The DMZ

Terry Chia

02:56

Happy Star Wars Day guys.

AviD

07:08

@RоryMcCune well to be fair, I have seen a whole lot of crap, even for a security person.

Or maybe I just have higher standards / expectations.

@RоryMcCune the two are often correlated. While language choice might not be the cause, it is a fair signpost, or symptom if you will.

@ScottPack I know, right? After all the trouble we went through, you'd think they'd give half a rat's arse as to what in hell we were doing it for.

@TerryChia yknow, I feel stupid, but I had no idea why it was being called star wars day. My kids had to explain it to me.

So that made me feel better, a bit.

Terry Chia

@AviD Heh. At least your kids are a fan of Star Wars.

AviD

@TerryChia yeah, exactly.

also, Laphroig lovers: I had this over the weekend. Veeeeeerrryyyy nice, though a bit different from their usual. Definitely worth trying. Though I also had a couple shots of Triple Wood, which is like the "regular" one, just very much more so. Fantastic.

Terry Chia

@AviD That looks expensive.

AviD

@TerryChia apparently. Had a friend over for the weekend, he brought it with him. He'd just picked it up in the UK...

the triple wood was at Saturday morning toast. Actually enjoyed that one more.

3

Hmm. Saturday morning triple wood. Do with that what you will.

Terry Chia

07:23

@AviD Obligatory TWSS.

AviD

inb4 ;-)

it was very oaky, btw. just a bit more earthy than smokey, for my taste.

Rory Alsop

Yarrr. Good whisky

Rоry McCune

08:03

@AviD Rly? I was thinking that company type predicates language and that therefore predicates remediation rate

AviD

@RоryMcCune yeah, that's what I was saying.

Rоry McCune

@AviD Ah I see

AviD

that is, it's not the language that decides the remediation rate, its' the org culture that decides them both.

Rоry McCune

yeah , was one of quite a few areas where I disagreed with that reports conclusion...

AviD

@RоryMcCune I admit, I didnt even bother looking at it this time. though I've seen it in past years, and it probably hasnt change TOO much.

there is a silent mistake in any conclusion in that report, that noone talks about - it is built inherently on selection bias.

Rоry McCune

08:06

@AviD basically they gave .NET a bad rep 'cause it had a load of info disclosure vulns, and they counted those as being as bad as SQLi

which whilst it could be the case, in general is very far from the truth

AviD

Based on what we said about org culture - dont forget that every single one of their stats is based on an org that, coincidentally, has the culture to have WhiteHat scan them periodically.

These things are not independent of each other.

Rоry McCune

indeed there's always a level of self-selction bias in there

as with any of these surveys

AviD

yeah, but I'm saying its not a certain level, the entire basis cuts straight to the root cause - which is org culture.

org culture causes: language selection; remediation level; white hat sec.

Terry Chia

Boooooooooooooooooooring! Let's go back to dissing perl please.

Rоry McCune

@AviD culture or industry? so some companies are more likely to use the service because their industry dictates it (e.g. more regulated)

AviD

08:10

@RоryMcCune that could possibly be relevant, too - though other cultures in the same industry might take a different company, or low end product.

also, while I dont think there is a causal effect, there is definitely correlation between industry and culture... ;-)

Rоry McCune

@AviD well yeah, but unless whitehat are significantly different from others in their industry it could be seen as representative in that regard :)

@AviD hell yeah

I can generally tell industry from pen test scopes these days

AviD

I think they are. it does require a bit of forward thinking, as opposed to just running appscan (and ignoring the results), or getting 2 kids and their dog to run an ASV scan.

@RоryMcCune heh, yeah.

Terry Chia

@AviD Good name for an infosec consultancy: "Two kids and their dog"

AviD

and I've learned I can skip 80% of information gathering before a review, just by knowing who the devs are.

@TerryChia ah, thats a true story here. Very popular pentesting company (different name, tho). 'course, they've since grown and whatever, but thats how they started.

Rоry McCune

Thawte was one of the shining examples of that

IIRC before verisign bought them they didn't realise it was some guys in a garage

AviD

08:15

hehe

Rоry McCune

@TerryChia redmonk.com/dberkholz/2014/05/02/… is a good example of resurgence of Java that I was talking about

github stats showing activity by language

Terry Chia

@RоryMcCune Yeah, but how many of them are libraries and software moving to Github from other source repositories?

Rоry McCune

@TerryChia well overall github is growing but it implies that rather than dieing off (as java appeared to be outside of enterprise customers) it's a growing market

Terry Chia

@RоryMcCune That's not what I'm seeing. The JVM is getting popular again but for languages like Scala.

Also, I'm not surprised at the sheer size of Java in terms of repositories. I'm sure you have seen the many different libraries offering the same functionality?

Rоry McCune

@TerryChia well ya know why have one when 20 will do :op

Terry Chia

08:28

@RоryMcCune And each one of them has plenty of Factory classes. :P

Rоry McCune

@TerryChia well ya know what they say, "I tried to fix a problem with Java, now I have a ProblemFactory"

AviD

hehe, funny, but I thought we were making fun of Perl now?

Terry Chia

@AviD Right. Java might be verbose but at least you can read it.

AviD

good one.

but I thought verbosity is a good thing for code? conciseness too, sure, but not at the expense of readability.

unless you were referring to writing verbosely, i.e. lots and lots of plumbing....

Terry Chia

@AviD Too much of a good thing and all. :P

Also, a Java project is basically impossible to browse in a web repository.

You need to click through 10 directories to find a source file.

AviD

08:37

@TerryChia ah, that's true. file nesting is a real bugger.

AviD

10:39

@Lucas, we'sa gonn' have us a leetle problem, soon. You'sa getting too close to my rep. Don't force me to make you an offer you can't refuse.

Terry Chia

@AviD I doubt anyone will miss llama boy if he takes a year or two away from sec.se. ;)

AviD

@TerryChia I doubt anyone will miss llama boy if he takes a long walk off a short pier.

Lucas Kauffman

what

where is the love :'(

I'm not simon

and the only one who's going to go away for a long time here is @Terry iirc?

AviD

@LucasKauffman oh that's harsh dude. Never mock a man (or woman) for being forcibly drafted.

(which is what I assume you meant.....)

Lucas Kauffman

@AviD I'm not mocking, I have respect for it

AviD

10:51

@LucasKauffman ^ == mocking

Lucas Kauffman

@AviD that's not true, I can be a serious person from time to time

Adnan

God damn it! It's emm effing snowing here!!!

AviD

@Adnan seriously? It was over 30C by 9AM today. F**k that s**t.

I think god's weather machine is broken.

Rоry McCune

11:34

@AviD 30C in May.. eww personally I'd take the snow over that kind of heat..

Terry Chia

@RоryMcCune NEVER come to Singapore then. ;)

Adnan

@TerryChia I hear it's 31C year-long

AviD

@RоryMcCune oh I'm with you. that is WAY too hot. but it's really only a heatwave, should only last a couple days. Until summer, anyway.

Adnan

@RоryMcCune Please do take it. I want my 12C sunny back.

Terry Chia

@Adnan Ehh, slightly higher during the day, slightly lower during the night.

Rоry McCune

11:35

@TerryChia well it's not too bad when I'm on holiday, kid of expect it then.. I've been to India and Australia which can be quite warm, but in the general case I like it colder..

Adnan

I kind of agree with Rory. Around 20C (sometimes slightly less) is ideal for me.

AviD

I'm with you on that.

I can even take another +2 or 3 C's worth, but not much more.

Lucas Kauffman

12:11

TildalWave

12:22

@LucasKauffman hehe yeah one of the many cherishable moments from the Bill Maher's Religulous ducu

AviD

12:35

@TildalWave Bill Maher, while amusing and also having several good points, is a rabid lunatic and should probably be put down.

He could very well be Colbert's opposite counterpart, except that he actually takes his own crap seriously.

though I did like that exchange with that senator....

TildalWave

@AviD Oh agreed, but that documentary was pretty funny, I didn't regret watching it. There are a few annoying, pompous moments in it, but I expected those so I just ignored it.

in terms of seriousness it's somewhere there with Michael Moore and Penn & Teller tho

AviD

@TildalWave dunno michael moore, but penn & teller know they are entertainers. Maher fancies himself a TV philosopher.

TildalWave

@AviD well that's an oxymoron ... where TV is an oxy and Maher a ...

AviD

@TildalWave haha, lol, yeah

hey @TildalWave I have a dilemma. I'm trying to change my twatter name, but @avid is taken, as is @avi_d, etc and any other reasonable version I can think of. any ideas?

dont want to put my full name, too long, and besides everyone knows me as "Avi D" anyway....

hmm, I can suffix it with my country code.... that's available.

or "_sec"...

Nick

12:55

Avi_D

AviD

@Nick taaaaken.

Nick

@AviD ah ermm

AviD

you'd think with your name, you'd be better at this. ;-)

Nick

@AviD my twitter name ... and website is nickscode :P

@AviD Avi.D? possibly

AviD

periods not allowed....

> Only use letters, numbers and '_'

TildalWave

13:02

@AviD You're asking others to be creative with your handle?

AviD

@TildalWave actually yes.... twatter is still new to me....

Nick

@AviD whats "twatter" :P

AviD

@Nick twerker

TildalWave

@AviD just put something, does it even matter? dunno, "SecSE_AviD"?

AviD

ooo, sexy avid

Adnan

13:07

@AviD An oxymoron, I see.

AviD

personally I find it annoying when you're trying to @ somebody, and their name is not trivially obvious. Then go and figure out which one you actually mean.

TildalWave

@AviD then use something that'll make it more obvious, depends what you plan on using it for ... maybe use "OWASP" in the handle?

AviD

@TildalWave naw, owasp doesnt define me

nevermind then, I guess

TildalWave

@AviD right, and TildalWave defines me? dude it's just some handle, trying to make sense of it is like overthinking the custom car number plates

AviD

@TildalWave oo, that wouild be fun. we dont have that here

TildalWave

13:14

@AviD try "ThereBeDragons"

AviD

@TildalWave @IWillTakeWhatIsMineWithFireAndBlood

which, for the record, is NOT referring to #AK-47's.

TildalWave

@AviD it's not too long?

AviD

@TildalWave TWSS

TildalWave

I'm not gonna argue that :P

Scott Pack

14:13

@AviD Let's be honest, though, when has the management ever seemed to really care much outside of SO?

AviD

@ScottPack I dunno, they do try at times. but SO is such an overwhelming part of SE, the individual communities (with the possible exception of SF, SU, and gaming) are trivial fractions of it. So yeah, we do tend to get shunted as side projects often enough.

you should comment too, anyway. We demand an equitable amount of attention!

also. besides the trilogy, and p.se I guess, are there any other sites with such a wide remit as ours? that is, as broadly applicable to those outside our core "community".

Seems to me most others are rather "narrow" (as much as e.g. "Linux" is narrow, but I mean that it is a specific silo).

Terry Chia

14:29

@ScottPack @AviD What's this about now?

AviD

18 hours ago, by Scott Pack

@avid Thanks for issuing the, so far ignored, correction on the history of sec.se. I just heard that episode and went to comment.

Terry Chia

@AviD What episode?

AviD

@TerryChia the latest

Terry Chia

Episode of what?

AviD

urggh, hang on, looking for the link

hmm, looks like it was quite a bit ago.

@TerryChia ah, the SE podcast

Terry Chia

14:35

@AviD Ah, can do the searching myself. :)

AviD

Blog - Stack Exchange: Podcast #57 – We Just Saw This On Florp

Abby T. Miller on April 24, 2014

Welcome to Stack Exchange Podcast #57, recorded Friday April 11, 2014 with your hosts Jay Hanlon, David Fullerton, and Joel Spolsky. Today’s podcast is brought to you by the Heartbleed bug.

We have lots to talk about (which makes Joel scared), starting with Community Milestones (after we discuss 2048 strategy, that is)!

Expats is newly in public beta. It’s a site for people that are dealing with the bureaucratic messes involved in living outside your home country. Check out their top-voted questions. Can I lose my US citizenship for accepting employment within a foreign government? …

@TerryChia We were featured there. Uncorrectly.

Terry Chia

> Thanks for joining us during this very productive hour of your life for Stack Exchange Podcast #57, brought to you by Heartbleed – the first buffer overflow bug with a website, a logo, and a marketing department.

Heh

Scott Pack

@AviD I think it's less about user base breadth and more about personal interest. At that level they're pretty much all programmers.

AviD

@ScottPack yes, but sec.se applies to all programmers, too + and then some.

Scott Pack

@AviD You're assuming they have any interest in it because they're programmers. My experience still says otherwise.

Terry Chia

14:40

Ironically, sec.se doesn't appeal to the subset of infosec that interest me the most.

Scott Pack

Although, even though I just said that most of what I see on sec.se is someone whining about this log in their website or how to implement crypto.

Terry Chia

@ScottPack And passwords. Can't forget the damn passwords.

Scott Pack

@TerryChia I don't mind passwords, I do think we've done a terrible job of training people badly on that one, but it's not really that complicated.

AviD

@ScottPack oh, absolutely. "applies" != "interested".

except for the rare incident once in a while, like a logofied buffer overflow.

@TerryChia what do you mean?

Terry Chia

@AviD We don't really attract much of the "writing exploits" crowd here.

AviD

14:52

ah.

Terry Chia

I think @Poly was the only one with considerable knowledge in that area and even he doesn't hang out much anymore.

AviD

well, there is @rook. can't forget @rook.

Terry Chia

@AviD Hmm, I haven't actually seen an answer from @Rook in a while.

Yeah, last public activity 12 March.

Scott Pack

@AviD How is Rook? Don't you guys do drinks every week or so?

AviD

huh wha?

Scott Pack

14:57

I thought you guys were good buddies

Nick

I have to upload a 183MB file... on my 0.5KB/s upload speed -_-

Terry Chia

@Nick That's shitty internet. Where you at?

Nick

@TerryChia Greece... Im getting 2-2.5MB/s down and 0.5 up ... and you know whats worse... im paying for 24!!!

Terry Chia

@Nick You get more up than down?

Nick

oops reversed that :P 2-2.5 down and 0.5 up

Scott Pack

15:02

@Nick You're paying for up to 24.

Nick

@ScottPack Yes ... long story

Scott Pack

@Nick Meh, telecommunications is a freaking unethical field like none other. I hate those guys.

AviD

@ScottPack ohhh. Sarcasm. I recognize that.

Terry Chia

Thank god I live in SG. The weather sucks but the internet is solid at least.

Scott Pack

@Nick Don't forget that much of the world sucks compared to you people. A 750Kbps upload cap is pretty normal for the States.

Nick

15:06

@ScottPack yea but a 500 upload when im constantly uploading files which are entire GBs is just a pain...

Scott Pack

I don't disagree.

When I first set up CrashPlan I took my system into the office for two days.

AviD

@TerryChia that's a lot less than you used to get.

Terry Chia

@AviD It varies slightly during different times of the day.

AviD

"slightly" == 50% ?

Terry Chia

And this is over the powerline so I'm taking a hit compared to a direct connection to the router.

@AviD Nah, the 100MB/s one was when I was directly hooked up to the router. I get max 70MB/s through powerline.

AviD