The DMZ

Scott Pack

9:00 PM

@JeffFerland Why can't it be both?

There is that great picture of Teddy fording a river on a moose.

Thomas Pornin

@JeffFerland For a moderator, you need something which demonstrates natural authority

Rory Alsop

@ThomasPornin like a moose?

Thomas Pornin

A fierce creature, but also a calm one

Scott Pack

@ThomasPornin Like an image taken from a slight upward angle, of a man staring off into the future, and wearing a rather cunning cap?

Rory Alsop

hahahahahahahahahaha

Jeff Ferland

9:01 PM

@ThomasPornin I think Tiggers are neither fierce nor calm.

Thomas Pornin

One which could spread utter destruction but will refrain from doing it through sheer will.

Rory Alsop

@ScottPack I thought it was Tom Morello's cap you'd stolen

AviD

@ThomasPornin a... BEAR!

with frakkin lazer beams!

riding a horse!

Scott Pack

@RoryAlsop It was a gift from my brother. So I can't really say where it came from.

AviD

Rory Alsop

9:03 PM

@AviD - yes! On a horse!

AviD

@JeffFerland bouncin' is what tiggers do best!

Thomas Pornin

@JeffFerland If you use a moose, people will think that you are Canadian

AviD

actually, the tigger represents my raw enthusiasm.

Rory Alsop

@ThomasPornin that sounds aboot right:-)

Scott Pack

I actually thought you were a lady for the longest time since all the Tigger fans I've known have been....

Jeff Ferland

9:05 PM

@ThomasPornin I'm from Maine. It's a technicality.

AviD

@ScottPack whaaa??

no, thats @Iszi!

@ScottPack @Tigger is an alpha male! have you not watched any of the movies?

Iszi

@AviD No, @ScottPack has "verified my gender to within an acceptable margin of error" as male.

2

Scott Pack

Not since I was a child

AviD

@Iszi lol

Scott Pack

@Iszi Precisely. I still maintain the possibility of a stand-in, though I feel that is a small enough probability to be effectively zero.

AviD

9:08 PM

@ScottPack ah, see - I used to hate the poo movies. until my son made me sit through The Tigger Movie, over and over and over again, when he was home sick....

Rory Alsop

@ScottPack Trust models FTW

Jeff Ferland

@AviD You so want to add an "h" there

AviD

umm.... no.

Jeff Ferland

@AviD Winnie the Poo?

AviD

@JeffFerland yeah, those movies are crap ;)

Jeff Ferland

9:13 PM

@AviD HA!

AviD

but actually, after the 30th time or so, I began to see some good in those movies.

each character is annoying, but with a redeeming quality.

Rory Alsop

@AviD better than Spongebog?

AviD

@RoryAlsop oy.

Rory Alsop

oy oy

AviD

@RoryAlsop hassidic pirates, then?

Rory Alsop

9:15 PM

I did extensive googling, but couldn't find anything

so disappointed

AviD

hehe

Rory Alsop

I did like some of the geekier talk like a pirate quotes.

GET WAREZ / FILEZ here

like:

etc

AviD

@RoryAlsop ?

Rory Alsop

:-)

@AviD that's talking like a pirate

AviD

@RoryAlsop ohhhh slaps head

Rory Alsop

9:19 PM

Yay

right - will finish reviewing your epic:-)

Jeff Ferland

@RoryAlsop Slapping somebody as a mod must be fun, but I can't imagine anything beats getting a mod to slap himself. :)

AviD

@RoryAlsop :)

@JeffFerland WITH A HAMMER!

Rory Alsop

@AviD - interesting formatting on the smileys

not sure why they seem to stand proud of the text

will see what I can do

AviD

@RoryAlsop tried removing them... the editor seems to force them back in :@

so, the other day, my daughter looks me in the eye and says "dad, you bozo".
then she had a "muwahahaha".

My parenting is complete....

of course, this is my two year old.

Rory Alsop

@AviD Perfect!

SWMBO says she loves it too!

AviD

9:27 PM

then she tells me her brother is watching pooperman.

@RoryAlsop glad I amuse....

IN BED!

hehehe

Rory Alsop

no - Except in Bed!

AviD

gnite @JeffFerland ya sick bastard

yup, I'm gonna use that all the time now.

Rory Alsop

right - review complete. Made very minor formatting changes, but that's about it.

AviD

@RoryAlsop so, it wasnt too wordy?

Rory Alsop

no - I think anything including a review of various speakers is going to be wordy

it read fine

and has made me want to get the slides from some of the talks

AviD

9:33 PM

:)

Rory Alsop

So we have @Jeff's audit post scheduled for Friday, and the next one not till the 4th. You fancy having it next week?

AviD

I most recommend shay chen's (TSRC), erez on crypto mistakes, and Adi's with the mobile bank job. And mine, of course.

Rory Alsop

LOL

AviD

@RoryAlsop can do, in which case, some text would need to be changed (last thursday, owasp US this week)...

Rory Alsop

or we can do it now, to be honest - there is no reason I tend to schedule them roughly the same

shall we ping it out now?

AviD

9:35 PM

on the other hand, anything wrong with squeezing it in? timeliness and all...

as you wish, m'lord

Rory Alsop

two minds - a single thought

tis done!

AviD

@RoryAlsop single mind - two thoughts. sockpuppet, and all that...

excellent! cheers mate

Rory Alsop

@AviD oh darn - not again

AviD

hehe

were you able to fix my winkies?

2

Rory Alsop

nah - but it doesn't matter

M'vy

9:37 PM

oh hai usual suspects!

Rory Alsop

they wanted to stand out

so I let 'em

@Mvy oh hai. Am it fluffeh teim

AviD

@RoryAlsop heh

@RoryAlsop whaa?

Stack Exchange

Stack Exchange Security Blog: OWASP Israel Conference 2011

avid on September 21, 2011

This past Thursday, OWASP Israel held their yearly regional conference, just before the larger global AppSec conference in US. The Interdisciplinary Center Herzliya (IDC) was gracious enough to host the conference.

Sec.se was a sponsor there, and in addition provided some great swag – lanyards for the speakers, stickers, and loads of very cool t-shirts (these were gone before the first lecture even started!) Quite a few attendees popped them straight on, and I heard a lot of compliments on the logo design (thanks @Jin!!). Btw, Sec.se didn’t just sponsor the conference – they’re now full OWASP M …

AviD

is that celtic?

re schedule, let me know when there is a gap, I'm going to write up the content of my talk, it can go out whenever (as long as its not months away)

Rory Alsop

b3ta.com/board/6909428

AviD

9:39 PM

(writing it up as a post, not a talk - but based on the same format)

Rory Alsop

posts scheduled for 4th and 18th Oct, but nothing beyond that

AviD

@RoryAlsop ooo...kaaaay...

Rory Alsop

the standard ones I have generally every 14 days

but again, all moveable

AviD

nothing next week?

Rory Alsop

reminds me - need to ask for the next QOTW. We have this Friday's one. Nothing next week

AviD

9:40 PM

I'll try to squeeze it out, fill a gap.

2

Rory Alsop

fluffeh teim:

it's a very silly b3ta.com meme

AviD

yeah, I got that. ahhh...

Rory Alsop

still think folks could chip in with more OWASP info, and perhaps some other open source project bodies on this q

2

Q: Appsec Standards Organizations?

I'm a Java EE developer and I was wondering if anybody has had experience with the OWASP Project and could weigh-in as to how it measures up as a security standards organization. They have a huge website with multitudes of documents, sub-projects, frameworks/APIs, etc., and I just want to be sure...

appsec

heh - look at the starred comments:-)

AviD

omigooness.

someone starsniped me.

Thomas Pornin

good night everybody

time to get back to the land of the living

AviD

9:51 PM

ah, so you really are Hades!

Rory Alsop

LOL

AviD

@RoryAlsop have you read the transcript from the teacherscast?

hysterical. they be even more jiggered than us.

Rory Alsop

I was sitting in teachers as well - very amusing around the chaos/menorah/pitchfork nonsense

0

Q: Vote for your QOTW #11

For QOTW #11, scheduled for publishing to the Security Stack Exchange Blog on 30 Sept, please post your topics as Answers, and vote for your favorite question from the whole Security Stackexchange site. Please post any question that you feel is worthy and your reasons. Try not to promote your ow...

discussion featured qotw

Ninefingers

@AviD Teachers is... interesting. Like meta.

AviD

truthfully, it is a LOT of noise.

Rory Alsop

9:56 PM

LOL - interesting like.... Gneiss

AviD

a lot of letting off steam, usually

Ninefingers

yep but I think that's kinda needed for some mods, looking at what they've had to deal with

Rory Alsop

yeah - we do have it so much easier than elsewhere

Ninefingers

especially when those end users start saying things like use memcpy. Sheesh! Hooligans.

Rory Alsop

@Ninefingers LOL

AviD

9:57 PM

@Ninefingers LOL

so, you and @nealmcb are never gonna stop rubbing that one in, huh?

Ninefingers

@AviD well to be honest I tried to frame a funny comment under your mod election thing, but a) I couldn't think of anything funny and b) what's sorted is kinda sorted and I didn't want it brought up unless absolutely necessary.

AviD

though to be fair, I think after my initial buckshot reaction (accidentally spraying you with response to the vitriol) it was sorted all for the best.

@Ninefingers well, a) @nealmcb brought it up and b) I am kinda proud of the rest ;)

Ninefingers

yep, so do I. I agree programmers can be a little... difficult to deal with, especially on the subject of being ~~wrong~~ totally and utterly right. Study my methods, and you may just learn something (revision 2).

AviD

that's right, you saw what I did, I take credit for you :D

@Ninefingers whaaats that?? programmers are never wrong.

Actually I became a much better programmer the day I realized I am actually wrong more often than correct.

Even when I'm right.

@Ninefingers lol, love the revision

Ninefingers

There you go, fixed my previous statement.

AviD

10:03 PM

I see you got the strikethrough working....

Ninefingers

Yeah, turns out I can do a few things @RebeccaChernoff can do after all!

Rebecca Chernoff

chuckles

Ninefingers

@AviD I've recently experienced having to manage programmers, which is a bit new for me.

I've been a few things before a programmer... I studied maths at uni (college for Americans) until illness put paid to that (I am now a part time student), but I also did a few french courses and used to be pretty good (got a bit rusty these days) so I an odd mix of technical and a little bit of social. My old job was the kind of place where you had to get a lot of buy-in from everyone to get things done.

So I'm a little bit used to "idiotic management" and can also see that often it's not idiotic at all. Transferring that to developers has been challenging

As has "you're not wrong, but for varying reasons we can't do that now"

Rory Alsop

@RebeccaChernoff - if you didn't know what @AviD meant:

youtube.com/user/Metaltechtheband?feature=mhee

Dr Mayhem Mask!

... oh, I don't know how to do youtube oneboxing

10:20 PM

That rocks!

@Ninefingers I can imagine. having been on both sides of management, both idiotic and not.

(yes, I am aware that the filled matrix of my answer implies that I was idiotic managment, but I while I freely admit that I claim that I was not responsible.)

@RoryAlsop excellent

oo, matching masks!

Rory Alsop

Was fun - we hadn't planned on doing that song, but the event was a bit chaotic so they asked if we could do more

no matching masks

I have a viennese mask, Erik paints his face, Lord Thrapston Flagellator has a gas mask

oh you mean the paint job

:-)

AviD

ah, yeah I guess I do.

matching paintjobs, then!

Rory Alsop

oh bloody Gravatar - trying to change my pic to the mask, and it's all going wrong

Ninefingers

10:25 PM

That's so awesome. I reckon I'm gonna sneak up to Scotland sometime, it's not that far from here.

nealmcb

@AviD And you have a lot to be proud of - good nomination writeup! Some of your work isn't very apparent otherwise. I did feel good about my interactions with both of you and the happy result, so figured it was appropriate to refer obliquely to it without spewing the details. Did I offend you? That certainly wasn't my intent, but I didn't want to be completely non-responsive to the request for details.

Rory Alsop

@Ninefingers Anyone from Sec.SE turns up at a Metaltech gig - they get a guest pass :-)

AviD

@nealmcb of course not!

nealmcb

@AviD :)

Rory Alsop

@Ninefingers in fact - we have some small ones but then this big one in November:

AviD

10:27 PM

thanks to you I realized I was mistaken, you pointed me in the right direction and I blindly shot the saarlac's tentacles.

M'vy

@RoryAlsop wow. Special promotion :!

AviD

or, something like that.

Rory Alsop

aye - supporting KMFDM is a biggie for us

we supported Alec Empire last year, but this is even bigger

Ninefingers

@RoryAlsop doubly awesome. So you're gonna rock the place whilst I try to impress the ladies with my knowledge of kernels... I think I'm doing something wrong here...

M'vy

XD

AviD

10:29 PM

@nealmcb I found it amusing that you mentioned it, since I had been considering that... "situation", as an example of cleaning up my mess. and calming tense situations....

Rory Alsop

@Ninefingers Rock and Roll is a way to impress when they aren't interested in regex

4

AviD

@RoryAlsop excellent

Rory Alsop

although I was impressed - my new team secretary is cool - she runs a big Minecraft server:-)

and is much geekier than me

M'vy

But she ain't on sec.se :P

or ... wait!?

Rory Alsop

@Mvy she isn't security focused. She is a programmer, graphics, coding type

and no, she isn't called @Iszi:-)

M'vy

10:33 PM

^^

Rory Alsop

@Ninefingers - we may be playing at one of the big security cons in the UK next year

AviD

@RoryAlsop looool!

Rory Alsop

just need to confirm PA requirements

AviD

@RoryAlsop as PWC or Dr.Mayhem?

M'vy

@RoryAlsop we could make a new band for that event: metalsec.se?

Rory Alsop

10:34 PM

Me during the day, and Dr Mayhem in the evening

AviD

@RoryAlsop ah, a double feature

Rory Alsop

And the good thing is PwC are happy that I am IISP person, ISACA person, PwC person and Metaltech bod

M'vy

Mister Aslop and Dr Mayhem

AviD

6 in one!

Rory Alsop

@AviD I haven't spoken to you about our folk angle yet, have I - Acoustech

Ninefingers

10:36 PM

@RoryAlsop Sounds interesting. I've never been to a security conference, much to my disgust - I'm currently in the amateur realm security-wise (although a pro soft eng). I shall try to persuade the powers that be I need to go I think.

AviD

@RoryAlsop no?

Rory Alsop

@Ninefingers If you ever need good arguments to folks at CISO level about why some cons are good value, lemme know. I managed to justify Defcon for most of my team as the cheapest security training they could get:-)

M'vy

Nice one

Rory Alsop

@AviD The same songs, but on slide and 12 string guitars, fretless acoustic bass, and with lots of fingerpicking, flat caps and jerseys

M'vy

needs to publish more paper to go to conferences.

Rory Alsop

10:38 PM

Acoustech

AviD

@RoryAlsop ha!

Rory Alsop

@Mvy - that is the best way: as a speaker you get far more perks

Ninefingers

@RoryAlsop I'm in startup land at the moment, which is actually a pretty great place to be. So I might be able to persuade them to indulge my interest, I don't know.

AviD

and with the scottish brogue, of course

Scott Pack

@RoryAlsop Who is that douchey looking guy on the far right?

Rory Alsop

10:39 PM

@AviD nah - Erik, the singer, is from Orkney as well. Viking country!

M'vy

@RoryAlsop The university will pay for the trip... that's the important part...

Rory Alsop

@ScottPack yeah, whatever - just cos my cap says "Rory Quiet Pint" on it!

and yours doesn't

M'vy

personal note: grab the guitar when I got my Ph.D

Scott Pack

That's true, I don't have my name on any of my clothes.

M'vy

Shame I needed to stop playing while studying.

Scott Pack

10:41 PM

@Mvy I think I've promised myself to learn the harmonica once I finish my MS

Rory Alsop

@ScottPack LOL

My eldest has decided after being our roadie at a festival last month that he wants to concentrate not on guitar or sax like his dad, no.

Ninefingers

@ScottPack You think? As in you're not sure/can't remember?

Rory Alsop

Bass!

M'vy

Well, the difference @ScottPack is that I have 8 years of classical guitar behind me. So basically I need time and motivation.

Rory Alsop

The upside - Metaltech has loaned him a 5 string G&L bass to learn on

@Mvy best place to start

Scott Pack

10:42 PM

I did a lot of piano and voice for a long time. I had a rather harsh bout with mono in college that left me a bit tone deaf.

AviD

okay, there really is too much crap on the internet.

makes it impossible to find the crap that I want.

Rory Alsop

you checked out our website then, eh?

AviD

heh

M'vy

@RoryAlsop I also promised me to buy a real electric guitar to throw off the piece of s*** I have at the moment... Can't get the sound to be good. Especially G string.

Rory Alsop

too many kittehs

M'vy

10:44 PM

The internet is made of cats

Scott Pack

Sucks when I never learned how to read music :/

Rory Alsop

@ScottPack I used to be really good at it when I played violin, but I suck at it now

it ain't that important

as long as you have big hands

►

ah hah - gravatar change complete - now to await the replacing of cached images

:-)

M'vy

^^

Ninefingers

Rory Alsop ♦, Scotland, United Kingdom

13.5k 2 9 58

network appsec passwords encryption authentication education web-application

M'vy

yeah

Rory Alsop

10:48 PM

heh heh heh - now for world domination.

Or maybe sleep - I need to go to the gym before work tomorrow morning

AviD

@Ninefingers he's just sucking up to the Musical Practice and Performance crowd....

Rory Alsop

yeah sleep

domination later

@AviD :-)

good night all. And good luck to all in the election!

M'vy

@RoryAlsop Thx and good night too

AviD

@RoryAlsop gnite ya sick bastard

Ninefingers

I love that this picture accompanies: "Rory has managed large scale security programmes, including global attack & penetration engagements, privacy and security...." that's right, Dr Mayhem is looking after your system!

@AviD I must head over there myself as I probably ought to ask some questions... my own guitar playing is pretty dire.

Scott Pack

11:28 PM

@Ninefingers That's right, gentlemen. Doktor Mayhem personally penetrates your kit!

Transcript for