The DMZ

Adnan

03:05

This is taken from the "Secure Development Guide" for a big application by a gigantic company. The application can (and does) handle power stations, railway switchboard, trains, wind turbines, etc.

TildalWave

→ 1 message moved to Trashcan

@Adnan you need something else annihilated? :)

Adnan

03:36

@Tildal Thanks a lot

TildalWave

@Adnan sure

Terry Chia

04:47

TIL: Good random number generation is hard in PHP, so Wordpress HTTP GETs random salt from http://wordpress.org. https://github.com/WordPress/WordPress/blob/fd838ccb2b1d37bda02eecdf09c324863f050812/wp-admin/setup-config.php#L211

Tweeted by garybernhardt on June 20, 2014 at 9:49 PM

Wait WTF?

TildalWave

@TerryChia it's early here ... is that bad?

> define('AUTH_KEY', 'akrK9Mt?daanGQ9,g`+Ci>XoSn7Ntkky[8C}cg-@Pcs&X| !@)$Q4eBso1XAv;oi');
define('SECURE_AUTH_KEY', 'D%4/]#x@elT0!YVU+3HSZ&n&YOt~&+9e+sTg%;|>`TsF($(Z KKspiJ017`%`1](');
define('LOGGED_IN_KEY', '$<g0:wz.M|PT[H`*cKdp}8SCE{DdKaFsX-+jR3]Ii5zNj=U]O=<{9zw8j<{e=J9z');
define('NONCE_KEY', '$W$rsB`r@(-~Zo|eiqLRCU[E};cuS8`48kocEfJ.$=p){|lriQa?1HZ7StSV6e]J');
define('AUTH_SALT', '[gv-g$on>*X +0X:{C+dbs`;V`O<&+eJ;Wx?_cnoNZ>Vd|<EJY*]wh[5#pDM%MV~');
define('SECURE_AUTH_SALT', 'K4Y}.*f|)R<H<D=87hO87;X<AjbfvEs}E8ej),u-G$nIn{{jGKyEI<5}MGnJ6~qn');

Terry Chia

@TildalWave Wordpress generates salts by sending a GET to a remote URL instead of generating one locally with a CSPRNG. So yes, that's terrible.

TildalWave

@TerryChia you mean because it can be intercepted? or ... ?

ah OK yes ... sorry, slowly waking up still

Terry Chia

@TildalWave Because the idea that my local installation of Wordpress has to rely on a remote service for salt generation is terrible.

TildalWave

@TerryChia The idea of using Wordpress for anything isn't terrible enough?

Terry Chia

04:58

@TildalWave It's just another level of terrible.

TildalWave

man, you realize it would probably take you less time to write whatever you have it setup to do for you yourself and do that properly?

Adnan

06:04

Well, this is a new one for me. WiFi on the airplane

Terry Chia

@Adnan I have been on one or two flights with WiFi. Isn't it crazy expensive though?

Lucas Kauffman

07:04

lol wat

Terry Chia

@LucasKauffman wat?

Lucas Kauffman

the wordpress thingy

that's really funny

Terry Chia

@LucasKauffman Ah. Terrible isn't it?

Lucas Kauffman

@TerryChia I'm not really sure why they do it and even if you would need such a feature, it would be better to be able to opt in rather than ou

tt

Terry Chia

@LucasKauffman Because generating random data locally is a terribly difficult thing to do!

Lucas Kauffman

07:10

@TerryChia well we must not forget one thing Terry, in the end it's wordpress

and wordpress is written in PHP

I should migrate my blog one of these days though

I'm still using WP

Terry Chia

@LucasKauffman Layers of crap piled on top of one another isn't it?

Lucas Kauffman

@TerryChia the performance is terrible

Terry Chia

@LucasKauffman Jekyll ftw. (Or Pelican if you want Python.)

Can't beat static pages served out of a CDN.

Lucas Kauffman

yea I think I might change to jekyll

oh wait they have an easy migration tool

Terry Chia

@LucasKauffman You have to check the results first, it screwed with one or two of my pages when I migrated.

Not too bad though all things considered.

Lucas Kauffman

07:13

yea of course, I mean dev, test, acceptance -> prod

that's what you are supposed to do right not go in all #YOLO

Terry Chia

@LucasKauffman Awwhhh cmon! No one reads your blog anyway. ;)

Lucas Kauffman

@TerryChia I'm not sure how many people read it actually, the android tutorials and the java to python tutorial were actually quite popular

let me have a look on analytics

This month so far, from the first of june until now I had 2404 visitors

Terry Chia

I only get 1k or so sessions a month, I'm not sure how well Google filters out bots though?

So yeah, the only reason I blog is because I like reading the stuff I write. (Same reason I'm on Stack Exchange actually) ;)

Lucas Kauffman

@TerryChia not sure either

@TerryChia you like reading the stuff you write :P?

Terry Chia

@LucasKauffman Well, someone has to.

Lucas Kauffman

07:18

that's a bit like smelling your own fart

xD

I think at my peak, I got about 6k visitors a month, but that was just the android tutorials

Gilles

spam votes plz

Lucas Kauffman

theonion.com/articles/…

Gilles

-1

Q: How can I send an unencrypted message from one computer to another?

As you can see, I'm a noob. I'd love to do a demonstration where I send an unencrypted message from one computer to another, and be able to intercept it and read its contents. This might sound stupid, but I actually cannot find a way to send messages across a server in plaintext. Any help would ...

encryption

wat?

Lucas Kauffman

@Gilles genius

Adnan

@Terry I don't know. It's free with this airline (Norwegian)

Terry Chia

07:29

@Adnan Woah! That's pretty neat.

Adnan

Aaand.. Whoa! I've just noticed. They didn't ask us to do anything with our electronics

No flying mode and no turning off

Yup! Norwegian is my new best budget airline

Gilles

it's a new thing, the US stopped forbidding using electronic items a few months ago (last year maybe by now), the EU followed suit, and many individual airlines stopped having the no-electronics policy now that it isn't mandatory

@Adnan wow: say that... and get booted offline

Terry Chia

@Gilles Yep, I noticed the same on my recent trip to Korea.

Lucas Kauffman

@Adnan can you read arabic?

I'm trying to understand this:

Gilles

@LucasKauffman have you tried Google Translate? They have a scan-ocr-and-translate facility now

Lucas Kauffman

07:39

@Gilles wait wat

Adnan

@Lucas Let's see

Gilles

of course, with automatic translation, the result can be as obscure as the original

Adnan

10:05

@Lucas Basically, first comment says that the dead dude is going to hell for being Christian. Second comment condems the first and wishes the best to the dude's family and RIP. Third comment says that you shouldn't say RIP because the dead is Christian.

Last comment says "I'm ashamed of the things spme of us Myslims do and say. Religion has nothong to do with this. Some dude died, may him RIP"

From what I can infer, they're talking about some mudered dude

Terry Chia

11:38

►

This talk has an interesting title.

Terry Chia

13:07

@ScottPack Hey Scott, have you given RHEL 7 a whirl yet?

Scott Pack

I work for an Ubuntu shop now.

Terry Chia

Ahh I see. Was wondering how the OS is.

Can't personally give it a try until CentOS is ready.

Scott Pack

If I remember I can reach out to some guys and ask if they've started testing it.

Terry Chia

Nah, no need. I probably won't remember as well. :)

Scott Pack

@LucasKauffman One nice thing about WP is the ability to write and schedule posts. The workflow to do that with Jekyll is a fair bit messier. You also need to pull in several doodads from different places and glue them together to get a good feature set.

Terry Chia

13:12

@ScottPack at?

Scott Pack

@LucasKauffman What I've done is Disqus for comments, Google Analytics for tracking, bufferapp for announcements.

@TerryChia It depends on your workflow. What you'd have to do is have the full jekyll tree on your web host and have the webserver serve up the _site directory. You could then set an at job, or a cronjob for that matter, to run a jekyll build.

Terry Chia

@ScottPack Personally I am using GitHub pages now so it's a simple git push. My previous setup was building locally and using rsync for deployment. Both works well with at.

Scott Pack

@TerryChia I didn't want any of the build tools on my webhost so I do all my authoring and building on my laptop and have the _site directory as a git repo. When it's time to publish I check that out on the webhost.

Rоry McCune

@ScottPack what you using for build automation now you're ubuntuing?

Scott Pack

Unless you only ever have one future post in the queue timing gets wonky if you try to build in advance.

@RоryMcCune I'm getting Foreman up and running. I'm really digging it so far.

Rоry McCune

13:16

I had a look at chef-solo the other day but it's chances of working on windows == smeg all :)

Terry Chia

@ScottPack That may be true. I never run across this because I never had the interest of scheduling posts to go out at certain times. I just publish whenever I'm finished.

Scott Pack

@TerryChia When I decided to host my own I went through my history of guest posts and pulled them in to publish. That way everything I really liked would be in one consistent location. That made the idea of putting up a schedule pretty reasonable.

Terry Chia

@ScottPack Ahh. That's sensible if you don't want everything up at once.

Scott Pack

@RоryMcCune I haven't set up Foreman to be an ENC for puppet yet but it's pretty slick. Go into one web interface, define your server, hit go, and walk away. It'll create the VM in the right ESX cluster, on the right datastore, configure the hardware how you told it to, use gPXE to boot it, install it with preseed, then run puppet.

Terry Chia

@ScottPack Wrong Rory.

Scott Pack

13:19

@RоryMcCune Allegedly if you set it up as your ENC it'll even do all the certificate signing.

@TerryChia His attempt to reduce errant pinging has resulted in more errant pinging. :)

Terry Chia

@ScottPack Yeah, but the pings go to @RoryAlsop so I'm sure he's fine with it. ;)

Scott Pack

@TerryChia Probably so.

Rоry McCune

@TerryChia @RoryAlsop loves pings

I'd switch back but if I did I'm sure the generic pings would return :op

Terry Chia

@RоryMcCune It was a lot more efficient when one can ping both of you at once. ;)

Scott Pack

Or when I had the right keys on my keyboard to actually ping you @RоryMcCune

Rоry McCune

13:24

@TerryChia yeah but it's far more frequent for people to want to ping @RoryAlsop rather than me, him being a mod and all....

Terry Chia

@RоryMcCune True. Especially since he is the only reasonable mod that hangs out in The DMZ. ;)

Rоry McCune

@TerryChia oooh @avid burn

Adnan

13:42

Yaaay! I'm in Cambridge!

Soo damn hot!

No crosswalks!

Terry Chia

@Adnan I laugh at your complaints about the heat. :P

Adnan

Everybody has a funny accent

@Terry Beeecause?

Terry Chia

@Adnan Because I live in Singapore. Where its hot and humid every single day of the year. :)

Scott Pack

@Terry That's a mistake you can fix.

Terry Chia

@ScottPack Nah, it's a pretty great country except for the weather.

Good food, great internet.

Scott Pack

13:48

It may be a great country but what about the city?

Terry Chia

@ScottPack One and the same thing. :)

Scott Pack

So do you ever hang out with JourneyMan?

Terry Chia

@ScottPack I'm not a ServerFault person remember?

Scott Pack

Neither is he.

Terry Chia

14:07

@ScottPack Hmm? Then SU? I can't remember.

Scott Pack

Aye, Superuser.

Terry Chia

@ScottPack Ahh. I don't use that either. :P

Lucas Kauffman

14:24

@TerryChia we will put you together until you kiss

Rory Alsop

Apparently I love the pings! :-)

Afternoon all

Rоry McCune

14:51

@Adnan woo! watch out for bicyclists...

@RoryAlsop yep I'm sure I've heard it said that you love big pings and you cannot lie...

Terry Chia

@RоryMcCune Is pings a euphemism now?

Rоry McCune

@TerryChia well I was kind of referring to a sir mix-a-lot track...

Terry Chia

@RоryMcCune Sureeee. ;)

Rоry McCune

@TerryChia wait you've never seen/heard the classic "I like big butts and I cannot lie"?

Terry Chia

@RоryMcCune That sounds vaguely familiar but I can't say for sure.

Rоry McCune