@Simon Proof him wrong. ALWAYS.

he said that he would bypass me in rep by the end of december.

What a joke.

okay, I will amend that to "you dont need it".

Old men can't be productive.

@LucasKauffman no, I said that you would probably pass me. I cant help it if you're lazy.

@AviD I can't help it people aren't asking enough questions I can answer!

besides

I need to improve my quality

which means no more answering questions on my phone when I'm in the smallest room of the house

Have you guys seen this? bitbucket.org/FeministSoftwareFoundation/c-plus-equality

FeministSoftwareFoundation

@TerryChia seriously?

NOT CLICKING THAT.

@LucasKauffman It's a joke. :P

Quite funny actually.

> There is no need for exit(), terminate() or atexit() as a feminist's work is never done.

@TerryChia was gonna ask.

> Curly brackets are not allowed, as they perpetuate our society's stereotype of the 'curly' women. Instead, Python-esque indentation is used.

Note: This is a programming language written by and for FEMINISTS, not WOMEN. LEARN THE DIFFERENCE, YOU MISOGYNIST!

There's no difference, they all suck.

really bitcoin is a dream for shortsellers

> The traditional binary foundation of 1s and 0s is deeply problematic: 1 is inherently phallic and thus misogynistic. Also, some 1s are 0s, and some 0s are 1s. It is not fair to give them immutable labels. Instead, we have 0s and Os as our fundamental binary logic gates. They symbolise/-ize the varying, natural, and beautiful differences of the female vaginal opening.

I mean the volatility is insane, the dropped from 704 to 470 today and then climbed back up to 550 so far

@LucasKauffman Didn't it hit 1.3k a week or two ago?

No, that was the size of my wiener.

@TerryChia yea

@TerryChia I'm actually mining feathercoin and litecoin at the moment

nurd

litefeathercoin?

I like to configure LAMP boxes, I feel like a mini @ScottPack managing a server.

@Simon you mean clicking next 4 times?

wot?

or clicking ok at the debian screen when you selected the LAMP selection?

You got it.

@TerryChia It's pretty cool to see what they crypto currencies are doing, especially in the field of ASICs and FPGAs, they actually constructed SCRYPT asics capable of hashing up to 25 Mh/s

@Simon That should be your opening line when talking to the ladies

which is what Scrypt was meant to prevent

@Adnan You think so?

@LucasKauffman Linky?

@TerryChia let me try to find it, I'm on the waiting list for their prototype, they were able to built one with a constant 25 Mh/s which fitted in a 6 unit box

@Simon I often talk to women about the basic crypto stuff I know. They love it when I explain them in layman terms.

@TerryChia give me your email address

@LucasKauffman [email protected]

@LucasKauffman So... it's getting serious between you too?

@Adnan If you can explain it well that way, it means that you actually understand the concept quite well.

So, it's a great training at the same time.

@TerryChia got it

@LucasKauffman You do that as well? :D

do what as well?

@TerryChia Welcome to 10,000 porn newsletters.

@Adnan sometimes

@LucasKauffman Aaaahaa, that was a response to Terry, I just noticed the dit

also bitcoin trading is like before the wallstreet crash, people putting their live savings into it

@Simon My email is in my profile. Gmail has great spam filters.

@TerryChia so much spam inc

@Simon you are forwarding them all to him?

@AviD All of them.

can your email client even survive sending that many emails?

@Simon Oh, and social engineering. That's pantie melter

Hah! Someone flagged @ManishEarth.

@Adnan Oh it must be.

@Adnan no

If some random guy, no matter how hot he was, came up to me and started chatting crypto, I'd break his face

@kalina We're talking about real girls.

@Adnan yep, that's true

The ones who exist.

hah

@kalina Sorry, I meant to say "that's a proper-lady-pantie melter"

I exist

what the hell is a "proper lady"

they don't sound like they know how to have fun

@kalina that's like flirting for you, right?

@kalina face breaking ftw

@kalina Someone with whom I actually want to spend time. Someone who knows how to have fun, and is also interesting.

@Terry So, you're into redheads?

Ouch.

@AviD -.-

@Adnan you must be single

@Adnan @kalina jeez, you guys, get a room.

@kalina Unfortunately for you (regarding the absurdity of your comment), I'm not.

@AviD they do, it's called the DMZ

@KevinvanderVelden I'd get a room with ya.

@Adnan then why are you chatting up other girls?

the only way to make kalina melt is to get tons of hats on the winter bash I guess

@KevinvanderVelden this is totally my line

@LucasKauffman haha, the hat thing isn't all that special, it's just something to do while I'm at work

@kalina well then be quicker about it

@kalina whatabout actually working?

I take back my previous comment about how I prefer adnan over simon

simon is a million times better than adnan in every way

@LucasKauffman I don't want to do that

@kalina Monogamous relationships aren't my thing.

@Adnan Dayum.

@Adnan oh, you are polyamorous?

@kalina I think the term you are looking for is "cheating bastard".

@AviD Screw you! chat.stackexchange.com/transcript/message/12553744#12553744

well, I was looking on the bright side rather than being so negative about him

It's not cheating if the girls are aware and are ok with it.

@Adnan hehe

@kalina As long as I disclose that fact to my partner, and everybody is happy with it.

who was it that had the douchebag apps on his phone...? ;-)

@Adnan so... polyamorous

@Simon no, that's a party!

@kalina Yes

that's all you had to say

That sounds fun for a week and then must get old.

@Simon one guy annoys me enough, two would drive me completely crazy

@kalina I'm not the "I'm a $thing" type.

@Simon Not at all. It's actually quite fun.

If you select your partners carefully

@kalina Yeah, 2 girls telling me how bad she felt when when one of her co-worker was wearing the very same dress, omgawd.

@Adnan "polyamorous" isn't a $thing, it's a descriptive

@Adnan I guess that's the key.

you either are or you're not

@LucasKauffman Dude. What clicking? I go into the puppet node manifest and do "include httpd"

@Simon Think about it. One partner with whom you connect emotionally, another who is really good in bed, etc.

@LucasKauffman Then make sure my mysql server has the right db created.

@Adnan Well, if you connect emotionally you should connect in bed too.

@Simon I think he's making the distinction between emotional and/or intellectual compatibility versus physical skill.

@Simon Ahhh... there's a difference between "Really good in bed", "Good in bed", "okay in bed", and "bad in bed"

@ScottPack +1

I see.

@Adnan "@ScottPack in bed".

o lord, cant believe I did that.

@AviD synonymous with the last one

@Adnan I assumed you were going with that as before the first one.

Although, I think I remember seeing some science that indicated that having a proper emotional/intellectual connection overrides most skillset deficits.

@ScottPack It would make sense.

@ScottPack It can offer a huge compensation. I just don't find it enough for me

@AviD Hey, that's actually pretty awesome.

Monogamous relationships are just too restrictive; it prevents you from seeing what is out there. Yeah, some people say what I have is enough, but have seen what is out there?

All kinds of connections you can form with people

@Adnan are you talking about your mom again?

@AviD No, may she rest in peace.

oh snap. that was wrong.

@AviD Was it?

@Adnan Hence why I don't want to commit to a relationship now, I wanna see what's actually out there to get the idea what kind of girl I want exactly.

Once I'm done fucking around (not literally, or maybe...), I'll be fine with just 1 lady.

@Simon "girl" is an unvalidated assumption.

What is your dirty old mind thinking again?

@Simon and if it makes you happy, I'm happy for you :)

@Adnan Well ya, I'm just explaining my point of view. There's no right or wrong, just different opinions.

Yeah, I don't have the time or energy for any more than one, so from a practical standpoint any other considerations are moot. :)

@Simon Indeed

"more than..." ?

@AviD Do you need a dictionary?

@ScottPack I think I understand your point. At your age (used positively), it's kind of difficult to keep a successful career and more than one successful relationship

He just called you an old fart.

Up to late twenties, I think it's somehow manageable, but it gets progressively more difficult after that.

So, eventually, you will most-likely settle with 1 lady?

I never imagined there might be different perspectives of DMZes

@Simon The way I see it, it's very likely yes.

@user917279 Welcome.

@Adnan Thank you

@user917279 What brings you here, kind stranger?

@Adnan InformationSecurity , just that mesmerising word alone

@Adnan Then kids.

@Adnan Then your mom. Gods rest her soul.

mentioned by Gilles

in one of his comments to the question

@ScottPack Indeed. I believe once you have kids in one relationship, it's pretty stupid to seek another one.

@Adnan Kind of goes back to your earlier comment of "At your age (used positively), it's kind of difficult to keep a successful career and more than one successful relationship" :)

@TerryChia Where?

@user917279 Then what is your question ?

@ThomasPornin Hi, I am very glad to have met you here. Thanks a lot for the answer to security.stackexchange.com/questions/3936/…

I learnt something new and wonderful today

Can I stay here to learn some great stuff like that?

@user917279 You can stay here, but I'm not so sure about learning great stuff in the DMZ.

@user917279 In fact, you're more than welcome to stay.

@Adnan Oh I think we can promise that @user917279 will learn all kinds of stuff in here.

The open question is whether any of it is useful.

@Adnan Oh, Do you have any recommendation for any room where I can learn Information security ?

@ScottPack :D

@ScottPack :)

@user917279 Well, I think this is pretty much the only place in the StackExchange chatrooms.

@user917279 In a chat room you will find people who chat. To learn, books are usually considered better.

We occasionally discuss Information Security here.

@ThomasPornin Any particular authors to shill?

The last I checked you've been published, but not your own books.

@ScottPack Thanks a lot for that question

@Adnan I see, I see.

@ManishEarth Eh, can't remember now...

@user917279 dont listen to their jibber jabber. This is one of the collectively smartest bunch of people, anywhere. It's just difficult to filter through the jabber.

@ManishEarth It was some test phrase thing.

@TerryChia chat? Or main site?

@TerryChia oh that

Yeah, I got a few extra flags trickling in on that way after it was over

@ScottPack @ThomasPornin could probably fill a book or two just from the answers he has here.

@TerryChia You don't say

@TerryChia Say 4 and be comfortable

@AviD Thank you.

@user917279 Stop being so nice, you're gonna get destroyed here.

@Simon :). It is time for me to get repaid. I am ready .

@Simon, you're mean and yet we destroy you every day

No correllation.

@ManishEarth Am I invincible or what?

@Simon yes, like cockroaches.

@Simon No, we just aren't so mean as to destroy you completely

@user917279 I recommend reading up on the topics in which you're interested, check some of the top answers we have here, and then ask your own questions.

@user917279 Every now and then, stop by the DMZ and say hi, ask something on your mind, form some connections, and have fun.

@KevinvanderVelden Cockroaches in NL are weird.

@Simon as in, we don't have them? Yeah sure

@user917279 Almost everybody here is helpful.

@KevinvanderVelden Another reason to move there.

@ScottPack Edward Luttwak

@Adnan "almost". And @Simon says we never give a hoot about him.

@Simon only good thing about our winters, they kill most insects :D

@Adnan , Thank you. I am interested in Web application security , do you have any recommendations where to start from ? ( Google is too noisy to give a bibliography)

@user917279 I'd just suggest that you change your display name to something unique and memorable, so we can distinguish you from other userxxxxx

The Grand Strategy of the Roman Empire from the First Century AD to the Third, and then The Grand Strategy of the Byzantine Empire.

@user917279 I'm not @Adnan but the Web application hackers handbook is one I'd recomend if you're looking for books.

@AviD YO, I got a shit ton of helpful flags + reviews so le fu.

@user917279 owasp.org/index.php/Category:OWASP_Top_Ten_Project

@RoryMcCune Thanks for bringing that one up

@user917279 a LOT of stuff on OWASP. Feel free to start there, come back in a few months....

Do people actually do webapp security?

Thank you very much @RoryMcCune

@user917279 no probs

@ScottPack What's wrong with that?

@ScottPack not with PHP.

@Adnan , this name makes me feel more secure when bashed, fooling me enough to think that some "user" gets bashed

@ScottPack some do. the app I'm testing this week is actually fairly good in most ways..

@AviD Well done.

Most pre-modern times geopolitics are remarkable illustration of Information Security principles, in fact. Latency and lack of established high-speed communication systems tend to exacerbate the InfoSec importance.

I'd love to take web app security classes.

Nice. Jack Daniel: > We're dealing with people so we're dealing with assholes.

@Simon Lesson 1 would be to not use PHP.

@TerryChia I would disagree. Starting with PHP would be a fantastic starting point because it shows you how these things work.

@TerryChia tru' dat. PHP rarely ends well from a security standpoint...

@user917279 You won't be bashed, don't worry. Just use anything, we use our real names (a lot of us do), but you don't have to.

@TerryChia Come on. You know vulnerabilities are caused by the bad practice of the coders.

@ScottPack badly

Similarly, you wouldn't learn about memory management by learning on Java.

@Simon Sure, except when you have bugs in PHP itself.

No, you start with C on an architecture that requires memory alignment.

@ScottPack wimp, surely assembly is the place to start :op

@TerryChia Link me a HUGE bug that affected 328476237432 web apps and that was super critical.

@RoryMcCune Once I tried to teach a youngster by starting at the transistor, but it did not work well.

A bug that caused companies to lose $32784324M.

GO.

@RoryMcCune On a 68000?

@ThomasPornin You started at too high a level.

@ThomasPornin I've always wanted to start there and work up but sadly time is unlikely to permit and my uni training as an accountant didn't do too much for me on fundamental computing principles..

@ScottPack well either that or get an FPGA and go from there :op

@RoryMcCune Here's a bucket of sand and glue. Let's start with NAND gates.

I am gonna have fun now playing in the stream of information. wow

@ScottPack Quantum mechanics can be overwhelming for a 13-year old.

What's taking you so long, @TerryChia?

gimme da supa dupa bug

@Simon php.net/magic_quotes

@Simon However, some programming systems make it more difficult than others to have "good practice".

@ThomasPornin I totally agree and I know that PHP is one of them.

The existence and configurabillity of that caused so many problems.

@Simon I don't think there is even that many webapps built on PHP.

For instance, the Unix API makes it difficult to securely create a temporary file in /tmp.

Also of course: php.net/manual/en/security.globals.php

@KevinvanderVelden Sure, sure. Don't tell me there aren't any bugs in other languages.

@Simon no, but they didn't think "Hey, let's have a web system in which any users can create variables set to any value!"

That's pretty damn dumb =p

Meh, I guess that was a bad attempt at revolutionizing programming.

uuuhhgg >_< DokuWiki has changed the authentication plugin backend. It's making quite a lot more difficult to use AD authz with Basic+REMOTE_USER authn.

sigh

I'm not saying there is a perfect language, I'm just saying "Maybe we need to avoid people who make such disastrously bad decisions"

@Simon it was a nice idea, just not thought through at all. And it stayed for far to long as on by default.

This is the kind of thing that shouldn't make it through the first alpha version with it

That I agree, they're slow at updating stuff.

@Simon I also think it's bad that it got through to a release version, lack of either foresight or oversight. I don't despise PHP or people who use it, it was the first language I considered myself good at, but I think it should be viewed with some trepidation.

@Simon you could say that about so many things in PHP, or indeed, about PHP in general.

@KevinvanderVelden Yes. If I'd have to make a web app from scratch, I wouldn't mind to use PHP but I'd be extremely careful and I wouldn't use the new stuff they release or whatever.

I guess it's a matter of awareness.

@AviD How long is the flight from Canada to wherever you live?

@Simon jup, but because PHP is so ubiquitous a lot of the people that use it aren't aware :(

I'M GONNA KICK YO ASS.

hahaha

@TerryChia you should have email

@KevinvanderVelden And also because it's usually one of the first languages people learn so that doesn't help its case.

@Simon This is also very true. It used to be the case with ASP, and that is why there was so much bad ASP code.

@LucasKauffman Cheers. :)

@Simon writing shitty code cause you're still learning in an environment which is not known for encouraging proper code is just a recipe for disaster =p

@AviD Also it's easier to start coding in PHP than ASP because there's no licensing.

@KevinvanderVelden Damn right.

@Simon what licensing is there for ASP??

or are you talking about the OS....?

@AviD You need a damn Windows machine.

With VS.

@Simon also IIS

@Simon darlin', you always need some kind of machine.

@KevinvanderVelden If you ever wanna release it, yes.

@KevinvanderVelden IIS is free with OS.... and VS is not needed.

anyway, back then it was VI (visual interdev), but still not needed - you can (and I have :-( ) write code in notepad, if you really wanted to.

@AviD yeah, but compiling it is kinda difficult with notepad =p

@KevinvanderVelden ASP did not compile.

@AviD hmm, never mind then. I don't think I've ever used ASP

ASP.NET yes, plain ASP no

@KevinvanderVelden ah, world of difference between the two.

It's like moving from PHP to... to... hmm... to ASP.NET.

@AviD IIS? Seriously. Just use Apache on Windows.

@ScottPack why on earth would you want to do that??

if you want apache, it works better on linux.

in the dark corner, where it belongs.

@AviD Oh, those were the days.

I was just finding a pot to stir.

@Simon sent you some of his pot?

I agree. If you're going to use Apache then use Linux. If you're going to use Windows then use IIS. Stop fucking around.

@ScottPack Exactly. Dont want none of this "forced integration". Back of the bus and separate schools, that's what I say.

@AviD Use the right tool for the right job. Sometimes the right tool is @Avi, sometimes not.

@ScottPack very true.

Yeargeeeeer!

Interesting cs.tau.ac.il/~tromer/acoustic/#

@Stephane I remember seeing a similar paper for picking up wired keyboard presses using EM fluctuations, much like they're doing here with audio.

@Stephane Q12: What countermeasures are available? How about not encrypting their spell texts? That seems to be the easiest way to avoid this problem

@ScottPack Yup, that one is rather old (Cryptonomicon, anyone). But I don't remember anyone ever describing a method using the CPU noise to extract a RSA key

@Stephane Oh no, this one is newish to me. The EMI fluctuations one is from about the same time frame, though. 2004ish maybe?

@Stephane That's got Adi Shamir in there.

@ScottPack Sounds correct, yes

@AviD Right. Didn't even notice :P

@manish here?

I think several of us are man-ish.

debatable

I think I have sufficient qualifiers in there.

@kalina he definitely does think that.

Ugh. I need to test an app for REMOTE_USER. Which means I have to install a proxy to do it with.

What do you webapp people use nowdays?

@ScottPack <--

The last time I tried Pharos it was a freaking ugly nightmare.

@ScottPack fiddler is my proxy of choice. Windows only, though.

I AM ON A MISSION

and

I may have worked out how to get another secret hat

I'm all Macalicious.

I'm on a mission to get the message delivered

@kalina Go on.

And they try to diss me but I'm not gonna give up

@kalina which?

I forgot the rest of the lyrics, soz.

Not yet

I'll tell you once I work it out

@Adnan lol, that's hysterical. I'm pretty sure the postal service will just stuff it in my mail box when they see how long my driveway is (like they always do)

@kalina speaking of which, @ManishEarth did that hat pan out? /cc @Rory

@AviD stttrriiike 1

@AviD which hat?

@Rory !

ALL THE @RORY

@kalina the @Rory hat :D

@RoryMcCune Do you have a good answer to my product request?

@kalina @avid BMSMA :op

@ScottPack where was that?

@RoryMcCune ?

ah hahaha, never mind.

@ScottPack he probably throws up a Ruby app real quick to do the proxying.

@ScottPack if you're looking for free OWASP ZAP is likely the way to go at the moment. Personally I use portswigger burpsuite which is awesome :)

@RoryMcCune isnt zap what used to be pharos....?

@AviD you can write burpsuite extensions in Jruby but I've not got around to it yet...

@RoryMcCune but @Rory !

your ass isn't metal

@AviD it's based on paros but with many extensions and changes. now run by a guy who works for Mozilla

@RoryMcCune Yeah, I'm looking for free. I don't need to do any real testing I just need to inject that header

@kalina given I've never met you IRL (AFAIK) how would you know :)

With OWASP I always have lots of trouble figuring out what is still actually a maintained or current project.

@RoryMcCune because you're a @Rory not a robot

@ScottPack yeah that's better now than it used to be but ZAP is under pretty active development...

@RoryMcCune Good

@kalina but I could be half-man half-machine

@RoryMcCune nooooo

@kalina had to be done

@kalina yes?

@avid not yet

I need two upvotes on anime.se to be able to try

They're trickling in, so I can wait it out

@ManishEarth I thought I had worked out how to get before it was cool

but I haven't got the hat yet and it's been 10 minutes, so either I'm impatient or this isn't it

@ManishEarth two votes?

two question upvotes or two answer upvotes

I just upvoted your one answer ont here

@kalina what did you try?

everybody that has got before it was cool that I can see seems to have got a good/nice answer badge around the time they got the hat

for an answer posted before winterbash

Hmmmm, interesting.

so I've just got a nice answer badge

around ~15 mins ago

I'm going home now

will know by the time I'm back if it works

bbs

K. Ill do some digging then

@ManishEarth Here, let's try it with this one. It's one upboat away from that badge. security.stackexchange.com/a/4948/618

@manish doesn't look like that is it