crickets

@Braiam What are you doing here?

(Also, enjoy the constant pings from this room that will now keep you from ever truly leaving.)

@Braiam did you come here because of me? d'awww

and yes, @FEichinger is right. you'll never be able to leave.

Seriously, I tried.

well, it doesn't help that I have it favorited...

@Braiam Oi

Good morning

Good morning, indeed.

A bit cold today

here in Madrid

7º C

Morning All

@kiBytes about the same here, but then we are quite a ways north of you...

@RоryMcCune I am always struggling, Madrid is a city of excesses

-5º in Winter, 40 in summer

I don't really know if I want the "good weather" to come

May/June/September/October have good weather usually

April too, but it can be a bit rainy

I know what you mean, summer isn't as hot here but we get midges! so late spring and late autumn are better

(Midges: scottish biting insect, prevalent on the west coast, and very annoying)

@RоryMcCune Thanks for the clarification. I almost read that as "midgets".

The problem in Madrid is "sleeping"

30º is quite hot to be able to sleep

@TerryChia yeah it occurred to me that it was a terms that wouldn't be much known outside of the uk..

@RоryMcCune true, but in the DMZ it should be known by now

@AviD heh we'll convert you all to British English speakers yet :op

@RоryMcCune well, you know I'm halfway there already. I am one part Scottish....

@AviD well one part scotch anyway.

hehe

where do you think I learned about a proper single malt?

That's already one part too much, @AviD

@FEichinger you can never be too scottish ya know

(don't tell anybody, but truthfully I do have one part Irish...)

@RоryMcCune well, some would say kilt+commando is a wee bit too much.

@RоryMcCune You most certainly can.

@FEichinger how so?

@AviD you're not suggesting you would wear something under a kilt? Next it'll be coke in your whisky!

heh. right, how else would one moon the English.

You know what sort of developers you should never hire? This guy: blog.plover.com/prog/Java.html

too long, will read later.

TL;WRL ?

This quote basically.

> So yes, I enjoyed programming in Java, and being relieved of the responsibility for producing a quality product. It was pleasant to not have to worry about whether I was doing a good job, or whether I might be writing something hard to understand or to maintain. The code was ridiculously verbose, of course, but that was not my fault. It was all out of my hands.

wat.

@TerryChia Cut that shorter.

> So yes, I enjoyed programming in Java

unless that is pure sarcasm, or has a really surprising context, I would agree with you.

@FEichinger the programming is not the bad part of java. it is a ridiculously comfortable language.

If you ignore the typically required enterpriseyness, I would say it is one of the most productive languages.

@AviD Oh, definitely. But I have hardly ever heard anyone actually talk about only the programming part when referring to "programming in Java".

("productive language" signifying how the language enables you to produce more code, faster, and spend less time on plumbing.)

bazinga.

And, yeh, I've been contemplating writing Java2X converters, simply to exploit the simplicity and structure of Java.

@AviD Well, no, I was going off of the environment where "programming in Java" means "programming in Java" plus "the entire system around it that makes it an utter mess".

Best part of Java (and other statically typed languages): Worry-free refactoring and amazingly good IDEs. Worst part of Java (mostly the frameworks built around it): XML. Fuck XML.

XML actually isn't really that big a deal.

What XML has been bastardized into, however, sure is.

@FEichinger that sentence is left wide open, for an expected contrasting statement re "the entire system around it that makes it an utter mess".

@FEichinger this. very, very this.

or rather, what it is being used as.

XML databases FTW!

The worst part of Java is the crap that has accumulated around it. The newer frameworks like Play (although that's moving to Scala mostly) is surprisingly good.

I think the 2 worst parts of Java are:

the typical overly enterpriseyness (though this has less to do strictly with Java, and more to do with the fact that Java enables the enterprises to do this, practically encourages them)

and the original expectations and imaginations, that Java never had a hope to live up to. But tried anyway. And burnt up failing.

not the existence of the overly-complex interpreter or the excessively verbose syntax or the messy memory management?

a distant third.

I like code to be concise and expressive... 1000 lines of trivial get and set methods are antithetical to that.

though a good part of that is a result of my first two.

get and set methods shouldnt be 1000 lines of trivial code.

if you start with the presumption that OO is the only way to program, you end up with a terrible language.

no, the problem is Java is not based on that presumption.

it certainly appears to be

the presumption is that OO is only for structuring code, and not for the actual programming. And that this is the only way to do it.

since you run classes for some strange reason...

That doesn't actually lead to a terrible language, though.

okay, perhaps a #0 should be: Java is too easy, and all the crapgrammers jumped in way too fast.

but that's not inherent to Java, nor is it unique.

as a C++ and assembly guy I actually find java as difficult as pulling teeth

It's a different concept, sure. But not difficult by any means.

because you're looking at it the wrong way.

in C++ and assembly, the bits and bytes and registers and all are the core. All the code around that is just to get to that point.

I just find that it constantly forces me to do suboptimal things, and it's difficult to write concise code in it.

Java is - or should be - about telling your "computer" to do "stuff". I dont care how it gets done.

perhaps it should

@FalconMomot true, compared to assembler code is not concise. But it is more productive.

It's a tradeoff.

but the result of how its libraries have been developed is that it's about endlessly subclassing and creating singletons and trivial methods.

@FalconMomot == bad code

... see what I said about crapgrammers.

yes, it is

but I have yet to encounter, in production, any java that doesn't act like that

as in, pro-grammers who haven't earned their pro status.

Java is not meant to be used in conjunction with tons of libraries, frameworks and other crap on top of it.

because the very first thing we teach java programmers is to start making singletons.

It's meant to produce self-contained units.

@FalconMomot see again my statement above.

And - if done properly - they are very productive.

@FEichinger that is a very big if.

assembly has a totally different purpose. it's not for making applications; it's for making extremely fast bits of applications, compiler-emitted blocks, shellcode, and stuff.

@AviD Well, yeh, it's the same "if" as applied to everything done with PHP ever.

@FalconMomot exactly.

@AviD I know, but try to make a java curriculum without doing it.

C++ is what I use to write applications, almost 100% of the time

@FEichinger welll.... with PHP its not so much of an "if" and more of a "imagination" .

though I can be persuaded to use python as well

@FalconMomot I have.

publish it then

@FalconMomot I have given plenty of classes on Java without it.

I've seen so many people teach java where they introduce encapsulation before introducing OO as a tool

@AviD ಠ_ಠ

ah, hang on, I am talking about teaching security in Java. not the same thing....

well yes

I'm talking about a first course in programming

@FalconMomot agree. s/tool/concept/,

@FalconMomot ahhh. okay then.

ok, yes, it can be a concept more than a tool

though I have taught my daughter a bit of that.

@FalconMomot oh I agree it CAN be a tool too, but it should be first taught as a concept.

I prefer to teach it in C, though I find that python is more amenable to students' short attention spans

and encapsulation is part of that.

C as a first language is... painful.

oh, encapsulation is certainly part of OO. it's just a mistake to teach it as a fundamental element of programming in general, or a necessary thing for every single member of every single class.

sometimes you just need POD.

@FalconMomot agree.

@TerryChia can be, certainly. I can think of worse ones though, and C does a very good job of introducing fundamentals that make later things like the von neumann architecture really easy.

@FalconMomot proof of delivery?

ping of death?

@AviD plain old data :)

ahh

OO in C is one of the most annoying bastardizations there is.

hmmmmmm

Efficient, sure. And - if done properly - does a lot of great things. But jesus is it annoying.

@FalconMomot the problem is it forces you to be introduced the fundamentals of programming, at the same time as fundamentals of computer structure.

in C, certainly it is, but in C++ you can do whatever is reasonable.

and thats what makes it more complicated to focus on one.

oh, perhaps.

@FalconMomot "Class, this is your first programming lesson. But before we start writing a single line of code, here is the thirty flags you need to remember to compile your code!"

I totally agree that students should have BOTH, but as a first one it is tricky.

@TerryChia ugh. teach in linux. gcc main.c

@FalconMomot VS on windows is not more complicated....

no, I really don't know where @TerryChia gets those 30 flags from.

of course, linux is also good for teaching computer fundamentals

with all the streams and standard things

@TerryChia but no, I meant more about understanding memory layout and structure, CPU architecture, registers, etc. All this for a simple "Good Morning Terry" program.

oh

again, all this should be learned by any halfway competent programmer, but not necessarily as the first thing.

dunno if you need to talk about that first off

@FalconMomot I'm exaggerating obviously, but C is not a good first language imo because you need to understand a whole bunch of other things before you get to the basic logical thinking stuff.

@AviD Yeah, what you said.

if you can make people understand what a string is, you can get started with some things pretty quickly

you can even use iostreams if you like

actually iostreams is probably better for novice programmers, if you're willing to use C++

Teaching a language should start from its most elementary of operations, not with complex structures to "simplify" the code they end up typing.

@FEichinger So you want to start teaching CPU opcodes?

iostreams is very simple; my only gripes with it are that it is a state machine, is excessively verbose, and abuses the shift operators.

@FalconMomot okay, go for it: what is a "string" in C?

;-)

that's a trick question, you know.

@TerryChia Technically, yes. Effectively, though: Their representation in the language's syntax.

@AviD And, on that note, it's really important to make the distinction between C and C++ when it's about teaching the language.

@FEichinger I dislike how many people write C/C++.

@FEichinger see, that's where I think the mistake is: the first course should NOT be about "teaching the language".

it should be about taking A language, and teaching basic programming concepts using whatever language that happens to be.

@AviD Yes, but that should still be consistently one language.

Syntax is irrelevant, idiosyncrasies are irrelevant, CPU architecture is irrelevant.

@TerryChia Well, the sad part about it is that most of those people only actually ever used C++, but add in C because it's technically included in what they know.

Admittedly, I only use C when writing trivial programs, or working on existing C code.

and I'd certainly rather people use a C++ STL container than write vulns under the guise of implementing data structures from first principles.

@AviD oh, teaching it as a character array, which it fundamentally is, I find quite reasonable...

@FalconMomot Which means you need to teach arrays, which usually means you need to teach pointers.

@FalconMomot too many different representations.

you don't need to teach pointers the second you teach arrays.

First course: loops, conditionals. basic logic.

but you should teach pointers early and often.

Hence why I said "usually" - of course you can teach the array as a self-contained unit, but that may make coming back to it later-on much more complicated.

Oh, and cue in @Thomas to explain the difference in complexity between implementing compilers on embedded platforms for each.

there is no reason you can't introduce arrays and pointers in the second and third classes

no need to introduce dynamic memory allocation for that either

and it's dynamic allocation which is the hard part

so the most complicated thing is like

scope

and while the stack is fundamental to that, and push-down automata are fundamental to that... we don't start physics class in junior high school with the Higgs boson.

actually, if it were practical, I would prefer first course to be pseudo-code.

of course that doesnt let them run their own programs....

Visual Basic! VB FTW!

@AviD ew

So, the Enterprise Security and Risk Management conference looks interesting. Good range of speakers. And as it is near Russell Square station, a morning workout as I ran up the 175 steps...

@RoryAlsop Enterprise risk management and "interesting", not a set of words you usually see in the same sentence :op

@RоryMcCune Dude, he works at a bank!

@RоryMcCune heh, I was thinking that :-)

@TerryChia true, does tend to skew the view...

krebsonsecurity.com/2014/03/…

(I am sure I am a day late)

@kiBytes TWSS

@TerryChia that TWSS thing is not funny anymore, in fact, it was never funny

:D

@kiBytes That's your opinion.

@TerryChia TWSS

@RоryMcCune TWSS

because I was about to say that "the cursive" thing is not funny neither.

now all we need is @kalina and @adnan to start doing that infinite recursive quote thing and I can quit the DMZ

@RоryMcCune Don't worry. We have another @Rory. :P

and write the report I'm meant to be doing today

@TerryChia hah! he's abandoned you for an enterprise risk conference

@RоryMcCune Imagine how his wife must feel. ;)

@RоryMcCune I know how you feel... I need to review and rewrite a procedure

Pffft you slackers. Here I am hard at work catching all the Pokemon there are.

So far it is interesting. Had a good chat with the rapid7 guys. And coffee.

@RoryAlsop Because coffee is only available at Enterprise Risk management conferences. :P

@RoryAlsop You buy Nexpose yes?

Probably. Dunno.

@RoryAlsop They got to you

I don't get to buy anything. That's not my role:-)

@RoryAlsop best way to be, if you're a buyer they pester you all the time, an "influencer" on the other hand ...

"love" the suggestion to create passwords with urandom... I'm sure those are really memorable :op

@RоryMcCune You can use /dev/urandom to pick from a ASCII charset. :P

@TerryChia sure but almost no-one I know is any good at memorizing long random ASCII strings...

@RоryMcCune Or pick from a dictionary of words. :P

This is a fun one! technet.microsoft.com/en-us/security/advisory/2953095

I guess it answers one dude's question here, he asked it yesterday. It was about opening a message that destroys your system or something

:P

Late as usual.

@TerryChia What are you waiting for? Gimme teh exploits codez!!

@Adnan AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

@TerryChia newbie error, it's 0x410x410x410x410x410x410x410x410x410x410x410x410x410x410x410x41

@TerryChia Wait wait.. so it's not John Smithxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx?

@scottpack sup

I'M HERE I'M HERE

OK OK

@jrg You've already failed me.

Fucking preseed man.

@ScottPack i've always had preseed just work for me. :P

I'm, slowly, wrapping my head around it.

I've spent too much time in kickstart land where you have a relatively short key value configuration setup followed by arbitrary shell scripts.

It turns out that my biggest problem with the network setup wasn't actually the preseed, but the kernel options for networking. This network segment doesn't have DHCP available.

My goal is to have a fully installed, patched, and configured system on first boot. Which means also doing things like installing, and running, puppet during the late_command section. I only discovered last night that you can only have a single late command. >_<

@TerryChia I could see myself doing a digital music minor. :P

@jrg - I interpreted that sentence entirely scurrilously. Sorry...

@RoryAlsop why do people always apologize for that...?

those end up being hilarious. :P

if occasionally rude. :P

Hahahaha - I'm british

Suffice it to say, it had the words fingering, student and orchestra in it.

@DavidFreitag This melody should be brain-injectable:

@RoryAlsop I thought you were Scottish?

@LucasKauffman Not mutually exclusive. Scottish is British. British isn't necessarily Scottish.

Think: Being Scandinavian and Swedish.

At least this is how I understand it.

Yup

@LucasKauffman do we really need to link CGP's explanation vid on British again again?

okaaaay, fine then!

Oh good. I was going to look for that but got distracted.

@RоryMcCune Technically I tend to generate my passwords from /dev/urandom, and I remember them. It all depends on how you use the randomness.

The famous electric horse thing is about using random passwords under a guise which makes them easy for a meat brain to remember them.

@ScottPack and, linked from that, another video definitely worth watching, if you haven't yet:

long-ish, but entertaining enough the whole time to be worth it.

heh, nicely played.

@ThomasPornin How do you remember them?

Do you just read them and type them a couple of tens of times until remembered?

@Adnan I use my brain.

@Adnan What you don't know is that /dev/urandom is actually generated by @ThomasPornin.

@ThomasPornin :|

Basically, if you type a password often enough, you cannot really avoid remembering it.

It's actually a tun device.

@ThomasPornin yeah not to say there aren't schemes for that and people like yerself can use them but as general advice it seemed a bit dicey

My usual passwords have the format: two letters, then two digits, then two letters, then two digits. The second group of letters are uppercase.

It turns out that such passwords are not hard to remember, yet offer a decent 32 bits of entropy.

I usually find words that start and associate them with characters of the password to tell a story. "j<30$pad" Jenny likes free pizza and drinks.

The whole point is that I generate the password and then I accept it. I don't regenerate it if I don't like that password.

@Adnan Stories are fine as long as they are applied a posteriori, i.e. you generate the password randomly, then (and only then) you find a matching story.

@ScottPack Someone should really host a webapp. "Thomas Pornin Facts"

If you do it the other way round, then you risk being non-random and you cannot accurately estimate entropy.

@ThomasPornin Yup, that's what I do. It's more fun this way.

@Simon Google doesn't have that track :\

cc:/ @Simon

So, we did this procedure so we could put in production a different certificate from the one in development because obvious reasons

(certificate and private key)

Well, I have discovered today than the day after putting the new private key in production, someone copied the whole production environment into a development/maintenance environment.

Private key included.

So, actually we changed it for nothing.

So I hate them.

@kiBytes At least you didn't commit the key into source control!

@DavidFreitag The skies are angry with me. I'm now forced to work with WPF PropertyGrid :(

@Adnan :[

Are you writing from scratch or refactoring someone else's code?

@DavidFreitag The second :(

"Someone else's code" underplays it a bit.

Yeah me too. It suuuuuuuuuucks.

This project has been touched by, at least, 30 developers.

This is impossible.

IMPOSSIBLE!

@Adnan git blame and send them swear emails. ;)

@Adnan Ah that's awful

@TerryChia Oh, I can see which part is written by whom.

Too bad I can't open my mouth about it

Life shouldn't be that difficult for us, attractive people.

@Adnan Guerillamail man.

Or... I don't know. I got nothing.. NOTHGIN!

How well commented is it at least?

> Hey, I got an email about my ProjectInitializationPropertyGrid class. Do you think it's from that dude who has the ProjectInitializationPropertyGrid ticket?

@DavidFreitag :(

Dude, the names of the methods are horrible.

@Adnan Make the email general. Something like.... "You code is shit"

When you see a method Project.InitializeNewProject(), what do you think?

@Adnan Someone has no imagination whatsoever.

This method will initialize a new project, right? RIGHT?!

But noooooo

no no no

There's a method called Project.CreateAndInitializeNewProject()

Is the name of the project really just Project?

aaaaand... this one doesn't even call the first one

@DavidFreitag Well, the project is about creating a software that handles projects.

Yay!

@Adnan Oh joy...

@Adnan someone doesn't understand constructors?

@AJHenderson I don't know man.. I don't know.

The git log is about 100 entries for one day.

So. Many. Developers

Can't follow shit!

@AJHenderson Nah, they are going with the non-object-oriented approach.

@DavidFreitag Guess what we're using?

MVVM!

@Adnan You should be lucky you even have a git repo with logs. The code i have has not one single commend and no repo.

Our projects have "overviews". So the View is called OverViewViewModel

@Adnan huehuheue

and I know, this makes it sound like 50 devs are awful and I'm the only good one. No no, I'm awful as well. It's just that because I'm the newbie, everything I don't do "according to the standards" gets flagged and my commit reversed.

The project I am working on does sorta the same thing. The main application is just a big empty window with some buttons at the top. Based on what button you press it loads one of the UserControl classes that display things

So, basically, any task I have is Refactor + the original task

@DavidFreitag Sounds simple enough. Now how awful does that become in reality?

Design Patterns SUCK, period.

@Adnan It's not too bad, but the visuals that the chose SUUUUUUCK. It looks exactly like one would expect buying a cheap piece of software from India.

But let me put it to you this way. It uses a separate thread to dispatch the changes to the main window's UI. So every time you click one of the buttons at the top to display another page of content it spawns another thread that then tells the main UI thread to change the display.

> I want to add one button here. I'll go ahead and create a new class, inherit from another class, use that interface, create a new class for the execution command, add a CanExecute method, create a new class for the event, and activate the button using a message from another part of the software, and add the button to the xaml, and finally add the bindings.

~ 5 hours of work.

@Adnan ~ 5 hours of paycheck

@DavidFreitag Well, that happens. However, you have the nice project manager saying "Oh, adding a button? That's like 10 minutes max! What took you so long?!".

Geee, I don't know. The metaball-less spaghetti dish that is your project?

@Adnan Yeah, I don't have a project manager. I have the owner of the company breathing down my neck.

> Why is it that we haven't released the software yet?

@DavidFreitag Jesus. You have it even worse!

@Adnan I am the only person in the company even remotely capable of fixing this meatball.

My boss could probably do it, but all he really knows is embedded C which is what all of the firmware of our old instruments was written in.

@Adnan so was yo momma

@AviD May her soul rest in peace.

@Adnan oh damn, hate when I do that. May it indeed.

@TerryChia Love, does your crypto project have GCM?

@AviD Why do you hate when you do that?

@Adnan Indeed it does.

@TerryChia Could I bother you with a link to the implementation, please?

I cannot find it

@Adnan This is categorically untrue.

@Adnan Mostly wrappers over OpenSSL.

Gimme a sec.

Design patterns are awesome. The problem is when they are used for a completely different purpose than that for which they are intended.

@TerryChia I searched the repo for GCM and still can't find it. I feel stupid.

@AviD They were intended to sell nice books about design patterns ?

@ThomasPornin overly-cynical much?

> The Bible/Quraan is awesome. The problem is that we interpret it in a completely different way that it was intended.

cmon, coming from you?

@Adnan hehe, true, true.

@Adnan Here is the interface. github.com/pyca/cryptography/blob/master/cryptography/hazmat/…

@AviD I have been practising design patterns since way before I knew that they were called "design patterns". I call them "do your job properly".

Design patterns are intended for two complementary purposes. and this is even mentioned in the GoF: 1. communication shortcut between team members; 2. shortcut to finding a common baseline for simple solutions.

They were never intended to be a complete and restrictive framework, which is how they are most commonly used.

The biggest problem of design patterns is that they are presented as "design patterns", i.e. slogan-level recipes that should be applied dogmatically without thinking.

@ThomasPornin completely agree there.

@ThomasPornin exactly this.

design patterns shouldn't be applied, they should be recognized. And maaaaybe labeled as such.

even nevermind the "without thinking".

@Adnan You probably just want to look at the documentation on how to use it. cryptography.io/en/latest/hazmat/primitives/…

@TerryChia No, I actually want to see how it's implemented.

That's what I still can't find