The DMZ

Stack Exchange

04:06

To everyone who responds to everything by saying they've 'lost their faith in humanity': Thanks--I'll let humanity know. I'm sure they'll be crushed.

3

tylerl

07:03

Jesus. this is my least favorite part about programming

I've been at it for about 7 hours and haven't written a single line of code.

...but I've read about 70 pages of specs, manuals, source code, commentary, examples, and other mind-numbing madness.

But if you'll pardon me, I need to go shave a yak.

David Freitag

@tylerl Whatchya workin on?

tylerl

@DavidFreitag I'm writing a libnss module that will search through multiple passwd/shadow/group files instead of sticking to just the ones in /etc/

David Freitag

@tylerl Ah. Sounds like fun

tylerl

Also, metaprogramming in C using DEFINEs -- I kinda want to kick someone.

'course, I'll prolly end up doing it myself too. But I won't like it.

And I've spent a depressing amount of time trying to figure out the bloody purpose of functions like getpwent_r() instead of getpwent(), giving that neither is re-entrant.

All they had to do is pass double pointer to setpwent and endpwent, and you could totally use it to manage state in a reasonable way. It makes LOADS of sense and is exactly what the _r suffix is supposed to mean.... but... nope. Sorry. We're just dumb.

AviD

07:41

@RoryAlsop oh! happy happy birthday!! Are you still hungover?

Lucas Kauffman

@RoryAlsop happy birthday

kalina

I thought @Rory was supposed to be a divine being of some kind, such creatures aren't "born" and thus don't have birthdays

Lucas Kauffman

@kalina He's Exception: Integer Overflow years old, that's a bit divine no?

kalina

no

It's unbelievable that any of you would error handle the getting of age data from the database

therefore you should just collapse on the floor after "He's"

Lighty

i went to ZZTop yesterday, i stood like, not more then a mere metre away from them! :D

Lucas Kauffman

07:50

Read that article about a US SWAT team throwing a flashbang into a baby's cot by accident?

AviD

@Lighty did you touch their beards?

Lighty

@AviD Nah, but i think they powdered them, atleast, the powder was on their jackets

AviD

dandruff

Lighty

the Ben Miller band preformed as support act, complete hillbilly's, yet awesome

tylerl

  /* Get lock.  */
  __libc_lock_lock (lock);

is that really necessary?

(this shows up all over the glibc source)

AviD

08:00

libc is unnecessary.

tylerl

I mean, If you have a function call that says lock_lock(lock) , the comment "by the way, this locks something (a lock)" is a bit redundant.

AviD

@tylerl i = i + 1; // Add one to i

never seen that?

CodesInChaos

@AviD That should be i++; // Add one to i

tylerl

@AviD Yes, though not typically in code that is used by literally every program on the computer.

AviD

stupid worthless comments. Usually because of stupid worthless coding policies that require comments for everything.

@CodesInChaos I've seen it both ways.

tylerl

08:03

@CodesInChaos ++i is more efficient

CodesInChaos

MSDN is pretty great at redundancy as well.

AviD

I've actually even seen private int Increment(int i) { ... I'll let you guess the rest.

True story.

CodesInChaos

Originally I though GhostDoc were a parody. But there are people who seriously use that thing.

AviD

@CodesInChaos true, all the "Learn to Code in 21 hours" are rife with worthless comments. If your coders learned from those, it is likely they picked up that dirty habit too.

but then, if they learned to code from those books, its likely they don't know how to code either.

Arperum

@AviD Did you print it and made the original writer eat that code?

tylerl

08:05

@AviD Learn to code by lunchtime. You'll be writing security-critical software before you can say "disaster"

Lucas Kauffman

@AviD that's really just full retard

Terry Chia

@AviD So's your face.

@AviD If it's Java you need a IncrementFactory.

Lucas Kauffman

@tylerl Like those questions we sometimes get on here "Hello, I am making critical transactional app for a bank, how to secure bank application? thx"

tylerl

@LucasKauffman dear god. I've personally answered at least a dozen.

AviD

@LucasKauffman no, it's a typical programmer hack when you get your bonus based on how many lines you wrote. Or yelled at.

@TerryChia ha, so true.

@tylerl STOP ENCOURAGING THEM!

Lucas Kauffman

08:09

There should be a law, if you're breached by a vuln >1 year old, you register as sex offender for screwing your customers without permission

Tweeted by edwardmccabe on June 25, 2014 at 2:40 AM

3

tylerl

5

A: What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?

If you have to ask, then you shouldn't do it. Security is difficult to get right, and requires a fair amount of experience to recognize all the ways in which it can go wrong. And a safe-haven for whistle-blowers represents not only a clear target for determined attackers, but it also comes with ...

Lucas Kauffman

None of you guys have an answer to this?

0

Q: Best practice for log signing

I can imagine that for sensitive systems logging to a central logging server it can be handy to be able to verify the integrity of the logs. Each line can either be signed or a shared secret may be used (HMAC) to add an additional field before sending it off to a central logging server. I was wo...

logging

I've seen it being done and I'm really curious how you implement it properly

tylerl

@LucasKauffman You have to figure out what you're defending against

AviD

@tylerl +1

tylerl

@LucasKauffman If the sending server signs its logs, what does that signature indicate? That the server actually sent the logs? Or that the logs weren't tampered with before being sent?

Lucas Kauffman

08:13

@tylerl that the logs weren't tampered with

AviD

@LucasKauffman some products already do this.

However, I refuse in principle to answer any question that asks for "Best Practices".

Lucas Kauffman

0

Q: Good practice for log signing

I can imagine that for sensitive systems logging to a central logging server it can be handy to be able to verify the integrity of the logs. Each line can either be signed or a shared secret may be used (HMAC) to add an additional field before sending it off to a central logging server. I was wo...

logging

better?

AviD

hehe

kalina

so tired

I will rest for just a moment

AviD

thats still just "Best Practices", just with lower standards.

tylerl

08:15

@AviD BOOM. PWNT.

AviD

like @Simon.

kalina

@LucasKauffman no, now you're asking for casual practices and you should already know those

AviD

oo oo, no, like @Kisunminttu. Get it? Because of @Adnan? No? Never mind.

kalina

I don't think you should be mean to @Kisunminttu as she already has enough on her plate dealing with the mistakes she's made

Lucas Kauffman

pffffrt

tylerl

08:17

@LucasKauffman So you're signing messages in a potentially hostile environment, and you want to know the best practices for detecting whether or not the data was tampered with before the signature was applied? Is that right?

kalina

application of more pressure may result in her cracking and setting you all on fire

@tylerl fdisk

Lucas Kauffman

@tylerl no after the signature was applied. The idea is that an auditor can verify that the presented logs haven't been tampered with

tylerl

@kalina I wrote an article on how to recover rebuild your partition table after someone uses fdisk in anger.

kalina

fdisk, as you know, is the solution to all problems in computing

AviD

@kalina thats the thing, I was being mean to @Adnan.

kalina

08:19

@AviD stating that kisu has low standards is insulting to kisu while being mean to adnan

I'm not bothered about the latter but I will not tolerate the former

Terry Chia

@kalina This raises the question, are you @Kisunminttu's sockpuppet?

tylerl

@LucasKauffman But they can be tampered with before they get signed. So you have to sign them before there's an opportunity to tamper... which, it turns out would have to be pretty early on. At least before they hit the log file.

Lucas Kauffman

@tylerl yep

tylerl

maybe before that. And really, there's no guarantee even then

AviD

oh jeezus. This client's app, besides having 3.5 MLoC in Java, and an undetermined amount of code in 4GL, now shows having 1.25 MLoC of.... PHP.

NOT.TOUCHING.IT.

kalina

08:22

@TerryChia no

Lighty

gives @AviD some vaseline you'll need it

Lucas Kauffman

@tylerl I've seen it in practice being used where they added a HMAC of the log to each log line.

AviD

I wanna respond with one of those anigifs from secreactions: kids playing tag "nuh uh, not it! NOT IT!"

kalina

mloc is what?

oh

AviD

@kalina million lines of code

Lighty

08:23

million lines of code

kalina

midlands lotus owners club

Lighty

yea, that

AviD

also known as: a shittonne of crappy code

Lucas Kauffman

kalina

minimum level operational capability

Lighty

08:24

kalina

missing logical or in expression used as brand condition

AviD

@Lighty yes, this one is perfect.

kalina

master pre-light off checklist

AviD

"All aboard the nopetrain, next stop - notphpville!

kalina

I hope you enjoy your week of PHP hell

in fact, why don't you off load it onto a PHP... er...

what is the PHP equivalent of "developer"?

Lighty

08:26

a Lighty

AviD

@kalina naah, really not doing that, I agreed to the java only.

Lighty

some nouns also suggest Unlucky Person, Daredevil or @FEichinger

kalina

@AviD maybe the java relies on the php in some way and you'll have no choice

AviD

besides, you think over a million lines of php can be covered in a week??

kalina

@AviD I don't think 10 lines of PHP can be covered in a week to a quality standard that would be acceptable in other languages

let alone more

Terry Chia

08:27

@AviD Sure you can. Just grep the source for db code and you have enough crap to report.

AviD

@TerryChia ah, but its never about "enough to report", its about "what else is there"

if it was "enough to report", I'd stop as soon as I saw ".php"

kalina

@AviD so report "this section of the project needs rewriting as it's been written in PHP"

Terry Chia

@AviD You need that scanner I wrote?

AviD

except that I'm not doing the PHP! There is not enough money.

@TerryChia what scanner?

Terry Chia

gist: The most awesomest scanner in the whole world!, 2013-07-17 14:00:32Z

vuln_scanner.py

import os

for r,d,f in os.walk("/var/www"):
    for files in f:
        if files.endswith(".php"):
            print "You are fucked!"

Oh, SE inlines gists now?

AviD

08:30

heh, nice

kalina

nobody cares

please explain to me why Star Trek has the cult following that it does

AviD

Because Gene Roddenberry was such a genius, they even named the word "genius" after him.

kalina

that's not true

no

don't lie to me

Lighty

@kalina what do ya mean?

tylerl

@kalina everything has a cult following. That's why they call it a cult following.

kalina

08:32

@Lighty if I have to explain that sentence to you, you should just sit on the sidelines and wait for the next conversation to begin

Lighty

@kalina i would make a comment about furry cults/fandom, but i wouldnt :P

Terry Chia

@Lighty ...

AviD

@Lighty if you want to contribute to this conversation, go find the xkcd with the crazy straws, and link it here.

kalina

@Lighty those comments wouldn't be relevant to me at all

I have certainly never dressed up as a pony for day to day life

or even harley

although harley quinn does seem like an appropriate outfit

tylerl

@AviD lazyass

The new crowd is heavily shaped by this guy named Eric, who's basically the Paris Hilton of the amateur plastic crazy straw design world.

kalina

08:35

I'm sure the next place I'm DJ'ing has foam party/fancy dress rules

AviD

@tylerl well done. @kalina, this.

kalina

@AviD I don't follow

this doesn't answer my question

AviD

of course it does

kalina

nope

your answer is not acceptable

ok so puncturing a pen with a needle was not a good idea

Lighty

better then shooting your finger with a nailgun while making a roof...

kalina

08:43

I wasn't trying to inflict pain on myself

Lighty

i was referring to the risc factor of accidents while handeling a nailgun

AviD

nailguns run on RISC ?

kalina

there is a risc factor?

interesting

I didn't realise there was a nailgun in the world powered by sparc

Lighty

let me put it this way, if you ever need to use one, try to hold the wooden planks atleast a few inches away from the inpact site, the moment you realize those planks are thinner then the actual nails... well

it stings

kalina

let me get this straight

because I'm not completely clear what you're saying

did you just say "when using a tool that propels nails through surfaces, don't hold the surface so close to where you're nailing" ?

Lighty

08:50

yup

AviD

...

kalina

right so, moving swiftly on

before the brain damage sets in

AviD

Lighty

damnit @AviD, you dissapoint me, i'd ATLEAST excpected a burning comment about young whippersnappers

kalina

that's a meme in the making, that is

Lucas Kauffman

08:52

@kalina Is it, lass?

kalina

what is "las"?

AviD

@Lighty your father is a young whippersnapper. I'm not sure what to call you.

@kalina VEGAS.

Lighty

@AviD i just wanna bet hes a bit older then you.... and a bit more.. "filled"

kalina

@LucasKauffman you're still missing punctuation that turns these three words into something readable

AviD

@Lighty did you just call your own father "fat"??

the infants these days, no respect.

kalina

08:54

@LucasKauffman are you Scottish?

Rory Alsop

@AviD I don't get hangovers. Well, I did have one once - it was my stag do, so it was expected :-)

kalina

Great Scott.

@RoryAlsop merry popping out of your mother day

Rory Alsop

@kalina Divine beings still have days when others can worship them :-)

AviD

> Remember, when you get drunk, you are borrowing happiness from tomorrow.

Rory Alsop

@kalina heh - better :-)

Lucas Kauffman

08:55

Every day is a Rory day!

AviD

I guess you dont pay interest on that loan.

Lighty

he's a 120kg 2metre tall guy, and really strong who got me addicted to gaming, ofcourse i can call him filled

AviD

@RoryAlsop your "Name Day"?

kalina

@RoryAlsop I don't worship anything or anybody

except for Ben and Jerry

AviD

@Lighty and now you called your dad gay??

kalina

08:56

two individuals that deserve worship for the happiness they've bought to my life

AviD

NOT that there is anything wrong with that.

@kalina nihilist

kalina

@AviD homophobe

@AviD I actually am

AviD

16 secs ago, by AviD

NOT that there is anything wrong with that.

kalina

It says so on my facebook page

AviD

@kalina that scene from Big Lebowski....

@kalina oh? link?

kalina

08:57

@AviD never seen it

Lighty

@AviD im not following you...

AviD

;-)

@kalina WHAT.

kalina

@AviD no.

that would be like the most epic disaster in the history of humanity

AviD

how can you claim you're bored when you still have that at the top of your todo list??

kalina

not only would you know my name, my age, what I look like, you'd also have access to a list of my not-so-privacy-concerned friends

who would most likely quite happily fill in additional details, like my address

THIS DISASTER SHALL NEVER COME TO PASS

I'm sure searching facebook for people who list their religion as nihilist would narrow it down to a few million people

have fun with that

give you something to do instead of pretending to be a security professional

AviD

09:00

@kalina shure, because I'm the one you have to worry about.

Lighty

is anyne getting security messages on laviejolie.com ?

kalina

@AviD no, you're right

Rory Alsop

@AviD heh - us oldtimers are well past that one.

kalina

in fact, the other week when I left my phone unlocked was quite a close call

@AviD I don't

I don't even know what you're talking about

Rory Alsop

@kalina you should

It's very good

2

kalina

09:04

I can't watch something recommended by AviD

I have standards

Lucas Kauffman

The Big Lebowski is rather good

Rory Alsop

@kalina How about something recommended by me?

hmmm - anyone got views on this? I think it's off topic - a config/rtfm issue

1

Q: adding certificate that resides on smartcard to the microsoft store with private key ownership

how can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? in an enrollment system where users generate smartcard certificate request online to a CA , the certificate is loaded 'offline' in the smartcard, for example sever...

cryptography public-key-infrastructure smartcard

and should we have a 'Dave' tag, d'ya think:

54

Q: Convincing my manager to use salts

My manager says we don't need to salt our passwords because people are not likely to use the same password because they all have different native languages, in addition to the websites they are active at. What is the best counter argument to this?

passwords hash salt

emberfang

g'day mates

Rory Alsop

@emberfang mo'nin

or if you are out in 'straya, afternoon

kalina

@RoryAlsop it was still recommended by avid

emberfang

09:19

I'm still recovering from that heat-wave

Rory Alsop

@emberfang we have had one in Scotland for over a week now. Over 20 Centigrade every day. It's just not right!

FEichinger

Ugh. Morning.

Arperum

@RoryAlsop We have warm weather here for a couple weeks now, and this weekend there is a pretty big festival (Graspop metal meeting) and they are predicting rain...

Rory Alsop

ey up @FE

kalina

@RoryAlsop that's barely a heat wave

@FEichinger Ugh. Morning.

Rory Alsop

09:23

@kalina it is in Scotland

@Arperum Good line up! We saw most of those at Download and they were good!

not quite most - but certainly many

kalina

@RoryAlsop *barely* a heat wave.

Sure it's t shirt weather but it's not bikini weather

Rory Alsop

@kalina I look stupid in a bikini

10

emberfang

haha

Rory Alsop

but it is definitely taps aff weather

@Arperum Avenged Sevenfold and Behemoth have awesome stage shows on this tour

Arperum

@RoryAlsop Which ones in specific did a good show? So I can make sure not to miss these, because there are always at least two bands playing at the same time (except for the headliners)

Rory Alsop

09:24

And Alter Bridge are awesome

Don't miss Steel Panther

@Arperum My top 5: Alter Bridge, Avenged Sevenfold, Soundgarden, Black Label Society, Steel Panther

However, Sabbath and Slayer weren't playing at Download - so they may well be higher up the list.

Arperum

@RoryAlsop I've seen slayer at Fortarock this year already, it wasn't that special. They barely moved on the stage at all...

Rory Alsop

@Arperum ahh. Best overall stage show was Avenged's - amazing stage hardware/screens/pyro etc. Behemoth also had good kit.

Steel Panther have a lot of audience participation, especially for their song 17 girls. If you know of them you will understand.

Arperum

@RoryAlsop I'll try to remember to go watch these two in particular.

@RoryAlsop I don't know steel panther, but I know of situations with massive crowd participation (The Bard Song or Valhallla at a Blind Guardian show come to mind)

Rory Alsop

Black Label Society and Alter Bridge were both just amazing though - Kennedy and Tremonti, and Zakk Wylde really know how to rock

@Arperum ahh - perhaps look at some of their youtube stuff. very NSFW. Imagine Poison without the political correctness. They went down very well at Download

Arperum

@RoryAlsop I might do so tonight. At work now though. It'll be a while until I'm home.

Rory Alsop

09:35

enjoy - try Glory Hole, and perhaps the video from Download Festival of "17 girls"

AviD

@LucasKauffman - the adobe password hack was because they DIDN'T hash the passwords at all, let alone salts - they used 3DES in ECB mode, so no salt and also no IV (which is used typically for chaining modes...)

this re the daveboss nosalt q.

also, I dont blame the manager in this case - I blame the consultant who did a pisspoor job of halfsplaining salts to the clueless boss.

FEichinger

@Lighty Don't make jokes about me. It's unhealthy for you.

AviD

@FEichinger @Lighty he's right. Only we get to make jokes at @FEichinger. You haven't earned that privilege yet.

Lighty

@AviD yarr harr

FEichinger

Dead serious. There's a very limited set of people who I allow making jokes about me. Anyone else gets a bump right up my shitlist.

AviD

09:47

@FEichinger So, there is a whitelist of permitted jokers. I would assume there is also a blacklist of severe offenders. Now, we hear that there is also a brown list??

emberfang

go easy, he's just out of bed you meanies :p

FEichinger

@AviD I could now make a nazi joke, but I feel that'd be insensitive.

Transcript for