The DMZ

Rоry McCune

12:02

@TerryChia heh

kalina

I made an informative picture yesterday, which is completely pointless

and now that I have shared this with you, I have finished this phase of procrastinating and I'm going clothes shopping

Rоry McCune

@kalina o/

kalina

phase two starts in about three hours, unless the city is packed full of idiots and it takes longer than planned to walk into a shop, find a single outfit, purchase it, and leave again

Rory Alsop

afternoon - hella lot of flags today...what's been going on?

Terry Chia

@RoryAlsop Yo momma.

AviD

12:14

@RoryAlsop @kalina is upset that we have free time.

or something like that.

Rory Alsop

@AviD luckily for her I am still not feeling well, so doing a small amount of work and a small amount of SE

in between sleeping

(blimming plague vectors)

AviD

oy. sick sucks.

Adnan

@kalina Jesus, that was 200 million years ago

Rory Alsop

@AviD I'm sure I been sick more since moving to $CURRENTEMPLOYER than ever before

or the cause may be that my friends are all starting to have small snotty kids now

AviD

must mean you're depressed.

Rory Alsop

12:18

don't think so - have you seen what the life of a rock star security person is like. Depressed is quite far away from me...

AviD

heh

Nוnɛfוngɛrϛ

@RoryAlsop On the one hand, you're very uncool because you do computers. On the other hand you're very cool because you do guitars. So... identity crisis?

AviD

computers are uncool now all of a sudden??

Nוnɛfוngɛrϛ

@AviD In the perspective of wider society, yes.

AviD

not anymore

AGE OF THE GEEK, BABAY!!

Nוnɛfוngɛrϛ

12:27

@AviD Is that like year of the Linux Desktop ;)

AviD

►

more? ;-)

We run the world!

Nוnɛfוngɛrϛ

@AviD hell yeah

AviD

should watch that series again

Nוnɛfוngɛrϛ

NSFW: youtube.com/watch?v=b92KaPXSVyg

That's what the life of a rock star security guru is like.

kalina

I am jealous of your free time

But I'm not bothered about that

Nוnɛfוngɛrϛ

12:35

@kalina Not mine, @RoryAlsop's

kalina

I am bothered about parking next to ask these people

All*

AviD

@Nוnɛfוngɛrϛ dude, I cant play that here!

neighbors all go running for the safe room

Nוnɛfוngɛrϛ

@AviD Surely they won't mind what with all the tanks on the drive?

AviD

heh.

you just sparked a red alert! We went to Defcon 5!

Nוnɛfוngɛrϛ

@AviD Good job you have a lair.

AviD

12:40

@Nוnɛfוngɛrϛ you almost had us blow up the moon!

Nוnɛfוngɛrϛ

@AviD shouldn't get a bit fighty then. 1.999 drinks, max.

AviD

actually funny thing, DEFCON 5 is actually the lowest level, aka "WORLD PEACE"

Simon

@AviD pls

AviD

oh cmon, that was a good one.

Simon

@ColinCassidy Morning sir, how is it going?

Arperum

12:43

@AviD Doing that would be actually impressive. And stupid.

AviD

@Arperum of course. that is a unique life-form, alone in all the galaxy.

Nוnɛfוngɛrϛ

@AviD Sorry I only deal in UK terror levels. They're "BAD, REALLY BAD, AWFUL, TERRIBLE and END OF THE WORLD".

AviD

@Nוnɛfוngɛrϛ not sure which is worse.

Nוnɛfוngɛrϛ

@AviD They're not really, but the threat level never really changes from substantial or severe.

So I don't really see the point.

Arperum

@AviD I don't give a shit about the unique lifeform part, I care more about the part where a) the pieces would fall on the earth and do non-fun stuff longterm. Plus the lack of a moon would do other non-fun stuff.

Nוnɛfוngɛrϛ

12:48

@Arperum Like no tides.

Arperum

@Nוnɛfוngɛrϛ Yea, that.

AviD

@Nוnɛfוngɛrϛ well, it would be inappropriate to be on alert.

too provincial.

@Arperum oh dont worry, the moonbeast will likely lay a new moonegg.

I get the feeling you're not really getting what I'm talking about....

Simon

Does anyone ever do?

AviD

wat?

can you rephrase in English please?

Terry Chia

@Simon He's not you.

AviD

12:58

I see google translate isnt working for you.

Simon

@AviD The dude who lives on an island understood.

AviD

I.. um.. wat?

Simon

Are you okay?

raz

Is the DMZ dropping messages or something? None of you are making sense.

AviD

@raz that sounds about right for the DMZ.

Simon

13:03

Dropping messages? HOW DOES ONE DROP MESSAGES?

AviD

The day the DMZ starts making sense, thats when you need to start worrying.

THE DAY OF... THE DMZ!!!

Rоry McCune

@Simon you're the Oracle DBA, figure it out!

Simon

@RоryMcCune pls

Rоry McCune

@Simon good start

Simon

^_^

Rory Alsop

13:15

Metaltech takes us to Defcon 5 aka World Peace? That can't be right

Tinned_Tuna

I've got an opinion based question; so I probably shouldn't pose it as an actual stack exchange question.

But, regardless; for a company producing and hosting a web application in the UK, where would you source role-specific (e.g. front-end, back-end, etc.) training for developers? I'd especially want to make the training relevant, a challenge to the developers and make it so we can evidence it's outcome for compliance?

Rоry McCune

@Tinned_Tuna I guess, given you were thinking of Sec.SE it's security training you're looking for?

Terry Chia

@Tinned_Tuna "relevant" and "compliance" doesn't really fit together very well. :)

Tinned_Tuna

@RоryMcCune ah, yes, sorry, should've mentioned that :-p

@TerryChia that's part of my (very sad) dilema

I want to avoid having to try to come up with in house resources, because then you've got to argue that that is good enough/relevant/etc...

Rоry McCune

@Tinned_Tuna so one option is that a lot of security confs run training just before the conf (e.g. AppSecEU), it's not exactly cheap but can be quite good

Terry Chia

13:18

@RоryMcCune Are conf training developer-relevant? The ones around here seem focused on research and pen testing.

Tinned_Tuna

@RоryMcCune oo, I might have to take a lookey

Rоry McCune

@TerryChia depends on the conf. OWASP ones tend to have some decent stuff

so for example eoin Keary and Jim Manico are doing a secure dev. course at AppsecEU

Tinned_Tuna

@RoryAlsop yea, I've just looked at the OWASP one from 2014 (this one, 2014.appsec.eu/training-overview) and it all looks good

I can't spot any prices though, which fills me with fear

Rоry McCune

@Tinned_Tuna another option that I thought was quite good in the past (although last time I took one was 10+ years ago) was learning tree learningtree.co.uk/courses/940/…

@Tinned_Tuna prices ain't cheap usually for AppSecEU stuff (e.g. £1000+ per head for a two day course)

Jim and Eoins one is sometimes free

Terry Chia

@RоryMcCune That's the price Syscan charges as well.

Rоry McCune

13:22

yeah conf. training ain't cheap

Tinned_Tuna

@RоryMcCune hoo-boy, that's quite pricey. Though a good start.

Simon

You should just hire @AviD. He'd be like: "Today, we're gonna lockdown Krispy Kreme's website and ask for donuts as a ransom".

Tinned_Tuna

LearningTree looks good, but a little too generalist

AviD

@Simon ooo I love your business model

Tinned_Tuna

@AviD ?

Rоry McCune

13:23

@Tinned_Tuna another model is online training like securityinnovation.com/training/application-security

AviD

@Tinned_Tuna oops wrong reply

@Tinned_Tuna yet another model, depending on how many devs in each role, is to bring in custom trainers.

may consulting companies do that, some better than others

some focused specifically on training

Rоry McCune

@AviD @Tinned_Tuna yeah I've done that at a bank before, for a room full of people is likely cheaper than sending people on courses

AviD

I've worked with a couple of those in the past, actually can be pretty darn good.

@RоryMcCune still not cheap, but much cheaper than paying for a formal course per head.

Rоry McCune

@AviD yarr

Tinned_Tuna

@AviD yea, I know one place that does that sort of thing, but we're a small team (like, 3), and I'm not sure how it would even work with that few folks. And we (mostly) fill different roles, with a bit of overlap

AviD

13:26

the other benefit is they can build the training very specifcially for your tech, according to your needs, etc

@Tinned_Tuna sounds more like you need one series of trainings, covering all the bases...

I've done that too, in teams that werent strictly segregated.

Tinned_Tuna

/me is sad

AviD

can go very well, worst case you have a session or two that is less relevant for a dev or two.

Terry Chia

One relevant question is how much knowledge do the devs already have?

AviD

@TerryChia yeah, thats the other benefit of hiring a training course to come in - they can tailor to the precise level of your dev team

(assuming they are approximately at the same level...)

otherwise, just spread them out to what they need.

Tinned_Tuna

@TerryChia varies, we've all got Bachelors degrees in various fields (Mus.Tech, EE, CS/Maths), and varying degrees of experience, but no one's got less than 3 years experience.

AviD

13:29

in fact if its just 3 in total thats probably the best way.

@Tinned_Tuna I think he mean security-specific.

Terry Chia

^

AviD

though dev experience is also important for the training.

Tinned_Tuna

oh, security specific? Um... aside from me, no one's got anything specific, and I'm an "in progress" so to speak.

AviD

I've walked into a classroom where the devs literally did not know how to connect to a database themselves.

kalina

@Adnan talk about minor exaggeration. I wonder if this is the scale @Simon uses when quoting measurements...

AviD

13:31

or any number of ridiculously beginner things that anybody should know.

Terry Chia

@AviD Cmon man! Even @Simon knows that!

AviD

@TerryChia thats what I told them!

Simon

@TerryChia Cheers Terry!

AviD

and they're all like "Who's Simon??"

kalina

@TerryChia doesn't really count in PHP, though, does it... even I could connect to a database in PHP

Simon

13:32

@kalina In django too! You do it in settings.py

LIKE A BAWS.

AviD

@TerryChia "if you just reference the X library, you'll see... " "WAIT how do I reference a library????"

this was in .NET for chrissake.

kalina

I parked my friends car in a multistory car park

Simon

@AviD Ouch.

kalina

came back after fetching said outfit

AviD

was the outfit fetching?

kalina

13:33

some person has obviously had an ass the size of a bus and opened their door into the side of it

Terry Chia

@Tinned_Tuna Are you looking for "SQL injections and XSS 101" type stuff or more advanced?

kalina

the outfit looks a little wednesday addams but it's for a funeral

AviD

@kalina appropriate then

Simon

Funerals are always so damn awkward.

AviD

I always thought Wednesday was cute.

@Simon especially for the guest of honor.

kalina

13:34

@AviD you have a thing for children that haven't reached legal age yet?

AviD

because you being awkward is the worst part about the funeral.

Simon

Yeah...

AviD

@kalina urm, not NOW, back when I was a kid. Duh.

now I just think sh'es "cute".

kalina

don't talk to me about awkward, we're ending the funeral with "Don't stop me now" by Queen

Arperum

Gah. I have some dumb old asp website that got hacked/spam-code inserted into a template used for the website, I cleaned out the spam, but now I am tasked to find how they did modify said file. How do I get started with that.

Ohnana

13:35

@kalina hell yeah

Terry Chia

@kalina That's... actually kinda awesome.

AviD

@kalina I.. umm.

Tinned_Tuna

@TerryChia hm, perhaps... I don't want to be patronising to the other devs by underestimating them... but on the other hand, I have spotted a few security-relevant issues in our code base over the years.

Ohnana

I love that song

AviD

@Arperum Closed as too broad.

Arperum

13:36

Or do I just blame "Stop using ASP already, you fuckwits".

Terry Chia

@Arperum You hire a Highly Paid Consultant. /cc @LucasKauffman

Arperum

@AviD Exactly. I have no clue abotu where/how to start.

kalina

somehow I am expected to keep it together long enough to give a eulogy

Ohnana

@Arperum 1. Access logs 2. file permissions 3. Server configs

kalina

this is just a nightmare

this whole thing is just wrong

people shouldn't die in their late teens

Arperum

13:37

@TerryChia Heh. If you are going to do that, you start by not having a site in ASP (not .NET, the old stuff)

Ohnana

@kalina D: I'm sorry

Simon

@kalina You're a late teen.

kalina

my age is undisclosed

my hair is literally falling out

stress is bad

so is hairdye, I guess

Simon

Why isn't FE coming with you anyway?

kalina

I don't understand the question

Simon

13:45

FE + you = <3

Therefore,

kalina

according to who?

Simon

FE + you => funerals

kalina

I have no love interests, and I'm single

Simon

That's irrelevant.

blablabla

kalina

sure, I make a habit out of inviting people I know off the internet to join me in real life and do stuff

so @Simon, what are you up to next week?

lets go around Joel's and mess shit up

except, no...

Simon

13:47

I dunno, but FE seemed to go emo for you.

kalina

I would never arrange such a thing

that's not my problem

Simon

#denied

@kalina Why don't you enjoy distorted kicks?

kalina

I also don't really appreciate it being bought up, as if it isn't awkward enough for me

as for distorted kicks, I see distorted kicks as fills, not the main feature of the track

Simon

:OOOO

raz

0

Q: HTTPS in request and HTTP in response

If I have an API that calls a backend webservice, is it possible to use HTTPS in the request and just HTTP in the response?

Arperum

13:51

@Ohnana logs: can't see any people who logged in(except for me)

raz

:facepalm:

Simon

@raz WHY WOULD SOMEONE WANT TO DO THAT ANYWAY?

kalina

I know I'm hardly at peak performance emotionally anyway, but you've actually upset me, @Simon. Congrats.

Simon

"Hey guys, we use HTTPS!"

Then, the response is in plain text.

10/10 would use again.

@kalina You remind me of my ex, everything was my fault.

kalina

I don't see anybody else bringing it up

and I can't just tell you the facts, because it's not fair to do so

Simon

13:54

Bring what up?

FE being an obsessed donut?

raz

@Simon Haha, yeah I have no idea what they're thinking.

AviD

@Simon its not something that even makes sense to say.

can I have it encrypted and in plaintext?

Transcript for