The DMZ

KnightOfNi

01:40

@Simon Does knowing your donut is capable of love make eating it harder?

Terry Chia

@Flyk AbstractRoryFactory

Simon

02:18

@TerryChia @AviD:

100 YO MAMA JOKES - Can You Watch Them All?

►

@KnightOfNi It makes it easier and tastier.

TildalWave

02:30

@Simon the heck? since when does it onebox like that?

oh, F5 makes it better ... it showed with a title next to the thumbnail, and now over it

Terry Chia

@Simon Dammit @Simon!

KnightOfNi

03:00

@Simon is the first "serial eater"

ManishEarth

06:04

@TerryChia @AviD @ScottPack @RoryAlsop Anyone have some superfish certs?

bugzilla.mozilla.org/show_bug.cgi?id=1134506

Need to do moar research

Terry Chia

@ManishEarth I don't own a Lenovo product.

I don't believe this affects FF though? FF ships their own trusted store.

ManishEarth

It does

apparently it hooks into the windows store too

@TerryChia I actually use a thinkpad and love it. (HDD was reformatted first though since I wanted to set up a dual boot)

Terry Chia

@ManishEarth Hum, that's interesting. Why?

ManishEarth

I guess it's so that corporate systems can use it?

Not sure

@TerryChia maybe we don't, but it's possible that superfish installs on firefox too

11:44 < rbarnes> but that doesn't mean that superfish hasn't hasn't haxxored the fx store

@TerryChia we don't

Terry Chia

@ManishEarth From what I have seen I think it's just a cert inserted into the Windows store on the factory image of the Lenovo products. I highly doubt that they jacked the FF store.

ManishEarth

06:17

best to find out

Terry Chia

@ManishEarth Waste of effort imho. Very little you can do technically to stop this if they want to get clever.

ManishEarth

@TerryChia bugzilla.mozilla.org/show_bug.cgi?id=1134506#c9

If they get clever we just back out, no point arms-racing

But now they'll be under lots of scrutiny

Terry Chia

@ManishEarth Sounds good.

ManishEarth

So they can't push funky hotfixes without getting noticed

The real danger here is that someone with access to that privkey sells it

Superfish may go down, but that privkey might not

That's got to be purged

Terry Chia

Oooh, Mozilla now gets money from Yahoo instead of Google for the default search engine? When did that change?

ManishEarth

06:25

November iirc

@TerryChia

11:54 < Manishearth> If superfish is using this root CA to sign MITM certs,
11:54 < Manishearth> then...the privkey for this CA is on all affected computers
11:54 < Manishearth> Please tell me I'm wrong

Terry Chia

@ManishEarth You are not wrong.

ManishEarth

:(

ManishEarth

07:17

@TerryChia what I know till now

inpursuitoflaziness.blogspot.com/2015/02/…

tylerl

07:51

Have to go to Canada next week. Not terribly excited about the fact.

tylerl

08:15

Resisting the need to point out that if you're using Windows then security must not be one of your core concerns. Must...not..state...the...obvious.. — tylerl 13 secs ago

soo mean.

Rory Alsop

08:43

This new question

33

Q: Why do browsers default to http: and not https: for typed in URLs?

When I type example.com without any scheme into the browser bar and press Enter it is interpreted as HTTP://example.com, not HTTPS://example.com. Why? And where are the plans to fix this? (To be clear, I'm talking only about typed/pasted addresses coming from a "lazy" user, not about software-...

feels like a direct dupe of

38

Q: Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?

cryptography web-application tls http

any thoughts?

feel free to flag as dupe if you agree

AviD

@ManishEarth why on earth would I buy a lenovo product? What do you take me for, a troglodyte?

@TerryChia @ManishEarth apparently the superphish also installs the cert into FF's store.

@tylerl also completely ridiculous, unfounded, and wrong.

@tylerl since when did you become a rabid proselyte who replaced dogma for brains?

Awww, the things Google will do to a good person.

tylerl

@AviD lol. Not saying anything specific is better, just saying that security is your top concern, then windows is a ... confusing .. choice.

AviD

@tylerl that would be based on an assumption that there is a more secure platform?

or rather and more specifically, a platform that is easier to secure properly.

regardless, those are both ridiculous claims.

ones that you would not have stated (at least not in public) just a few short months ago, before drinking the google juice.

I am now going to continue to mock you mercilessly for the assumed google groupthink.

@Simon some of those are funny, but the delivery is so painful.

Nוnɛfוngɛrϛ

09:15

All I have to say is X11, security, lol, LOL, LOLLLLL, HAHAHAHAHAHAAA

Rоry McCune

@Nוnɛfוngɛrϛ and of course, android... security LOLOLOLOL

Terry Chia

@RоryMcCune "Windows Phone." "Windows what? LOLOLOLOL!"

tylerl

@AviD I haven't used a Windows desktop in 7 years. I figured most people don't have the luxury of using Linux or OSX instead of windows because of "work" related issues.

Then I go to Google where you have to have a special justification if you want a Windows desktop. nobody uses it.

Rоry McCune

@TerryChia well I'm not a WP user but the OS has sold millions of units so all relative at the end of the day

Terry Chia

@RоryMcCune Your face is relative.

tylerl

09:20

I have seen the promised land, where we can be free of Active Directory for ever.

Rоry McCune

@TerryChia you forgot your <simon></simon> tags

Terry Chia

@RоryMcCune I thought that was implicit in The DMZ?

Rоry McCune

@tylerl out of genuine curiousity what would you see it replaced with for large groups of users to provide central auth stores?

Terry Chia

@RоryMcCune Node.JS.

Rоry McCune

@TerryChia ooh I hope not! Everything I say in here in a simon tag...

Nוnɛfוngɛrϛ

09:21

@TerryChia Rust

Terry Chia

Active Directory isn't webscale.

AviD

@tylerl wat

I think that is the first time I heard "linux" and "luxury" in the same sentence non-ironically.

@tylerl I was forced to use a Mac for a few months for work related issues. Those were a dark few months indeed.

and, my most vulnerable months too.

Journeyman Geek

@tylerl heh. Most of my industry is like that

Nוnɛfוngɛrϛ

Oh boy we gots us some OS-religion wars like we're some kind of slashdot

So

Journeyman Geek

My main box is a centos 6.5 ex-graphics workstation. However we have a critical non production app that's OS X only

AviD

09:24

@tylerl see, thats the religious groupthink that I was referring to.

Nוnɛfוngɛrϛ

Linux security sucks for the desktop because X11

Terry Chia

@Nוnɛfוngɛrϛ You obviously have not been in The DMZ for a while. We have OS wars on a regular basis.

Journeyman Geek

@Nוnɛfוngɛrϛ and actual security is haaaard

AviD

@tylerl Active Directory can free your mind

Terry Chia

It's mostly be making fun of @AviD and @RоryMcCune.

Nוnɛfוngɛrϛ

09:24

OS X sucks because they were the last to introduce ASLR and have not received significant security attention compared to the other two

Terry Chia

Me*

AviD

@TerryChia LOLLLL

Journeyman Geek

@Nוnɛfוngɛrϛ: and I can't officially build my own system the way I want it ;p

Nוnɛfוngɛrϛ

Windows security sucks because most people writing software for it introduce bugs, plus it has to backwards support 10000000000 things that increase complexity beyond all reasonable bounds.

AviD

@TerryChia actually, we dont. We have OS mocking. Wars are rare here.

Terry Chia

09:25

@Nוnɛfוngɛrϛ We should all be using OpenBSD obviously.

AviD

@Nוnɛfוngɛrϛ wow, sounds like you are becoming a Windows advocate.

must be all that mucking around with kernels.

Journeyman Geek

@AviD: actually sounds like he says... All operating systems suck ;p

Nוnɛfוngɛrϛ

@AviD There are other issues too

AviD

@JourneymanGeek yes, but in different ways.

Nוnɛfוngɛrϛ

Ok

tylerl

09:27

@AviD Every month there's a new Windows-specific security disaster. Another cryptolocker, another banking trojan, another password hijacking tool, etc. And you can either spend your life doing tech support for your family, trying to rebuild after [security disaster] has trashed their computer... or.... you can just not use Windows, and problem.fucking,solved,

AviD

there is such thing as bad design, and there is such thing is "impossible constraints".

tylerl

Luxury, yep.

Nוnɛfוngɛrϛ

Windows security sucks because they shoved half the GDI subsystem into kernel unnecessarily.

AviD

@tylerl uhhhh

welcome to 1997?

Nוnɛfוngɛrϛ

win32k.sys

AviD

09:28

@Nוnɛfוngɛrϛ oh yeah, that is true

Nוnɛfוngɛrϛ

so

my point being

AviD

though I thought they took that out?

Flyk

I swear running in the cold is bad for your health

AviD

what with all the support for headless Server Core

@Flyk running is bad for your health

Flyk

no

rule #1: cardio

Rоry McCune

09:30

@Flyk define cold

Flyk

@TerryChia Windows 8.1 is the only operating system you'll ever need, until Windows 10 comes to replace it

Terry Chia

@Flyk I don't think he'll get that.

Flyk

@RоryMcCune lower than 10 degrees

AviD

cardio is bad for you. Your heart pounding like that is your body's way of telling you to relax.

tylerl

It's crappy because 2 decades of bad priorities and poor management has led to a mess of legacy landmines. Rendinging truetype in the kernel is a symptom. The cause has metastasized.

Rоry McCune

09:30

@Flyk ah so southerner definition of cold :op

Flyk

@AviD my heart doesn't pound, it flutters along in time with the music

AviD

woot! just won a free package of coffee. Silly competition, won by a geek

Journeyman Geek

and your heart stopping is your body's way of telling you I told you so?

AviD

@JourneymanGeek exactly

> I ain't puttin' up wit' dis crap!

Flyk

I have been on the edge of death, I know what critical heart palpitations and misbeating feel like

that was drug related, though

unable to breath as you collapse to the floor

this is more about pulling in loads of cold air while breathing

it just doesn't feel right

my lungs feel like they're on fire

@RоryMcCune psh, "cold" is 15 degrees or below while sitting, or 10 degrees while working out

I can't imagine what running as a cigarette smoker must be like

fuckit, I'm going to shamelessly self plug

fml, that was a bad idea

why google

sec.se doesn't need translating into sexy

WHY DID YOU DO THAT

AviD

09:37

@Flyk yeah, excercise will often make you feel that way

tylerl

@Flyk huh?

AviD

@tylerl yes, she did just share with a bunch of internet strangers that she is going to go plug herself. No shame, indeed.

Flyk

no

I'm going to amend the memes of sec.se and add this:

tylerl

@AviD shamelessly self-plugging presumably means the plugging happens on camera.

Flyk

15 hours ago, by Flyk

@RоryMcCune damn all you rories look the same, like you were made in some kind of rory factorory

AviD

09:40

@tylerl or in public

Rоry McCune

@Flyk huh whut?

tylerl

HAVE YOU NO SHAME??!

Flyk

no, I'm not plugging myself with anything on camera

except maybe ice cream, in my mouth.

if I wanted to enter the porn industry I would enter the porn industry

2

tylerl

@Flyk I hear you can make good money doing that. The internet has strange tastes.

Rоry McCune

@Flyk anyway we don't all look the same

I look much more corporate than @RoryAlsop (well some days anyway)

^see

Barry Carlyon

09:42

^ would bang

WHAT

Rоry McCune

@BarryCarlyon WTF!!!

Flyk

@RоryMcCune obviously @RoryAlsop in executives clothing

nice suit, though

Barry Carlyon

@RоryMcCune I am joking of course.

Flyk

if only you were 1/3 of your current age

Rоry McCune

@Flyk at a $largebank conf

@Flyk I'd be like 13 or something

Flyk

09:43

@RоryMcCune which is quite close to my age

AviD

@RоryMcCune oo like a suit and everything

Flyk

yeah, proper suit

Rоry McCune

@AviD it was a suit type conf

Flyk

much lieks

AviD

Stripes and dots, thats a bold choice.

you pulled it of well, though.

Your roried the heck out of it.

Rоry McCune

09:44

they had a proper photo person and luckily got that one decent shot

the other two they sent over were pretty bad

@AviD yeah I don't have a lot of shirt/tie combos these days as rarely use them

AviD

what, you dont have half your walkin closet full with suits, ties, and dress shirts even though you rarely wear them, just to bug your wife?

must be just me then.

Barry Carlyon

Dang was gonna post my photo in a suit but I can't find it on tEh googles

Flyk

you look too much like a business person

I would turn upto such an event in ripped jeans and a bright tshirt

Rory Alsop

@Flyk definitely. But cardio does not need to mean running :-)

Rоry McCune

@Flyk yeah next weeks conf talk will be hoodie and jeans

AviD

09:49

@RоryMcCune you should try mixing it up once in a while.

hoodie and tie.

Rоry McCune

@AviD I have an awesome 90's style duck tie

that might work

AviD

whats that?

Barry Carlyon

XKCD Tie is best

AviD

ymean like a tie with ducks on it?

Barney style?

though I admit I'm not sure how it would even work on a hoodie.

Rory Alsop

@Flyk they keep complaining when I do that

Flyk

09:51

@RoryAlsop sure, but running also tones a whole variety of muscles

Rоry McCune

@AviD in the UK in the 50's there used to be a thing for having flying duck models on the wall, this tie looks a bit like that

Rory Alsop

@Flyk I refer you to my previous post :-)

@RоryMcCune I have my full cartoon tie collection. Stacks of them

Rоry McCune

@RoryAlsop good call

Flyk

@RoryAlsop I don't get laid frequently enough for sexercise to classify as exercise

I'm also starting to get really close to consistent 5 1/2 minute miles

Rory Alsop

are those two facts related :-)

@Flyk also - oh

Flyk

09:53

no, not related

Rоry McCune

@RoryAlsop you reckon she's chasing dudes down?

Flyk

lol

I don't chase

I play impossible to get for the first day

hard to get for the second day

Rory Alsop

@RоryMcCune heh - that was where I was going with that. Then a lasso or bolas

@Flyk going for persistence

Flyk

and anybody who is still around on day 3 gets to hold a conversation with me without me assuming negative things

Rory Alsop

@Flyk lol - extreme filtering

Flyk

09:55

and that conversation is like walking through a mine field

there are so many phrases that will turn me off somebody

Rory Alsop

I always assumed that is the sort of thing celebrities and incredibly attractive folks would need to do:

filter everyone - hard

Flyk

in the event I'm ever successful enough that newspapers care

the last thing I ever want is a newspaper story about my sex life

and since that's my current trajectory, I see no issue in getting used to the process in advance

hard dance upsets me so much

I love listening to it, but making it...

I build these beautiful dynamic tracks and then master all the dynamics out of them to make them as loud as everybody else's

it's about time the loudness wars ended

I am not successful enough to demand high dynamic range exports of other people's music yet

well, in many cases

so I have to destroy my own music to play it out

much prefer slower dance musics

this is starting to become a daily occurrance

where I come in here, chat to myself for several hours

and then suddenly everybody else turns up and talks nonsense about information security

or cats

or hitler

I wonder if this monologue will make it to a full page at 1920x1080 before somebody else responds

probably not, but here goes...

Barry Carlyon

@Flyk I don't want to interrupt :-)

Flyk

@RoryAlsop there is a reason I am friendly with all of my long term male friends

@BarryCarlyon dammit

well it's too late, now you've ruined it

way too much text to type out in order to get back to where I was

talk about destroying my motivation

Barry Carlyon

I for one welcome my imminent death at the hands of @Flyk

AviD

10:03

@BarryCarlyon you're optimistic she will use her hands. She doesnt know you well enough for that.

Tinned_Tuna

Can we make an arena, and equip each of them with a copy of Anderson's Sec. Eng. book. Two enter, one leaves and all that?

Barry Carlyon

@AviD true…

@AviD LIVING THE DREAM…

Flyk

I can kill you with my brain </river>

oh, I have a new highest voted answer on sec.se

thank you for everybody taking part in this experiment

fire for those who didn't

Barry Carlyon

Anything for @Flyk

Flyk

...*anything*?

screw you markdown

Barry Carlyon

10:06

@Flyk Pretty much anything

Flyk

@BarryCarlyon ...pretty much anything?

Barry Carlyon

@Flyk nods carefully

AviD

14 mins ago, by Flyk

@RoryAlsop I don't get laid frequently enough for sexercise to classify as exercise

Flyk

no, not that

as much as I like sex, I don't just hop into bed with anybody

Barry Carlyon

@Flyk likewise

2

Flyk

10:09

OH MY GOD YOU STARRED THE PLUGGING COMMENTS

sometimes I really hate this room

2

AviD

its not just anybody, he's willing to do ANYthing for you!!

and I can barely imagine a worse fate.

Flyk

@AviD you're the one that wanted hiring

can you really not imagine a worse fate?

AviD

@Flyk haha, that is amusing

@Flyk hiring whatnow?

@Flyk okay that was disingenuous of me.

Flyk

I am pretty sure that being my personal assistant would be a fate worse than eternal damnation

especially in the first hour or so after I've woken up

I see @RоryMcCune is having fun with pinned messages

Rоry McCune

@Flyk who... me :op

could've been @AviD or @RoryAlsop

Flyk

10:15

you should have given me room owner by now tbh

so I could remove you all and laugh for the brief second before getting removed

Rory Alsop

@Flyk I'd far rather if one did come out that it wasn't written by a hack journalist, but by me :-)

Rоry McCune

@Flyk yeah....no

Flyk

@RoryAlsop erm

you want to write about my sex life? o_O

AviD

hahaha

SEXUAL HARASSMENT .... BY A MOD

the surprising part is, it wasnt me

Flyk

I know, I'm still shocked

in comparison to most conversations in here it barely classifies as sexual harrasment, though

Barry Carlyon

10:22

"Guys you are hammering our API so we stopped you being able to fetch past page 16, but it's really our own fault because pages are limited to 100 entries"

sighs

Flyk

"Barry you said a sentence full of words and the only one I really paid attention to was hammering"

Barry Carlyon

@Flyk hehe dirty statement response

Flyk

huh

I wasn't being dirty, I was talking about hitting things with a hammer :/

perverts

Barry Carlyon

@Flyk sorry

Flyk

you're all as bad as each other

AviD

10:32

I read that as "as bald as each other". Wasnt sure what your point was.

CodesInChaos

@RоryMcCune Chat.se displays how pinned a message. No deniability for you.

Rоry McCune

@CodesInChaos darn, busted, and I would've gotten away with it too, if it hadn't been for you pesky kids

AviD

hehehe

@CodesInChaos were / how?

Barry Carlyon

@AviD pfft my hair is currently a little longer than shoulder length…

AviD

like a girl

Barry Carlyon

10:35

@AviD punches in face

AviD

to be clear, when I said "like a girl", I was talking about @Arperum.

Rory Alsop

@Flyk ... I don't think I said that

Barry Carlyon

@AviD rly?

AviD

@BarryCarlyon real men should all shave their heads.

CodesInChaos

@AviD The little down arrow on the right, and then "history".

AviD

10:36

and grow a goatee.

Barry Carlyon

@AviD I'm tooooo lazy to go get it cut

AviD

@CodesInChaos yeah...?

Arperum

@AviD Nope.

AviD

ohh! I looked at history, didnt notice the little "pinned by" at the top.

Arperum

@BarryCarlyon That's kinda short :p

AviD

10:37

@Arperum TWSS

CodesInChaos

@AviD Reading is difficult.

AviD

@CodesInChaos yeah....

Flyk

@AviD that's not true, but I prefer guys with short hair

and therefore it is true

why not

let's just insult half the channel

Barry Carlyon

shrug I've been wanting to get it cut for a while. Just been busy to get around to popping in for a trim.

Rory Alsop

10:52

@Flyk fuzzy does get my head stroked a lot:-)

Flyk

do you like being stroked?

CodesInChaos

@Flyk Beats having a stroke.

Rory Alsop

@Flyk cuddles, strokes - of course :-)

Transcript for