The DMZ

Rhino

00:09

I was thinking of this on a slightly different level; right now on Windows for example you don't need the user to actually interact with the system to read the clipboard. It's possible to inspect clipboard data and even receive notifications when clipboard data appears.

As such, as soon as you copy your password to the clipboard, any app can grab it

Steve DL

yes exactly

same under X11 / current Wayland / Android

but that's the problem. At least limiting to the currently active app or to apps that have an explicit permission for unrestricted clipboard access would help towards security

Rhino

the only solution I can see to that is to implement something that understands the user operation "I want to paste a password into my super secure site"

but that's full of minefields. I might successfully implement a way to get my password to my browser, but what about the url I'm pasting to?

Don't want to paste my password in here for example

Steve DL

yeah, then it leads to data leaking

conceptually, OSs have no idea what a UI is

you'd be tempted to build some form of IFC inside apps

so that if the url bar's label receives a password, it cant send it into arbitrary packets

that go to arbitrary places

i've never heard of anyone successfully doing that

Rhino

@SteveDL it probably requires too much browser/OS co-operation to be feasible.

Steve DL

well, if you wanted to treat apps as arbitrary black boxes and only looking at IF in their memory, you'd hit a couple of glass ceilings

you cant deal dynamically with indirect control flows, to start with. so you cant always tell if the secret (or its value) you dont want to expose causes a code path or another to be executed

Rhino

00:18

I mean it's simple on the password/not a password level, but if you consider what selinux was really aimed at (no read up, no write down for gov MLS) you've then got even more complexity.

My interest here was could I build something that secures my bank tab and isolate it from everything else. The answer is probably not enough unless my bank tab is a bank browser instance running in a bank vm on qubes...

Steve DL

browsers have built-in sandboxing mechanisms

so you've got to trust those to be well-implemented

or you can go out of your way and run multiple separate instances

i-d actually love to have UI toolkits to build tabbed UIs with systematic separation between tab contents

currently too few apps are compartmentalised, and the effort of building an app with sandboxed compartments is pretty high so only very good / well funded teams attempt to do this

so if we could improve the developer experience of compartmentalised app writing, everyone would benefit. But it's also important that the OS provides the toolkit and enforces the separation, so that rogue apps cant bypass it

Rhino

@SteveDL I was purely thinking about it as an exercise in could it be done.

Steve DL

if even possible... one of the core principles of app confinement is that apps must be stateless

@Rhino i can blabber for hours about these things. best to sneak out of the room discreetly ;-)

Rhino

@SteveDL they are if the OS can enforce the sandbox; however there have been sandbox escapes based on OS bugs.

Steve DL

oh yes of course, that'll happen

but you only need to fix one bug in one app, and to propagate the fix once

that's much simpler than fixing every app one by one

M'vy

07:46

Morning!

Rory Alsop

Morning all

AviD

@DavidFreitag or do you mean "even better"

Rоry McCune

Mornin' All

Rory Alsop

08:02

ayup @Rоry

Rоry McCune

08:13

hey @Kisunminttu @Adi is that true?

AviD

08:47

"memcpy and memmove account for 4-5% of datacenter cycles" profiling the datacentre as computer http://www.eecs.harvard.edu/~skanev/papers/isca15wsc.pdf

Tweeted by justincormack on May 6, 2015 at 1:58 PM

@Rhino I thought you might enjoy that one ^

Rory Alsop

09:14

@RоryMcCune hahahaha

Adi

09:31

@RоryM Jepp. Sterotypical Finns rarely say anything about anything

When they do, it's usually a urprise to everybody else

AviD

@Adi and always when soaking nude?

Rоry McCune

@Adi but there's smalltalk in saunas?

I guess scandanavians must get a bit surprised if they try to visit "saunas" in scotland

Adi

@RоryM Usually, sauna is a place for piece and relaxation

Rory Alsop

@Adi relaxation...probably

:-)

Adi

also spanking your friends with tree leaves

2

Rоry McCune

09:35

@Adi yeah in scotland saunas are sometimes a euphamism for brothel....

Rory Alsop

@Adi That doesn't sound too unlikely in Edinburgh either

AviD

@Adi you have a weird sex life.

Adi

Scandanavians are surprised when visiting Finnish saunas as well

They can't handle the heat

Rory Alsop

@Adi why

Adi

An average of 80C is too high

AviD

09:36

@RоryMcCune that... could be interesting

Adi

Scandanavian saunas are usually ~65C

Rоry McCune

@AviD yeah like I said, could be easily misconstrued, especially with a language barrier...

Adi

Tbh, everything in Finland is shocking to Scandanavians.

AviD

@RоryMcCune and this in addition to the confusion that arises in Scotland for any typical skirt-chaser.

Rory Alsop

@AviD hahahahahaha

Adi

09:38

The careless women, the weird social life, the exessive drunkness

AviD

@Adi yeah, Scotland is a crazy place.

Adi

Reminds me of Glasgow, really :D

Rory Alsop

@AviD very good. I see what you did there

Adi

Except weird social life in Scotland is just being friendly to everybody

Man, I loved the little time I spent there

AviD

@Adi that IS weird.

Rory Alsop

09:45

@AviD friendly to everyone - except today, when everything is politics and nonsense

I'm going to be grumpy to everyone today

AviD

@RoryAlsop you could be friendly while being angry. Independently cross, even.

HOW ARE YOU grumble DOING TODAY?!!

Rory Alsop

@AviD Independently cross? Like my eyebrows!

AviD

@RoryAlsop actually, being super-friendly to strangers while making a really angry face, really creeps them out.

even not strangers. Works well on annoying in-laws, too.

Rory Alsop

10:54

@AviD I don't think I know how to make an angry face. I even need to wear a mask on stage to look at all scary

M'vy

11:20

hm... that time when you google something and the relevant link is your own unanswered question on a stack...

M'vy

11:31

So the thing is: windows 7 uk keyboard has a correct CTRL-[ code, but the extended uk keyboard has not...

And go google CTRL-[ or C-[ if you dare...

even with ".." it does not work

Simon

allo

M'vy

hey

Rhino

12:31

@AviD Love it! We should totally ban that function then that'd save 4-5% of cycles ;)

Particularly memmove. Who are those C scumbags who want to copy memory to regions that overlap itself? Can't you see that's madness?

Almost as bad as those C++ people with their move operators.

Tinned_Tuna

@Rhino OpenBSD have enabled a "Do these regions overlap?" condition in their memcpy implementation, sauce: openbsd.org/57.html

Rhino

@Tinned_Tuna yeah they bug out rather than just let it happen and go on with UB.

That's probably a good idea.

Tinned_Tuna

@Rhino Yea, I think I approve. Loss of availability is better than a loss of C or I, I'd say.

well... "better."

Rhino

I'm for anything that minimizes bugs in code - UB is hard to detect because well it's undefined, so crashes are easier to find and test for, then fix.

You'd hope

Tinned_Tuna

12:49

There are lots of confounding issues at play with UB. I wish it was just not there.

Rhino

@Tinned_Tuna Write Haskell! cc @RоryMcCune I know Rory likes ethically sourced haskell.

Rоry McCune

@Rhino hey hey no conflating me with the hipster boys (CC @AviD @TerryChia)

Thomas Pornin

@Rhino Another equally good idea, but incompatible, would have been to silently map memcpy() calls to memmove() and be done with it.

Rоry McCune

although I might make an exception for Haskell due to the Glasgow connection

Thomas Pornin

It really depends on how purist they want to be.

Tinned_Tuna

12:50

I did used to write a lot of Haskell, but cabal was too much of a pain to keep going.

Thomas Pornin

Of course, if the OpenBSD people did not want to be purist, they would be using NetBSD.

2

Rhino

@ThomasPornin True but performance is a consideration. Only a slight one but memmove is not quite as efficient. If you know memory doesn't overlap memcpy should be slightly more efficient.

Tinned_Tuna

So now I live in the land of The Java, and feel sad, because my runtime is like a sieve.

Rhino

@Tinned_Tuna It's full of (security) holes?

Thomas Pornin

@Rhino My point is that by adding a test for overlaps in memcpy(), they nullified that slight performance advantage.

memcpy()-with-test is no better than memmove(), because memmove() really is memcpy()-with-test.

Tinned_Tuna

12:53

@ThomasPornin my understanding was that they'd enable it for a few versions, hopefully blasting the bugs in due course, and revert after a while.

Thomas Pornin

@Tinned_Tuna That might be the intent but there is no way this will actually happen. It is there, it will stay there.

Tinned_Tuna

There's also the ideology of the project -- security is more important than performance.

Rhino

@ThomasPornin this is true.

Thomas Pornin

What may happen, and actually already does, is that the memcpy() calls generated by the compiler will map to a special __builtin_memcpy() or a similar function that does not do the test, because the compiler uses it only in "safe" situation (typically to copy structures).

Tinned_Tuna

Also of note, the OpenBSD team are comparatively good at code-gardening

so they are probably slightly more likely than other projects to revert the change in a few versions. But it's still quite possible that this is now permanent "feature" (view-point dependant) of OpenBSD now.

I do wonder how much the security features actually cost, in terms of developer time to implement, maintain, test, debug and review, versus electricity and cooling "wasted" on non-vulnerable programs (i.e. programs that don't need the feature, but it's on by default); and how that compares with estimated breaches prevented.

Rhino

13:00

I wouldn't mind if it was. It's probably worth the performance hit; unless you're doing something really high performance it's likely insignificant.

Even then I'd say that it's unlikely you'll be bound by the performance of your CPU.

Steve DL

hi there

Tinned_Tuna

@Rhino It's more likely that it's a (very?) small percentage, multiplied up by many thousands of hours on thousands devices.

Rhino

@Tinned_Tuna that's exactly what it'd be, but, if you're doing many many devices, chances are the cost of synchronising your tasks and communicating responses adds a lot to the cost. It all depends and you really need to measure it to know.

For example, arbitrary precision arithmetic is a good example. There's very little point adding the limbs up in parallel then summing the total because the cost of combining the limbs together - synchronising the threads - is so insane versus the efficiency of a single calculation it's not worth it - unless your numbers are astronomically big.

raz

13:53

Google Search: exploiting pids

Did you mean: exploding pigs

M'vy

@raz well... you know... world.

Rory Alsop

@Tinned_Tuna Although this is very very different to the head of the NHS - for him Availability and Integrity were essential, with Confidentiality being only something he had to do for the regulator.

raz

world domination?

Rory Alsop

His example was that he needed critical data to be available immediately for certain things - to avoid killing patients

Rоry McCune

@RoryAlsop yeah it always makes conversations about password quality and account lockouts tricky in healthcare

M'vy

13:59

@raz no, dumb world

Rоry McCune

put a strong password on this and if you get it wrong 5 times we'll lock you out of the system that tells you a patients drug allergies

is not a good message

Steve DL

not to mention the amount of authentication events is ridiculous, upwards of 20 a day, in hospitals (dont ask me for source, i forgot it)

Rory Alsop

Yep - to be honest. I fully agree with their reasoning, even though it makes buying off the shelf products tricky, as they aren't set up with the same priorities. Saving lives trumps all the rest of it for almost all circumstances

Simon

And also, they don't offer donuts to their patients. What a shitty healthcare system.

Steve DL

I think that's a pretty good move healthwise not to offer donuts. Y'know, obesity.

We keep the donuts because we love you

Simon

14:11

Some believe that psychology has a lot to do with someone's health, how he recovers, etc.

No one can be unhappy with donuts.

Yes ladies and gentlemen. I am saying right now that we can cure cancer with donuts.

M'vy

Be advised, our sensors are detecting obvious starbaiting going on.

Rhino

@RoryAlsop You could argue that said modifications are about availability too. If you know when an application crashes you can design procedure to handle it (or if you're developing it fix it) but if an application crashes randomly you never know when it won't be available. As such it could randomly crash on you when you need it most.

raz

@Simon Then Dunkin' Donuts and Tim Hortons are slacking!

Simon

@raz No, they're getting bullied by the pharmaceutical industry!

Rоry McCune

Scrubs Kitten Scene

►

Simon

14:23

@RоryMcCune Exactly like that but with donuts!

I gotta say that I'd enjoy the box of kitten, too.

Rory Alsop

14:33

@SteveDL Apologies - I am still on calls... I may need to look a bit further ahead and plan a chat next week.

Simon

On calls to do HR? Odd.

Tinned_Tuna

@RoryAlsop ah yes, I think banks often have that problem (in other ways) that they'd rather "give" money to the wrong person and compensate, rather than deny access to a legitimate user.

Steve DL

14:59

@RoryAlsop no worries!

M'vy

@WorryAlsop no rories!

Rory Alsop

@Simon HR is all about the chat

Steve DL

@M'vy well there are indeed no rories on the phone here! :-)

Seen on the site today: "If you can not thrust your virtualisation software your screwed. " oh, the innuendo

Tinned_Tuna

15:17

uh

Simon

Confused_Tuna

Rоry McCune

15:46

@M'vy no Rories?!?!?

Rhino

@RоryMcCune if you say no rories but you're that guy from life of brian you get... no worries

Or probably more accurately no wowwies

Simon

pls rhinu

Rhino

@Simon Yes salmon?

Simon

:OO

Rоry McCune

16:12

@Simon not a fan of salmon?

Simon

@RоryMcCune Not a fan of fish in general, I had too much when I was a kid.

Rоry McCune

@Simon ahh well being raised by bears will do that to you I guess

that's how it works in canada right? you get turfed out to be raised by bears in the wilderness..

Simon

Yes, until 5 y/o.

Lucas Kauffman

Alright 2 exams down one to go

Simon

5-10 beavers, 10-15 moose

Rоry McCune

16:23

@Simon so basically fish, trees and whatever the heck moose eat are right off the menu!

@LucasKauffman what exams is this you're doing..?

Lucas Kauffman

@RоryMcCune Msc Infosec at RHUL

@RоryMcCune just did computer and network security

still need to do security management

Rоry McCune

@LucasKauffman ahh I see interesting, is it a purely remote course or have you been in Sunny london?

Lucas Kauffman

@RоryMcCune remote course, pay 50 bucks an hour to do exams

I think it's a great business model :p

Rоry McCune

@LucasKauffman so you pay them for exam time? sounds like an incentive for them to give you lots of tough exams :)

Rhino

@RоryMcCune and the bears all speak French and know crypto

@Simon 15-20?

wolves?

Simon

16:38

@Rhino If you're a chosen one, yes. Otherwise, you go back to your human family.

Lucas Kauffman

@RоryMcCune 3*2 hours

Rоry McCune

@LucasKauffman are they online exams?

Lucas Kauffman

@RоryMcCune handwritten

I shit you not

Rоry McCune

@LucasKauffman ouch! what with bits of dead tree and a pen

last time I had to do that was 12 years ago when I did a cert in Data Protection

Lucas Kauffman

@RоryMcCune yea, actually bought a fountain pen just for the occasion :p

Rоry McCune

16:44

I reckon they passed me 'cause they couldn't actually read my writing!. Never been my strong point and these days I almost never write stuff

Lucas Kauffman

@RоryMcCune +1

Rоry McCune

heck when I was at school I presuaded teachers to let me type my exams (and this was before PCs were widespread) so I could aviod getting marked down for poor handwriting

Lucas Kauffman

Allah Beats

►

@RоryMcCune I tried explaining that, didn't work, it's ridiculous though, the whole damn course is online, with online seminars, online papers and then suddenly they expect you to return to 10 years ago

Rоry McCune

@LucasKauffman that's straight up bizarre, and TBH would put me right off looking at any of their courses

Lucas Kauffman

@RоryMcCune I'm also a bit disapointed in the material, I expected it to be a bit more actual on some things

Rоry McCune

16:48

@LucasKauffman ahh a bit outdated?

Lucas Kauffman

@RоryMcCune but yea I don't have a lot of choice if I want to pursue an MSC related to infosec which I can combine with my job

@RоryMcCune as in sections about disabling SSLv2 in favour of SSLv3

Rоry McCune

@LucasKauffman yeah that is the problem, not a lot of good options..

@LucasKauffman ahh yeck, must be a pain keeping the syllabus up to date for that kind of course ..

Lucas Kauffman

@RоryMcCune plus it's still good to have it, took me a while to get it approved tho, they debated on it for a month

so now I can't go back and say it's not as good as expected :P

I still need to do crypto and then I can choose two out of Advanced crypto, smartcards, forensics and ecommerce

I'm thinking of doing advanced crypto and smartcards, but I guess EY will prefer Forensics

Rоry McCune

@LucasKauffman you should do the e-commerce one then complain if it doesn't cover the benefits of IO.Js and MongoDB

Lucas Kauffman

@RоryMcCune :D

Rhino

16:52

@LucasKauffman Or do the advanced crypto one and complain it doesn't extol the virtues of mongo and io.js

Rоry McCune

@LucasKauffman or do the advanced crypto one and complain that it doesn't cover BearSSL!

Rhino

then write a blog post about it and win 1 internet

I'm still eagerly awaiting the release of BearSSL Dr Bear.

I will re-write it in Haskell just because @RоryMcCune likes it

and @AviD can create node.js bindings

Rоry McCune

@Rhino hey hey no tarring me with the hipster brush, I'm an old-school ruby person :)

Rhino

@RоryMcCune don't worry I don't think it's sticking

and I actually quite like haskell

I'm not sure it counts as hipster though, being as its old hat, is compiled and knowing what a monad is and type theory is too much like maths for "just build it"

Rоry McCune

@Rhino it's probably just that any level of hipsterism I could aspire to pales into significance next to that attained by @AviD :) I mean he's been employed by an actual silicon valley mac-wielding stealth mode startup!

Simon

16:56

@RоryMcCune My dream.

Lucas Kauffman

@RоryMcCune I was writing a bit on software flaws with flawed crypto and used as an example the usage of sha3 for password hashing. I listed scrypt, bcrypt and pbkdf2 as good pwhashing algorithms and for a moment I was tempted to list Makwa as well :P

Rоry McCune

@LucasKauffman do iiiiit nothing like making the examiner look foolish to get extra marks :)

Lucas Kauffman

@RоryMcCune the thing is something that really grinded my gears is that they mention SIEM at one point in the course, do few explanation on it and then ask a 25 point question on it during the exam

Rhino

@RоryMcCune I know. He's the ultimate hipster. You can tell this because a stealth mode startup is by definition invisible and hipster is anything nobody else has seen yet.

Rоry McCune

@LucasKauffman yoinks! that doesn't sound like a good match-up

@Rhino yeah and he left it too, probably 'cause they went too mainstream and suggested Node.JS or something

Lucas Kauffman

16:58

@RоryMcCune no the emphasis of the network security course during the year was mail crypto, kerberos, biometrics, authentication algorithms and then on the exam you get questions about SIEM, SNMPv1 vs v3

Rhino

@RоryMcCune Came out of stealth mode. No longer startup enough of a startup.

Rоry McCune

@Rhino srcclr.com yeah and they don't even use .io for their website?!?!

Lucas Kauffman

@RоryMcCune I still have nightmares about ticket granting tickets

Rоry McCune

@LucasKauffman blech kerberos I think I only started to get that stuff when the practical attacks started hitting it

Rhino

It's enough to make anyone want to leave really. That and "while we were having a great time using language X, we decided in the end to be pragmatic and use a language that has been well tested and has a mature community. Like Nim"...

Rоry McCune

17:00

the lovely silver and golden ticket stuff is funny

Lucas Kauffman

@RоryMcCune yea but I think the whole silver and golden tickets is a bit exagerated though

You already need to be a domain admin to create them

Rhino

@RоryMcCune they did drop all the vowels though. Gotta give them some credit.

Rоry McCune

@LucasKauffman yeah but it's persistence. So get a domain admin token once and grant a ticket that can't be revoked without changing the KRBTGT account which until recently was really difficult (read rebuild the entire domain)

@Rhino yeah and that font they're using is pretty hipster

Lucas Kauffman

@RоryMcCune true

Rhino

@RоryMcCune they have black and white horizontal sections on their website too. Or as I like to call them "stripes obviously influenced by Tigger". I see @AviD all over this.

One day I might bother to read about Kerberos.

Simon

17:07

If we don't get the new profiles on InfoSec.SE by next week, I'm starting a war.

Lucas Kauffman

What happened?
You've requested a page on a website (security.stackexchange.com) that is on the CloudFlare network. CloudFlare is currently unable to resolve your requested domain (security.stackexchange.com). There are two potential causes of this:
Most likely: if the owner just signed up for CloudFlare it can take a few minutes for the website's information to be distributed to our global network.
Less likely: something is wrong with this site's configuration. Usually this happens when accounts have been signed up with a partner organization (e.g., a hosting provider) and the provider's D…

Rhino

@Simon I recommend opening a meta.se post asking for flag weight in profiles to be visibly displayed along with public display of every moderator flag accept/reject, and for banishing of "historical questions" with a list of highest upvoted questions for each site.

Light blue touchpaper...

Simon

@Rhino HEY, you're being a donut right now, I can tell.

I have 725 helpful flags and I wanna say that less than 50 of them were due to flagging old questions.

Rhino

@Simon Yeah. Flag weight used to be a thing you had on your profile which went up for good flagging and down for bad flagging. People got... competitive.

Also closing "historical questions" was a big kerfuffle.

Simon

Oh. Because I actually did that at one point, which ended up causing a big of trouble.

Thomas Pornin

17:14

@Rhino I am still working on it. I hope to have something releasable (as a first version) in a couple of months.

Simon

5

Q: Closing old questions

Someone's currently going through old questions (typically ones at least a year old) and flagging the ones requesting tools for closure. Is this an appropriate thing to do?

Rhino

@ThomasPornin I'm kidding, no rush... it will be interesting to see, certainly.

David Freitag

@ThomasPornin Out of curiosity, is your code on GitHub (or something similar)?

Simon

Terry uploaded one: github.com/Ayrx/python-makwa

David Freitag

@Simon I meant for his BearSSL project.

Simon

17:19

o

raz

@Simon Yeah I agree with the other guy's answer

David Freitag

Chipotle mayo is a beautiful thing. Especially paired with chipotle chicken and chipotle cheddar cheese.

Simon

@raz Yeah, I should have left those questions alone.

raz

@DavidFreitag Then pair it with this

@Simon I think some of them were worthy of closing, but I clicked Leave Open more often than not.

David Freitag

@raz Ooooh that would go great with this. You know... apart from my being at work.

raz

17:24

@DavidFreitag nonsense! Beer and work go together all the time.

Is this really a thing?

0

Q: Pending review count in the status bar

In the status bar at the top of the site there is already notifications with counters regarding recent inbox messages, recent achievements, current reputation and current badges. However, I was still wondering why the "Review" link remains static and why it does not indicate dynamically when the...

feature-request review notifications

Because I never get notifications for review types other than suggested edits.

Simon

I get them all the time.

Ah, yes, suggested edits.

Rhino

@Simon here's what started the deleting popular questions on SO:

32

Q: The Great Question Deletion Audit of 2012

In the spirit of The Great Question Deletion Audit of 2010, I give you the great question deletion audit of 2012. These are basically all of the highly-voted questions on the first "Most Votes" page that, if asked today, would quickly be closed as Not Constructive (this is not a complete list):...

discussion stackoverflow off-topic broken-windows

raz

@Simon I would love it if it notified me for all the review types.

Simon

@Rhino Ah, but they wanted to delete questions that actually helped a bunch of people!

@raz Ya, that'd be great.

Also, I bet that @AviD is the one that deleted "What makes PHP a good language?"

Rhino

@Simon stackprinter.com/…

so you can read it

but, those questions were complicated

when they were asked the scope wasn't so clearly defined and community wiki was supposed to handle those Qs

these days you'd probably vtc a question like "what are some penetration frameworks I should be using?"

David Freitag

17:36

@raz Uhm, not here.

Thomas Pornin

@DavidFreitag Right now, it is on my own server (with Subversion). And copies on the two client machines that I regularly use.

Pushing it into github would raise interesting questions about export laws on crypto.

Simon

@Rhino Perfect, cheers.

Thomas Pornin

My intention is to rent some cheap VPS somewhere in Canada (probably through OVH) and publish it from there. Canada's laws appear to have exception for "public domain" software.

David Freitag

@ThomasPornin I figured this would be the case. I just wanted to poke around the code ;]

Ohnana

dear jesus someone give me a viable synonym for "cyberattack". i have to write an essay on stuxnet and I KEEP TYPING THAT WORD

David Freitag

17:43

@Ohnana Penetration.

Ohnana

goddamit

Simon

nurdz attack

Rhino

@ThomasPornin I thought that public domain software for end user use was generally considered okay these days

Ohnana

@Simon now i want to work that in ther

Thomas Pornin

@Rhino That's the case, but it depends on the country. Basically, allowance to export public domain crypto software is part of the Wassenaar arrangement.

Simon

17:45

@Ohnana :p

Thomas Pornin

But some countries have negotiated not to follow the agreement in that respect, in particular the USA.

Ohnana

but seriously i wanna rip my eyeballs out reading my professor talk about security stuff

Rhino

@ThomasPornin Really? I am obviously not a lawyer but according to cryptolaw.org/cls2.htm#ear they do.

Thomas Pornin

So, to do things properly, I will keep it all-Canadian: code written in Canada, published in Canada.

Ohnana

CYBER ALL THE THINGS

Rhino

17:46

In so far as they allow open source, anyhow.

and there's plenty of crypto code on github already

although they could all just be breaking the law and not care

@Ohnana cybergeddon

cyberapocalypse

cyberextinction

Simon

cyberturtles

wat

Since @AviD and @RoryAlsop aren't here to censor me, I did it myself.

Rhino

@Simon @AviD's hiding because @RоryMcCune and I called him a hipster.

Simon

I thought he enjoyed that.

Rhino

@Simon I suspect he does, but obviously you can't acknowledge being a hipster, or being a hipster is not the latest in thing. It's the diagonal lemma, for hipsters.

Transcript for