The DMZ

tylerl

01:18

@DavidFreitag Not only is drinking at work NOT against the rules at Google, in many cases they provide the alcohol.

Xander

@tylerl How's the new gig?

tylerl

pretty kickass

David Freitag

@tylerl Interesting. And awesome.

Xander

Excellent!

David Freitag

@tylerl Have you gotten a floating desk for your office pool yet?

tylerl

01:22

@DavidFreitag wtf does that even mean?

David Freitag

@tylerl A desk that has enough buoyancy so it floats on water?

tylerl

This was me at work last week.

The park area is between buildings and badge access only.

and yes, lots of people bring their dog to work.

David Freitag

01:39

@tylerl So jealous.

Terry Chia

04:04

diogomonica.com/posts/…

Pretty interesting article.

Rоry McCune

07:33

@TerryChia interesting yes.. but he doesn't describe a security environment I recognise at all

Terry Chia

@RоryMcCune Never said it was practical. :)

Rоry McCune

@TerryChia wasn't suggesting you had, but he seems to work in a world where take up of scrypt and bcrypt is good!

I don't think I've ever seen scrypt in the live

I've see bcrypt, but generally only when the framework uses it by default

Terry Chia

@RоryMcCune Aye, he's describing a perfect world where all developers follow good security practices and where users aren't completely stupid.

Rоry McCune

also he thinks that users know how to choose good passwords!

@TerryChia yeah like I said not a world I recognise :)

that said password vault is what I do

only sane way for me to handle the number of passwords I have

Terry Chia

I use Google OpenID whenever possible.

Rоry McCune

07:39

@TerryChia yeah if you're ok with ecosystem lockin that kind of solution is fine

just be careful never to annoy google or do anything against their T.o.S :)

Terry Chia

@RоryMcCune Almost everything I have is linked to my gmail account anyway.

Rory Alsop

08:16

mo'nin all

Rоry McCune

@RoryAlsop Watcha'

hows Livi today?

Rory Alsop

@TerryChia Ahh - a PHD. Not yet realised what the world is actually like.

@RоryMcCune Really sunny and warm, bizarrely

Rоry McCune

@RoryAlsop wow we've got misty and cool

Rory Alsop

think I'll get the kids to help me cut the hedge today. They can sit on top and hack it, I'll pass up the power tools :-)

Rоry McCune

@RoryAlsop sounds like a plan. We've been letting our hedge grow out this year but at some point it is going to need a trim...

Rory Alsop

08:19

Hamish is looking at buying a quad/hex copter... not sure this will end well :-)

@RоryMcCune ours grew 4 feet this year! Need to chop at least 3 feet off it

Rоry McCune

@RoryAlsop yoinks! Maz is keen to get our hedge growing as much as possible to block out any view of civilisation from the garden :)

BTW had my first whisky which required water last night... A’bunadh, at 60% was a bit overpowering neat..

Terry Chia

@RоryMcCune You trying to get @RoryAlsop to volunteer his kids as well? ;)

Rory Alsop

@TerryChia they'd be totally up for it

Especially if your chainsaw is petrol powered - mine is only an electric one

Terry Chia

@RоryMcCune Also, that's what she said!

Rоry McCune

@RoryAlsop we pretty much have to go either petrol or battery here, corded stuff is a bit of a no-no

Terry Chia

08:32

Rory Alsop

@TerryChia ...... okay

Terry Chia

@RoryAlsop "Back in my day we only had holes in paper"?

Rory Alsop

@TerryChia well, once we invented paper, sure :-)

We had holes first

Terry Chia

@RoryAlsop I didn't know you were chinese. ;)

Rory Alsop

@TerryChia ;-P

Iszi

08:39

@TerryChia Dafuq? Someone made an Emoji programming language?

Terry Chia

@Iszi It's not an Emoji programming language. It's just a language that supports unicode identifiers in code.

Rоry McCune

apparently a lot of them do

3

c# for example

Terry Chia

@RоryMcCune Does Ruby? I know Python only allows a subset of unicode.

Rоry McCune

@TerryChia ooh good Q about ruby I've not checked...

ahh the answer to all our questions on this topic.. rosettacode.org/wiki/Unicode_variable_names

Terry Chia

It's still a horrible thing to do and any programmer actually doing it not as a joke should be fired.

Rоry McCune

08:53

indeed

Terry Chia

Man, someone flagged "YO MOMMA" in another chatroom.

That's so lame...

Terry Chia

09:46

Rоry McCune

10:40

HTTP/2 implementation coming in the next version of IE

blogs.msdn.com/b/ie/archive/2014/10/08/…

gonna play havok with testers this one, HTTP/2 is binary rather than ascii....

Terry Chia

11:09

@RоryMcCune It's a standardized format though, so there should be tools to deserialize it.

Rоry McCune

@TerryChia sure but at the moment those tools don't exist and it'll break all the existing ones that rely on it being ASCII

so lots of redevlopment

of course in well written software it should be a question of replacing a library and updating

but in hacky pen tester written stuff....

heh I just realised it'll break all the web content management filters too, that'll make vendors happy

"upgrade now to super-filter 2015, only $10,000"

AviD

12:15

@RoryAlsop hullo suh, what you referring to suh?

Rоry McCune

@AviD watcha' @AviD hows the JavaScripting?

AviD

@RоryMcCune heh, thankfully I'm back on saner ruby today

Rоry McCune

@AviD \o/ you doing tools development stuff?

Terry Chia

@AviD This is proof you have gone full hipster.

AviD

I do have a scary PHP task looming, I dread the day I will need to delve into that

@TerryChia heh, everything is relative

> YOU NEVER GO FULL HIPSTER!

Rоry McCune

12:24

@AviD yoinks you'll be a language polyglot soon!

Terry Chia

I think i'm the opposite of you, I'm going to hippy-land for the time being.

AviD

@RоryMcCune not inasmuch, no - we need to cover all dem hipster languages, so I need to be familiar with them - and their vulnerabilities

@RоryMcCune lil bit, yeh :-)

Rоry McCune

@AviD ahh I C well PHP it's easy, see PHP, know PHP is vulnerable :)

Terry Chia

@RоryMcCune Doesn't sound as good as "Full Stack Javascript Ninja".

Rоry McCune

Ruby's big weak point for me is the dynamic nature

monkey patching is part of the community

and is v. dangerous for security in a lot of cases

AviD

12:25

@RоryMcCune sure, but try and talk the devs out of using it....

Rоry McCune

last two rails apps I reviewed had Monkeypatched ActiveRecord to do SQL Injection protection...

Terry Chia

@RоryMcCune Isn't fair to blame dynamic typing for that. There are plenty of dynamic languages that don't encourage monkeypatching.

AviD

@RоryMcCune oo thats actually damn cool.

Rоry McCune

@TerryChia I wasn't, I was saying it's a ruby thing

@AviD hipster :op

AviD

hahaha, no no, its be sekooriteh!

Rоry McCune

12:27

it's also dangerous, I saw one place that had monkeypatched XSS protection and then in one place they monkeypatched the same call, without realising about the original one and gave themselves XSS

AviD

@TerryChia and, some very not-dynamic languages that do. I'm looking at you, C++.

yes yes, I know its not the same as monkeypatching, but it is equivalently the same, and has the same problems (if not worse).

@RоryMcCune ah, yeah well...

Terry Chia

@RоryMcCune IIRC Ruby's monkeypatching is global in scope?

Rоry McCune

@AviD in small teams it prob. isn't too bad as long as everyone knows it's there, but on bigger teams... nightmare..

AviD

in other news, I've upgraded my hardware to 32GB RAM.

So, I might be able to run firefox now.

Lucas Kauffman

@RоryMcCune I've seen stuff like that as well, fixing a security issue in a super class and then overriding the behavior when subclassing

Rоry McCune

12:29

@TerryChia can be sure you can path string if you like

Terry Chia

@AviD Hahahah!

@RоryMcCune Uggggh. Python's behaviour is much more sane. Everything is module scoped.

Rоry McCune

@LucasKauffman a wild @LucasKauffman appears, yeah it's tricky and Static analysis tools almost never catch it 'cause they don't check the framework code

AviD

@TerryChia ooo like node.js

Terry Chia

@LucasKauffman Inheritance is terrible. :P

AviD

;-)

Terry Chia

12:30

@AviD YOU TAKE THAT BACK!

Lucas Kauffman

@RоryMcCune yea was moving my shit this morning, so didn't get a chance to check in yet :p

AviD

nuh uh

Rоry McCune

@LucasKauffman s'that you in the new place?

Lucas Kauffman

@AviD Now you made Terry cry. You bully!

@RоryMcCune yea, still trying to figure out how I'll get my washing machine and dryer up

might need to take them apart

Terry Chia

I'm having fun with clojure actually. It's totally different from the stuff I'm used to so that's pretty neat.

Rоry McCune

12:31

@LucasKauffman ahh yeah those are always tricky if you're up stairs

Lucas Kauffman

@RоryMcCune renting a lift is like 120 euro

so I'm first going to try like this

AviD

@TerryChia Clojure is like Ruby written in Java.

Terry Chia

@AviD Nah, Clojure is nothing like Ruby.

AviD

you dont know ruby.

Terry Chia

Ruby isn't a Lisp. Unless someone found a way to monkeypatch the syntax. ;)

TildalWave

12:43

@RoryAlsop not that I'd know of

For one, I don't recall getting such nice fan letters as this one:

Mostly I'd get completely different fan mail informing me of deaths of wealthy relatives in some banana republics that apparently left me a great deal of money in their will and I didn't even know they existed. :|

Of course, being in part a vampire, my family members don't even die they merely become immortal :)

Rory Alsop

Afternoon folks!

Lucas Kauffman

afternoon

Terry Chia

13:15

Anyone getting SSL errors on reddit? I think cloudflare screwed up their stuff.

TildalWave

13:27

@TerryChia looks fine to me

Terry Chia

@TildalWave Fixed now, looks like an intermittent thing. I had the same problem with HN earlier.

TildalWave

@TerryChia You're being Cloudflare MiTM-ed :))

aka SSL mossaded

as long as you continue using the internet for things you were using it so far, you should be fine :P

Adnan

14:20

So there's a campaign in Finland against the State Regional Administration Agency (Avi, for short) for trying to get the "Beer and whisky expo" to remove the "whisky" from their name because it is "advertising strong spirits"

TildalWave

14:50

Why are they ALWAYS C# devs?

@TidalWave the fluid is to create a 0-g like environment regardless of actual acceleration. Same/similar effect is used in NASA training (IIRC) and to support a whales huge size. Not perfect, there are limitations, but 40G may be within limits. Of course, largely academic until someone ponies up a few billion. — NPSF3000 10 mins ago

Terry Chia

TildalWave

15:22

@TerryChia cute

so you're saying C# is to science like Fortran is to dating?

Terry Chia

@TildalWave No relation to your comment. :P

TildalWave

oh :(

Terry Chia

Hey, I actually like C# a lot.

TildalWave

hey I didn't say anything about C# itself

wait, I did

Terry Chia

@TildalWave Hahaha

TildalWave

15:24

well I started with a question, it's your fault I ended up being presumptuous :P

damn be thee who actually like C# a lot!

AviD

@TildalWave you're wrong

this is pretty cool: facebook.com/video.php?v=374659006015288&fref=nf

@RoryAlsop ^ that should be your next automobile upgrade

Terry Chia

15:40

@AviD Heh, nice!

TildalWave

15:52

@AviD You're answering a question why with that? You're a C# dev? :P

Terry Chia

@TildalWave Oh no, he's a language polyglot now.

AviD

@TildalWave I... am having difficulty parsing that :-)

@TerryChia haha, this, i wish.

TildalWave

@AviD My question: Why are they ALWAYS C# devs? Your answer: you're wrong And yes, I'm having problems parsing that too :P

AviD

but really, even with all its shortcomings, C# does seem to be the best language for most situations.

Terry Chia

@AviD Assuming a Windows environment of course. Mono isn't quite there yet.

AviD

15:54

@TildalWave no no, I said "youre wrong" to "damn those who like C#"

my point was that C# is the path that leads away from damnation.

In most common scenarios.

@TerryChia yeah, true, but I said "most situations" ;-)

TildalWave

I'm not saying anything about C# tho, it's just an observation that some C# devs are the the majority of people we have on Space.SE that'd suggest fallacies as solutions.

you know, like asking why are they always PHP devs, only not as an observation to why websites don't work as they should

Rory Alsop

Pah - these newfangled notions. C++ was just fine

AviD

@TildalWave interesting

@RoryAlsop for some definition of "just fine" ;-)

TildalWave

And for the record, I kinda like C# too

Terry Chia

@RoryAlsop C++ was never fine.

AviD

16:00

57 secs ago, by AviD

@RoryAlsop for some definition of "just fine" ;-)

Rory Alsop

17:51

Well you know my opinion. I was always happiest in 6800 or 68000 assembler. At least C wasn't too abstracted. I don't have a clue what underlies some of these new languages

TildalWave

18:23

Can we somehow make reviewers pay more attention to what edits they're approving?

16

A: How can security audits be integrated into an agile project?

Microsoft's guidelines for Security Development Life-cycle (SDL) for Agile recommends security practices during design, implementation, and release of the project. Regardless of the development methodology in use, no line of code should make it into production until it has undergone a security ...

Financial definitely doesn't fit there instead of Finical. For one, offloading a task to peers doesn't make it any less costly, frequently quite the opposite.

Gilles

@TildalWave uh? The sentence doesn't make sense with finical

it does with financial

the choice is internal review by peers vs external audits by professionals

TildalWave

@Gilles Followed by level of scrutiny? I'd say it does.

> showing or requiring great attention to detail

Rory Alsop

19:26

@Tildal erm...I'd say the only way that sentence makes sense is with "Financial"

I'd have to go with @Gilles on this one

Rory Alsop

19:50

also @TildalWave - I always thought of mankind as humans...some folks are slightly troublemaking, methinks. That said - I think your solution is spot on

TildalWave

@RoryAlsop I can accept that I got it wrong and that the suggested edit was indeed appropriate, what I have issues with is that nobody asked Rook (the author of the post that the meaning was now changed) about it. I read that answer before and while I thought, OK, unconventional use of a word, but I dig it, I didn't even think to try and correct it without being sure it needs it.

@RoryAlsop Yeah, that's another matter and I kinda regret even responding to it because I was nearly opinion raped with something I don't even disagree, just don't find it an issue. Well, not on a site that's supposed to be forward-thinking at least I don't.

BTW if you're interested there's a great show on The Space Show now and they're totally buttkicking "Pathways to Mars"

in The Pod Bay, 1 hour ago, by TildalWave

The Space Show Classroom program featuring a panel discussion on the recent NRC Pathways Human Spaceflight Study hosted by Dr. David M. Livingston and panel members Dr. Jim Logan, Dan Adamo, and Dr. John Jurist is now podcast live. More info on today's show in the newsletter

Rory Alsop

20:12

@TildalWave cool - thanks for that.

Rory Alsop

20:35

@TildalWave Ah - I don't think the meaning was changed. I would have always assumed he meant financial, but made a misspelling. He'll have been notified of the change anyway, so will be able to confirm/argue

TildalWave

@RoryAlsop true that

Transcript for