The DMZ

David Freitag

00:02

►

copy

00:17

@DavidFreitag I'll see your whatever and raise you by youtube.com/watch?v=rvuO2EvCTAE

David Freitag

@copy Ah a classic, this was good when i was like... 8, now i like big-boy metal :]

►

cc: @RoryAlsop

copy

Pff

David Freitag

00:33

@copy Heh, I'm just kidding, Slayer is still one of my favorites. But by now my tastes have evolved past them

copy

That's interesting, because my taste has evolved in the opposite direction

David Freitag

00:50

Heh, well everyone likes what they're going to like.

Terry Chia

01:55

your mom

ManishEarth

05:55

You guys may enjoy this

tylerl

@ManishEarth where the hell'd they get the data?

ManishEarth

That's what I was wondering about too :P

Terry Chia

@tylerl PRISM.

3

tylerl

@TerryChia Snorted my drink out my nose.

ManishEarth

LOL

Terry Chia

05:58

@tylerl :)

tylerl

this question certainly has attracted the attention of a lot of amateur cryptographers:

4

Q: Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This seems like it would be pretty awesome - one of the problems that I can think of is if the QR reader i...

Terry Chia

@tylerl Yeah, I'm basically ignoring all of them now.

tylerl

It's interesting to see the level of experience/expertise of those who support the idea versus those who think it's worthless

the difference is pretty stark

Also, note the view count vs the amount of actual attention the question has gotten.

(votes, answers, etc)

and then google SQRL to see why :)

Terry Chia

@tylerl Hah! Third on Google.

tylerl

2nd when I check

1st if I'm logged in

Terry Chia

06:11

@tylerl I'm getting this as the second result sqrl.eecs.utk.edu

I should really write a blog post on it. Will be a good boost to the view count.

ManishEarth

wtfs a squirrel?

Terry Chia

@ManishEarth A small furry animal?

ManishEarth

lol no the sqrl thingy

it sounds stupid. qr code for security?

Terry Chia

@ManishEarth Basically yes, it is stupid. :P

tylerl

@ManishEarth the idea is to use QR codes to log in using your phone instead of using a password. Basically it turns your phone into your password. The technology is sound, but the real-world implications are ... mostly undesirable.

ManishEarth

06:16

@TerryChia y u no call it stupid in your answer?

tldr

Terry Chia

> Like anything that comes out of Gibson, this SRQL scheme is highly flawed and offers no benefits over conventional methods.

Too subtle for you?

Also, right at the beginning.

> As usual, take anything related to Steve Gibson with a truckload of salt. Obligatory attrition.org link.

ManishEarth

@TerryChia too buried

big fat tldr

"ITS STOOPID"

Bold, with h2 formatting

tylerl

@TerryChia Fanboys (which constitute 99.3% of the viewers of your answer) will see the ad-hominem attacks against Gibson and then dismiss your whole argument. It kills your credibility.

Terry Chia

@ManishEarth I won't edit it in, but I have no objections if you want to do so. :P

tylerl

attack the design, not the designer

othewise it makes you look small-minded

the fact that you're right isn't the point ;)

Terry Chia

06:19

@tylerl Oh sure, normally I would agree with you. I'm just sick of Gibson. ;)

ManishEarth

What's up with this Gibson dude?

tylerl

@ManishEarth he's the main character in the most popular security podcast that's running.

Terry Chia

@ManishEarth attrition.org/errata/charlatan/steve_gibson

tylerl

He's a self-proclaimed security expert, but he doesn't work in teh security industry

He's a an "expert" because he studies the subject a lot. Except not really, because he has no experience at all. So his ideas are often subtly flawed in ways that are not obvious to normal listeners

ManishEarth

Oh, sorta like Ankit Fadia

Well, Fadia knows nothing but has popularized himself

I should get in on this. I know enough about security to sound smart even when spouting crap

2

tylerl

06:22

Well, 97% of what he says is right. But that remaining 3% can be a really big deal. And he thinks he's right about it as well. He just doesn't know any better.

And this auth scheme he came up with is a great example of that. The technology is sound, but in real-world usage it would be a disaster.

but his job isn't dealing with this crap, so he doesnt' know to think about it

And more importantly, because he's such a popular voice on the subject, a lot of people just starting in the industry think he's right. They're used to him being right. So they get subtly incorrect ideas on important topics.

ManishEarth

"So, if we take the HMAC and enable HSTS for it, we can get a tenfold increment in security due to the addition of an extra symmetric ECDSA key pair that encrypts the SSL layer"

tylerl

@ManishEarth not quite like that

ManishEarth

@tylerl I bet non professionals wouldn't be able to tell the difference :P

AviD

@tylerl normally I would agree with this, but in this case - its not a question of some small issues that he can work out next iteration, or maybe we should be intrested in his other designs.

ManishEarth

But yeah, I know what you mean

Sensible ideas at the outset, but an experienced person will immediately run around screming

AviD

06:27

it is like when a rabid monkey offers to build your house - do you really need to bother with the details, or just rule it out completely because rabid monkey?

tylerl

@ManishEarth But see, that's what's so pernicious about the whole thing. You can't write the guy off for being completely cracked. He undersands most of the technology pretty well. He's shit at explaining it, but he studies it heavily. The problem is that he doesn't understand the nuances, so whenever he comes up with an original thought, it's terrible.

ManishEarth

haha

AviD

@tylerl actually, a lot of the basics are lost on him too.

probably not much worse than typical managers or marketers, though - but they dont profess to be technical experts.

tylerl

Imagine you take a middle-school kid who really, really wants to be a physicist. So you give him all the books he wants and let him study physics. ... Now you make him a professor at MIT.

See if you can spot where the error was made.

ManishEarth

@tylerl I have first hand experience with that, learning lots of physics on my own and then not knowing the nuances

AviD

06:32

@ManishEarth but you're not a professor at MIT.

wait, are you??

ManishEarth

@AviD Not yet.

rubs palms

@AviD 'course not, I'm a student.

tylerl

So we get a lot of visitors to the site, to that question, who think that his ideas are sound. But they all know even less about security than he does... and we end up with what you see there on that page.

and the fact that my assessment is true is evident in the disparity between the experience levels of the different commentors, for and against.

Q.E.D.

Terry Chia

Yay, blog migration completed. infosecstudent.com

ManishEarth

Wait, he's using a different protocol for sqrtl? Even I can tell you why that's stupid

AviD

cool, according to an ad on youtube, we now have smartcard identity cards here. i.e. the identity cards we've always had now have chips embedded.

now to find out how this is actually implemented, and if it even matters.

tylerl

06:40

You mean the SQLR:// protocol handler? It's not a different transmission protocol, it's an app launcher mechanism, just like "tel:" or "mailto:" links

AviD

or if its like the CAP creditcards, which work great, but are trivial to bypass.

tylerl

It's dangerous for another reason, though.

@AviD US passports supposedly have RFID in there somewhere.

No more useful than a barcode IMHO

AviD

no, not rfid, cryptographic chip, like in some credit cards.

tylerl

a decent 2D barcode can encode easily as much as RFID, and with better inherent security.

ManishEarth

@tylerl ah, OK. Not mitmable then, right?

Terry Chia

06:42

Anyone here has experience with configuring nginx?

ManishEarth

As in the HTTPS://-to-SQRL:// transition being mitmable

tylerl

@AviD with the gold contacts and everything? That's tough to miss when you look at it. Shouldn't need an ad to tell you it's there.

@TerryChia Yes.

ManishEarth

nginx? /me not likey

Terry Chia

@tylerl Are there any special configurations I need to take note of if I'm serving up static files only that can help with performance?

AviD

@tylerl yes, like that - but not rolled out to everybody yet, of course. I would KNOW if I had it, point is it is available.

still, like I said it is probably trivial to ignore.

they're pushing it as solution to identity theft.

ManishEarth

06:44

@TerryChia ..don't use nginx? lighttpd for static

tylerl

@ManishEarth Bad because the third-party app won't know what site initiated the auth request, so it won't know whether or not it's legit. Plus it can be triggered without the user knowing.

Terry Chia

@ManishEarth Heh. Why? Everything I have seen points to nginx being superior to Apache for serving up static files.

Ah lighttpd...

Never played around with that before.

ManishEarth

Yeah, nginx>apache, but for static files why use either?

32

Q: Best lightweight web server (only static content) for windows

I got application server running in Windows – IIS6.0 with Zend Server to execute PHP. I am looking for lightweight static content only web server on this same machine which will relive IIS form handling static content and increase performance. It need to be only static content web server – maxim...

windows http webserver static-content

tylerl

@TerryChia It actually is better in a number of cases. Just 3 days ago I set up nginx as a reverse-proxy to protect an apache installation against a ddos attack.

ManishEarth

hmm, mongoose is a new one (to me), ~~but that may not be unix~~ and apparently works on unix

tylerl

06:46

Even in event mode, Apache can't keep up with nginx.

ManishEarth

@tylerl yep.

Still, I have more experience with apache, and as a nonprofessional I just use it whenever possible. Or lighttpd

tylerl

@TerryChia I typically use the stock configuration with a few server-specific customizations. It's pretty good out-of-the-box

you may configure it differently if it's under DDoS, for example

grr. my dd operation is slowing down. Stupid drives.

tylerl

07:05

only 20 more minutes to go....

Terry Chia

07:16

@tylerl Alright!

ManishEarth

1

Q: Is there 100% reflective mirror...i just want one

I have heard there are none right now...but i saw something that said something about 100% reflection. Forgotten completely. sorry. I want it, i think it'd be very amazing to save sunlight in it from day and let little out in night. But i have heard it's theoretically not possible to have surf...

visible-light reflection

I just want one... cmon guys just one is that too much to ask?

@Polynomial Last week I gave a presentation on cellular automata. While talking about Rule 110 and Rule 30, one guy asked the meaning of the numbers and I told him that the rule can be back-constructed from the number, giving a range of rules from Rule 0 to Rule 256. One guy asked "So, is there a rule 34?".

Nobody else in the class got the joke -_-. Both of us had a laugh and moved on, after which everyone was asking us what the joke was.

Terry Chia

@ManishEarth Did you explain it to them?

ManishEarth

Well, the prof was a cool guy and was also curious. I said that it was NSFP, but he pushed for it. So... I told 'em :P

Terry Chia

@ManishEarth Hah!

ManishEarth

After which the prof says "Hmm, interesting, gotta look that up. If I you see me smiling on Monday then you'll know that I did."

AviD

07:26

lol

@DavidFreitag oo, I'd tried them out a long time ago. if you have a specific question you can try me out, but I cant promise that I will know anything...

@TerryChia heh, I'd already seen that. excellent.

AviD

08:27

10

A: I hereby declare the 22th of September each year to be Bear Day!

The Bear approves of your oath of fealty. You may keep on chanting the glory of your ursine overlords.

hehe, just saw this now. Legendary.

Terry Chia

@AviD I, for one, welcome our new ursine overlord.

AviD

"new"...?? Blasphemy!!

Terry Chia

@AviD Hey, I have to fit that into the meme.

Terry Chia

09:15

AviD

hehe, I had to read some responses to get his comment...

not familiar with xhamster.... yet ;-)

Adnan

11:48

What a wonderful Sunday!

Plastava, everybody.

Terry Chia

@Adnan Are you drunk?

Adnan

@TerryChia Plastava to you too.

@copy My dear friend! I missed you

and @Tildal, where have you been, man?

Oh, @Avi, how are you today?

AviD

@Adnan plastava.

Adnan

@AntonyVennard is here! The guy with the best last name around here.

Terry Chia

Yup, @Adnan is drunk. He is being way too polite today.

Adnan

11:52

@TerryChia Nonsense!

Ooh! Look who's here! My BFF, @Kalina

AviD

@TerryChia well, it's Sunday noon. Of course @Adnan is drunk.

Terry Chia

@AviD I don't think it being a Sunday or it being noon has anything to do with the fact that @Adnan is drunk.

AviD

@TerryChia you're probably right. "It's day, of course @Adnan is drunk".

Adnan

Look at that.. look at that. Ah, sunset in Finland is amazing

AviD

hmm, remove the day part...

Adnan

11:54

AviD

@Adnan oh gohhhd its a double rainboooowwww!

Adnan

Too bad next month sunrise will be like 11:00 and sunset will be like 14:00

Antony Vennard

Sometimes I worry about the (what I assume are) sober conversations in this room. This could be fun...

Adnan

You know what would be nice now? Feta-cheese pasta.

Some EVOO and Balsamic on top

hmmm

yum

God damn it! I don't have pasta!

ManishEarth

@AviD Just saw the slides of your talk. Love the ending!

AviD

12:01

@ManishEarth heh, thanks. :-)

the verbal commentary is what made it interesting, if you ask me.

otherwise a lot of it just seems random.

what I said made it clear that it is VERY random.

ManishEarth

@AviD yeah lol

Plus the twenty pages of arabic spam

AviD

f.e. right before switching to slide 4, I said that I'm going to start with the conclusion... referring to slide 9, of course.

@ManishEarth oh I built that up nicely.

Lucas Kauffman

@AviD was it screencasted?

AviD

I'll admit its far from the type of talk I usually give - and not really the subject matter that is my usual research. but it was fun...

@LucasKauffman no :-(

someone taped most of the conference, missed two and a half talks - mine included :'(

Lucas Kauffman

@AviD what an idiot

the best talk he missed!

AviD

12:05

anyway, it was mostly in hebrew - not sure how much it owuld have helped...

@LucasKauffman heh, sweet. Not accurate, but sweet.

Antony Vennard

Ok I'm just reading the slides: owasp.org/images/8/87/… and so far it's hilarious.

AviD

@AntonyVennard exactly.

I love the section of "Random Sh*t".

truth is, it practically wrote itself. I just collated and commentated.

Terry Chia

@AviD Hah! That one on webapps one is hilarious.

TildalWave

@Adnan I'm here ;) Where have you been? :P

Terry Chia

"XSS by Design" lmao.

AviD

12:11

the mods there told me aboout one they didnt have pics of, I would have loved to include it: during the spamflood, the spammers were coordinating some of their "work" via the comments on the site.

Antony Vennard

@AviD I particularly like "I am durnk. Can someone call me a taxy?"

Terry Chia

@AviD Miley Cyrus under "Offensive Material" Genius.

AviD

@AntonyVennard did you notice what that is directly after....?

@TerryChia ahhh thank you thank you.

Terry Chia

@AviD Page 97 is Andrew?

AviD

@TerryChia hehe

he was actually noted earlier on, too... remember when he trolled someone off the internet?

I found those posts.

Terry Chia

12:14

@AviD Yeah, the IP address from images one.

AviD

yup.

Antony Vennard

@AviD Chickenpox lollies or "I HATE YOU MICRO$OFT I WANT MY FAVOURITES ON THE RIGHT"?

AviD

about equal, I think.

@AntonyVennard I meant that it is right after the viagra request. A solution for the needy.

Antony Vennard

@AviD Ah yes!!

AviD

besides, as I said, you cant have a talk about spam, without mentioning viagra. Right?

except that that guy was probably never on the internet ever, if he had to look for it.

Antony Vennard

12:18

@AviD Yeah. Surely "check your inbox/spam folder" would be all you needed to do to find tablets claiming to be viagra.

I particularly loved "why are these trolls moderating this beautiful site" !!

TildalWave

@AntonyVennard wheey I get a mention too [edited out] LOL

some funny shit there nice collection @AviD

AviD

@TildalWave which was you....?

TildalWave

@AviD page 85 ... I just edited out some offensive speech

AviD

@TildalWave ahh right right

TildalWave

hehe didn't see that suggested edit "And I'm gay" :D

AviD

12:25

not sure that was on sec.se.

I used that as a starter example for things like online bullying.

I wrapped that section up with a reference to a guy who quit the police to fight that personally full time. in case anybody there has such issues, either their kids or themselves (lots of young-ish college students there.... )

Antony Vennard

12:45

Oh btw @AviD check your hotmail at some point... :D

AviD

ah, yeah, seen the headlines come in, havent had a chance to open it yet :-)

my east european trip next week was cancelled though, so that will free me up some breathing room.

Antony Vennard

@AviD Cool, no worries.

Adnan

@TildalWave I don't know. Drinking some Taylor's

Damn, that's a nice port wine

10 years

You can taste the softened phenols

AviD

@Adnan TWSS?

I'm sorry, I dont know what phenols are.

Antony Vennard

Phenol

| Section2 = | Section7 = | Section8 = }} Phenol — also known as carbolic acid — is an aromatic organic compound with the molecular formula C6H5OH. It is a white crystalline solid that is volatile. The molecule consists of a phenyl group (-C6H5) bonded to a hydroxyl group (-OH). It is mildly acidic, but requires careful handling due to its propensity to cause burns. Phenol was first extracted from coal tar, but today is produced on a large scale (about 7 billion kg/year) from petroleum. It is an important industrial commodity as a precursor to many materials and useful compounds. I...

AviD

12:53

even after reading the wp article...

> Although similar to alcohols, phenols have unique distinguishing properties. Unlike in alcohols where the hydroxyl group is bound to a saturated carbon atom,[5] in phenols the hydroxyl group is attached to an unsaturated ring such as benzene or other arene ring.[6] Consequently, phenols have greater acidity than alcohols due to stabilization of the conjugate base through resonance in the aromatic ring.

I stand by my TWSS comment.

oh, hang on - now this part is language I can understand:

> Occurrence in whisky
Phenol is a measurable component in the aroma and taste of the distinctive Islay scotch whisky,[33] generally ~30, but can be over 150[34] ppm in the malted barley used to produce whisky.

Adnan

And the the intensified grape skin taste due to the lack of acidity

Oh my! Yup, this is my favourite porto

Terry Chia

@Adnan You sound douchey. Like Ted. :P

Adnan

@AviD Well, easily explained. Phenols are what gives some wines that bite, the one that dries out your mouth (not the acidity).

@TerryChia But but but.. you can taste them. I'm not douchey :(

When softened, they give the wine an extra layer in its body.

You can feel it on your tongue as you roll it in your mouth

3

You can call it extra viscosity

ManishEarth

@Adnan twss?

AviD

starwhore.

Terry Chia

13:05

@AviD Or maybe just a regular whore.

AviD

I wouldnt know.

TildalWave

13:35

@Adnan all I can do is envy you really, I've just got rid of one bug and another one found me... can't have alcohol with antipyretics

but I know what you're saying, even if these ignorants here don't :P

Thomas Pornin

14:01

@Adnan Eh. About 15 years ago, we used 10 years Taylor's as standard payment for IT services between friends.

If you can find a 10 years Osborne, buy it, it is really good

At that time, there was a supermarket who had it as a regular product

Adnan

15:02

@TerryChia So mean.. so so mean.

@TildalWave Oh come on! @AviD isn't an ignorant. He just likes to pretend he's some Whiskey expert or something, just because he drank like 1000 bottles of 100 kinds of whiskey

Antony Vennard

@AviD Y'know as a modrator/troll you can just click "clear stars".

Of course, that would make you trollin' these beautiful chatz, but, it would be funny.

Xander

@AntonyVennard @AviD Slide 41 is epic.

Adnan

@ThomasPornin Whoa! It's 40% more expensive than Taylor's (at least here). I wonder how different it will be.

Antony Vennard

@Xander I couldn't work out what that meant at all.

I'm sure it was slightly (or even very) offensive somehow, but I'm confused as to who, other than women generally.

TildalWave

15:19

@Adnan it was just a tease ;)

He did? Wow!

Xander

@AntonyVennard What impressed me what how thoroughly incoherent it was. All I could understand out of the whole thing was "90 percent of American and Australian women are a piece of crap" and then there was a solid page of text to explain, and not a single bit of it made any sense at all.

Antony Vennard

@Xander The sad thing is somebody probably wrote that with the general intent to make a point and failed utterly.

The incoherent part is scary that the to make an inability point common is on the internet.

3

Adnan

15:34

Looking outside my window, there's a group of 7-8 children who play in that yard every weekend.

The group consists of two black kids, three blond kids, and two kids who look Jewish/Arab

They're playing together, laughing, jumping, and yelling. While their parents are sitting on two benches, drinking beer and eating sandwiches

I HATE THEM!

Come on! Nobody supposed to be that happy

It's like some TV commercial

AviD

16:51

@Adnan oh please, I never claimed to be a whisky expert, I'm American.

I just enjoy a good bottle.

@AntonyVennard well, considering I was the first star there, it would be pointless. That said, your comment is starworthy.

@Xander I was considering subtitling my talk as "Sh*t StackExchange Says", but I didnt want it to be just SE focused.

@AntonyVennard @Xander a big part of what is so amusing, is their choice of site. Some of the things actually make some sense (like how to cook a curry duck, on cooking.se) - but the offensive american women was on ubuntu.se (I think)

Antony Vennard

@AviD I think it is best not to try to rationalise "they picked the right site" with "wtf did they write there and why? If they could figure out what site to be on". There lies madness.

AviD

hehe, true. But when there is a very tenuous connection (again, like the curry duck - damn I'm hungry) it amuses me.

ooohhhooo, Arrow is back! And - with Summer Glau!

That is just what every show needs - more Summer Glau!

AviD

17:26

damn, OF COURSE xkcd already did that.

By my count, only 48 of the 158 minutes in Live Free or Die Hard have action. That's pathetic, guys. Crank is better, but needs a bigger budget and more Summer Glau.

AviD

18:31

lol @RoryMcCune!! Just noticed in the latest episode of Arrow - they all using Surfaces... :D

Rory McCune

@AviD noice, I'll need to get the missus onto watching that :) Her Surface 2 Pro is due week after next I think...

AviD

cool! Dont know if its a surface 1/2/pro/rt in the show though...

Rory McCune

@AviD well the pro's have a give-away vent on the site

Apparently the Lumia tablet is due out soon too...

AviD

heh, not THAT much of a close up....

Rory McCune

will be interesting to see what that looks like when it's out..

AviD

18:34

@RoryMcCune reeeheeellyy??

but but but! That's a MS product now too!

Rory McCune

@AviD yarr it was delayed by the acquisition news, but is now rumoured for Nokia world which is soon IIRC

AviD

why dont they just rebrand the surface as lumia?

or the lumia as surface...

Rory McCune

t3.com/news/nokia-lumia-2520-tablet-leaked-in-cyan-and-red

I'm guessing it's a product they've been working on for a while, but yeah you've got to question the longevity of it after the merger goes through...

AviD

well, if they're smart at all, they will either merge the technology (and figure out the rebranding excercise), or keep them both, one as high-end one as lowend...

curious to see how it compares to surface.

oooo LTE. thats the buy right there.

Rory McCune

indeed it sounds from the specs like it's relatively similar, apart from the radios..

but yeah LTE could be a good selling point :)

AviD

18:39

AND the snapstand! and keyboard cover...

Rory Alsop

19:23

@David and @copy - Like all 3 of those. A lot. But especially Slayer, because I am that old

David Freitag

21:16

@Adnan It is finland, iirc in the top ten happiest places on earth.

@AviD That's good i suppose, i gave up on it as ancient technology and just started an InstallSheild project, as much as i hate it.

Transcript for