one engineered a photo of a sonic with apple logo on it yet ?

Rоry McCune

@kalina yeah I saw an article with many of the funny come-backs like the gallifrey one or the english one (a cup of tea)

On the apple thing there was a good article about the legal consequences of Apple going along with it lawfareblog.com/not-slippery-slope-jump-cliff

diagprov

09:50

I don't really understand what the problem is with the court order in the Apple case.

Rоry McCune

@diagprov if apple comply every law enforcement agency in the world will start coming to them for the same capability

at which point apple's security is essentially stuffed

because with 100's of law enforcement agencies round the world, sooner or later one or more will get pwned and then the "bad guys" get the capability too

diagprov

@RоryMcCune true, but the capability that was asked for according to the court order was downloadable firmware locked to the target device IMEI.

Rоry McCune

@diagprov sure and if they do it once, everyone else will ask them to do the same thing

apple will get thousands of requests a month for cracked firmwares

what happpens when it's China asking for a cracked firmware for a US citizen who's susppected of "espionage"

diagprov

@RоryMcCune the easy response to that is "get a court order and we'll do it."

Rоry McCune

or a "terrorist" in the middle east who's actually a human rights person

@diagprov courts in most countries will just go for it, why wouldn't they

M'vy

09:54

I don;t think there is yet a law that can force Apple to do it

diagprov

@RоryMcCune because Apple's profit and Intellectual property is owned by Apple Inc, in the US. You need to go via US courts.

Rоry McCune

@diagprov if a court in Saudi Arabia orders apple to crack a protesters phone so they can round up and execute their confederates...

@diagprov that doesn't fly, we've already seen local courts shut down tech companies in that country if they don't comply with local requests

whilst for small insignificant countries apple might take the hit

when it's a market like china, there's no way they could afford to be chucked out

their only hope is to maintain "we do this for no-one" and hope that people like the US Gov back them up

as soon as the US Gov demands it for their own law enforcement that game is over

kalina

@RоryMcCune that's unusual... I've already read this article

Rоry McCune

@kalina deja-law

M'vy

like it

Rоry McCune

09:58

and as that article points out once the principle is established, it will be malicious updates over the air to take control of "criminal's" phones

because that's technically possible, in fact quite easy

once you have the signing keys and the app. update infrastructure

diagprov

@RоryMcCune I suppose. Are there any other markets aside from China with the clout to demand this kind of thing though?

Rоry McCune

so we enter a world where all automatically updated devices are vulnerable to all government agencies who get the power to demand a court order

@diagprov the EU definitely, India definitely, Saudi possible (friends in high places in the US)

Transcript for