The DMZ

Terry Chia

12:01

@RоryMcCune The infosec world is a small one huh?

Rоry McCune

@TerryChia in the UK pretty much. Once you've been around for a while you end up being 2nd or 3rd connections with pretty much all of it I'd guess... That said I'm sure the same must go for Singapore?

Terry Chia

@RоryMcCune I think so yes. I always see the same faces around cons.

AviD

@TerryChia cue @Simon talking about his anatomy being a small one.

dammit, okay its not @Adnan's fault, its the damn accounting.

good part is I'm almost done for the year.

@RоryMcCune same in Israel, but on the other hand not just - it is the same (to a lesser extent) around EU, US, etc....

Global economy FTW!

Adnan

@AviD That's it? You'll kill yourself this year?

Maan, we're gonna miss you

You and your "asking girls about their underage sex stories" moments.

AviD

@Adnan hehe, noooo

but I'm getting close to it.

Kisunminttu

12:15

@Adnan , the skirt I made is indecently short

AviD

it just keeps getting more complicated, every year... thanks to the IRS to a large extent.

@Adnan wait, what?

never mind, please do not link something I said out of context.

Adnan

@AviD I won't link to it, and no it's not out of context.

@Kisunminttu Pic?

(Of the skirt! Not of you in the skirt)

AviD

@Adnan oh yeah baby!!

hehe

deed02392

@AviD Ta!

Kisunminttu

@Adnan I'm still in the finishing stages with it

deed02392

12:17

@RоryMcCune Oooh, you've met?

Adnan

@Kisunminttu Pic pic pic

Rоry McCune

@deed02392 colin? yep indeed :)

Kisunminttu

@Adnan oota hetki

deed02392

Haha, shall I tell him you said hi?

Adnan

@RоryMcCune God damn! The infosec world indeed very small.

AviD

12:20

@Adnan @RоryMcCune I think its not just that - infosec is a very consultant-heavy field, meaning lots of people moving around a lot.

Rоry McCune

@deed02392 please do :)

Adnan

@AviD and some important official bodies were people meet

AviD

so instead of knowing on average people from one company every two years, you are more likely to get familiar with half a dozen companies per year, at least.

Adnan

I'm remembering how surprised I was that @RoryA knew someone in Finland in a company to which I was applying

deed02392

@Adnan Members of the office I'm joining were in Finland recently, maybe I'll be able to visit you some time

AviD

12:21

or not so familiar with 2 dozen companies per year.

deed02392

or maybe we'll work together!

Adnan

@deed02392 Sweet! I'm moving to a bigger apartment next week, so you'll have a place to crash

You know, if your fancy company doesn't put you in a fancy hotel :D

deed02392

Oo nice, and you can help me out with good Finnish beer and salmiakki

Adnan

@deed02392 and girls. I can help you with Finnish girls

They're much more delicious than Salmiakki, and definitely more delicious than Finnish beer.

deed02392

muahaha

well I need plenty of help on that front

Adnan

12:24

@deed02392 I don't think you do.

(see? see? Covert compliments. Works with the ladies as well)

deed02392

haha

Adnan

@Kisu 'sup?

deed02392

I'm learning I'm learning

woah, lightening and thunder

i feel like I should take the earphones out from my metal bodied laptop...

Kisunminttu

@Adnan I'll send it on whatsapp...

Terry Chia

Silicon Valley is a pretty good series. Anyone else watching it?

Adnan

12:26

@Kisunminttu Nah, send it here. More saucy for the peeps here.

@deed02392 Don't. Extra job opening for me :D

Kisunminttu

@Adnan It's still on its way to my email. Having an old phone is making this a bit difficult :)

deed02392

@Adnan Lol never realised this was such a cut-throat industry

Rory Alsop

@TerryChia they are awful. They just don't work the way every decent trackpad works

Adnan

@TerryChia Let me guess, it's about a bunch of geeky dudes who grew up to be assholes and started patent-trolling each others?

Terry Chia

@Adnan Geeky dudes check. Assholes check. Patent trolling, not so far.

CodesInChaos

12:28

@LucasKauffman Are there unpatched local privilege escalation exploits?

Rory Alsop

@TerryChia Ahh - well, I had the 'luck' to end up managing testers. Which meant I never got bored of testing. However, I got very jealous...

@RоryMcCune true. Everything is fun until I'm dead (some restrictions apply)

Terry Chia

@RoryAlsop Do tell.

Rory Alsop

@deed02392 Congratulations. I may end up being a client of yours :-)

deed02392

@RoryAlsop Thanks! Oh really?

Adnan

@CodesInChaos On the OSCP machines? Yes. Lots of them. At least I've encountered a few in the lab

Rory Alsop

12:32

@deed02392 seems relatively likely

deed02392

@RoryAlsop What's the project/where is it?

Rory Alsop

@TerryChia sadly no. They are in my memoirs (still in draft until I'm exceptionally old...er)

@deed02392 No project. Just generally. We use a million pen testers, so y'know

deed02392

Ahh I see. Well I'll be on probation for 6 months, I might see you but I'll only be a shadow

exhales slowly

AviD

@deed02392 breathing heavily in your ear

Terry Chia

@RoryAlsop I expect a signed copy.

deed02392

12:34

@AviD ..the warmth

AviD

@RoryAlsop hmm, need upstream, non-pentesting, consultants too? ;-)

deed02392

@AviD and moistness

2

Terry Chia

Talking about signed copies, I seem to remember @Poly promising us copies of his book if he ever gets done with it. :P

I wonder how he is doing with that.

deed02392

I've got a signed copy of OpenSSL Cookbook

thanks to Qualys, which you reminded me of earlier @TerryChia

Terry Chia

@deed02392 That's a thing?

Rory Alsop

12:35

I now have a signed, personalised copy of Grant Morrison's 'Happy'

very, very cool

deed02392

@TerryChia Ivan Ristic

Rory Alsop

@AviD on occasion, yes

but tricky if you aren't on the preferred supplier list

CodesInChaos

@Adnan So patches for those vulnerabilities are available, but were deliberately not installed on those machines?

AviD

@RoryAlsop well you have my number ;-)

deed02392

I was there when we got a 'sexy spoon' signed by Lawrence Lewellyn-bowen. My mum asked decorating questions. It was embarrassing.

Adnan

12:36

@CodesInChaos The whole idea is to simulate a pen-testing environment

AviD

@RoryAlsop yeah true, I've seen that other places as well. nervmind then, I guess

Adnan

@Codes How would you train on using exploits if there are no known vulns to exploit?

deed02392

Yeah @Codes, God.

Terry Chia

@Adnan You give them a fully patched machine and get the participants to write zero days for you.

deed02392

@TerryChia But it doesn't have much useful to you really, except a little jig on the syntax for defining cipher preference. That's why I didn't mention it before

Terry Chia

12:38

@deed02392 It looks like that's about the openssl command line?

Yeah, not that useful to me.

deed02392

Yeah, exactly

Adnan

@TerryChia Well then it's not a Offensive Security Certified Pen-tester, it becomes Offensive Security Certified Security Researcher and Everything Else (OSCSREE)

deed02392

In fairness this is just the first few chapters of the yet-to-be-released book

Terry Chia

@Adnan No no no, you don't tell them that. :P

You are just making use of them remember?

Adnan

@TerryChia and then news get out that almost nobody passes your course.

The idea is to have your cert difficult enough to be sought after, but not too difficult that nobody wants to pay.

deed02392

12:46

anyone attending the Mandiant webinar on cyber governance?

Kisunminttu

Finally!

Lighty

pretty o.o

deed02392

@Kisunminttu, what's that for?

AviD

@Lighty @Kisunminttu I would tend to agree, but its hard to tell without seeing it ON you.

deed02392

Damn, that was a stupid question

AviD

12:52

</pervy>

Kisunminttu

@Lighty Thanks :)

AviD

actually thats a nice pattern, and I like the cut.

FEichinger

@AviD Tsk, tsk, tsk. Push further.

Also: Afternoon, folks.

Kisunminttu

@AviD I think that this skirt is only for @Adnan to see on me, because as I stated earlier, it is short

deed02392

@Kisunminttu Is it terrible weather there too right now?

the lighting is like it's an overcast day outside

AviD

12:54

hehe

Kisunminttu

@deed02392 The weather is awesome here! We had a lightning storm last week

deed02392

Oh man, I'm jealous. I have to cycle in possibly a lightening storm in a couple hours

Lighty

@adnan is one lucky guy ^^

Adnan

@Kisunminttu Oh wow. Send me a pic with you in it on WhatsApp

Damn! I really like skirts on you!

AviD

@Adnan no no, share it here - more saucy

2

Kisunminttu

12:56

@Adnan Mind if I do that in a bit? It's full of needles now because I'm finishing up the hemline and I need to be in the laundry room in 4 minutes... :D

@Adnan That's why I'm making a few :*

Rory Alsop

@AviD there are always ways. some effort required. If it looks possible I have your number :-)

FEichinger

@AviD It's not like "it's only for @Adnan" would really stop them from sharing it here either.

Adnan

@Kisunminttu Yeah, no problem.

@AviD Naah, probably too saucy for the Internet.

AviD

@FEichinger hehe, true.

@Adnan whaaat? no such thing!

FEichinger

"too saucy for the Internet" is inherently impossible.

I mean, there's porn next door. And the door after that. And the one after that.

Adnan

12:59

@FEichinger I'll rephrase: I wouldn't like photos of my girlfriend in that very short skirt floating around the Internet

AviD

clearly you've never watched "The Girl Next Door".

Lighty

i have a picture of my girlfreind on the internet, naked... and hawt: img2.wikia.nocookie.net/__cb20140321193607/…

i bet @AviD is the first one clicking that

Rory Alsop

I dread to think...

AviD

@Adnan would it help if I made you a private room for that? ;-)

@Lighty hahaha

@Lighty it says potato...

FEichinger

@AviD "you" ... Right.

Adnan

13:01

@AviD Yes yes, where only me and her and 200 other mods are there.

AviD

@Adnan and dont forget the 80 SE staff.

Lighty

and the NSA

AviD

►

Lighty

because i like old and hated jokes

FEichinger

@Adnan Actually... Since we have 120 sites now, it would be around 360 mods.

Adnan

13:02

Well, so there's that.

and we all know how trusted and decent people 100% of the SE mods are.

Especially @AviD

AviD

hehe

FEichinger

A short check of the moderator list reveals, it's even HTTP: Payment Required!

Lighty

i think im going home early, i don't feel well X.x

Adnan

@Lighty Oh, sweetness. What's wrong?

AviD

btw the sound of that vid is NSFW

FEichinger

13:05

(I never knew there was a "Payment Required" HTTP status code ... Go figure.)

Lighty

i have no idea, i somehow for totally no reason feel like, well, crap, you know, like pressure on chest, trouble breathing well

i need some fresh air

Adnan

@FEichinger Just learned that

Hey, @AviD wanna see @Kisu's pic in that skirt?

402

Terry Chia

@FEichinger I don't think that's standardized is it?

Adnan

Hehehehe

@TerryChia w3.org/Protocols/rfc2616/rfc2616-sec10.html Ctrl+F 402

FEichinger

@TerryChia It is. iana.org/assignments/http-status-codes/http-status-codes.xhtml

Adnan

13:06

> This code is reserved for future use.

Rory Alsop

@FEichinger maybe less - some of us mod a couple of sites :-)

AviD

@RoryAlsop but there more sites that have more than 3...

Terry Chia

@Adnan Ah yes, I meant to say "actually used for payment required" stuff.

Rory Alsop

@AviD true

Adnan

@TerryChia I don't know, you'll have to ask @AviD. I'm sure he frequents such sites.

AviD

13:07

heh

FEichinger

@RoryAlsop No, exactly that many.

stackexchange.com/about/moderators?by=users

> document.querySelectorAll(".mods-item")

> NodeList[402]

Rory Alsop

@AviD - was just looking at the admin page. I'm definitely the bad guy and you are the good guy (comments and posts deleted vs posts edited)

AviD

hahaha

Or I am the lazy one, and you are the one that actually takes action

Rory Alsop

@AviD nonon - look at your edits

twice as many as me

AviD

will do, soon

oh? You're catching up. It used to be 3.5 times as many ;-)

Adnan

13:21

Whoa! You guys have so many edits

I'm only 435 :(

Terry Chia

@Adnan That's probably 3 times what I have.

My site participation kinda crapped out.

Adnan

Yeah, why?

Terry Chia

@Adnan Got bored mostly.

FEichinger

@Adnan Damn, you're old.

Adnan

Who am I to talk. I've written only 2-3 answers in the last 2 months

@FEich not as old as @RoryA

Nobody is

Terry Chia

13:24

There really isn't any motivation past 20k rep.

Adnan

I hate mobile chat!

But I guess it would be too weird to take the laptop to the restroom

AviD

Whoa. @RoryAlsop @JeffFerland remember @GrahamLee? yknow, the ex-moderator that @JeffFerland replaced... looks like he's joining Facebook too.

hmm, maybe he's looking for some payback to @JeffFerland... ;-)

Adnan

@AviD I guess I should do the same.

Depends on if they still have that master password thing

Rory Alsop

@TerryChia badges. steenking badges

@AviD I've missed him

Simon

@RoryAlsop I missed you too xox

Rory Alsop

13:45

@Simon lol

Rоry McCune

@AviD you haven't seen the process to get on their preferred supplier list, I've seen one back in the day, trust me you don't want none of that

@AviD heh he was at the Ruby Conf I was at last week

Scott Pack

Wait. Graham is getting sized for jackboots?

AviD

@RоryMcCune oh I can imagine. Seen it other similar places.

at times I've subcontracted through an Approved Supplier to skip that process....

Rоry McCune

@AviD the amusingly evil bit was where they made all their pen test suppliers go through a reverse auction process where they could see who had the cheapest rates and had a period of time (an hour or so) to consider lowering them

AviD

heh, I'm not surprised.

I usually raise my rates in situations like that.

I figure if I have to work with these Godzilla corporate types, it should be worth my while.

Rоry McCune

13:56

@AviD yeah but you're not a sales guy, they get very jumpy at the idea of being the most expensive people in a CfP situation...

AviD

I've never lost a project I wanted because my rates were higher than (almost) anybody else. Either its worth it to them to pay for quality, or I wouldnt want to work for low-quality anyway.

@RоryMcCune oh yeah, I know - I've had to work with them.

Terry Chia

“I’m an engineer”, “That’s nice dear. Planes? Cars? Buildings?”, “Erm…I mostly just use jQuery to build websites”. Engineer™

Tweeted by iamdevloper on May 22, 2014 at 1:54 PM

AviD

got tired of fighting them to keep our proposal sane and quality, one of the reasons I left the company and went independent.

Rоry McCune

@AviD heh yeah 1st party work is nice from that perspective..

AviD

actually, not fighting them, got tired of this conversation:
Sales guy: "Great news, the client approved the project for X hours!"
Me: "Okay, I'm doing it in 2X, like in the original proposal."
Sales: "no no, we only have X hours, any more than that and its not profitable enough".
Me: "Okay, I'm doing it in 2X, like in the original proposal."
*repeat...*

Rory Alsop

14:00

@RоryMcCune As a buyer now - I still dislike the reverse auction. It doesn't drive quality and assurance. So it is incredibly difficult to get the team you want to use.

@AviD excellent! That is my favourite way :-)

stick to your guns

Rоry McCune

@RoryAlsop yeah procurement like them 'cause it shows their value add, but I'm much more skeptical..

Rory Alsop

@RоryMcCune procurement (in some hypothetical orgs) utterly destroy assurance

by focusing on their KPI's, not the important factor of Securing the org

AviD

@RoryAlsop its not even negotiable - I already gave them the minimum amount of time I need to do the job at an acceptable quality.

Rоry McCune

@RoryAlsop this... does not surprise me :op

AviD

I could do the whole padding thing, 2*X + 10, but I dont play that game.

@RoryAlsop sure. it is a nice idea when it applies to raw materials, when the product is effectively identical.

or e.g. cleaning staff.

Terry Chia

14:03

@AviD That's jobist.

AviD

but when there is such a huge range of quality, and easily fungible content and scope, its ridiculous and destructive.

TildalWave

What's the easiest way to clean a George Foreman?

Terry Chia

@TildalWave A shower.

TildalWave

@TerryChia It's OK if the electric part gets wet? I just dry it and it's ready to go?

Terry Chia

@TildalWave I am joking.

TildalWave

14:07

@TerryChia well dunno, it might me an option actually, not while on grid of course LOL

Simon

Oh yeah, what's up with people calling themselves Engineer when they don't even have a degree in engineering?

TildalWave

it can't be much more than a simple induction cooker, can it?

Terry Chia

@Simon It's better than "Javascript ninja".

Simon

I guess.

TildalWave

@Simon I prefer calling myself an architect :)

Simon

14:09

Personally, I like to be professionally referred to as a pirate.

TildalWave

Having some past experience with straight out criminal incompetence, I should probably upgrade my status to "God" :D

or "the son of ..." :))

Scott Pack

@TildalWave Paper towel. Just wipe it down.

TildalWave

@ScottPack it's kinda old, and greasy ... there's no way to go about it in some more "industrial" way?

sand blasting? :D

Scott Pack

You can try soapy water or some such.

I'd say as a first step just get it hot and wipe it down with a wet paper towel.

TildalWave

@ScottPack OK, I'll do that then, thanks! I just thought I could have some proper fun with it, soapy water and paper towels sounds like effort ...

Scott Pack

14:18

The cooking surface is designed to be non-stick enough such that cleaning is wipe off

Terry Chia

@TildalWave Sounds like @AviD.

TildalWave

@TerryChia hehe

@ScottPack so you're saying I should get off my ass and give it a good wipe? :D

4

Terry Chia

@TildalWave I seem to recall that @Adnan thinks you should use water as well.

Adnan

@TerryChia I use water. You guys can use whatever you want.

AviD

@ScottPack are we still talking about the grill...?

1

Q: Why was this question migrated to SO?

So I happened to be browsing SO, and came across this question. As it deals more with abstract security principles and trust models than with a specific programming problem, it looked to me like a potential candidate for migration to security.SE. That is, until I noticed the banner below the qu...

@RoryAlsop @ScottPack I kinda agree with him....

That Brazilian Guy

14:32

I tried to SSH into a server and got this message:

> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
[redacted].
Please contact your system administrator.
Add correct host key in /home/[redacted]/.ssh/known_hosts to get rid of this message.

Should I worry?

Rоry McCune

translate.google.com/#ja/en......................

6

try entering a series of dots and clicking the listen button on the japanese side

Simon

@RоryMcCune LOL

I'm gonna make a track out of this.

Terry Chia

@RоryMcCune That. Is. Awesome.

FEichinger

@RоryMcCune I ... I think I could listen to that all day.

Rоry McCune

all it needs is a bass line and I'm sure someone could make that a dance hit

paging @Kalina

Scott Pack

14:37

@TildalWave Make sure it's nice and moist first.

Adnan

@RоryMcCune How dare you?! :O

FEichinger

@RоryMcCune She's unavailable right now, I'm afraid.

Simon

@FEichinger You're unavailable.

FEichinger

Your face is ... You know what, no, I cba.

Rоry McCune

@FEichinger aww well you can relay the request, I want a writing credit on it when she releases it tho'

Adnan

14:39

@ThatBrazilianGuy Contact the server's admin and ask whether the RSA key has changed. If yes, verify the new fingerprint with him.

Rоry McCune

@Adnan whaat that's a legitimate reason to page her

Simon

She won't release shit. Drug addicts don't get things done.

FEichinger

@RоryMcCune She'll get the ping, so I guess she'll see it at some point.

Adnan

@ThatBrazilianGuy If the new fingerprint matches the one given to you by the server's admin, then all good and it's normal.

Actually, the error message basically says that.

That Brazilian Guy

@Adnan Will try. Thanks.

Rory Alsop

14:43

@AviD hmmmmm - I saw the flag and agreed enough to migrate it. The question looks different to how it was earlier - some edits have ensued...I think I now agree

TildalWave

@ScottPack heh :) finished, it's all nice and shiny like new... took about 15 minutes but it wen't OK with a strong winegar, a plastic mesh, towels to wipe it off and a lick of oil for the finish

5

damn who starred this?

Rory Alsop

@TildalWave :-)

Scott Pack

=D

TildalWave

bastards! :))

Simon

D=

TildalWave

14:49

I was still talking about a George Foreman grill :P

Scott Pack

I use white vinegar frequently for cleaning purposes.

AviD

@TildalWave shuuuure ya were ;-)

TildalWave

yup that's the one I used

AviD

@ScottPack doesnt it make ya feel all tingly....?

TildalWave

@AviD man, it's going on summer, a clean George Foreman is just as important as foreplay :P

Simon

14:50

Learning Symfony2 is kind of an exhaustive task but I can already see the benefits of using it.

Terry Chia

@Simon Or you know.. learn something that isn't PHP. :P

FEichinger

@TerryChia That would be better for everyone involved

Scott Pack

@AviD You just have to be careful. A 1:1 mix of boiling water and vinegar isn't something you want to put your face over.

Simon

@TerryChia I would have gladly learned Python with django instead but I don't get to choose.

it's for le work

AviD

@ScottPack wasn't talking about your face...

Rory Alsop

15:05

> wasn't talking about your face ...

AviD

so weird. I've been getting the audible ping from chat a minute or two late. Something's fikky with Chrome...

Rory Alsop

@AviD sounds like a Finnish word

Kisunminttu

@RoryAlsop As a Finn I find the word in question to have more of a Norwegian tone to it. :P

AviD

2

Rory Alsop

@Kisunminttu I stand corrected :-)

Simon

15:18

@Kisunminttu I bought Drink The Sea ^^

Kisunminttu

@Simon That's great, so glad you liked it :) The last album I bought was from Parov Stelar, very groovy music.

Adnan

It's so freaking hot!!!

It's 25C!

@Kisu We need an AC

Kisunminttu

@Adnan Nope, I have my skirt, I'm good 8)

Adnan

@Kisunminttu I don't think you have an AC under your skirt.

I've thoroughly researched that area.

Scott Pack

Skirts are much more cooling than pants.

AviD

15:32

@Kisunminttu I have a feeling that your skirt will just raise @Adnan's temperature even further.

Adnan

@AviD That's a good one

Kisunminttu

@AviD Hehe :D

AviD

that said, I would prefer @Adnan not going into such detail.

Adnan

@AviD Are you sure?

Kisunminttu

@Adnan I'm currently trying to find out how much that cooling thing costs, the one that I told you about.

AviD

15:33

@Adnan hey, I specified you going into detail. if @Kisunminttu wants to send pics of her skirt, well that's a different story altogether.

Simon

@AviD Man, you're a real creep.

AviD

►

FEichinger

@Simon Says the person talking about his dick every day, just to validate its existance.

3

Simon

@FEichinger Send me a pic of your skirt.

FEichinger

I'm afraid I cannot do that.

Adnan

15:40

@Simon I can send you a pic of my skirt

Simon

@Adnan That'll do.

David Freitag

@TerryChia Since i have less than an hour's worth of experience with either of them, I would say yes - even those two i would prefer over Objective-C.