The DMZ

« first day (1234 days earlier) ← previous day next day → last day (3944 days later) »

Scott Pack

00:59

How drunk are you?

Falcon Momot

@LucasKauffman wow

3 hours later…

anorton

03:39

FYI: I don't know if anyone has already mentioned this, but some people here might find this an interesting class to take on Coursera.

2 hours later…

Rоry McCune

05:40

so on a scale of 1-100 what't the likelihood that I'm going to pin @LucasKauffman 's late night mesages to the starwall....

Terry Chia

@RоryMcCune 100?

Rоry McCune

@TerryChia possibly, tho' pinning something with dicey language could get me in more trouble than him...

Terry Chia

@RоryMcCune Then get @ScottPack to pin it. No one cares if he gets banned. :P

Rоry McCune

good call hey @ScottPack want to risk getting a ban?

3 hours later…

Adnan

08:57

@Lucas Are you sure you tried harder?

Terry Chia

09:12

@Adnan He probably tried too hard, broke down and got drunk.

Adnan

09:42

@TerryChia You might actually be very right.

You get stuck and then you beg for somebody to give you a tip, but nobody gives you any tip. Instead, "Go try harder"

A lot of the time, it's helpful to dig on your own, but sometimes it's too frustrating.

3 hours later…

Terry Chia

12:54

The most annoying character in GoT is Janos Slynt. This has been peer-reviewed. — WOPR 4 hours ago

Lucas Kauffman

13:18

Uh oh I was stupid drunk

Terry Chia

@LucasKauffman Obviously... :P

Lucas Kauffman

What did I post?

Aside from what I can see

My phone should have an alcohol lock

Terry Chia

@LucasKauffman That's all in this room.

Rоry McCune

@LucasKauffman IIRC there was an add-on for gmail for that, if you went to send mails late at night it made you solve math problems before it let you send..

Lucas Kauffman

13:42

I'm also completely in the dark why I said that

or to whom

2 hours later…

Scott Pack

15:31

@RоryMcCune @TerryChia Do you people seriously think that's bannable? Whatevs.

Rоry McCune

@ScottPack do I... not at all.. Do I consider if possible that someone else would...yep unfortunately

Scott Pack

@RоryMcCune Meh

Rоry McCune

15:49

@ScottPack hows consultancy-land?

saw you were having some "fun" with time sync

Terry Chia

Wow, RSA will go bye bye in TLS 1.3.

Rоry McCune

@TerryChia so it'll be deprecated around 2025?

Terry Chia

@RоryMcCune You are being a tad optimistic there.

Rоry McCune

@TerryChia I know my career as a security person has made me an incurable optimist..

Terry Chia

s/2025/never and I'll agree. ;)

@RоryMcCune Hey, I'm supposed to be the naive optimist and you the experienced realist.

Rоry McCune

15:53

@TerryChia you've hung around here far too long for that, will make you cynical before your years!

Scott Pack

@RоryMcCune Technically we're more vendors. It's an odd relationship. Until Jan 1 my company was the internal IT department of our biggest client and provided some services to our sibling company.

Rоry McCune

@ScottPack ahh complex! saw an amusing (from a security point of view) monitoring system this week

Terry Chia

@RоryMcCune I know right. Listening to @AviD makes me sad.

Rоry McCune

called sensu. Nice piece of software but the security defaults make you shudder

@TerryChia @AviD is pretty cynical even for a security person..

Scott Pack

@RоryMcCune A bit, yeah. At that point we were spun-out into a separate company. We still operate somewhat like the IT department of that company.

@RоryMcCune I'll have to take a gander for some chuckles.

@RоryMcCune I'm going to have to do a follow-up to that post as well. While trying to implement the changes on Friday I noticed some....skullfuckery.

Rоry McCune

15:56

@ScottPack combines an unencrypted HTTP API which defaults to no authentiation, with RabbitMQ with guest/guest as a default login and Redis defaulting to listening on the network with no creds or encryption

shame 'cause it looks really cool

easy to configure cross-platform monitoring

Scott Pack

Yeahh...that's pretty terrible.

Terry Chia

@RоryMcCune RabbitMQ and Redis? Sounds hipster.

Rоry McCune

@TerryChia nah it's old-school, written in ruby. there's not even a sniff of Node.js

Terry Chia

@RоryMcCune Wut? Node.js is so 2013. 2014 is the year of Go and binary web apps.

Rоry McCune

@TerryChia actually I've started hearing that 2014 is the Java Comeback year

I have a feeling that Go may be a bit old-hat

Terry Chia

16:00

@RоryMcCune Really? Whatever happened to Scala and Clojure?

Scott Pack

That reminds me!

Terry Chia

Isn't functional programming the new fad now?

Rоry McCune

@TerryChia I think it's an Android thing. Cool devs have to code Java to make money in mobile, so it ends up attracting cool stuff

Scott Pack

whitehatsec.com/resource/stats.html

SUCK IT BITCHES PERL IS THE SECURIST LANGUAGE ACCORDING TO WHITEHAT SECURITY!!!

Terry Chia

@ScottPack That's because most people can't understand perl code enough to find bugs in it.

> Perl has an observed rate of 67% Cross-Site Scripting vulnerabilities, over 17% more than any other language.

Who the hell still writes webapps in perl?

Scott Pack

16:02

So your claim is that the report is flawed because Jeremiah Grossman is an incompetent programmer?

Rоry McCune

@ScottPack well yeah if hackers can't read the code they can hardly inject stuff into it...

Scott Pack

You guys are just jealous.

Terry Chia

How many Perl developers does it take to change a lightbulb? None. There was no electricity when Perl was invented, so they’re used to it.

Tweeted by iamdevloper on April 29, 2014 at 11:23 AM

Rоry McCune

I'm not fan of their key stats page. The first page would have you believe that coldfusion is "most secure", on the very next page they mention that 10%+ of coldfusion apps have SQLi... not all vulns are equal..

CodesInChaos

@TerryChia Since when is functional programming "new"?

Terry Chia

16:05

@CodesInChaos "new fad" != "new"

CodesInChaos

@RоryMcCune Rust is the new go

hearing lots of Rust hype recently

Rоry McCune

WTF "coldfusion had the best remediation rates" what has language choice got to do with remediation rate. that's an organisational thing not a language choice thing..

Terry Chia

@CodesInChaos Rust is interesting but I'd wait for it to get out of beta.

Scott Pack

I thought rust was a game?

CodesInChaos

"information leakage" sounds pretty broad.

Rоry McCune

16:08

Those stats are laughably bad. If you eliminate "information leakage" (which can be bad but usually isn't) .NET leapfrogs the competition

Scott Pack

And now time to go remove dandelions. Jerks.

Gentlemen.

Terry Chia

@RоryMcCune I think he got upset we made fun of perl. :P

Rоry McCune

@TerryChia surely not, he'd spend most of his time on the Internet upset if that was the case!

CodesInChaos

The relative numbers of vulnerabilities make little sense to me

I'd expect more XSRF holes. And "abuse of functionality" should be really common

Rоry McCune

16:57

well AFAIK the results come from a largely automated scanning too, so there's certain classes of issue that those are less good at finding....

3 hours later…

Scott Pack

20:07

@TerryChia Oh, no, I was referring to the dandelions as jerks.

I'm de-dandelioning the backyard and laying thickening seed.

@avid Thanks for issuing the, so far ignored, correction on the history of sec.se. I just heard that episode and went to comment.

2 hours later…

Rory Alsop

21:49

@RоryMcCune had this interesting message today from owasp Ukraine:

Rory, hi!

How are you? Hope you've heared about big problem in the Ukraine with Russian terrorists. Our ISACA Kyiv chapter is going to give an advice to our business and public sector what to do with this issue in terms of cyber-security.

Do you have any experts who have experience in counter-terrorism actions in cyber-security area?

Thought I should ask

:-)

« first day (1234 days earlier) ← previous day next day → last day (3944 days later) »

all rooms