The DMZ

AviD

00:03

@ScottPack I heard it's something about spirits, sure.

Scott Pack

I have a little gin left.

@AviD I'm sorry to say that it's not very moist today.

AviD

hehehe. how much longer?

Scott Pack

Probably not past tonight.

mdlp0716

HEY GUYS guess how you piss of a web developer

AviD

HEY GUYS guess how you piss off an entire chatroom ;-)

dammit, I really shouldnt be online after 2AM. Sorry @mdlp0716.

Scott Pack

00:12

GOTO BED;

mdlp0716

lol

AviD

promised to send this email tonight.... 'course the later it gets the more difficult it gets.

tylerl

@AviD say the word fractal in stackoverflow: PHP

Scott Pack

@AviD ahem.

DAMN

AviD

heh

@tylerl hehe, nice.

sore subject, is it?

Scott Pack

00:13

@tylerl They must hate Frozen.

tylerl

@AviD like millions of tiny daggars

mdlp0716

ive seen frozen rule 34 before @scott pack

Scott Pack

Oo...I hadn't....yet.

tylerl

Actually, every PHP dev in the world says "I know the language has issues, but the way I use it it's safe"

Scott Pack

Boring.

mdlp0716

00:16

bored

anyone like puns?

*clears throat

Scott Pack

The things worse than puns are jokes about sausages. Those are the wurst.

mdlp0716

vagina jokes aren't funny, period

WHAT DID THE chemist say when he found two isotopes of helium

HeHe

AviD

I'm pretty sure puns are banned from this room.

If you continue, you may be pun-ished.

mdlp0716

why do fangirls travel in odd numbers

because they cant even...

Scott Pack

@AviD I can't do that. Can you?

mdlp0716

00:22

gay jokes arent funny, come on guysssss

Terry Chia

03:57

I see chat got weird again.

10

Rоry McCune

05:45

@RoryAlsop woo! good call, will need to get a date in the diary for that :)

Lucas Kauffman

07:42

AAAAND IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII WILL ALWAYS LOVEEEEE YOUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

AviD

@LucasKauffman drunk again?

or still?

Terry Chia

@LucasKauffman @Adnan isn't here right now.

Lucas Kauffman

@AviD working

AviD

@LucasKauffman is it?

Terry Chia

@AviD If that's referring to his liver, no.

AviD

07:53

ah, I figured you would go for his genitalia.

Lucas Kauffman

jeez I got drunk once here -_-

Terry Chia

@LucasKauffman I'm pretty sure it was more than once.

AviD

@LucasKauffman .... aaaand still haven't sobered up.

ftr, it was more than once.

Lucas Kauffman

@TerryChia okay maybe 3 times

he who has not been drunk in the DMZ throw the first stone!

AviD

HE SAID JEHOVA!!!

Terry Chia

07:59

Hmm, how many concurrent sockets connection can a single network card reasonably handle? :P

AviD

depends if the network card is slutty enough.

no wait, what's that setting called?

ah right, "Promiscuous".

Adnan

@LucasKauffman You'll just have to wait it out.

I got drunk here once, they forgot about it 2-3 months later

AviD

@Adnan and then we all mis-attributed it to @LucasKauffman.

Lucas Kauffman

08:19

I'm going to do another BBQ tonight

weathers going to be great

deed02392

08:36

@LucasKauffman I had three over the weekend \o/

I don't think I've been drunk in the DMZ yet

Terry Chia

Hey @CodesInChaos, are you familiar enough with the TLS handshake process that I can pick your brains a little? Big Bear hasn't been around in a few days.

Rоry McCune

09:12

pseale.com/blog/2011/02/02/…

^ This is very useful for testers

deed02392

is there a .iz tld? Most results seem to be blocked at work

Rory Alsop

09:45

@deed02392 give it time...

CodesInChaos

@TerryChia My knowledge of TLS is rather shallow

Terry Chia

@CodesInChaos Well, see if you can help me out anyway. :) So I know that the client specifies a list of ciphersuites in ClientHello in order of preference, which the server uses to pick the ciphersuite that will be used. The final decision completely lies with the server. Am I right so far?

Rory Alsop

@TerryChia yes

as long as the client has a list, the server will pick one of that list

which is why to force a server to give you the cipher suite you want, you need to specify only one

CodesInChaos

yes.

Terry Chia

@RoryAlsop So my question is that if I give the server a list in the order of preference, how does the (common) implementations of SSL pick the one to use since the server can be configured to have a priority list as well.

Rory Alsop

09:53

ahhh - now that I don't know. I think big bear even ppointed out there was uncertainty

Terry Chia

Yeah, I was asking more about what the commonly used implementations do. :P

Rоry McCune

@TerryChia @RoryAlsop yeah if you search the transcript I'm sure I've had this conversation with the bear before

Terry Chia

The server can RNG the one to use and it will still fit the spec.

Rоry McCune

there was a reason why a scanning tool couldn't come to a reasonable conclusion.

Terry Chia

@RоryMcCune I know. I'm writing said scanning tool now. :P Hence the question on what normal servers do.

AviD

09:55

I do happen to know that Windows / IIS does enforce it's own order of priority.

CodesInChaos

@TerryChia Typical servers either respect the order or they don't. Often you can configure a flag.

AviD

but I have no clue on any others.

Terry Chia

@AviD So it picks the first cipher in the client provided list that is fits the order of priority?

CodesInChaos

Google is exceptional since they support a mix. Where the server picks the client preference from suites the server considers equivalent (AES-GCM vs ChaCha-Poly1305) but enforces its own priorities elsewhere.

AviD

@TerryChia if you just said that it selects the first cipher according to its list, that also appears in the client list, then yes.

Rоry McCune

09:56

@TerryChia IIRC the context of my question was why the bears tool doesn't do that, and the answer was that it wasn't reasonably derivable :)

AviD

@RоryMcCune I think he also mentioned that its not "important"?

Terry Chia

@RоryMcCune SSLLabs does it though. I'm assuming thats by opening lots of connections with multiple ciphers to decide which one the server will use.

So I'm trying to emulate that.

AviD

no, no. Always try to emulate the Bear.

For it is in His own image we are registered.

Rory Alsop

@AviD Bearmulation!

Lucas Kauffman

cure53.de/pentest-report_onion-browser.pdf

Rоry McCune

10:02

@TerryChia chat.stackexchange.com/transcript/151?m=14255658#14255658

that covers this ground I think :)

deed02392

10:15

The Bear wrote a scanning tool? Sauce!

AviD

yeah, its called "BearScan".

jk

and it has a really nice UI - a bear avatar is stands on top of a tower, and each request is visualized as him throwing barrels down at the target site.

Adnan

@LucasKauffman Whoa! They report that the whole thing took about a week. Do you think that's enough for only 3 people?

Lucas Kauffman

10:31

@Adnan what?

the pentest on the browser?

@Adnan scope always depends on budget

AviD

@LucasKauffman back asswards. Though true, sadly enough.

Adnan

@LucasKauffman Hmm.. true

Lucas Kauffman

@Adnan answered you on skype just now

AviD

@LucasKauffman are you one of those people that SMS someone to tell them you left them a voicemail about sending them an email? And then stop by their office in person to make sure they read your text?

deed02392

@AviD lol

Adnan

10:43

@AviD He was away from Skype for a while, I sent him a couple of messages. Now he's just confirming if I received it

Nothing wrong with that.

AviD

@Adnan how could you be away from skype? is that even possible?

Adnan

@AviD I don't know, man.

deed02392

11:20

@AviD You mean the kind of person who gets shit done?

AviD

@deed02392 no, I mean the kind of person that is too hysterical to get anything done, but they keep running around asking "What's your status? What's your STATUS?", trying to get everyone else to get their stuff done, and wants to make sure that everyone else knows about any little thing they DO happen to get done, but also ensure that everyone also knows that they can't get anything done because of someone else, he's waiting for their DELIVERABLE, they are BLOCKING. In short, hysterical godzilla

@deed02392 very much no.

deed02392

Ah OK, well that's a little clearer description of the kind of person you meant.

AviD

hehe

did you think my first description is someone gets stuff done?

they're too busy running around REACHING OUT to everyone to get anything done, that's the only thing they know how to do well.

I can't imagine anyone who gets stuff done that would do the SMS-Voicemail-Email-Visit thing...

Terry Chia

Nothing, NOTHING in the world is as satisfying as seeing someone get physically injured as a direct result of showing off.

Tweeted by GABELORD on May 20, 2014 at 11:02 AM

deed02392

12:54

@AviD I think there're some industries where people need constantly chasing to do their job, I was thinking a manager in one of those industries would be the kind who would not let anyone slip under their radar and get lazy

Terry Chia

@deed02392 Sounds like a shitty industry.

deed02392

@TerryChia Labourers and factory line workers

I think it's more common than you think. Every industry has teams like that, who need managers like that

Terry Chia

@deed02392 Well, I think it's pretty unfair to generalize it to an entire industry. A particular company or team? Sure.

AviD

Fire them.

@deed02392 yes, but does the industry need teams like that?

deed02392

@AviD Certainly not, but obviously we don't live in a perfect world. I was just saying the first time you described that kind of person, it was ambiguous to me because I know of teams that kind of manager would actually be desirable

AviD

12:59

I disagree.

deed02392

Lol I'm going to stop because I feel like I'm digging a hole

AviD

that would be equivalent to saying if your going to cut out your heart, you should use a knife instead of a spoon.

Terry Chia

@AviD Well, you should.

AviD

@TerryChia A spoon is dull, it will hurt more.

deed02392

@AviD Exactly, that's why you'd use the knife

Terry Chia

13:01

@AviD How is hurting more relevant to cutting out my heart?

AviD

►

you twit.

deed02392

whaaaaaat, eric prydz has done a 16 bit ish track

Miami to Atlanta

checkitout

AviD

@deed02392 on the other hand, perhaps I shouldnt be cutting out my own heart?

deed02392

@TerryChia @AviD What kind of music are you two into?

AviD

that makes it sound like we are a couple.

deed02392

13:03

@AviD Is there something wrong with it?

AviD

a very gay couple.

NOT that there's anything wrong with that.

Terry Chia

@deed02392 Alt rock, pop punk etc.

deed02392

Cool, any particular bands you're a fan of?

Terry Chia

blink182, green day, jimmy eat world, new found glory for the older bands. paramore, all time low, the wonder years for some newer stuff.

Bunch of others as well.

Rory Alsop

@TerryChia all of those are good

my kids like them all

Terry Chia

13:12

@RoryAlsop Psssh! Your kids have good taste. ;)

Rоry McCune

@RoryAlsop @TerryChia They are , although I'm not particularly happy about Green day and blink 182 being referred to as "older bands"

Terry Chia

@RоryMcCune Well, older compared to some of the stuff I listen to. ;)

AviD

@RоryMcCune heh, I was thinking that. Then again, Green Day's breakout album was out a few years before @TerryChia was born.

Rоry McCune

@TerryChia I know it's all relative but when stuff you remember coming out becomes the "older stuff" that's not so good.. like Guns'n'Roses turning up on classic rock stations

Terry Chia

@AviD Dookie was released on the year I was born actually.

deed02392

13:15

To be fair Green Day were releasing good stuff when I was growing up

they might be old but they've produced good stuff relatively recently

Terry Chia

@deed02392 Ehh, all their stuff is mostly decent. And they put up a damn good live show.

@RоryMcCune Well, you are getting old after all. :P

Rоry McCune

@TerryChia shut up, shut up, shut up, shut up, shut up, shut up, shut up, shut up! :op

Terry Chia

@RоryMcCune Hey, no worries. @RoryAlsop is here.

Rоry McCune

true!

Terry Chia

I think I have just discovered the tech trend of 2014. nobackend.org

AviD

13:20

@TerryChia that IS a parody, right?

Terry Chia

@AviD I wish... :(

AviD

then again, dev-null-as-a-service.com ....

Terry Chia

Read this blog post: nobackend.org/2014/05/getting-started-with-noBackend.html

> Plug and play any type of BaaS until you find the right fit, while only changing a few lines of JavaScript to get it all set up.

AviD

meh, I'm dealing with enough stoopid stuff for today.

accounting day. yaaay.

deed02392

@AviD looks like a holding page

AviD

13:22

@deed02392 heh, thats not real. I hope.

deed02392

@AviD :o could have been a 0day trap, damn you

Terry Chia

Wrong link actually, the real one is devnull-as-a-service.com

I'm pretty sure I linked it a while back.

Oh no, @AviD did.

Jan 18 at 20:08, by AviD

anybody know if this http://devnull-as-a-service.com/ is purely humour, or if they are really trying to dupe the clueless?

AviD

oh crap that thing is real.

Discard Protocol

The Discard Protocol is a service in the Internet Protocol Suite defined in RFC 863. It is intended for testing, debugging, and measurement purposes. A host may send data to a host that supports the Discard Protocol on either Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number 9. The data sent to the server is simply discarded. No response is returned. Inetd implementation On most UNIX-like operating systems a discard server is built into the inetd (or xinetd) daemon. The discard service is usually not enabled by default. It may be enabled by adding the follow...

hehe

Rоry McCune

what about foaas.herokuapp.com

^ (warning NSFW language)

deed02392

Isn't port 9 what you send WOL packets to?

AviD

13:25

@RоryMcCune oh yes, that one is quite good.

Rоry McCune

@AviD I particularly like their committment to variety!

Terry Chia

Oct 23 '13 at 1:35, by Terry Chia

Fuck off as a service. http://foaas.com/

Rоry McCune

@TerryChia did I claim to be original :op

Terry Chia

@RоryMcCune You can't beat me at finding random crap on the Internet. ;)

Rоry McCune

@TerryChia son I was finding random crap on t'internet before you were born :op

Terry Chia

13:27

I particularly liked /linus/:name/:from

> Will return content of the form ':name, there aren't enough swear-words in the English language, so now I'll have to call you perkeleen vittupää just to express my disgust and frustration with this crap. - :from'.

deed02392

"perkeleen vittupää" lol!

Rоry McCune

armory.com/~crisper/DHMO <-- old-school random stuff

AviD

@TerryChia foaas.herokuapp.com/fascinating/everyone

Terry Chia

@RоryMcCune Sure, but I'm a natural born talent at finding random crap on the Internet. ;)

deed02392

Did @Adnan say that?

Terry Chia

13:28

@deed02392 Linus made it famous. lkml.org/lkml/2013/7/13/132

AviD

there are some new ones...

deed02392

Ahh, shoulda known

Adnan

@deed02392 Hehehehehehe

Vittupää

hehehehe

But I guess that can sort of expressed in English

Rory Alsop

@Adnan re your Travel question - you may well find people telling you you'll just have to be uncomfortable :-)

@Adnan I googled the Finnish profanity page

which is very enjoyable

Finnish profanity

Many Finns use profanity in everyday speech when compared to other nationalities. While not all Finns swear, frequent swearing is a mark of youth culture, sometimes the elderly, and usually not the middle-aged. However, it is commonly considered impolite to swear excessively in public and official occasions, and particularly in front of children in all regions of the world. Use of swearwords may also imply familiarity as opposed to official distance. Swearwords are used as intensifiers, adjectives, adverbs, particles and to start or finish sentences. There is also an aggressive mood that ...

Terry Chia

This article is hilarious! cracked.com/blog/…

Adnan

13:39

@RoryAlsop I'd say the closest thing would be "damned c*nt head"

Terry Chia

Not the actual article, the captions of the photos.

Adnan

@RoryAlsop Yeah, it's happening already.

AviD

@TerryChia I have another couple, I'll tell you about them later.... after I finish the accounting

Adnan

@AviD You're an accountant now?

Terry Chia

@Adnan He would go great with @RoryAlsop the HR Manager eh?

AviD

13:53

hehe, nooo... but I have to go through it all EOY, since I am independant.

I am effectively my own CFO.

Terry Chia

@AviD Why not hire someone?

Simon

@TerryChia He's old and greedy.

Terry Chia

@Simon So's your mom.

AviD

duh, I have an accountant. I still need to prepare my docs, go through my insurance policies, etc etc.

Simon

@TerryChia She's old but definitely not greedy.

Rоry McCune

13:55

@AviD yeah underrated aspect of being an independent is the time spent on bookkeeping..

CodesInChaos

@TerryChia I prefer encryption as a service

AviD

@RоryMcCune exactly, and there is a limit to how much you can dump it on a bookkeeper / accountant. Like I said, I have to be my CFO.

Terry Chia

@CodesInChaos Hmm, let's setup devrandom as a service.

CodesInChaos

@TerryChia Exists. Known as random.org

and people actually use it

Terry Chia

@CodesInChaos Ah right, I totally forgot about that.

CodesInChaos

13:57

claiming it's better than a CSPRNG

Rоry McCune

@AviD yeah we still have quite a bit of stuff to do. Use FreeAgent which makes it much less painful but still a timesink

CodesInChaos

7

Q: I need a true random number generator web service

I need a way to get non-deterministic random numbers on demand for my application. However i do not wish/have the capabilities to build the hardware myself, thus I'm looking for a web service which does just that. Basically I'm looking for a non-deterministic random number generator for my appl...

Terry Chia

@RоryMcCune Hmm, so marry an accountant? ;)

AviD

oh, and I have double accounting - since I am also a US citizen, so I have the pleasure of IRS on top of Israeli tax authority.

@TerryChia that's a timesink too.

Rоry McCune

@TerryChia my missus did that, so it's my job :(

Terry Chia

13:58

@RоryMcCune Hahaha!

Rоry McCune

hey @AviD only an hour to go!

AviD

o_O

Rоry McCune

@AviD till the big event!

AviD

@RоryMcCune I am confused?

Is @TerryChia becoming a man?

Adnan

Soo, here's a photo of my debugging duck driving a fire truck next to a lizard balancing on a stack of euro coins.

Rоry McCune

14:00

@AviD probably not, it was a deliberate non-sequiteur leading up to me reminding you about the MS surface event :)

AviD

@RоryMcCune ah. no clue about that. What is it?

Rоry McCune

@AviD well probably surface pro 3 + surface mini + possibly other stuff :)

events on a 4pm UK time

Terry Chia

@AviD foaas.com/thanks/terry

AviD

whoa! didnt know. v3 already??

I look forward to seeing the specs.

Terry Chia

@RоryMcCune Is MS going to have a big Surface 2 sale? ;)

Rory Alsop

14:03

@Adnan okaaaay

Rоry McCune

@TerryChia dunno, could happen , depends on how good their inventory management is I guess..

Rory Alsop

@Adnan ahh - a duplicate exists

Terry Chia

@Adnan You wanted loads of Twitter followers right?

Big Ben

@big_ben_clock, Up a tower.

The first, established November 2009 & entirely unofficial. Copyright details here: http://t.co/q8UCMopfd5, but still apparently imitated everywhere.

38.5k tweets, 441k followers, following 0 users

Rory Alsop

hahahahahahaha

deed02392

haha, that's awesome

Rоry McCune

14:18

DONG DONG DONG DONG

Tweeted by koelner_dom on May 20, 2014 at 2:00 PM

for the CET people in the room

@TerryChia you follow stefan esser don't you..

Terry Chia

@RоryMcCune Yes. :P

The jailbreak rage is pretty funny.

Rory Alsop

@RоryMcCune obviously I am too old - I cannot understand teh twitterz - that whole thing makes no sense to me. Except the Big Ben and Koelner Dom posts - they make perfect sense

AviD

@RoryAlsop yes of course you like the dong.

5

Rоry McCune

@AviD starwall bait

2

@RoryAlsop twitter == info firehose

Terry Chia

@RоryMcCune I also follow Gary Bernhardt, the TDD rage is hilarious as well.

Rоry McCune

14:28

@TerryChia you might like the lightning talk I went to at Scottish Ruby Conf then codon.com/videos/the-dhh-problem/the-dhh-problem.mp4

Terry Chia

@RоryMcCune Yeah, I saw that.

Rory Alsop

@RоryMcCune yep - too much and no filter

Rоry McCune

@TerryChia tom stuart is a bright guy, went to the workshop he did on creating TCP services from scratch

@RoryAlsop yeah they're introducing muting and hopefully more filtering will follow...

Terry Chia

@RoryAlsop Follow the right people then.

Adnan

@RoryAlsop Yeah seems like it.

Rory Alsop

14:31

@TerryChia I do

mostly

Adnan

I just don't understand why some people seem to take the subject as a personal offence.

It's not like I'm in the parliament demanding that every place should have a bidet trying to destroy the European way of life.

I'm simply asking on a public forum about this issue

which is directly related to the scope of said forum

Rory Alsop

@Adnan because most people in the world have crazy morals/ethics/hygiene/beliefs - obviously everyone should change to match mine, then the world would be a much happier place

AviD

@Adnan yeah, some people take a really shitty attitude.

Adnan

@RoryAlsop but, you see, I'm not asking people to change the way they do things

AviD

@RoryAlsop yeah, people should stop shitting on other people's beliefs.

Adnan

14:34

I'm simply asking, "Do you guys have an idea about how I can do my thing?"

@RoryA It's a bit of strawmanning of you to suggest that I even implied "everyone should change to match mine"

Terry Chia

@AviD ahem

AviD

@Adnan that's horrible, why would you say that??

Adnan

@AviD Say what?

Rory Alsop

@Adnan no no - I didn't suggest that! I was suggesting that everyone should change to match mine :-)

AviD

@Adnan "everyone should change to match yours"

Rory Alsop

14:37

No @AviD - mine

:-)

Adnan

@AviD What's wrong about giving the women of the world some long-missed satisfaction.

Rory Alsop

(until Big Bear comes along, then I'm hiding)

Adnan

@RoryAlsop Oooh, now I get what you mean. Sorry, I kind of misjudged what you said.

kalina

morning

Rоry McCune

@kalina incorrect

Adnan

14:48

Morning

kalina

...ok

Rоry McCune

@Adnan incorrect

@kalina :op

Adnan

@RоryMcCune Okay, I have to ask this. What's that smiley?

I saw you make it many times, I don't understand it

Rоry McCune

@Adnan It's a sticky out tongue smiley

kalina

I'm not around long, I just figured that since I've been sat down for multiple hours for the first time in months that I'd come say hello to some internet people

Rоry McCune

14:49

@kalina hello :) <waves>

@kalina you get a job standing up a lot?

Adnan

@RоryMcCune I thought that was ":p"

kalina

no

Rоry McCune

@Adnan I like noses in my smileys

kalina

@Adnan originally :-P

Rоry McCune

it's a bit old school I know

kalina

14:49

:o) <- big round nose

:oP

Rоry McCune

that's the one big round nose is the best

kalina

no @RоryMcCune I'm technically er

well I don't have a job

I am getting paid

quite a lot

it's all music related

I can't really give you any specifics

Rоry McCune

@kalina getting paid is good :)

@kalina you're mixing the next daft punk/pharrell track?

kalina

no, definitely haven't been paid that much

Rоry McCune

@kalina you're doing a song for Gary Barlow called "sorry I didn't pay my taxes"

kalina

14:51

no

but I do have my own creative accountant now

Rоry McCune

hmmm I'm out of ideas then

Terry Chia

@kalina You the new backup dancer for Miley Cyrus?

kalina

I'm insulted

Terry Chia

@kalina I think that's the point.

Rory Alsop

@kalina sounds very cool - you're not doing the final edit for our rockumentary, are you?

Rоry McCune

14:52

@kalina careful with dicey accountants BTW just in case that was serious, the kind of stuff they do can come back and bite you hard, years down the line...

kalina

you won't get any specifics anyway because that's not how I've rolled... ever

I am doing better than I expected

Terry Chia

@kalina But if you ever get famous, I demand a signed autograph that I can sell on ebay.

kalina

but I feel like I'm leaving part of myself behind in order to achieve it

Rоry McCune

@kalina that is true, international Internet person of mystery you

kalina

@RoryAlsop no but I have been fully briefed on my options and the ideal points in time/pre-requisite achievements to get the most out of them

and some of the options are a bit bonkers in terms of amount of effort I put in to the amount I get paid

the last few months have completely broken my view of the world

Rory Alsop

14:56

@kalina yes - it's all a bit odd isn't it.

I love the music biz - tonight I'm off to see Nine Inch Nails

kalina

@RoryAlsop compilation cds

Rory Alsop

with a friend of Trent Reznor's - which could be fun

kalina

mixing one high volume compilation cd

basically more money than most people will earn in their life time

also I have concluded that capitalism sucks

Rory Alsop

high volume = 11 ?

Terry Chia

@kalina I hear North Korea is nice this time of year.

kalina

14:59

high volume = double platinum or higher

probably just platinum tbh

Transcript for