The DMZ

Stack Exchange

00:03

Blog - Stack Exchange: Winter Bash 2014

Jon Ericson on December 14, 2014

There is no better antidote, at least for the worst hours and eclipses of the soul, than to conjure up … serious frivolity.—Friedrich Nietzsche

No, it’s not a new flavor of Unix shell. Rather, Winter Bash is an ancient tradition of Stack Exchange. (2011 is ancient according to Internet time.) Here’s how it works:

Starting right now, when you complete one of 30-odd challenges while logged on a participating site, you will be awarded the associated hat. To notify you, an icon will light up on the top bar. In addition, admire your hat collection on the Winter Bash 2014 site …

2

Rory Alsop

yay - first hats already

sorry @AviD

TildalWave

I'm installing SE apps just to get me some LOL

Stack Exchange

05:00

Lucas Kauffman

07:43

2

Adnan

07:56

@LucasKauffman You on Skype? I wanna ask you a few questions

Rоry McCune

08:15

@LucasKauffman i'd be worried if I was you.... one mention of Cyber'ing and @Adnan wants to get you on Skype :op

Adnan

@RоryMcCune Actually, I wanna talk to you too. Facebook?

Rоry McCune

@Adnan who me, yeah about to go out for a walk but back in an hour or so :) will ping you when I'm back

Adnan

Lovely

Lighty

What is this hat thing

xD

SE turned into a winter team fortress?

3

Journeyman Geek

HATS!

4

(we did it last year too)

Lighty

08:23

ahhhh

xD

Adnan

08:41

aaand clicking "I hate hats"

Rory Alsop

@Adnan Are you related to @AviD? :-)

Adnan

08:59

@RoryAlsop Maaaybe, but I'm more good looking

Haaa!

Rory Alsop

@Adnan lol - I saw your latest facebook profile pic update

AviD

09:13

@Simon so what's it feel like?

@RoryAlsop whaaa? HELLS NO

@RоryMcCune no no, you misunderstood the subtitle - that 's "Javascript, a playful introduction to (pseudo) programming"

@TildalWave yeah thats not fair, SE needlessly discriminates against WP owners.

/cc @Iszi.

its not our fault we have better taste, and prefer a superior device.

Terry Chia

09:36

"Why isn't there malware for Windows Phone?" Who's it going to infect? They can't even get @edbott to use a Windows Phone.

Tweeted by SwiftOnSecurity on December 15, 2014 at 1:15 AM

/cc @AviD

"Why isn't there malware for Ubuntu?" Because Linux malware isn't compatible with Ubuntu.

Tweeted by SwiftOnSecurity on December 15, 2014 at 1:05 AM

AviD

09:54

heh. thats a good one.

AviD

11:26

WHAT. I find this incredibly shady - the wikipedia entry for BSIMM redirects to.... Cigital? Spammy much?

ftfy.

though now its showing an empty page, instead of a nonexisting one...

Huh. somebody already reverted that... WTF??

Rory Alsop

@AviD wut??

Cigital don't own BSIMM do they? I thought they just coordinated

@AviD linky?

AviD

thast to the best of my knowledge, too

Cigital

Cigital is a software security firm, based in Dulles, VA and provides a full range of software security solutions and products to its clients. These include Static and Dynamic Security Testing as a Service (STaaS), Computer Based (CBT) and Instructor Lead (ILT) Training, Architecture Risk Analysis, Software Security program design and implementation, and SecureAssist, a product that acts as an application security spellchecker for developers. == History == Cigital was established in 1992 with grants from DARPA The technology in this product was eventually licensed to Kleiner Perkins and used as...

note that link is to BSIMM

hmm, maybe we're both wrong

Rоry McCune

@RoryAlsop t'was them + fortify that started it IIRC

AviD

I thought that was the NIST-blessed version, but that site (bsimm.com/facts) states that it was cigital + fortify that own it.

@RоryMcCune heh, looks like I was right. about being wrong.

@RоryMcCune so what am I thinking of?

Rоry McCune

tho they had Chandra Pravir (IIRC) work on the first version and then they had a parting of the ways and he started OpenSAMM

@AviD OpenSAMM?

AviD

11:34

no no.

ah. twas DHS, not NIST - and daaaamn close in naming: buildsecurityin.us-cert.gov

Rоry McCune

@AviD ahh

AviD

there is no way that cigital OR fortify would choose a confusing name on purpose, riiiight?

Terry Chia

Acronyms. Damn acronyms everywhere!

Rоry McCune

@AviD cynic :op

AviD

@RоryMcCune no, in this case its "disgusted cynic".

all this time I've been discussing and mentioning (and even recommending on occassion) BSIMM, because I thought it was vendor-agnostic.

Rоry McCune

11:37

@AviD ooh no you wanted OpenSAMM for that

@AviD tut tut recommending a Non-OWASP programme for which there is an OWASP alternative.

AviD

@RоryMcCune no, I thought I was talking about the maturity model part of DHS's BSI.

(okay I thought it was NIST, but whatev)

@RоryMcCune 2, actually

Rоry McCune

@AviD sure but BSIMM, and OpenSAMM cover the same ground IIRC

just BSIMM has the "interview" and metrics things going on

Terry Chia

@RоryMcCune I was under the impression that there is a subpar OWASP alternative for everything. :P

AviD

@TerryChia heeey

actually thats fair

Rory Alsop

@TerryChia ping (just keeping the party rolling)

AviD

11:39

well, there are some that are not so subpar

Rоry McCune

which conveniently gets Cigital in front of loads of senior security people on a regular basis to "interview them" for the next version (can't think where they got that idea eh @RoryAlsop ?)

Terry Chia

@AviD Yeah, like the 3 or 4.

AviD

@TerryChia yes.

@RоryMcCune how does opensamm compare to clasp?

Terry Chia

@ManishEarth: This may interest you: us.pycon.org/2015/schedule/presentation/411

AviD

@TerryChia ping

Lighty

11:42

screw this day, this has been the WORST monday of the month

Rory Alsop

@RоryMcCune hahahaha

Me neither

who would do such a thing

corporate nonsense

Lighty

had to hurry like a boss to catch my morning train, made it JUST IN TIME, my train card got declined with checking in because the credit was about 4 cents short (minimal of 10 euro to check in), after that, the train was LOADED, it was frickin 8:16AM, the time of the biggest mass, and they jsut use a small model train, with ONE model, not two, one...

Rоry McCune

@AviD same people (Chandra) so I'd say that openSAMM is likely a successor to CLASP (as CLASP seems like a dead proj and they cover similar ground, I've not read CLASP stuff in detail to be able to compare well)

Terry Chia

@Lighty Worst monday of the month, so far.

AviD

@Lighty if you're in such a rush, why did you stop to play with model trains?

Lighty

11:44

at school, I gety to hear that lessons are shifted for half an hour, ok, no problem, AFTER that, we get to hear that all the lessons drop out, and have to wat one hour and 45 mins for an awnser if we can go or not

after that, no class, probability of class tomorrow and wednessday? low

AviD

also - I point you to @Simon's Rule of Yolo

17 hours ago, by AviD

> Here's a bit of folksy wisdom: You never know what something's going to feel like in your butt until it goes in your butt. There you go, kids: That's the new #YOLO.

Lighty

I've read that list

AviD

@RоryMcCune yeah clasp was kinda DOA. it went down the wrong direction.

curious if opensamm are doign the same.

@Lighty my point was the model trains.

Rоry McCune

@AviD OpenSAMM has a shiney website opensamm.org

AviD

yeah looking at it. though so far the project page on owasp.org has more actual information.

Thomas Pornin

11:47

@Lighty The month is still young...

Rоry McCune

@AviD that'll be a first

Lighty

@ThomasPornin #1st world problems

AviD

@RоryMcCune inorite?

Lighty

but still, after next thursday, i'll get my 2 weeks off

so not alot of room for bad (mon)days

:D

only to pounce my bed, sleep, or game all day

AviD

@Lighty @kalina see, he's already forgot that he was pretending to have a girlfriend.

Rory Alsop

11:51

@AviD hahahaha

AviD

> THAT IS THE CONSEQUENCE OF WEAVING A WEB OF LIES

> YOU WILL EVENTUALLY GET STUCK IN IT YOURSELF

Terry Chia

@AviD #burn

Rоry McCune

whatcolourisit.scn9a.org <-- would be cool to have on an extra monitor

AviD

hehe

Rory Alsop

12:08

@RоryMcCune oooh - yes. I like it. Very mellow

I now have that as my background for the day :-)

Lighty

damnit, now I have to apply cold water

pfff

darn you old man!

AviD

@Lighty @kalina see, cold showers a sure sign.

Lighty

@AviD go pick on @Simon, this is my unofficial day off D:

;~;

Rory Alsop

@Lighty two seahorses dancing?

AviD

@RoryAlsop hehe

seamonkeys

2

Rory Alsop

12:17

Oooh - I like this hat. Doktor Spock Mayhem

AviD

12:29

@RoryAlsop looks like you've been busy feeding your hat obsession

so, what is that secret hat?

and why dont mods all get a secret hat automatically?

Rory Alsop

My secret ones are Fascinating, Warm Welcome and Chameleon. The Tardis hat may be mod only - not sure

Waffle hat may be too

Rоry McCune

@AviD I thought you hated hats?

AviD

so can you share the secrets?

@RоryMcCune no, I hate the obsession with hats, I hate the gaming of the hats, and above all I hate not having all the hats.

or rather, not knowing the secrets of the hats.

Rоry McCune

@AviD so what you're saying is you only hate the game if you're not winning?

AviD

@RоryMcCune well not exactly, I dont have time, energy or interest to invest in winning.

Rory Alsop

12:32

64

Q: Winter Bash 2014 Secret Hats

So far, I've unlocked one of the secret hats. I'm wondering what other secret hats are out there and how to earn them.

AviD

on the other hand, I dont think they should reveal the secrets to just anybody. People work hard at discovering the answer, or coercing it out of somebody who did, dont give it to everybody!

Rory Alsop

@AviD yeah - I had 2 of my seekrit ones before I saw that meta post

I was pointed at it for the tardis one

AviD

@RoryAlsop hmm.... bigger on the inside?

Rоry McCune

@AviD you trying to be nice today?

AviD

heh, li'l bit

Rоry McCune

12:39

or just not attract @Simon ?

Rory Alsop

@AviD I wrote the same, and then saw your comment

heh

AviD

also, #OffColorSunday was yesterday.

Rory Alsop

@AviD Oh - I missed that - I thought it was ping @TerryChia day!

Rоry McCune

@AviD yeah that top pinned post fits that theme

AviD

@RoryAlsop and what did you think we meant by that?

Rory Alsop

12:40

@AviD dunno - I was on mobile all day so checking transcript was tricky

AviD

@RоryMcCune heh. I think thats going to be my approach to security testing from now on.

Rory Alsop

@AviD 'there you go, kids'

kalina

why do I keep getting pinged in relation to Lighty's imaginary girlfriend

2

stop doing that

AviD

hahaha

okay okay

Terry Chia

@kalina Because you will never get pinged if we wait till @Lighty gets a real girlfriend.

kalina

12:50

if I never get pinged, I don't see that as an issue

Rory Alsop

@kalina Morning!

AviD

btw @kalina, update on the remoteFX - I was wrong there is a noticable performance hit. I was half-blaming the spotty mouse, and half-assuming the quality of the game. When played on metal, I was able to see a substantial difference.

kalina

@RoryAlsop salut

Rоry McCune

@RoryAlsop running late today?

kalina

@AviD figured as much

AviD

12:51

anyway, though I did solve the mouse issue, it still is not perfect - so not appropriate for twitch gaming anyway. playable, but not twitchy.

kalina

as long as it's playable though, it's generally enough to compromise on the rest

Rory Alsop

@RоryMcCune Nah- I've been in since just before 7. Just hadn't said morning

:-)

kalina

if you just had to play right then and there

AviD

@kalina for the most part. its good for a casual game, but I wouldnt try a lanparty that way.

Rоry McCune

@RoryAlsop that's an early start!

AviD

12:53

@kalina yeah exactly. its good for a quick game in between work. For a real gaming session, I can boot my metal straight into that VHD, so its still good :-)

Rory Alsop

@RоryMcCune Usually I'm in just after 7. It avoids most of the rush hour traffic

AviD

@RoryAlsop so does getting in after 10

Rоry McCune

@RoryAlsop yeah TBH that's what I used to do when I worked in Edinburgh I hate sitting in traffic

Simon

@AviD Like sex.

Rory Alsop

@AviD Like you'd know - Mr. Walkdownstairs :-)

AviD

12:55

@RoryAlsop heh, I saw a problem, I found a solution.

Rory Alsop

@RоryMcCune And then I leave (hopefully) just before it gets bad on the way home

Simon

@RоryMcCune TOO LATE BITCHES

Rоry McCune

@RoryAlsop yep it's the way to go (well apart from working from home, which is much better as my commute is measured in ft ) :)

Terry Chia

@RoryAlsop Welcome to #2. :)

AviD

@RоryMcCune so is my....

Rоry McCune

12:59

@AviD paging @Simon and @kalina it would appear @AviD wants to chat :op

AviD

ahem. I meant "so is mine ..."

:$

Rоry McCune

yeah yeah

AviD

►

took me a while to find that

> I chaaate trrraafic

Lighty

@TerryChia you guys so mean D:

im surely going to cry in bed the whole day and not come out of it now </sarcasm>

Terry Chia

@Lighty Is this your first day in The DMZ?

Lighty

13:07

@TerryChia Everyday is your first day in the DMZ

2

topic should be, "Welcome to the DMZ! be sure to bring vaseline"

2

AviD

cripes, what the hell? since when is @Lighty so starrable?

2

Lighty

@AviD Cuz mommy tells me i'm a star :)

4

AviD

vaseline doestn always help, chat.stackexchange.com/transcript/message/19060044#19060044

@Lighty aaaand all is right with the world again.

Lighty

@AviD GG Well Played

AviD

@Lighty you should buy her a sticker.

Lighty

13:09

Just bought her a new plush

actually

Terry Chia

@AviD ahahaha

Lighty

a very soft one

Terry Chia

@Lighty TWSS!

Lighty

@TerryChia not sure if TWSS or intended burn

but here it is: jinx.com/p/minecraft_squid_7_plush.html?catid=&preview=1

Simon

My hat is fugly.

So is @AviD's face.

kalina

13:10

it's still an improvement over your face

AviD

@Lighty ahh now things make sense. @Lighty's mom is a teen mom.

Lighty

@AviD Thats one of my WORST nightmares you know, being a teen dad, or dating a teen mom

way to fuck up your life in one "sitting"

>.<

kalina

so much prejudice in the above few lines

Terry Chia

Time to dig up my Nexus 7 so I can get a hat.

4

AviD

@kalina no, I dont think there was enough judice to have prejudice. I would coin "non-judice" special for @Lighty.

kalina

13:13

might as well throw a couple of racial and religious slurs in there to complete the set

AviD

@TerryChia that is a straaaaange comment.

out of context, anyway.

Terry Chia

@AviD Everything is strange out of context.

Just like your face.

AviD

@TerryChia so's your face.

dammit!

Lighty

AviD's tail is out of context too

Rоry McCune

@AviD when there's hats for stars?

4

Rory Alsop

13:15

@RоryMcCune i reckon

AviD

@RоryMcCune ohh

starwhore

Rory Alsop

get it all out the way today, and stars will be normal again

Rоry McCune

@RoryAlsop yarr

AviD

@RoryAlsop seee thats the problem with hats!

btw speaking of, I just got a secret hat

Terry Chia

@RоryMcCune Star 8 people and you get hat.

12

Rоry McCune

13:17

@TerryChia that sounds like information which should be made available to others, I shall place a totally legitimate star on it to help them find it

:)

Terry Chia

@RоryMcCune It's not a secret hat.

Rоry McCune

@TerryChia I know

AviD

@RоryMcCune pppfffft

Terry Chia

Dammit, how do I get a silver badge.

Thomas Pornin

@TerryChia By being mildly awesome.

AviD

13:19

@TerryChia you have to do something useful.

Simon

@TerryChia What?

Terry Chia

Holy crap, someone managed to get Tenacious?

Rоry McCune

@Simon hats for android app usage

Simon

@RоryMcCune Fucking legit. NEXUS 5 I LUB YOU.

Thanks.

Lighty

And i'm just sitting here with my windows phone, being a total social outcast

AviD

13:20

@TerryChia your hats make no sense. you are a purple QR code.

Thomas Pornin

@TerryChia If you answer 33 questions with authentication, and manage to get at least 10 upvotes for all these answers, then you should get a silver badge.

3

AviD

@Lighty that has nothing to do with the phone.

Terry Chia

@ThomasPornin 33 questions...

Maybe I should retag some stuff.

Simon

GIMME MY HAT I UPVOTED A QUESTION ON ANDROID

Terry Chia

I request 3 upvotes: security.stackexchange.com/a/52837/10211

Simon

13:22

@TerryChia Say please or I'll downvote.

Terry Chia

@Simon Please. :)

I'll even spell "donut" today.

Simon

@TerryChia Upvoted.

Ladies and gentlemen, that's how you raise kids.

@TerryChia Well done!

@ThomasPornin You get hat for upvoting one of my answers.

Thomas Pornin

@Simon You have answers ??

Simon

@ThomasPornin Like 3 or so.

Terry Chia

@ThomasPornin Ouch.

kalina

13:24

@ThomasPornin those mundane questions you can't be bothered with

AviD

@ThomasPornin @Simon oh snap. burnt by the bear.

that's like a bearburn

Simon

I don't ever feel loved here.

Terry Chia

I now request a downvote on this: security.stackexchange.com/questions/21551/…

Simon

@TerryChia My pleasure.

AviD

@TerryChia @RoryAlsop do you see now? All this gaming and border-line cheating?

DAMN HATS

Rоry McCune

13:27

@AviD hey hey, he's in the military, this is his only chance to get to wear fancy hats that doesn't involve parades!

AviD

@TerryChia SCREW YOU AND YOUR FEAR AND LOATHING

@TerryChia you said "popular smartphone operating system " why didnt you mention WP?

Terry Chia

@AviD Why would I mention WordPress when I'm talking about operating systems?

AviD

heh, naaasty

Terry Chia

Man, I want that Breaking Bad hat.

Rory Alsop

@AviD you can tilt your hat?

AviD

13:31

@RoryAlsop and resize, too!

Rory Alsop

@AviD Hmm - I don't have these options at work. I blame IE6

Terry Chia

AviD

@RoryAlsop you have to check the "show controls" box

Rory Alsop

@AviD Yeah - I don't have one of them. I'll play once I gethome

Rоry McCune

@RoryAlsop IE6... there's no way you can be using that browser, it's out of support with the vendor :op

Rory Alsop

13:33

@RоryMcCune stoppit you

:-)

Rоry McCune

and there's no way that an organisation supported by taxpayer money would be paying a vendor for extended support as they weren't able to migrate off in time :op

Rory Alsop

@RоryMcCune heh

heh

Terry Chia

@RоryMcCune Why are you telling @RoryAlsop this? He deals with people, not technology.

Rory Alsop

@TerryChia 'wetware'

Are people upvoting this old question just to get a hat?

192

Q: How can someone go off-web, and anonymise themselves after a life online?

With data mining tools like Maltego and other correlation tools for large data sets, if we conduct any transactions online assume that these can all be collated to build a good picture of what we do, buy, read etc (hence Google etc). If a normal person, with a large online history decides to go ...

anonymity

(If so, I approve - it's nearly at 200 votes)

:-P

kalina

@RoryAlsop ensure that you use a unique name for every site you go to, and never link those names to your real identity

Rory Alsop

13:44

@kalina Heh - this question is not quite for your situation. This is more for disappearing after a normal life

Thomas Pornin

@RoryAlsop You should ask for upvotes for that one: security.stackexchange.com/a/58217/655

Nearly gold status.

Rory Alsop

@ThomasPornin Good call - it only needs 2 :-)

kalina

@RoryAlsop my life is normal, the rest of you are just careless

Rory Alsop

(thanks)

@kalina heh - you'd hate normal

kalina

@RoryAlsop ...my life is normal, the rest of you are just careless

Rory Alsop

13:46

@kalina ooh - deja thingy

thoris

So, Sec.SE is currently in 13th place. C'mon folks - get hattin':

winterbash2014.stackexchange.com/leaderboard

Simon

UPVOTE MY SHIT YOU DONUTS

Rоry McCune

@kalina or your life is weird and the rest of us are normal :op

@Simon eww shit doughnuts

kalina

@RоryMcCune no, that could never be the case

Rоry McCune

@kalina hokay :)

kalina

as much as I want to take part in the hatting, I don't want to take part in the hatting

I'm winning on Arqade but that's because I've had nothing to do so far today

Rory Alsop

13:48

@kalina you are @AviD, AICMFP

;-P

Oooh - and my off-web anonymity question is on 94 favourites. Wonder if there is a badge for 100...

kalina

there is

now you just need to lie about there being a hat for it

something like:

@TerryChia there is a hat for favouriting 5 questions with scores of >90

should do it

Rory Alsop

@ThomasPornin Thanks Big Bear - security.stackexchange.com/a/58217/655 now only needs one more upvote

@kalina perfet

@TerryChia there is a hat for favouriting 5 questions with scores of >90

Terry Chia

@kalina Pssh

Rory Alsop

(how was that @kalina?)

kalina

@RoryAlsop looks pretty convincing

now you just need to get @TerryChia to link it to whatever group he's working with this year for hatination

and POW

Thomas Pornin

13:53

@RoryAlsop Yes, the "stellar" badge: security.stackexchange.com/help/badges/51/stellar-question

Terry Chia

@kalina You not gonna abuse the system with me this year?

Rory Alsop

@TerryChia delete 'the system with'

FTFY

Terry Chia

@RoryAlsop I'm not @Fei.

Where is @Fei anyway?

Rory Alsop

@TerryChia gone. :-(

Simon

<terrydadonut>I request 2 upvotes: security.stackexchange.com/questions/40564/… donuts</#me>

Jeezus, that messed up everything.

Terry Chia

13:55

@Simon Daily vote limit reached.

Will do it tomorrow if I remember.

Rory Alsop

@Simon dude - that was a good question, so I already upvoted it

@TerryChia heh

Simon

pantalooooooons

NOOOO HANG ON

The damn formatting messed up the link

23

A: Is it safe to show users why their password is not allowed?

If you don't tell the user exactly what's needed in his password to go through the validation of your function, how would he know what to add or modify to make it valid? Giving such information could result in making a bruteforce attack easier. However, considering your requirements, it doesn't ...

This!

kalina

@TerryChia why, so I can take the blame while everybody else gets away with it again?

Rоry McCune

if we're vote wrangling can I get a couple on this

23

A: The valid role of obscurity

Interesting question. My thoughts on this are that obscuring information is helpful to security in many cases as it can force an attacker to generate more "noise" which can be detected. Where obscurity is a "bad thing" can be where the defender is relying on that obscurity as a critical control...

almost at it's silver

Simon

+1'd

Terry Chia

13:56

1 min ago, by Terry Chia

@Simon Daily vote limit reached.

Rоry McCune

also one of my better answers and way better than my highest voted..

Rory Alsop

@RоryMcCune will do - as soon as tomorrow comes :-)

for the same reasons as @Terry

AviD

@Simon ratemypoo.com ? No thanks.

Rоry McCune

@Simon I had already upvoted that one, soz

Simon

@RоryMcCune Well then I should say thanks anyway!

Rоry McCune

13:57

@AviD no way I'm clicking that :op

Rory Alsop

@RоryMcCune oh - I upvoted that one ages ago

And Simon's one

Simon

Cheers to whoever upvoted.

kalina

@TerryChia do you have any secret hats I can get?

AviD

@RоryMcCune I should hope not.

Terry Chia

@kalina You already got the ones I got.

kalina

13:59

oh, well I just kinda turned up and mashed buttons all morning

Rory Alsop

Do you like my current one?

It's very subtle

can you see it

look closely

:-)

cool, eh

anyway

kalina

not really

Rory Alsop

fair enough

I'll change it

Transcript for