The DMZ

11:13 AM

@RoryAlsop @LucasKauffman is it? sounds like the solution (with the exception of the ink signature image) he's looking for is "use digital signatures".

Rory Alsop

heh

the answer is simple

the question is broad/woolly/undefined

AviD

@RoryAlsop well, sure, because he is not familiar with digsigs.

its like "I need to protect the secrecy of some information. I would use something like a passcode, but stronger, to enable only me to access the information; anyone without the passcode wouldnt be able to. Isn't there some tool out there that would do this for me??"

A: "Yes, duh, it's called encryption. Go look that up, it solves it very well".

Adnan

I've just plugged Sec.SE in a talk

I'm surprised how little known Sec.SE is. Even amongst security experts such as ones involved with OWASP

Rory Alsop

@Adnan that's terrible. Is RoryM wearing a Sec.SE t-shirt? :-)

Adnan

@RoryAlsop He's not

Rory Alsop

11:20 AM

obviously means we need to try harder

Adnan

aand aaaand.. I already tried and asked to get t-shirts, SE people never even answered me

I sent a request about 3 months ago

AviD

@Adnan shameful.

@Adnan yeah, I've noticed this too. I've been pushing it on occasion, but its more like "hum, thats interesting..."

Adnan

@AviD I mentioned it occasionally in some talk today

AviD

Thomas Ptacek was harassing OWASP for not using SE resources, specifically regarding the crypto guide. many of the OWASPers were "oh wow, didnt know that! please help!"

Adnan

then somebody asked me to talk more about it, and I gave an on-the-spot 30-min presentation on SE and Sec.SE in particular

AviD

11:23 AM

@Adnan good for you!

@Adnan you giving a talk? or just random conversation?

Adnan

@AviD No, somebody else was giving the talk and he asked for suggestions on something

I suggested an idea, and mentioned Sec.SE

and the dude giving the talk asked me to talk about it more if it's possible

@AviD The only reason they were semi-interested was because I suggested applying game theory to OWASP contributions

AviD

"if only there was some place on the internet, where we could ask all our security questions, and get good answers from experts!"

Adnan

We made a proposal and we're gonna send it up the chain to the OWASP guys

AviD

"even better if we could vote on the answers! yknow, like stackoverflow..."

Adnan

The Dev Guide and Code Review project leaders made the proposal

They're gonna switch some projects from the Wiki to GitHub

and use GitHub API to measure activity

AviD

11:26 AM

@Adnan excellent. Interestingly enough, I had mentioned something like that to one of them a while ago, also why I stopped working on it

Adnan

and reward active members with free admission to events and maybe free training

Terry Chia

@AviD Am I the only one feeling that the number of actual experts actually answering questions on the main site has dropped recently?

Kisunminttu

@Adnan that's some stellar work! :*

AviD

well, "stopped" almost before I started.... that and lack of time.

@Kisunminttu TWSS! ;-)

yes yes, I know, hence the humor in it.

Adnan

@TerryChia That's very true. You got @Lucas and @RoryM almost stopped answering

AviD

11:27 AM

@TerryChia I stopped a while ago, but then I'm not an "actual expert".

Adnan

Haven't seen anything from @Codes lately

and, there's the most expert of all, myself, I've stopped

AviD

@Adnan I think he meant expert on security.

Terry Chia

In all seriousness, some of the answers (except from @Thomas of course) to the questions I randomly clicked were embarrassing.

Adnan

@TerryChia Please show examples so we can improve

AviD

have I mentioned I hate doing contracts?

Adnan

11:29 AM

@AviD Oh, I thought he meant the art of love making

AviD

especially rental contracts.

@Adnan you always do.

Terry Chia

@Adnan I can't remember any off the top of my head (I was just randomly clicking stuff). I stopped really paying attention to new answers nowadays.

Adnan

@TerryChia I kind of agree with you. I haven't seen an answer by one of our top 15 lately

AviD

@Adnan am I one of those?

I just really barely have time for anything lately.

I think I might take a regular full time employee type of job. I would have so much more free time.

Adnan

@AviD So you'll become one of us?

AviD

11:33 AM

@Adnan depends what you mean by "us"?

Perverts?

Finnish?

Terrorists?

Adnan

@AviD You already are a pervert

AviD

@Adnan true, was gonna say

Adnan

@AviD and you already are sort of a terrorist

AviD

am I?

Adnan

@AviD I mean day jobbers

AviD

11:34 AM

@Adnan ah that.

dunno, maybe. I would consider it.

probably still be timeshifted out of my timezone, though.

Terry Chia

@AviD Can't you just take less jobs if you are overwhelmed?

AviD

That's just how I roll.

@TerryChia not really overwhelmed, and I do often take some downtime.

but lots of demands for my time, and I have to keep juggling several different balls in the air.

hurhur, he said "balls in the air".

Rory Alsop

@Adnan you have the link to the stack swag form, right?

Adnan

@AviD More consistent time with the family, easier to follow on your hobbies, etc.

AviD

@Adnan not sure about that part, though. Since I (usually) work from my home office, I can pop upstairs for lunch with the kids. Just did that today...

Adnan

11:38 AM

@RoryAlsop The Google Docs form, right?

I had it and used it

No answer

AviD

@Adnan I think the big difference would be a consistently defined limit to how much time I actually spend on working.

Rory Alsop

@Adnan erm - yeah, sorry

@Adnan yes, that one

wonder why

if you use it again, tell me and I can ping in the teachers lounge

AviD

also, I would be working on one single track at a time (or maybe a set of related tracks). As opposed to running in several different, unrelated directions, with different clients pushing their demands.

Terry Chia

@RoryAlsop Oh, we don't need anymore information about mainframe security. ;)

AviD

oh, and all the damn administrative overhead, of being an independant.

Rory Alsop

11:40 AM

@TerryChia pffffft. Of course we do.

kalina

nope

no more Star Trek

this is so boring

I'm going to watch Stargate again

AviD

@TerryChia hahaha, nice.

Adnan

@AviD Exactly. Limiting your work time allows to be more focused on other things when you're not working. Now, you're just basically working all the time

at any time

That's very mentally demanding

AviD

@Adnan yeah, pretty much exactly.

kalina

you're mentally demanding

Adnan

11:41 AM

@kalina Indeed I am. @Kisu can confirm

AviD

and while I dont exactly spend a substantial amount of time marketing, I do work a lot of pipelines in parallel.

kalina

@Adnan I already have my confirmation, I wasn't asking, I was making a statement!

AviD

so there is the non-work work-related work that takes a lot of time and head space, too.

Adnan

@AviD and especially if it's something you'd enjoy. Being in a company takes a lot of the overhead

accounting, managing subcontractors, etc.

It has its upsides and downsides

kalina

Microsoft brings own security info exchange to the world

AviD

11:43 AM

yes, absolutely.

Adnan

I'm sure you already know that

AviD

biggest problem for me is that I am a helpless cynical git. I cannot bring myself to commit to anything for a non-trivial amount of time, unless I totally believe in it. Seeing as I am just short of being a nihilist, this is tricky for me.

kalina

...

nobody cares when I post something that's actually relevant to the channel here

Nick

@AviD possibly rebase yourself

kalina

but when I talk about angel cake I get stars

4

explain yourselves

AviD

11:45 AM

I came very close to taking a job, on more than one occasion, mostly with top-line companies. Managed to save myself just in time.

@Nick that's disgusting!

@kalina we're just surprised, is all.

kalina

sigh

Nick

@AviD you said your a cynical git... i had to say that xD

Adnan

@kalina What's angel cake?

Terry Chia

@Adnan I would presume it's a type of cake.

AviD

@Nick oh the reason I am cynical is because I have seen and experienced enough stupid snake oil to know that is the majority.

@TerryChia made out of angels.

Terry Chia

11:47 AM

@Nick rm -rf .git/

Adnan

Anybody used SDL Threat Modeling Tool from Microsoft?

AviD

or does it have some strange angles?

kalina

@Adnan a naked angel covered in cake

AviD

@Adnan yeah

Nick

@TerryChia nahhhh that does nothing, sudo rm -rf / --no_preserve_root

AviD

11:48 AM

@TerryChia ohhh, is that what he meant.

@Adnan what about it?

Adnan

@AviD I"m writing a management-friendly security summary of a system. My project manager is insisting on using that tool. Is it any good?

AviD

"good" depends for what...

Nick

@AviD i ment git rebase ;p

Adnan

@AviD He told me to use to "Generate fancy charts, graphs, and diagrams. Management love those!"

Rory Alsop

@kalina works for me

FEichinger

11:50 AM

@kalina Screw you!

AviD

I use it to build ad-hoc DFD's, with the focus on trust boundaries. I also use it as kind of a backup to my memory to run through STRIDE-per-element when doing threat models.

Rory Alsop

@Adnan it's okay for that purpose, yes

and it's actually an okay process flow

Adnan

@FEichinger I shouldn't google for that?

Terry Chia

@AviD Sooooooo much buzzwords in that one sentence.

AviD

@Adnan graphs yes, charts and diagrams not so much.

Arperum

11:51 AM

@kalina Good thing I have that image now firmly planted in my head, the other one my brain constructed is purely ohgogwhydidIthinkofthatagain

Adnan

@RoryAlsop @AviD Can I whip out a couple of diagrams with a couple of hours of work from it?

AviD

@TerryChia nooo techy words you dont understand. dont make em buzzwords....

Rory Alsop

@Adnan pretty much, yeah :-)

AviD

@Adnan sure, if you know the system architecture.

and assuming you know what you're doing...

Adnan

Alright, thanks.

AviD

11:52 AM

the graphing part is basically Visio, with a modified toolkit.

Adnan

@AviD Security stuff, yes I know, but the tool itself I have no clue

CodesInChaos

@Adnan The bear is usually faster than me in answering crypto questions on security.se. No point in posting a redundant answer.

Rory Alsop

for those of you who aren't in a position to sponsor my wee daughter, she has been entered in a Mountain Warehouse competition, where votes will determine the winner, who will then get a cash prize towards their charity. Anybody fancy voting, please do: mountainwarehouse.com/charity/entries/…

AviD

is she raising money for snacks??

Rory Alsop

@AviD sort of, yes

:-P

AviD

11:56 AM

@RoryAlsop but joking aside - totally WOW on her.

Rory Alsop

@AviD she's a wonderful nutter

AviD

@RoryAlsop I would expect nothing else from your kids ;-)

Terry Chia

@AviD His kids are probably older than you. They just age slower.

AviD

hahaha

so this is new. Recruiter spam from... the GCC. That's the arab countries in the Persian Gulf, right? How the hell would I be able to work there?

funny, the guy looks just like @Adnan. but he's from UAE. Strange....

Rory Alsop

@AviD hehheh

kalina

12:06 PM

@RoryAlsop I don't see a vote button

AviD

you must be blind.

kalina

THE VOTE BUTTON IS MISSING

Rory Alsop

@kalina scroll down - it says Vote Now

kalina

yeah I don't see that, one of my plugins must be disappearing the button

AviD

it's a big green button that says "Vote Now". That's the vote button.

Rory Alsop

12:07 PM

@kalina how about on this main page:

mountainwarehouse.com/charity/entries

kalina

FINE I'll use internet explorer

AviD

@RoryAlsop she's in the lead! woohoo!

kalina

I hope you, as a security professional, feel bad making me bypass all of my security to commit vote fraud

Rory Alsop

@kalina In which case, thanks very much. (I despise having to go to IE for something)

FEichinger

FWIW, I'm not seeing the button either.

AviD

12:07 PM

@RoryAlsop buncha troglodytes.

Xander

@RoryAlsop That's awesome. My father's a pediatric rheumatologist, so I grew up around juvenile arthritis of all manner.

kalina

@FEichinger it's on the second link he linked

Rory Alsop

@AviD not quite - I see ones that have quite a few votes

kalina

I still don't see it on the first page

and it asked for an email address!

YOU WANT ME TO GIVE OUT A LEGITIMATE EMAIL ADDRESS?

Rory Alsop

@kalina erm.... you must have some spare, right?

AviD

12:09 PM

@RoryAlsop ohh. I thought it was sorted by votes....

kalina

this is an outrage

Rory Alsop

it's only an outdoors clothing and supplies company...

sorry

kalina

even my own mother doesn't have my email address

AviD

you don't have one.

kalina

I do technically

the individual I popped out of is still alive

AviD

12:11 PM

you motherless goat. your father smelled of elderberries.

2

umm no, I think I'm mixing my insults.

►

Xander

@RoryAlsop Is there still a way to sponsor as well, or is that done?

Rory Alsop

@Xander justgiving.com/LexiesLongWalk

I think JustGiving keep the site open for 3 months after an event

AviD

anybody read that Stephen king story "The Long Walk" ?

Rory Alsop

So she has £1300 on the site, about £500 offline, and my work is adding £250 - it's all good

kalina

fine I have done the thing

Rory Alsop

12:13 PM

@AviD I'm not reading that to Lexie

kalina

all future email to that address will be sent to /dev/null

AviD

it was awful!!

Rory Alsop

@kalina Thanks. Karma suggests you will get cake!

kalina

I am the cake.

I am an angel

Rory Alsop

(but the cake is a lie)

AviD

12:14 PM

@RoryAlsop who's Karma? she sounds nice.

kalina

angel cake is an angel covered in cake

do you not get it

Rory Alsop

@kalina so if the cake is a lie, this suggests you are a naked angel?

kalina

FINE WHATEVER

star trek voyager is a crap show as well

Rory Alsop

@kalina yes

kalina

@RoryAlsop the cake isn't a lie, it is delicious moist cake

I refuse to watch the original series because it's too old

FEichinger

12:15 PM

@kalina Yep. Very much so.

kalina

I can't be bothered with terrible cheesy acting and terrible effects

Rory Alsop

►

kalina

Red Dwarf is outside of the lower threshold of what I find acceptable but it gets away with it. Just.

@RoryAlsop Portal is a lie

Rory Alsop

this is the GlaDOS / Jonathan Coulton duet version

Xander

@RoryAlsop Excellent, thanks.

Rory Alsop

12:21 PM

@Xander Dude - seriously. Thanks!

kalina

dude

did you just dude?

Rory Alsop

@kalina I do just dude

FEichinger

Dude dude dude. Dude.

Dude dude.

AviD

►

Rory Alsop

@kalina I have a certificate. I have my Dudeism ordination

kalina

12:23 PM

oh no

ashton kutcher without a top on

get it off my screen

Xander

@RoryAlsop Johnathan Coulton has many talents. Singing well is not one of them.

kalina

my eyes

MY EYES

I'm blind

Rory Alsop

@Xander true. He writes fun filk songs though

Xander

@RoryAlsop Yes, yes he does.

Rory Alsop

My kids love Skullcrusher Mountain and Ikea

AviD

12:24 PM

@kalina NOBODY TALK. KEEP IT ON HER SCREEN.

kalina

...

FEichinger

Wait, no, nevermind, not risking my life over this.

kalina

edit history is a wonderful thing

it's still on the screen

this is a disaster

anyway

Xander

@RoryAlsop Sure thing, it's a good cause and she's working hard. She deserves it.

kalina

I'm not really bothered, I just wanted to pretend you had found my kryptonite

now I know that in my darkest moment, @fei would actually kick me when I'm down

EXPOSED

Rory Alsop

12:27 PM

@kalina lol

FEichinger

@kalina Of course I would! Just like you would torture me in unspeakable ways for it.

kalina

I wouldn't torture you for kicking me in my darkest moment

I'd consume you, entirely, in fire, followed by everybody you've ever known or met

boredom level 10/10

Thomas Pornin

@Adnan There has been an answer from @DW just yesterday (or today, depending on time zone)

kalina

boredom overflow

critical warning: boredom level 11/10

Adnan

@kalina Take a walk around

Fun stuff happen all the time

Terry Chia

12:33 PM

@Adnan I think the fun stuff actively avoids @kalina.

AviD

@TerryChia I know that I have my fun stuff avoid @kalina.

FEichinger

@kalina If you're having a boredom overflow, shouldn't that be boredom level 0/10, overflow flag active?

Adnan

@Kalina Stop a random person in the street and have a conversation about anything

AviD

@Adnan if she were to stop a random person to have a conversation about fun stuff, she would likely be arrested for solicitation.

Adnan

@AviD :|

kalina

12:36 PM

@FEichinger no I handle the overflow and assume 11 for dramatic purposes, since it overflowed

Adnan

If you say "Hello, big guy. Want me to show you some fun time?", then yes

kalina

@Adnan this never ends well, if I approach a random guy in the street they assume I want sex with them

if I approach a random woman in the street she assumes I'm after her other half

let's just avoid approaching random people

that sounds like a good idea

AviD

@kalina silly girl, she doesnt know that you're still after sex

kalina

@AviD I wasn't after sex in the first place!

I have people I can call for that -.-

AviD

@kalina well, how do you define random? Is pseudo random good enough, or does it need to be cryptographically random?

kalina

12:38 PM

@AviD you're taking this a little too far now

AviD

@kalina TWSS!

Adnan

@kalina I don't know, I do that all the time

kalina

I will define "random" as "anybody I do not already know"

Adnan

Yeah, most of the time I get weird looks and people telling me to fuck off

kalina

@Adnan you are a guy

@Adnan seriously, if a random girl walked up to you and started talking to you in the street, would you tell her to fuck off?

actually, *you* are probably the wrong person to ask

AviD

12:40 PM

@kalina thats probably half correct.

kalina

@AviD -.-

Adnan

@kalina I wouldn't say fuck off, to anybody.. guy or girl

AviD

you know I'm right.

kalina

@AviD of course I do, I've already said as much

AviD

@Adnan you just did! just now!

Adnan

12:41 PM

But most of the time I have somewhere I have to be, and usually I'll politely say that I'm busy

when I'm just strolling around or waiting for something, I have no problem talking to a guy or a girl

AviD

"I'm busy right now. Can you call me tonight? Or just stop by."

Adnan

Throughout the years, I've stopped hundreds of people in the streets, and only rarely I've ever thought "I wanna have sex with them"

kalina

@Adnan a guy stopping a girl in the street is a completely different thing to the other way around

Adnan

and I've been approached on buses/trains by ladies and guys and I've rarely thought "They want to have sex with me"

kalina

the two acts are physically the same act, but the different sexes form different preconceptions about what the stopping is about

Adnan

12:44 PM

Unless the lady is being obviously flirtatious

@kalina I'm from the different sex, and I don't assume every lady stopping me in the street wants to have sex with me

and many people think the same

AviD

@Adnan you're obviously wrong

Adnan

@Kalina I guess it's just because you think every guy who stops you wants to have sex with, you seem to think that when you stop a guy he'll think about that.

So, honestly, the problem is you

kalina

@Adnan I haven't ruled that out as a possibility

Adnan

@kalina and I'm just asserting it

Rory Alsop

@kalina My assumption is never that they want anything other than what they are asking. This has led to me being surprised a couple of times.

AviD

12:48 PM

@RoryAlsop That's the exact opposite of me. I always assume they have an ulterior motive, but that I can rarely surmise what that is.

Doesnt stop me from being surprised on ocassion, though...

Rory Alsop

@AviD heh

Adnan

@RoryAlsop and I guess that's only very few times, no?

FEichinger

I always assume people are shitbags. Works for me.

3

Xander

@AviD You should always assume that their ulterior motive is nefarious. That they're just trying to distract you so their partner can rob you. Always check your six.

Rory Alsop

@Adnan I lose count, or I forget - some time ago...

kalina

12:49 PM

@FEichinger same

Rory Alsop

@Xander this works too :-)

kalina

it's probably that assumption that resulted in this conversation

however, it keeps me sane

AviD

> Always mind your surroundings.

kalina

spatial awareness and knowing where the exits are

Adnan

@FEichinger I always assume that shitbag people are shitbags

FEichinger

12:50 PM

Random person stopping me to talk? Get the hell out of my way.

Adnan

@kalina and what objects can be used as weapons

kalina

"If it comes down to it, will I actually survive jumping through that window and falling 6ft into the carpark"

AviD

@Xander actually, I dont usually assume nefariousness. Doesnt mean I dont prepare and watch out anyway.

@Adnan That's racist.

kalina

enter a building I've never been in before, locate the exits, the weapons, spot all the people, watch which routes they're taking

Adnan

@AviD Shitbaggery doesn't know a race

Rory Alsop

12:51 PM

@kalina this maybe does mean that you will be well prepared in the event of the zombie apocalypse, but doesn't it require an awful lot of effort that could otherwise be used being less bored?

Xander

@AviD Yeah, I don't really either. I typically default to assuming extroverted-ness. Nafariousness isn't that far behind though.

AviD

@kalina always sit with your back to the wall and facing the entrance.

Adnan

@kalina I hate that I'm relating to you

Rory Alsop

@kalina always locate exits, sure, but weapons? really?

@AviD I do that because you get to check out the folks passing by...

Adnan

@RoryAlsop You never know

kalina

12:52 PM

spot all the CCTV cameras, the guards, people of authority, check to see if they're looking at me like I'm innocent or wary of my presence

Adnan

@kalina aaand I'm semi-horny now

5

AviD

@Xander Never attribute to malice that which can be explained by incompetence.

Rory Alsop

@Adnan true - but I'm confident I'm 99.9% correct

kalina

@RoryAlsop yes, in a split second I want to be able to defend myself if the need arises

AviD

... or cluelessness.

FEichinger

12:52 PM

@Adnan ಠ_ಠ

kalina

If I'm walking down the street, and a guy is walking on the other side of the street

Xander

@AviD Yes, that too. I find it to be regularly true.

Adnan

@FEichinger We discovered some ASCII list haven't we?

kalina

I will speed up, locate the darkest tightest route I can and prepare to sprint

if they cross the road, I tense up

AviD

@kalina I was with you until this. Better to prepare an active defence.

FEichinger

12:53 PM

@Adnan No, actually I have had that in my button script for ages.

Adnan

@FEichinger That's actually non-sarcastically cool

FEichinger

chat.stackexchange.com/…

Also, that.

kalina

@AviD I am tiny, I know my physical limitations and I know that against a guy my size or larger I will lose

AviD

@kalina what's that thing you like to remind us all? It's not the size that counts?

kalina

@AviD size matters when you're being pinned down

FEichinger

12:55 PM

Adnan

@kalina What are you doing tonight?

Xander

@AviD Hmm. So, since the purpose of defense is to end the threat and disengage, running away is a very viable option in many cases.

Adnan

I actually, never mind, tonight we have the OWASP pre-party

AviD

►

kalina

@Adnan stop hitting on me

Adnan

12:56 PM

@kalina am I? Is that how guys it on you?

Poor you

AviD

sorry for the crappy quality. first link I grabbed.

Adnan

@AviD We never really expect quality from you

Rory Alsop

@Xander ANd especially if you are tiny, or likely to come off worst in close contact, this is a really good piece of advice

AviD

true. that is my safety vest.

@RoryAlsop better is to call a cop, or run into a crowd.

Rory Alsop

@AviD agreed

kalina

12:58 PM

@AviD calling the police does nothing

Adnan

@Xander I completely agree

Rory Alsop

I wouldn't go the 'darkest' route

Adnan

I never go into fights that I'm sure I'll lose

kalina

@RoryAlsop I would, I have dark brown hair and wear dark clothes, I'd become invisible

AviD

unless you run a lot, all you are likely to do by running away is to tire yourself out. Have less chance of defending yourself when he does catch up.

Adnan

12:58 PM

Threat mitigation with the easiest way possible

@kalina Do you have dark skin?

AviD

@Adnan and yet you keep picking on @kalina.

Adnan

@AviD Oh, come on. Kalina would never be able to take me in a fight

Or any other way

Transcript for