The DMZ

schroeder

02:13

yeah - I raised my eyebrow when they mentioned it

tylerl

02:51

@schroeder wow. just wow.

schroeder

03:06

@tylerl I just have to make sure the company is secure - I don't have much say on the direction of development.

... operational security aside ...

Stack Exchange

04:17

That seems like an awful lot of hassle when all I wanted was a cool sword.

Lucas Kauffman

04:50

@schroeder Scala is cool though

tylerl

schroeder

@LucasKauffman I've been learning a lot about it, and I agree it has cool points, but I'm not sure about converting all code to scala, including ditching XML and JSON data formats in favour of specialized scala objects ...

tylerl

@LucasKauffman "Cool" and "actually gets shit done" are often contradictory.

this.josh

remind me, what is good about XML?

tylerl

@this.josh You have to remember that SGML was the alternative

It's quite an improvement

SGML: "Sounds Great, Maybe Later"

this.josh

04:54

No, SGML was first, XML was the 'improvement'

tylerl

right. XML is was all sorts of Golden when you compared it to SGML

this.josh

which begot yaml

tylerl

Then JSON

this.josh

indirrectly, in the same way that ancient german begat english

Lucas Kauffman

I'd prefer json over xml anyday

tylerl

04:57

ASN.1 fits in there somewhere. It was one of those "good ideas" back in the late 80s

@LucasKauffman depends on the context. Try to build a web page in JSON

Lucas Kauffman

@tylerl true

this.josh

ASN.1 was quite early and was based on bit saving

Lucas Kauffman

@tylerl btw our latest app has support for FIDO :O

tylerl

@LucasKauffman wow

this.josh

ASN.1 was a 1980's era standard, and we all know how well those turned out. PCMCIA anyone?

tylerl

05:01

@this.josh It was theoretically a good idea, but it took a very bureaucratic approach to extensibility. And now it's the least-safe part of any TLS implementation.

this.josh

PC/104, AMR (Audio modem riser)

tylerl

@this.josh you looking for one?

this.josh

Why, are you sitting on a crateload of Dell Pentium II machines?

tylerl

@this.josh pc/104 is still pretty easy to come by since it's a useful form-factor in embedded

Very IOT

this.josh

Blech don't get me started on IoT. This is just a bad excuse to sell WiFi chips with cheap consumer electronics.

Why not run your toaster on PoE?

Should your washing machine text you when you have colored laundry in a white load?

Lucas Kauffman

05:06

@this.josh yes pls

this.josh

I suppose that's fair.

interesting IT Sec loop: Corp IT locks down IE, HR uses third party Java app requiring Java 6 plugin, IT provides local download for the plugin, but plugin can not be installed because lockdown rules consider it insecure. Works fine on Chrome, Firefox, Opera... IT Sec fail.

this.josh

05:26

@tylerl I think the real problem is multiple possible outputs for the same input, which might have come from the bureacuracy.

Terry Chia

06:36

@tylerl Scala is a "get shit done" language in the sense that it's the most optimal choice of language if you want those hipster devs your hired to actually write code for the JVM.

2

AviD

07:24

heh this is funny, in case you havent seen it already

10 hours walking a security conference

►

well some of you have, I'm sure, but they didnt bother sharing it with you

M'vy

@AviD "wanna see my bash?" I don't think I can hit on anyone with that line.

Morning all!

Rоry McCune

07:48

@AviD heh, a Javvad video! he's doing quite well for himself with that stuff

Adi

@AviD Hahahahahahehehehe

> Can I have your IP address?

That old guy looked sooo adorable

and creepy

@RоryM This year, I'm gonna bring a patch for the AppSecEU QR badge.

I'm still not sure what I wanna write in it

Rоry McCune

@Adi '; Drop table attendee;--

AviD

08:04

@Adi all old guys look adorable and creepy

Adi

@RоryMcCune I was thinking of some prank to play on the people who scan you (the people on the booths)

Rоry McCune

@Adi well that (assuming they have SQL injection and the table is called attendees) could be amusing , but yeah perhaps not at the time..

Adi

@RоryMcCune Hmm.. I could put the info of some world leader

Rоry McCune

@Adi yeah Edward Snowdon could be amusing

or Julian Assange

Adi

For height plausibility, Manning would be more suitable for me :D

AviD

08:08

@Adi whaaat?? He's close to 2m tall, I seem to remember you're relatively shorter

not @Jefff levels of short, but not NFL tall either

Adi

@AviD I'm talking about Chelsea

AviD

@Adi chelsea clinton?

there is a chelsea manning?

Adi

@AviD Jepp

AviD

ahhh yeah okay

Adi

The girl who leaked the docs

AviD

08:10

I assumed you meant this Manning:

Peyton Manning

Peyton Williams Manning (born March 24, 1976) is an American football quarterback for the Denver Broncos of the National Football League (NFL). A five-time league MVP, he played for the Indianapolis Colts for 14 seasons between 1998-2011. He is a son of former NFL quarterback Archie Manning and an elder brother of New York Giants quarterback Eli Manning. Manning played college football for the University of Tennessee, leading the Volunteers to the 1997 SEC Championship in his senior season. However, No. 3 Tennessee lost to the No. 2 Nebraska Cornhuskers 42-17 in the Orange Bowl, giving Nebraska...

Rоry McCune

@Adi what about satoshi nakamoto

AviD

@RоryMcCune TAYLOR SWIFT

Rоry McCune

@AviD good call

Adi

@AviD But she'll already be in the conference

AviD

@Adi with a fake QR code that says "Adnan"

Adi

08:16

@AviD :

:O

M'vy

Why would people code ifs without curly braces... tell me...

AviD

@M'vy lack of experience?

specifically in searching for that one stupid bug caused by missed statement block....

M'vy

@AviD Or maybe they just like to screw with whoever will maintain their code. idk.

AviD

other than that - spaces/tabs, braces on same line / new line, parantheses spaces / no spaces, empty argument list / no list, etc etc etc for all other silly formatting preferences.

@M'vy extra points if they indent it as if it is all part of the same block.

M'vy

@AviD Well for style, I can get it. Everyone likes it's own.

@AviD ah ah :) I got better yesterday

AviD

08:24

@M'vy thats mostly not even style, its formatting.

M'vy

if(cond)
(cond2 ? math_statement : math_statement2)
(cond3 ? Assignement1: assignement2)

AviD

any IDE worth its salt can reapply formatting rules as per your preference, regardless of the original source.

M'vy

@AviD Yeah, the problem is source control

AviD

@M'vy ah no indentation is just as bad

@M'vy not really

or rather, it shouldnt be (though yes sometimes it is)

M'vy

@AviD Well I've remove the indents cause of markdown thingy. But even indentation made that stupidly unreadble

AviD

08:27

@M'vy ternaries ftw!

its lacking some unary prefix/postfix joy.

M'vy

@AviD I think some uses hooks to auto-style on commit or so?

AviD

that could be reeeeheeelly confusing.

M'vy

@AviD ah ah

AviD

@M'vy can do that, or just display your way without changing the source, or set your vcs to ignore trivial whitespace changes

Rоry McCune

@M'vy pythonistas?

M'vy

08:29

@RоryMcCune Yeah, ofc I was talking of C/C++ :)

AviD

@M'vy ohhh I was talking C#.

M'vy

@M'vy and related :P

Rоry McCune

@M'vy I was thinking that if someone liked python they might become accustomed to its formatting and carry it over to writing in other languages....

M'vy

@RоryMcCune ah ok, I get the point now

But I'm sure it's just laziness

Terry Chia

@M'vy IIRC the Linux kernel style guide explicitly mentions that one line if statements shouldn't have braces.

M'vy

08:30

Or C/C++ hipsters

AviD

@TerryChia you're kinda proving the point here.

Terry Chia

If not the kernel style guide a style guide of another major C project.

AviD

as @CodesInChaos said, the linux kernel should not be held as an example of excellent coding style.

M'vy

The thing is, I see absolutely no reason of why one would want that

AviD

@TerryChia @M'vy I would allow that, IF it is a trivial SAME LINE statement.

Terry Chia

08:33

Hey, no judgements. I don't write C often enough to have an informed opinion.

M'vy

yeah same line maybe. But even so, what does it cost to add '{' '}' and 2 '<CR>' ?

(modulo tabs/spaces)

AviD

@TerryChia I dont write C often, but I read it waaaaay to often to NOT have an opinion.

remember, the code you write is for another programmer to read (or yourself). The computer is happy reagardless.

M'vy

@AviD If a computer happy can be.

AviD

@TerryChia is there even a thing, writing C often "enough"?

if you never write C outside of a classroom, that is often enough.

Terry Chia

@AviD The only C code I read on a regular basis is OpenSSL. I don't want to form an opinion from that. :P

AviD

08:35

@TerryChia oh you should.

as bad as Openssl is, it is far from the typical worst.

M'vy

Hum.. that qtcreator fakevim do some strange things sometimes.

CodesInChaos

08:58

@AviD I don't think I said that.

AviD

@CodesInChaos well, somebody smart did.

oh huh. Not sure it was a smart person.

Apr 29 at 14:09, by raz

@Rhino I wouldn't be so quick as to look to the Linux kernel for good programming practices.

I may have to revise my opinions based on new information.

then again @Rhino also agreed with him.

CodesInChaos

I like using if without braces.

Tinned_Tuna

I use OpenBSD's style for C. But I'm aware that I disagree with it on some points.

CodesInChaos

One interesting variant (which I don't use personally) is putting the then part in the same line as the if itself. That way they can't be torn apart by accident.

Bernstein uses that style.

Tinned_Tuna

And I'm also aware that a style isn't there to suit one's personal preferences -- you can't please everyone all the time. Select one that's widely used and stick to it, if possible use tool support to enforce it.

CodesInChaos

09:02

One compromise rule could be: Braceless if is only okay if the then statement transfers control elsewhere (e.g. throws an exception, returns, breaks, etc.).

That way most accidents lead to unreachable code, which should trigger a compiler warning.

and most of my simple ifs would fall under this rule. e.g. if(x==null)throw new NullReferenceException(), if(x==y)break;

AviD

@CodesInChaos I like peeing in the swimming pool.

okay not really.

@CodesInChaos this I mentioned, and I think it also helps with clarity sometimes.

41 mins ago, by AviD

@TerryChia @M'vy I would allow that, IF it is a trivial SAME LINE statement.

@CodesInChaos yeah, thats the type of thing I was referring to. excellent examples.

its when the single line then statement does something, like a calcluation or an assignment... thats where it gets messy.

M'vy

09:36

Hey, do MSWin has a special meaning for CTRL-] and CTRL-[ keys? I cannot use them inside my gvim...

CodesInChaos

09:48

@M'vy It doesn't necessarily have to be windows itself, it could also be some program that registered these as a global hotkey.

M'vy

hm

Lucas Kauffman

@M'vy COBOL.

Lucas Kauffman

10:01

@M'vy great thanks, that's what I thought, but I just needed confirmation

M'vy

@LucasKauffman wasn't that question "too easy" ?

:)

ANyway lunch time

Lucas Kauffman

@M'vy It's GSM, if you look at the security, it's one facepalm after the next

so I just wanted to be sure :P

M'vy

@LucasKauffman yeah I agree with this. Ahah

M'vy

11:30

@LucasKauffman as a note, the slides are saying: COMP128-4 for 3G networks is based on AES

Simon

12:10

Hello @Kisunminttu!

M'vy

Hum biology.beta has the new user profile but we don't

Simon

@M'vy Wow -.-

M'vy

And hi @Simon

Simon

Hello kind sir.

To whom do we complain about this?

Thomas Pornin

@M'vy I used to omit the braces because it was saving one line (the one with the closing brace). Under the rational reason that saving lines was increasing the amount of code that could be embraced by my eye without vertical eye movement.

M'vy

12:13

@Simon how dare you ask a "To whom" question @simon ...

Simon

:D

raz

Finally

jesus it took forever to login

@M'vy Seriously?

Does SE hate us?

AviD

@ThomasPornin and now, you're all about optimizing the code embraced by your eye, instead of maximizing?

Thomas Pornin

@AviD I came to the conclusion that I write code not only for myself, but also for other people, and I had to write code that other people can read comfortably, too.

AviD

@ThomasPornin yeah, I mentioned that.

Thomas Pornin

12:24

Omitting the braces, though rational, proved tiresome to explain and justify again and again.

AviD

also, "other people" can also include yourself 2 months from now.

raz

@ThomasPornin That sounds a bit too logical, you can't possibly be a developer

Developer's Anthem: Obscurity

Thomas Pornin

@raz I am not a developer, I am the Bear !

2

raz

I am the Eggman

Simon

Wasn't the whole Apple SSL bug due to forgotten braces or something?

Thomas Pornin

12:28

@Simon Braces don't create bugs; people do.

Simon

Or at least it would have had avoided the issue.

raz

Braces are almost always a good decision. Except in Python.

Simon

@raz lulz

@ThomasPornin Yes, yes, I know. Guns don't kill people, I kill people, with guns POW.

CodesInChaos

I'm mainly afraid of merges breaking the code with single line ifs.

raz

@CodesInChaos One of my many pet peeves

Thomas Pornin

12:30

@AviD Actually I have had good success rereading my own code much later on, since about 2003. I still improve my coding style for people other than myself (at any space-time location).

Simon

It depends for what though, when the only purpose of the if is to pluralize something or not, depending if the index is higher than 1, it is very tempting to do a 1 liner.

Thomas Pornin

@Simon For some such one-liners, I tend to use the ternary '?:' operator.

(in C-like languages where such an operator exists, of course.)

raz

@ThomasPornin I definitely prefer that

Simon

Yep, it looks good to me too.

AviD

@Simon that's cute, @Simon is pretending to understand code.

Shush now, grownups are speaking.

raz

12:48

Hey PHP is a real... hahaha I can't even say it with a straight face... language

Simon

github.com/Pittoreski/Anti-brute-force-authentication

FEAST YOUR EYES ON MY PYTHON CODE YOU DONUTS

2

Journeyman Geek

MY EYES. MY EYES

raz

Are burned from their sockets?

AviD

@Simon thats not your code. Can't be, not nearly enough donuts.

Simon

@AviD pls

Thomas Pornin

12:52

@Simon "Pittoreski" ?

Simon

@ThomasPornin That's my online identity, yes.

AviD

@ThomasPornin @Simon OPSEC FAIL

Taylor will spank you later.

taking turns with Grugq.

Simon

wat

It is also my website: pittoreski.com

AviD

@Simon there are no donuts there

raz

Why would you have a website of baby bunnies getting murdered...

Simon

12:57

getting wat

I'm building some sort of portfolio right now so soon it'll be super serious.

Hence why I'm uploading snippets on github.

raz

Man Bear Pig exists, I'm super serial!

Simon

Yeah, that's how serious I'm expecting it to be too.

I think that what I hate the most about VB6 is the lack of try catch.

AviD

you dont like ON ERROR RESUME NEXT ?

Simon

Not a fan having of using GoTo to get to my error management.

CodesInChaos

13:18

@Simon The only proper way to slow down online guessing attacks is a sleep(5 mins) call.

Simon

@CodesInChaos Haha.

CodesInChaos

I've seen code somewhere on stackexchange that seriously used that technique.

AviD

no no, the only proper way to slow down online guessing attacks is to make the user input his password twice.

Simon

@CodesInChaos And it was on a web-based app?

CodesInChaos

I think it was php

Simon

13:22

Oh boy.

AviD

@CodesInChaos ooooof COURSE it was.

CodesInChaos

@Simon Can I use X-Forwarded-For to spoof any IP?

AviD

@CodesInChaos of course. it is informational only, and not necessarily honored by anybody.

CodesInChaos

@AviD You misunderstood my question. I was asking if I could use it to fool simon's code.

AviD

@CodesInChaos ahh yes of course I did. I was wondering why you were asking.

@CodesInChaos why does @Simon's code look at X-Forwarded-For?

or are you asking rhetorically...

Simon

13:35

@CodesInChaos I'm hoping that the ipware library is more clever than that but you're making me doubt right now.

But according to the default precedence, I think you're right.

Wouldn't REMOTE_ADDR be the most reliable in this case?

CodesInChaos

The proper solution would be using the remote ip of the TCP connection by default, but allowing you to configure it differently (if you have some kind of load balancer or reverse proxy)

Terry Chia

@Simon Login_failed isn't a Pythonic class name.

CodesInChaos

@AviD ip = get_real_ip(request) or get_ip(request) simply looks suspicious.

Since that's some kind of fallback.

Terry Chia

@Simon Prefer 4 spaces over tabs for Python code.

CodesInChaos

tabs4lyfe

David Freitag

13:44

4 spaces instead of tabs is literally the devil.

Terry Chia

@Simon Keep it under 80 chars per line.

AviD

@CodesInChaos ah sorry, I didnt actually inspect @Simon's code.

Rоry McCune

2 spaces FTW!

tabs <shudder>

David Freitag

@RоryMcCune Dude the arduino IDE uses 2 spaces. I have never understood that.

Terry Chia

@DavidFreitag Not in Python.

AviD

13:47

spaces vs tabs has been empirically proven. it is now a ridiculous argument with only one possible, considerate answer.

Rоry McCune

@DavidFreitag ruby standard :)

Terry Chia

@RоryMcCune I think it's standard in node.js code as well.

David Freitag

@TerryChia Why? And answers like "It's standard" or "Because some python interpreters choke on tabs" are not acceptable answers.

Terry Chia

@DavidFreitag "It's standard" is literally the answer because tabs vs spaces is a matter of project convention.

AviD

since it has always been an argument, and *always will be*, the only acceptable answer - is to put in some placeholder, and let each programmer format according to his/her personal preference (or ascribed dogma).

That placeholder is a tab.

David Freitag

13:48

^

Rоry McCune

@AviD phhbt

AviD

@RоryMcCune 2 spaces is stupid, even for spacers - it is not enough to be visually significant. go for 3 spaces, if at all.

Terry Chia

@AviD No.

Rоry McCune

@AviD in the fonts I use it's usually pretty easily visible

David Freitag

@RоryMcCune Every time you make that noise it sounds like a fart to me.

Rоry McCune

13:50

@DavidFreitag it's intended to signify someone blowing a raspberry

David Freitag

@RоryMcCune Why would someone blow a raspberry?

AviD

@TerryChia you're wrong. any other possible answer you try to come up with is just forcing a square peg in a round hole. There is no possible reason to force such a stupid formatting requirement - except consistency, which is amply solved by the placeholder+tool-formatting solution.

David Freitag

@RоryMcCune Nobody but you codes in 72pt Consolas anymore.

Rоry McCune

@DavidFreitag it's intended to indication a subtle derision :op

AviD

@DavidFreitag yeah! Even @RoryAlsop uses 86pt Times New Roman.

Rоry McCune

13:52

AviD

@RоryMcCune derision for the raspberry, upon whom you are currently mouthing?

David Freitag

@RоryMcCune I see, must be a UK term.

Rоry McCune

to even my aging eyes that's a relatively easy to determine level of indentation

AviD

@RоryMcCune dark / light screens are another formatting choice.

I bet @TerryChia wants to force everybody to use the same colors.

David Freitag

@RоryMcCune What's with all of the unnecessary extra lines in there man?

Or is that also a ruby standard?

Rоry McCune

13:53

@DavidFreitag apparently the US equivalent is a "bronx cheer" en.wikipedia.org/wiki/Blowing_a_raspberry

AviD

@DavidFreitag there is only one unnnecessary, before the begin

CodesInChaos

I fart in your general direction! Your mother was a hamster and your father smelt of elderberries!

David Freitag

@RоryMcCune Oooooh duh. I thought you meant violating fruit.

AviD

@RоryMcCune I grew up 'merkan, I always knew what a raspberry is

Terry Chia

@AviD No. Stick to whatever is the standard and stop debating pointless stuff.

Rоry McCune

13:54

@DavidFreitag no , no violation of fruit intended.

AviD

@TerryChia exactly. the standard is a tab. stop arguing.

David Freitag

@RоryMcCune Phew.

Rhino

@AviD I think any large programming project has undesirable properties. These are called compromises... usually between engineering ideals and getting stuff done. That doesn't mean it's exemplary code; it also doesn't mean it's terrible.

Simon

@TerryChia What's the standard for class names?

Rhino

I happen to think the LK use of goto is a good example of where it can be used to avoid nested ifs

Simon

13:55

@TerryChia Noted.

Terry Chia

@AviD The standard is a tab for your project. It isn't for 99% of Python / Ruby / whatever projects. Stop trying to force others to accept tabs as standard.

Simon

@TerryChia Noted too, thanks.

Terry Chia

@Simon PascalCase.

methods, functions and variables are lower_case_with_underscore.

AviD

@TerryChia its the other way around. if you use a tab, you allow everyone else to control formatting.

Rоry McCune

@TerryChia PyPy.js anyone? pypyjs.org

CodesInChaos

13:56

PascalCase, camelCase, snake_case

AviD

you are the one trying to force everyone to use a specific number of spaces.

Terry Chia

@CodesInChaos Oh yeah, blah.

CodesInChaos

SCREAMING_BLOODY_MURDER_CASE

Simon

@TerryChia Ah, that's why I got confused. Taken from the doc: "Use underscores, not camelCase, for variable, function and method names (i.e. poll.get_unique_voters(), not poll.getUniqueVoters"

Rhino

but then I'm making a subtle distinction when programming communities in general would rather argue about tabs versus spaces. I'm in the wrong f***ing job.

Simon

13:56

But then right below: "Use InitialCaps for class names (or for factory functions that return classes)."

Whoops!

AviD

@Rhino its a stupid argument.

8 mins ago, by AviD

since it has always been an argument, and *always will be*, the only acceptable answer - is to put in some placeholder, and let each programmer format according to his/her personal preference (or ascribed dogma).

That placeholder is a tab.

Terry Chia

@AviD I literally do not give a damn and do not want to argue with you further.

Stop forcing me to try and accept your view.

AviD

@TerryChia yes, you do .

@TerryChia I am saying exactly the opposite.

David Freitag

We should all golf our code, so all of these pedantic arguments over whitespace can end.

AviD

if you use tabs - everyone can choose their OWN view.

by prescribing X number of spaces, you are the one trying to force everyone else to accept YOUR chosen view.

Terry Chia

13:58

@RоryMcCune Yeah, the cool thing about RPython is that it's theoretically possible to have different compile targets. The C target is the only one actually working decently at the moment.

CodesInChaos

Shut up avid. I like tabs, but I don't want to hear your argument.

AviD

@CodesInChaos heh. I AM SAYING IT IS SILLY TO ARGUE.

CodesInChaos

SHUT UP

AviD

It is just formatting. tools should handle formatting, not people.

David Freitag

@AviD THEN STOP BEING SILLY

Simon

13:59

@CodesInChaos Yes. It said in the doc that you should use real_ip if you were on the same network as the server.

AviD

lol, exactly what always happens

Transcript for