The DMZ

Terry Chia

00:21

Woah, @ThomasPornin is all over my Twitter feed.

ManishEarth

@TerryChia ?

I thought he didn't have a twitter account?

David Freitag

@ManishEarth No, but the community is posting for him :]

ManishEarth

heh

Thomas Pornin

@tylerl I got my 15 minutes of fame.

Terry Chia

@ThomasPornin You are developing a reputation for spoiling SSL protocol vulnerabilities right before they get announced.

Thomas Pornin

00:34

@TerryChia Next time they'll ask me nicely not to do it.

tylerl

@ThomasPornin why don't you work here, anyway?

Thomas Pornin

@tylerl What is your "here" ?

Terry Chia

@tylerl Ooooh, I see they promoted you to Google recruiter. ;)

Thomas Pornin

Ah, Google.

ManishEarth

@TerryChia Oh, that happened? Wow.

Thomas Pornin

00:36

Well, if Google opened an office in Québec City, it would be negotiable.

Terry Chia

@ManishEarth CRIME and now this.

ManishEarth

ALL HAIL THE BEAR

tylerl

@ThomasPornin montreal isn't close enough, then.

ManishEarth

@TerryChia He discovered CRIME? :o

ooh, nice

192

Q: CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?

Terry Chia

@ManishEarth Yeah, where have you been man?! :P

ManishEarth

00:39

@TerryChia Hey, I wasn't around that much in 2012 :P

I've seen the Bear's awesome answers and other stuff, didn't know he had predicted CRIME. And now (psh) POODLE

Thomas Pornin

@tylerl I'd prefer not to do a daily 500km commute. I am also wary of plans such as 3 days on site and 2 days on remote.

ManishEarth

@ThomasPornin wouldn't guessing the attack before release be a bit dangerous? :p

(for people who have to now immediately patch as apposed to having some time before it goes public)

Terry Chia

@ManishEarth This isn't a patch thing.

This is a protocol thing.

ManishEarth

@TerryChia You still need to patch your systems using the protocol, to not use it anymore, no?

Terry Chia

@ManishEarth And everyone in the world needs to do this, how will keeping it private help?

Thomas Pornin

00:42

@ManishEarth The announce was due tomorrow (they delivered it early) so the danger is small.

ManishEarth

@TerryChia Usually such vulnerabilities give time to major providers to fix them

(I'm talking about CRIME here, POODLE was announced from the outset as being "something wrong with SSL3")

Thomas Pornin

In the case of CRIME, the researchers tried to do some self-promotion with teasing, so it was fair game.

ManishEarth

haha

@ThomasPornin Google doesn't do full time remote? Bummer.

Thomas Pornin

@ManishEarth I used to work at home, on full time remote, and after a few years it grows a bit tiresome. I like to meet coworkers on a weekly basis.

ManishEarth

@ThomasPornin Hm, true

Terry Chia

00:50

Oh for the record, POODLE is a stupid name for a vulnerability.

ManishEarth

@TerryChia ++++infinity

Thomas Pornin

@TerryChia All vulnerability names are stupid. Vulnerabilities don't need names; they need reference numbers.

8

ManishEarth

CVE-FLUFFY-DOGGY

4

@ThomasPornin I volunteer for Mozilla Servo and most of the stuff is remote, with weekly video chat meetings. (And work weeks a couple of times in a year, but I haven't yet attended one due to college -- will attend one in December). I find the environment pretty awesome, though I guess if that became my day job it would be different

Thomas Pornin

@tylerl Answer posted.

Not my best, from a literary point of view, but it should fulfil its role nonetheless.

Terry Chia

01:08

@ManishEarth GSoC is over right?

ManishEarth

@TerryChia Long over

@TerryChia I still regularly contribute -- it's fun and I'm learning a lot

Terry Chia

POODLE: first SSL bug with an emoji. 🐩

Tweeted by eqe on October 15, 2014 at 12:49 AM

ManishEarth

The other day I did a major chunk of form submission for Servo

David Freitag

02:39

Delicious pumpkin seeds are delicious.

Simon

So, I get suspended and then @ThomasPornin finds a vulnerability. Let's do this more often, shall we?

Terry Chia

@Simon I'm not sure the two are related but sure, I enjoy both equally. ;)

2

Iszi

@TerryChia I dunno. I enjoy the former much more than the latter. The latter tends to create headaches in one form or another. The former tends to relieve them.

Terry Chia

@Iszi I guess it depends on what spectrum of infosec you sit in, I don't have any servers to patch or maintain so I enjoy seeing new and novel vulnerabilities. :)

David Freitag

03:29

@Simon You got suspended?

Stack Exchange

04:06

Water/ice has a lot of weird phases. Maybe asking 'where do birds go when it rains' is like asking 'where does Clark Kent go whenever Superman shows up?'

Kisunminttu

05:45

Good morning

David Freitag

06:11

@Kisunminttu o/

Terry Chia

Everything wrong with Computer Science education in a single Reddit comment.

David Freitag

@TerryChia All of the buzzwords

Terry Chia

@DavidFreitag He suggested MVC for something that's literally iterating over a string and maintaining a counter (that's if you completely ignore Python's standard library)... I need to drown my sorrows in beer.

David Freitag

@TerryChia Already done. Apparently I drank a whole bottle of wine

Rоry McCune

06:32

Mornin' All

Terry Chia

@RоryMcCune Morning.

Rory Alsop

07:16

Morning

Lighty

g' 'murnin' folks

Lighty

07:30

i told cortana on my phone to open the pod bay doors

she told me she's afraid she couldnt do that

deed02392

09:29

mornin

Deer Hunter

09:51

@Lighty - Hi! I've seen you editing a number of posts lately, while the edits may be sometimes OK, please try to fix all the issues with a post without introducing new ones. E.g., in security.stackexchange.com/review/suggested-edits/38532 you changed "shall" into "will", which changes the meaning quite a bit.

Lighty

@DeerHunter it does? o.o

Deer Hunter

@Lighty - "the more you live the more you learn. The more you learn the less you know" :((

Kisunminttu

@DeerHunter So... skip the schools and start attending the "school of life"?

Lighty

@Kisunminttu isn't that exactly how problems are created? xD

Journeyman Geek

@Kisunminttu tried that. Apparently they don't like your certs if they are done in red crayon

Ninefingers

09:59

@JourneymanGeek I can confirm through empirical evidence that the colour of the crayon doesn't matter, either.

It seems any use of crayon is unacceptable.

Rory Alsop

@Ninefingers depends if it has been correctly sharpened

Lighty

Ninefingers

@DeerHunter I don't think shall/will changes the meaning. Shall is just a future construct, e.g. I shall go and eat a sandwich in 2 minutes. You can put will in there, too. All he's saying is "this is going to be the scenario".

If you want to be really pedantic though, it should be I shall, all other subjects will... in British English. So since the website is the subject and is not I, it should be "will"....

@RoryAlsop Oh man, this is where I have been going wrong!

Please can I have a CV prep session to show me the correct use of crayons?

Terry Chia

@Ninefingers @RoryAlsop doesn't use crayons. He uses the blood of lions he kills with his bare hands.

Lighty

@TerryChia i wanted to make a blood of virgin comment here, or a dracula one, but that could go out of hand really quick, concidering the maturity of this room

Kisunminttu

10:08

@Lighty Laughed so hard at this

Lighty

yay :3

its a masterpiece

Terry Chia

What the fuck? When did we have a emacs.stackexchange?

Kisunminttu

@JourneymanGeek It would be funny if you actually tried that

Journeyman Geek

@Kisunminttu alas no, I don't even have luck with a typed out one.

I am hoping my new bsc helps

Lighty

I made my own one using a template from MS Word 2013, worked flawlessly for me xD

Terry Chia

10:23

@JourneymanGeek What sort of jobs are you looking for?

Journeyman Geek

@TerryChia not too picky as things are. Anything it thats not programming.

(And that's 'its not something I am great at rather than a dislike of it)

Kisunminttu

@JourneymanGeek You need to spice things up a bit, then! Crayons, legos, treasure hunt...

Journeyman Geek

A giant unicycle just passed by o0

Kisunminttu

@JourneymanGeek Define "giant"

2

Terry Chia

@Kisunminttu That's what she said!

Kisunminttu

10:28

@TerryChia Shoulda seen that coming

Journeyman Geek

Something like truck tyre diameter, but bike tyre thick

3

Lighty

@JourneymanGeek needs more vaseline then

Terry Chia

@JourneymanGeek ...

@JourneymanGeek Hmm, don't think I know anything like that unless you want to do pen testing.

Lighty

@TerryChia whith a giant unicycle?

Thomas Pornin

@Ninefingers "You shall not kill" vs "You will not kill"

Arperum

10:39

@DeerHunter If "shall" and "will" are not the same, what's the difference then? How did switching these out change the meaning of that sentence?

TRiG

Now that's a lot of alt names.

Ninefingers

@ThomasPornin What's the difference between those two? There's no implied doubt in "shall", especially in British English. If you say "will you read the paper tomorrow?" and I say "I shall", that's no different to "I will", except that "I shall" is more pedantically correct in archaic terms.

Arperum

Yea, to me the only difference between the two is that "shall" sounds more archaic, like from back in @RoryAlsop's youth.

Thomas Pornin

@Ninefingers When used with "you", "shall" implies a duty or command, while "will" is merely factual.

If I say "you will not kill" I am mostly predicting that your hands will remain bloodless. With "you shall not kill" I command you not to kill (without asserting whether it will work or not).

The "shall" and "will" can be swapped in many situations, but the nuance is still distinct.

When you are a supreme deity, you use "shall".

Lighty

"Thou shall not pass!"

Ninefingers

10:55

@ThomasPornin It really depends on the speaker, but generally yes, that's how I'd read your example (oxforddictionaries.com/words/shall-or-will). But, in the case of the edit in question, it's just an expression of futureness. You could put it as "is going to be running on..." and it would work too.

Deer Hunter

@Ninefingers - maybe I'm already senile and hair-splitting...

Ninefingers

@DeerHunter It is archaic sounding to my ears (British English natively) the way it was used, but also not the end of the world. Still, I wouldn't lose any sleep over changing it (or not).

Thomas Pornin

@Ninefingers I have not read the edit; I am commenting in a general way.

deed02392

shall to me is more expressive in terms of the speaker not permitting the action

Ulkoma

Hello

deed02392

11:02

'will' is more a prediction that the speaker is making

Adnan

@Ulkoma Welcome, stranger.

Ulkoma

:) finally someone figured it out

@Adnan thanks for the welcome

Ninefingers

@ThomasPornin I understand :) - I don't think it's possible to generalise shall though :) Perhaps I shall try ;)

Deer Hunter

Poodle Poodle Poodle... Do I understand correctly that I have to set Firefox security.tls.version.min to 1 to work around the Níðhöggr-like vulnerability?

Adnan

@Ulkoma Where are you from?

Thomas Pornin

11:06

deed02392

For users who don’t want to wait till November 25th (when SSLv3 is disabled by default in Firefox 34), we have created the SSL Version Control Firefox extension to disable SSLv3 immediately.

Kisunminttu

@ThomasPornin Why does it have five legs?

deed02392

@DeerHunter

Ulkoma

@Adnan Well I have been living in the UK for the last 8 years, so I think it's ok to say that I am from UK

Lighty

@ThomasPornin not sure if vool logo, or kinda creepy

Arperum

11:07

@Kisunminttu probably just a head, and it's dripping blood.

Adnan

@Ulkoma But you're from Finland, right?

Please be from Finland

Deer Hunter

@deed02392 - Thanks.

Ulkoma

@Adnan sadly no , or I would not call myself ulkomalainen , my grandmother is from Turku tho

Kisunminttu

@Ulkoma What's the inspiration behind your nick?

Adnan

@Ulkoma I thought that you're calling your self and ulkoma because you're a foreigner in the UK.

Ulkoma

11:11

@Kisunminttu thats for you

Adnan

@Ulkoma She's a Finn :D

Ulkoma

ohhhh lol

Kisunminttu

@Ulkoma Asked you that because of what you answered @Adnan and I found your nick very visually pleasing :)

Adnan

@Kisunminttu I have something else that you'd also find very visually pleasing.

3

Ulkoma

i see :)

Kisunminttu

11:15

Interesting that Google translates it to alien... Foreigner would be more accurate, but that's just my opinion

@Adnan Oh you have many things that are very visually pleasing

Arperum

Aug 14 at 5:56, by Terry Chia

@Adnan @Kisunminttu Get a room guys. Another room. :)

Kisunminttu

@Arperum We already tried that, but this is more... exciting

Lighty

@Kisunminttu does he suprise you with random gifts that consit out of chocolate and really sosft plushies? because that is visually pleasing

Adnan

@Kisunminttu Alien sounds quite accurate, actually.

Arperum

@Kisunminttu ... Bit exhibistionistic?(I might have messed up the spelling on that word)

Kisunminttu

11:17

@Adnan I was going to call you "my alien" to prove a point but then I realized "my foreigner" sounds even more creepy

Adnan

@Arperum Somebody flagged that

What the hell?!

Kisunminttu

@Lighty Actually, yes. Yes he does.

Arperum

@Adnan Awesome.

Is the "fuck"-flagger active again?

Lighty

@Adnan someone is stepped really quickly on their toes

Adnan

@Arperum Was there some insult that I might have missed?

Kisunminttu

11:18

Trolls trolling on trolls

Ulkoma

@Kisunminttu My wife asked me more than once why is her number saved on my phone under the name "kulta"

Adnan

@Lighty I marked it as invalid. I imagine many others did as well

Lighty

@Arperum no, yesterday was me, because i didn't feel good bout that situation, since it was circling around me too

Adnan

@Ulkoma That's actually very sweet

Arperum

@Adnan Nope, but someone has been going around lately flagging random messages that contain the word fuck. Even five day old messages.

Kisunminttu

11:19

@Ulkoma So you're into the whole Finnish thing?

@Adnan Agreed

Adnan

@Kisunminttu You know who's else into the Finnish thing?

Ulkoma

@Kisunminttu yeah

Arperum

@Lighty I don't know about yesterday, but did you go through the transcript from the Brisdge flagging anything containing "fuck"?

Kisunminttu

@Adnan If by thing you mean me, I'd assume the answer is you?

Lighty

@Arperum nope

Adnan

11:20

Mmm.. yeah. I think we might be going too far

Arperum

@Lighty Then I was not talking about you :)

Kisunminttu

@Adnan Or are you referring to the Finnish patriots...

Adnan

@Kisunminttu FOR WHITE FINLAND!!

Lighty

@Arperum i thought that the "f" flagger was referring to a certain situation form yesterday, my bad X.x

Kisunminttu

@Adnan Isämmaan puollustaja

Arperum

11:21

@Lighty I don't even know what situation you are talking about.

Lighty

@Arperum good

Arperum

@Lighty I asume you did something stupid (I'm aware this might be a bit offensive, sorry for that). And someone decided to go for a round of lighty-bashing?

Lighty

@Arperum no-no-no, dont worry, im not easely ofended, most of the time, but it wasnt about lighty bashing this time, thats @AviD's or @Adnan's job, there was a small spark inbetween 2 people when one guy commented on a convo inbetween me and someone else, and that might've set off flames, well, atleast i didn't feel entirely good about it

raz

Good morning

Lighty

hey raz :3

Arperum

11:34

@Lighty If it made you feel bad, it was your full right to go flag it.

Lighty

@Arperum i've ran multiple chatrooms over the years, and i own a Minecraft server, im used to childish behavior, so i generally don't mind it, and quietly deal with it, except when it's aimed at me, then i either ignore it or get rid of it

i should try ignoring more instead of challenging it

but as a MC server owner, you're used to a '/mute [player] [time]' command that works really effectively

Arperum

@Lighty You can hide messgaes from a specific person until you refresh here (hide posts), or forever (ignore feature), where forever is seen as: until it is undone.

Lighty

@Arperum i know, but i just don't like the "ignore" function that much in a chatroom, the hide posts one is acceptable

Terry Chia

11:51

@Adnan Just be aware that what @Kisunminttu find visually pleasing we might not like that much. ;)

Lighty

@TerryChia speak for yourself

runs

Arperum

@Lighty He said might, so if you want to exclude yourself from his exclusion, you are welcome.

Lighty

@Arperum ;P

this is a perfect example, of one of thse boring days

i NEED my tablet to continue, otherwise im stuck

forgot to charge the darn thing

raz

This is a perfect example of one of those boring days because I'm hung over from the hockey game the previous night.

Lighty

@raz water and asperin

its too silent

deed02392

12:10

@Kisunminttu Also agreed. That's what I used to call my Finnish girlfriend

moi, kulta

Lighty

i always call mine "Dot"

as in .

it feels weird speaking her real name instead of Dot

Terry Chia

If you do not upgrade your Drupal sites tonight there probably won't be a tomorrow. #drupageddon

Tweeted by i0n1c on October 15, 2014 at 12:08 PM

Sounds fun.

Arperum

@TerryChia WHat's going on with drupal?

Terry Chia

@Arperum Security advisory coming out tonight I think.

Stefan Esser has been hinting at it for a while so it's probably bad.

Arperum

@TerryChia As a partly (mostly probably) security unaware moron I don't know that name.

> He is also known as the first who completely broke the DRM of the Microsoft XBOX with software only exploits.

That's kinda fancy.

Terry Chia

12:17

@Arperum He's a pretty well known security researcher that does work on PHP and iOS.

Adnan

@TerryChia I'm extremely excited for this one

Terry Chia

@Adnan Yeah, the way he has been talking about it it doesn't sound like a normal XSS or similar vuln.

Drupal gave 5 days notice on this one: groups.drupal.org/node/445893

Adnan

@TerryChia Yup, I was checking it

Terry Chia

This was an excellent month for high impact vulnerabilities. Fun for researchers and pen testers not so fun for sysadmins.

Adnan

@TerryChia It's extra fun in the OSCP labs :D

Kisunminttu

12:29

@Lighty Aspirin is not recommended because it thins the blood, which adds to the blood thinning effect of alcohol. :)

Lighty

@Kisunminttu weird, grandpa always told me that helped against a hangover xD

raz

@Lighty Half a can of coke, then water. Drugs never help

Adnan

@Lighty Your grandpa is right, if you take a pill or two MAX

It helps with the headache

Liver and blood-thinning impact is minimal if you use in moderation (1-2 pills)

Rory Alsop

13:00

@Lighty The winning solution is Irn Bru and a fry-up, apparently*. This is how Scotland survives.

(* dunno - don't get hangovers, but I know a lot of folks who swear by Irn Bru)

raz

@RoryAlsop So old, alcohol doesn't effect you

Rory Alsop

@raz au contraire, it affects me very well

raz

13:17

@RoryAlsop My problem was drinking Miller Lite, I never get hang overs with good beer.

Xander

13:32

@raz That's odd, actually. You should get more hangovers with good beer (higher alcohol content) than with Miller Lite (corn flavored water)

2

raz

@Xander Higher alcohol, but cleaner and better quality. I've noticed much less hangover effects.

Xander

@raz Unless, of course, you're referring to the fact that you drink good beer more moderately, so as to enjoy the flavors, and because you don't feel the need to drink 15 of them to forget the taste.

@raz That's actually a misconception. American Light Lagers are some of the cleanest beers you'll ever drink. They're heavily filtered, in part to ensure consistent flavor. Some of the nastiest beer out there (from a particulate and dissolved solids perspective) are the oak-aged ales and stouts that we all love. The alcohol and water act as solvents on the oak, leaching out all kinds of yummy compounds that really shouldn't go in our bodies, just as with whiskey.

Terry Chia

@Xander Or you know, your body just really hates the taste of shitty beers and gives you hangovers to punish you.

3

raz

@Xander All I know is that American Light beers effect me differently than craft beer.

@TerryChia It's really the Universe slapping you in the face.

Xander

@TerryChia That's entirely plausible.

raz

13:44

@Xander I just had a beer aged in Lagavulin barrels. A little too much scotch with the beer.

Xander

@raz Oh yeah? What was the beer?

raz

@Xander checking untapped...

Xander

@raz Oh, that's right, I still need to friend you there!

raz

JW Lees and Co - Harvest Ale (English Barlywine)

@Xander zmazar

Xander

@raz Done

raz

13:51

@Xander Done, and no activity?

Ninefingers

@RoryAlsop I think fry-ups are pretty much universally applicable.

At least in the UK

raz

<-- ignorant American, @Ninefingers What are fry-ups?

Ninefingers

@raz Get a frying pan. Fry bacon, eggs, tomatoes, mushrooms. Add toast, beans, ummmmm black pudding, sausages. I think I missed something

Lighty

@Ninefingers beer

raz

mushrooms are terrible, but the rest sounds delicious.

Ninefingers

14:03

Anyway it is a full English breakfast. If you have every component it's called the full nine yards.

raz

Gotcha

Ninefingers

Sorry, perhaps I should say "full British breakfast"

Lighty

ooohhhh, BREAKFAST, then you missed scotch, not beer

Ninefingers

Obviously though following the recent vote, Scotland's power to decide what constitutes a breakfast/hangover cure has been devolved as part of further autonomy for them.

Along with a host of less important issues like spending and tax.

@Lighty I think that only counts if you didn't sleep.

@Rory what am I missing. I've got 8 of the 9 things...

Ahaa!

Terry Chia

@Ninefingers Black pudding is probably the only one I'd not like.

Ninefingers

14:08

If you have left over potatoes, you can fry them too.

Terry Chia

But that's a damn heavy breakfast though, I generally don't eat that much in a single meal.

Ninefingers

@TerryChia Contrary to the belief of all Europeans where I now live, I don't eat this every day. It's pretty much an exception, usually before you go and do something like hiking all day.

And an average fry up is probably bacon and eggs, maybe some toast.

Terry Chia

@Ninefingers Hehe.

Ninefingers

maybe one or two other bits at most.

Terry Chia

I'd say a little bit of each sounds good actually.

Ninefingers

14:10

@TerryChia It's not a huge heap, usually a bit of each. It's a bit of an effort to make for one person - best if done for a few people.

and I was surprised, but I quite like black pudding. Just tastes like salt to me.

Terry Chia

@Ninefingers I have not actually tried it before, plus I'll bet it's near impossible to find over here.

Ninefingers

@TerryChia I'd say try it when you can. It's not nearly as bad as you'd imagine it to be.

Terry Chia

Dammit, i'm getting hungry.

Adnan

One of my Chrome extension was updated and it seems to have some adware with it.

This adware (Superfish) injects code in every page you visit

This code sends HTTP requests to superfish.com to track your purchases

I can see the HTTP requests in the console and the network tab in the developer tools

However, I cannot pin it on any extension

Is the only solution to disable one by one?

Ninefingers

@Adnan I think adblock/ghostery and the like already inject code into pages, specifically CSS, so it might not be the only extension injecting.

Adnan

14:23

@Ninefingers I doubt that Adblock Plus and Ghoestry are injecting code that is making HTTP requests to a spam site

Ninefingers

@Adnan No, but my point being they already modify the page, so you might want to turn them off while you debug :)

Adnan

Oho. Thanks

Ninefingers

I'm pretty sure that's how they work anyway, I read somewhere about injecting css rules

could be wrong

Adnan

Found the culprit!!

Motherduckers!

chrome.google.com/webstore/detail/…

Looks like the author has removed it

> ChromeReload 0.9.3

Looks like I'm not the only one mturkgrind.com/threads/…

raz

1

Q: SSH key passphrase update and multiply locations

I have a ssh key which I use to upload code to github. the private key is located on several locations from where I upload/download data. I wonder how can I update (or expire) old keys after I update the passphrase on some of the locations. I wish to avoid a split situation where some location u...

ssh key-management passphrase

Xander

14:28

@raz Ha, nope. Haven't bothered to use it yet. I post my beers on my blog, and I'm not even always good about doing that. I've reviewed about 350 there though.

raz

He's doing something wrong here right? Or am I misunderstanding what he's asking

@Xander Link to your blog?

Xander

@raz opencraftbeer.com

Simon

@Adnan I'm assuming extensions can't actually harm your OS, right?

raz

@Simon If by can't you mean can

Adnan

@Simon In theory, Chrome extensions can't do much harm, at least not this one because it doesn't require too many permissions. The issue is that it's able to inject code in any page I visit, even HTTPS pages

Terry Chia

14:32

I think Chrome sandboxes extensions?

Adnan

@TerryChia Yes

Thomas Pornin

Mmh, I could have sworn that the Google blog post announcing the Poodle details quoted me as having independently discovered the flaw. This morning the post no longer states so.

Terry Chia

Yeah, so it depends on your definition of "harm".

Adnan

I've dissected the code it looks like it's tracking anything I purchase from eBay (and a bunch of other sites)

Not that big of a deal for me

I'm just afraid that at some point the code might have included pieces to collect other data

Xander

@ThomasPornin Hacker News credits you. news.ycombinator.com/item?id=8456178

Thomas Pornin

14:36

@Xander Yep. And Google did, too, but they apparently changed their mind.

Adnan

@ThomasPornin How so?

Xander

@ThomasPornin Figures. Bunch of chumps. // cc: @tylerl

Terry Chia

4 mins ago, by Thomas Pornin

Mmh, I could have sworn that the Google blog post announcing the Poodle details quoted me as having independently discovered the flaw. This morning the post no longer states so.

Thomas Pornin

I am OK with them not crediting me (it is their attack after all).

But taking steps to remove my name is kind of sloppy.

Adnan

@TerryChia I should have said "Why do you think they did that?"

Terry Chia

14:39

@Adnan Yes, yes you should. :)

Very different meanings.

Thomas Pornin

@Adnan The announce post does not match this morning what I remember from it as I read it yesterday.

I am talking about this one: googleonlinesecurity.blogspot.ca/2014/10/…

so either my memory is failing, or the post has been changed.

raz

@ThomasPornin "Does this apply to SSLv2 as well?"

Xander

@ThomasPornin To be honest, I don't remember seeing you credited there last night. But it could have been that I didn't read it until after it changed. When the post first came out, the pizza had just arrived at the OWASP meaning, and SSL was not at the top of my priority list.

raz

Stopping effing using SSLv2!!!

Thomas Pornin

@Xander Pizza trumps security.

5

Indeed, disguising yourself as a pizza delivery man is a time-honoured way to gain unauthorized entry to various buildings.

Xander

14:44

@ThomasPornin And particularly so during supper time.

raz

@ThomasPornin Disguising yourself as a pizza delivery man is a timing attack on SSL as they distract you from the truth.

AJ Henderson

@raz you also have to get there when they are hungry

raz

@AJHenderson Nobody rejects pizza

Rory Alsop

@raz depends. If haggis pizza, definitely correct in my case. If Dominos - I'd rather eat my own foot

AJ Henderson

news.ycombinator.com/item?id=8456178

apparently we aren't the only ones who realized we should just start feeding Pornin rumors to make real reports from

raz

14:51

@AJHenderson That is SO 20 minutes ago

Rоry McCune

15:12

@raz yeah where's my new Internet breaking 0-day it's been almost 18 hours since the last one!

Terry Chia

@RоryMcCune Give it a couple of hours. Drupal is going down soon.

Rоry McCune

@TerryChia nice!

Terry Chia

This is very interesting: arstechnica.com/security/2014/10/…

thegrugq is the one behind it so it should be solid.

Terry Chia

15:34

POODLEing: (v) Exploitation of an #SSLv3 vulnerability. (n) Incident that releases personal images via a #POODLE attack. See #fappening.

Tweeted by SecurityHumor on October 15, 2014 at 3:33 PM

Jeff Ferland

@ThomasPornin: are you 3/3 now? POODLE, CRIME, and Heartbleed?

Thomas Pornin

@JeffFerland I did not predict anything with regards to Heartbleed; I just stated that all other people were idiots.

Digital Fire

@TerryChia nooo not drupal! >=D

Ulkoma

Guys I have a question if you dont mind

Adnan

@ThomasPornin Not a wrong prediction. 3/3 in my book

@Ulkoma Shoot

Ulkoma

15:46

I had to delete it yesterday

I wanted to know what are the duties of a security expert

Thomas Pornin

@Ulkoma We don't mind questions but we don't guarantee that answers will be pleasant.

Ulkoma

do you just sit and wait for an attack

Adnan

@Ulkoma Impossible to answer

@Ulkoma Be more specific

Ulkoma

@Adnan ok

Thomas Pornin

@Ulkoma Do your job.

The job entails taking proactive steps.

There is always something to do, at least thinking, documenting or educating.

Adnan

15:47

@Thomas Is a security expert who is really good with crypto (and other things), and he does that. @RоryM is a pentester, he causes attacks. I assume that @Jeff makes code more secure to prevent attacks

Ulkoma

I see

Adnan

All of them are security experts, and hardly any of them does the same things as the other

Terry Chia

@Adnan It's Facebook. @JeffFerland is probably just looking at pictures.

Adnan

(same applies to the others here, but I don't think I'm familiar enough with what they do)

@TerryChia :D

Jeff Ferland

@TerryChia I didn't know what "twerking" was until Instagram released the video feature. Dear heavens...

Adnan

15:50

@JeffFerland Twerking?

Is it related to Twitter?

Like, tweeting while working?

Jeff Ferland

@Adnan Shaking ones ass rapidly and vertically, typically while bent forward.

Adnan

@JeffFerland Wikipedia confirms

> Twerking (/ˈtwɜrkɪŋ/) is a type of dancing in which an individual, usually a female,[1] dances to music in a sexually provocative manner involving thrusting hip movements and a low squatting stance.[2]

2

Kisunminttu

@Adnan I much prefer the wop

Adnan

@Kisunminttu The wop?

> Wop is a pejorative slur used to describe Italians, or people from Italy.

Kisunminttu

@Adnan youtube.com/watch?v=vb2Oqfj_c70 2:33 ->

Xander

15:56

@Ulkoma Another way to say what @Adnan has already explained, "security expert" is not a job. There are a number of different jobs in the security field (both information and non-information security, all of which may be staffed with "security experts") and they all have different duties. Very very different duties.

Ulkoma

OK

So being a security expert is an extra

Xander

@Ulkoma An enterprise security architect's job will not have any daily duties that overlap with a penetration tester's job, or of a personal security specialist designing a bodyguard detail.

Jeff Ferland

AssertionError: False is not true (going to be a long day)

AJ Henderson

@Ulkoma fundamentally, a security expert is just someone who understands one or more aspects of security, but there are numerous diverse jobs within the field that make use of security skills

Terry Chia

@JeffFerland That looks like Python?

AJ Henderson

15:58

there are dozens, if not hundreds of different possible jobs

Xander

@Ulkoma In the Vinn diagram of security related fields "security expert" is the set that overlaps with or contains every other set.

AJ Henderson

ranging from writing new cryptography algorithms to being a bodyguard (note that even if you limit it to "information security", physical security concerns are still a factor

Transcript for