The DMZ

Thomas Pornin

14:01

@Lighty About 153000, if we are to believe statistics.

Simon

Troll Pornin.

Lighty

facedesks

kalina

14:49

@Kisunminttu they're pretty close but you'd have to be a man to mistake them

the same could be said about @Lighty's avatar

AviD

all youse wimen look teh saem

Lighty

pff

Simon

I feel like typing a bunch of sexist stuff.

kalina

do it

Kisunminttu

@kalina Yeah I didn't really see it when I looked with my phone

Simon

14:50

No, I don't wanna go down to your level.

kalina

I'm not being sexist, I'm merely mentioning established facts

women pay more attention to the minor details

therefore we don't get confused

AviD

@Simon is this @Simon, not wanting to go down?

kalina

at least by the avatars in this instance

not in general

@Simon are you calling me short?

Simon

All I'm saying is that I like turtles.

kalina

at the moment you least expect it, I will be there, to say "boo"

Simon

14:52

Your face would be enough to scare me off.

kalina

my face would cause you to fall in love

Simon

HA!

Lighty

inlove with a hammer..

AviD

@kalina stop flirting with @Simon.

kalina

I'm not flirting with simon...

ewww

AviD

14:53

39 secs ago, by kalina

my face would cause you to fall in love

kalina

that's not flirting

that's biological field notes

Simon

You must be very desperate to flirt with me.

4

AviD

flirty flirting is flirting.

kalina

I'm just going to delete my account

AviD

hey @FEichinger! @kalina is flirting with @Simon.

3

Simon

14:54

rofl

Lighty

hehehe

plan backfires

kalina

he's totally into it, although I think when he thought threesome he thought two girls

AviD

hehe, they always do, right?

kalina

always

Simon

YOU, out of everyone, would do it with 2 dudes?

I hope you realize that would end up in a very disrespectful thing.

kalina

14:55

are you kidding

Lighty

she maybe meant the ther guy getting nailed by the guy while kalina watches while smoking weed

kalina

you must think that I am submissive

I find that very hard to believe

Lighty

hands kalina a whip

AviD

OKAAAY Imma just remind you all that there is a very thin line, and you are getting pretty darn close to it.

like @kalina and @Simon.

Simon

rofl

@AviD You're on fire today.

kalina

14:57

hifives @Simon

we broke the AviD alarm

2

AviD

@Simon Me?? Wait till you actually meet @kalina.

Simon

yay

wat

kalina

oh yeah, AviD and I met, it was hot

Lighty

AviD

@kalina ahh, young love, frolicking in the sunshine, breaking things together...

kalina

14:58

like... literally 30 degrees C and above the entire time I was there

nope, you're all still stuck on the last conversation

Lighty

this whole convo, formatted in one picture

kalina

what a waste

AviD

@kalina huh? I missed it?

kalina

still stuck on the last conversation

Iszi

@Lighty Does that lady remind anyone else of something made by Jim Henson? I can't quite put my finger on it.

kalina

14:59

I should come to accept it I guess, hanging around all you old people, of course you're slow

AviD

either way, uncool dude.

Simon

MOAR COWBELL

Lighty

i think i'll go home and rest before this place explodes from puns, sexual jokes and @AviD strangling @kalina and @Simon

Iszi

@AviD Neither. I'm talking about her face.

Simon

@AviD is strangling us? There's your threesome, @kalina.

AviD

15:00

naw thats @FEichinger business.

kalina

erotic asphyxiation

nice

AviD

heh.

Simon

I like it.

wat

Lighty

:P

killing spree

but im off now, have fun AviD

kalina

ah, the sound of AviD's alarm burning out

AviD

15:02

....

I find that euphemism highly inappropriate, in this context.

kalina

I... what?

Simon

It's really easy to offend old people, it seems.

kalina

apparently so

AviD

"highly inappropriate" != "offended".

kalina

either that or the bluntness of the conversation has left him compromised

swiftly changing subject

this cake smelt too nice

I know you're supposed to wait but I couldn't help myself

Kisunminttu

15:06

Burning your mouth with cake, @kalina ?

kalina

a little

but it's totally worth it

Simon

►

I love this track sooo much.

AviD

damn the euphemisms here are getting a bit out of hand lately.

kalina

no

euphemisms? In the DMZ?

That sounds highly unlikely

AviD

Jun 3 at 12:50, by AviD

@TerryChia heh, you just made "euphemism" into a euphemism.

kalina

15:09

oh so by euphemisms you meant penis?

AviD

heh. no.

kalina

oh, ok

Simon

@kalina This word has been coming out of your mouth quite often lately, I think you're doing it wrong.

I FORGET WORDS, HELP

kalina

I am using "penis" as a replacement word for "euphemism"

AviD

@Simon I know what you are about to say - and don't. Just don't.

kalina

15:11

what is he about to say?

you can't claim to know what he's about to say and then deny us from knowing if you were right or not

...

AviD

okay, I don't know. Either way, we are better off not hearing what it was.

kalina

it's fine, I'm bored now anyway

this conversation was not as exciting as it could have been

AviD

fine. Something useful then:

2

Coffee

Proposed Q&A site for sharing knowledge concerning brewing appliances, modifications, methods, techniques, coffee blends, roasting and grinding. Everything related to the coffee world. Coffee is pleasure and science!

Currently in commitment.

kalina

no

AviD

huh.

kalina

15:15

I don't use other SE sites

AviD

there ya go.

kalina

technically I don't use t his one either... I don't use an y SE sites

Simon

@AviD I didn't need to say more, you all got what I meant.

@AviD Coffee is soooo douchy.

kalina

hot coffee

I prefer tea when I am high

FEichinger

15:55

@AviD Ah, I'm not worried. She's just playing with him.

AviD

"him" == @Simon or @FEichinger?

probably both.

FEichinger

@AviD Tsk!

AviD

Hey, we've all been there.

Weeelll, I haven't, but I'm sure most have been.

Weeellll, not @RoryAlsop, I'm sure.

Weeelll, @Adnan was probably there, but on the other side of things.

FEichinger

>.>

Simon

wat

Simon

16:20

Time to listen to blink-182's Greatest Hits.

Xander

16:33

@Simon Blink-182 had hits? Plural? Or even a hit for that matter?

David Freitag

@Xander You wouldn't understand. Your generation never does.

Simon

^ Well said.

Xander

@DavidFreitag Oh well. I guess it's all fine, just so long as you kids stay off my lawn.

Simon

That I cannot promise.

Xander

I'm really not that old. I don't even have kids as old as you are.

David Freitag

16:37

@Xander That's not the point.

You were probably around my age when their music was getting popular, and that is the point.

Xander

@DavidFreitag Huh. Will you look at that. They've sold 35 million albums. Who knew?

Simon

At least 35M people.

Xander

@Simon To be perfectly pedantic, 35 million people each knew that they had sold at least 1 album.

David Freitag

@Xander I bet 99% were to people that are my age. The last 1% or so was people lost on iTunes.

Xander

@DavidFreitag That is a distinct possibility.

David Freitag

16:48

@Xander For me, at least, Blink-182 is pure nostalgia.

Xander

@DavidFreitag Ah, that makes sense.

Adnan

@AviD Yeah, you know me.. I like being on the other side.

David Freitag

It's by no means good. But every now and then if i catch the hint of one of their songs I get nostalgic and go on a week long binge.

Simon

@DavidFreitag Yuuuuup. You gotta be careful with those songs, nostalgia can you hit you real hard.

Thing is I don't much of those days, except the simplicity and that's quite something.

David Freitag

@Simon Heh, it's funny. My memory is seriously borked. I don't remember anything from back then, but yet I still get nostalgic.

Simon

16:54

I know, it's pretty much the same for me too.

Xander

@DavidFreitag Sure. I feel the same way about early Depeche Mode, and Sir-Mix-a-Lot.

Simon

I just remember the vibe.

David Freitag

It seems like knowing that something happened instead of remembering what happened is good enough.

Simon

Will I dare to listen to Sum 41? We'll see.

And if I'm crazy enough, there will be some The Offspring

schroeder

17:10

I had a phone interview yesterday. I fit their needs exactly, and I have the qualifications and experience they are looking for. Even I thought it would be a great fit

They asked how much salary I was expected and I told them what I was being paid now, and they choked

they were hoping to pay half of what I am getting paid now

they shut down the intrview right then and there because they had no intention of even trying to compete with my salary

according to all industry metrics, I'm in the middle of the expected range ....

I'm seeing a lot of job postings where they want an advanced IT sec pro, but offering peanuts

perhaps the 'IT Sec worker shortage' is created by employers?

I could make more money programming, and I am FAR from a programmer

What's going on with employers out there?

Rоry McCune

17:47

@schroeder yeah in my opinion "shortage" means "shortage at the salaries we're offering"

Don't know about other parts of sec. but I'm seeing day rates for testing be around the same for that last 10 years so down in real terms

heck my time got charged out higher when I was an IT consultant 15 years ago!

Rory Alsop

I reckon testing will split significantly out into those who are CBEST, CREST etc and those who do commodity testing

schroeder

@RоryMcCune It seems to me that when you are writing company policy, presenting reports directly to senior management, and acting as the sentinel against the invading hordes, one should be paid more than an entry-level programmer

Rоry McCune

@schroeder you would like to think wouldn't you. Consultancy is better in that sec. cons is v. heavily dependent on the staff (well for boutiques anyway) but corp is less good

@RoryAlsop yeah there's already been a split of some ex-testers in to inc. response/forensics, and CBEST will pull people off into red-teaming and the like. Will be interesting to see if there start being mandatory experience/qual req. for testers to call themselves testers...

@RoryAlsop BTW saw the nice bit of Sec.SE advertising in the Daily Record :)

schroeder

18:03

@RоryMcCune know any sec cons hiring in the UK? :)

Rоry McCune

@schroeder probably most of them :) Cigital will be I reckon, if you like software security

Thomas Pornin

@schroeder My opinion is that if programming was not entrusted to "entry-level" programmers, we would be better off against invading hordes.

3

Rоry McCune

@schroeder if you're into testing, NCC are always hiring

and I'll bet the other uk large consultancies will be too

@schroeder and ioactive that's another one to look at in London

schroeder

@RоryMcCune looking at all these now

Robert Harvey

Since all browsers and web servers use port 80 to communicate on, there's an underlying system that sorts out the traffic between different machines on the same Local Area Network. Does anyone know what that process is called?

Rоry McCune

18:10

@schroeder ok so if you want some other names who I know of and seem quite good (i.e. I know people who work there who are good and seem to enjoy it) Portcullis security (who employ @polynomial amongst others) Context IS, MWR Security. There's also the Big-4 (EY/PWC/KPMG/Deloittes) but if I'm honest I wouldn't recommend them :)

@RobertHarvey Switching, ARP ?

schroeder

@RobertHarvey networking layer: IP addresses

Robert Harvey

How does the web server know which local IP address it is communicating with?

Or is it a local TCP port?

schroeder

@RobertHarvey the sender IP is included in the packet

Robert Harvey

So when I do a POST in my browser, the local IP goes along with it to the remote web server?

So that it knows who to respond to?

schroeder

@RobertHarvey unless overwritten by a service along the way

@RobertHarvey there is also the x-forwarded-for process in http that can trace back to the origin

Robert Harvey

18:14

OK. For some reason I thought the router held a table that translated web requests into local traffic.

schroeder

@RobertHarvey it does - but what do you mean by 'local traffic' ?

David Freitag

@RobertHarvey Depends on how it's configured. Usually you have an NAPT router which does network address and port translation.

Robert Harvey

On a network utilizing NAT, a web server would see everyone at the same IP address.

So there is some sort of disambiguation that occurs.

kalina

Bored

bored

David Freitag

It's why if you take two computers connected to the same external facing router and go to whatismyip.com the external ip should be the same.

kalina

18:17

B0r3D

Boooooooooo...

...reeeeeeeeeed

David Freitag

@kalina Compose one of those million ideas you have floating around so I can listen to it.

Thomas Pornin

@RobertHarvey Oh, you ask for NAT ?

kalina

Blah

Thomas Pornin

In a TCP connection, there are two ports. The one on the server side will be 80.

The NATting router will use the other one for disambiguation.

Namely, when client 1 talks to external server on port 80, the NAT router modifies the outgoing packets to use the router IP as source address, and 5001 as client-side port.

The router remembers that "5001" is "connection from client 1"

If client 2 opens a connection, the NAT router will use port 5002.

and so on

Robert Harvey

Would that be considered Port Forwarding, or is that something else?

David Freitag

18:20

Thomas Pornin

we usually use the term "Port Forwarding" for the other direction: to keep a server on the local network, reachable from the outside.

Robert Harvey

OK. And it doesn't have to be a web browser, right? Any internal computer that originates a connection to any external resource would maintain a connection through the router in the same fashion?

Thomas Pornin

@RobertHarvey NAT works for TCP (and for UDP), regardless of what goes into the packets.

Some routers, though, are configured to do NAT only for some specific ports, because the sysadmin believes that punishing users is a good way to win their friendship and cooperation.

2

Robert Harvey

So basically the router keeps a pool of ports for this purpose, presumably releasing a given port after some period of inactivity?

Xander

@RobertHarvey You can believe @ThomasPornin's story if you like. Or you can believe (as I like to) that each router comes with a little man inside, whose job is to stand there and wait for packets to come pouring in through the WAN port, catch each one, then fling it back out the correct port on the LAN side. Replace "little man" with "invisible faerie" if you're using WiFi.

Rоry McCune

18:26

@ThomasPornin I thought that was because all those other ports were insecure and only HTTP(S) could be trusted?

AJ Henderson

@ThomasPornin well the average user will just know it doesn't work and then the sysadmin will be their hero when they make it work

Thomas Pornin

@RobertHarvey Yes. Keeping the pool size under control is the main reason why routers kill off inactive TCP connections.

Robert Harvey

@Xander That's as good a theory as any. I'm personally fond of pixie dust.

@ThomasPornin Thanks. The Wikipedia article on NAT is fairly opaque.

AJ Henderson

NAT is a fun concept. Not too hard once you understand it, but can be tricky to get to that point

kind of like SSL

Robert Harvey

So I've learned three things today. I've learned a little bit about NAT, some sysadmins get bored with conversations about fundamentals, and other sysadmins prefer pixie dust to accomplish their work.

3

AviD

18:52

@schroeder @RоryMcCune the shortage isnt in the workers, its a shortage of talent.

and for that matter, there is a shortage of good places to work.

Interesting how those two facts complement each other.

Rоry McCune

@AviD ah yes but in market theory, that shortage would drive up the salarys paid to talented people, drawing them in from other lines of work.....

@AviD I've always thought the quality/env is quite a bit more important than flat salary

I have seen some companies who get that

testing companies mainly

AviD

@RоryMcCune no, because see my point#2: they dont understand talent, and dont know how to draw it in.

@RоryMcCune oh absolutely - but it often goes together, with few exceptions.

bad places to work will usually not appreciate talent, and refuse to pay the appropriate premium - or even a decent salary range, for that matter.

and great places to work will appreciate that, and budget allowing, will pay a premium for real talent.

Rоry McCune

@AviD so broken market then. Yeah I'd agree with that trying to get buyers to differentiate on anything bar cost is tricky..

AviD

the employment market really is so broken. I still see them pretending they are doing a favor by bothering to interview you.

Rоry McCune

@AviD heh

AviD

18:59

@RoryAlsop I would say a 3-way split: commodity / certified / high-end. At the higher end, you would want to pay for real innovative quality, not just an "okay we tested you". Of course those markets that are regulated are not relevant to this...

Rоry McCune

@AviD yeah with CBEST as (i'd expect) it'll be live testing of critical production banking systems, the cost will need to be a lot higher to offset the risk if nothing else...

AviD

@RоryMcCune thats a good point, risk + insurance + certification fees... but there is another, high end market that slides past the banking systems and need for government regulation, around e.g. tech companies and such.

those are also usually a better judge of quality, so they dont need the certs...

Rоry McCune

@AviD yeah, you'd hope that all these $billion companies who totally rely on the security of their websites would have a lot of testing being done.......

AviD

@RоryMcCune well not WhatsApp. but most of the others...

Thomas Pornin

@RоryMcCune Tests ? Who needs tests ? There are end-users for that.

Rоry McCune

19:04

@AviD poss. although with a lot of them you'd never know it from their websites and the quality/amount of security info. they put up there...

AviD

true

kalina

doooooooooooooooooommmmmeed

Rоry McCune

►

?

kalina

... No

David Freitag

19:19

@RоryMcCune More like Bender.

AviD

@kalina more like that?

David Freitag

More like that

schroeder

20:01

Here's an odd networking issue: Users going through load balancer and using TLSv1 end up with tons of retries, but users who connect directly to web server do not. Users through the LB using SSLv3 do not get retries. LB is performing ssl off-loading. Am I looking at broken TLSv1 implementation on LB?

Lucas Kauffman

A surgeon went to check on his patient after an operation.
"You'll be fine," he said.
She asked ...
“How long will it be before I am able to have a normal sex life again doctor?"
The surgeon seemed to pause, and a small tear ran down his cheek from the corner of his eye, which alarmed the girl.
"What's the matter Doctor? I will be all right, won't I?"
He replied ...
“Yes, you'll be fine. It's just that no one has ever asked me that after having their tonsils out."

6

schroeder

lol

Xander

21:29

And, I learn something valuable from Twitter tonight.