« first day (1642 days earlier)      last day (3536 days later) » 
05:00 - 19:0019:00 - 00:00

 
2 hours later…
07:41
Morning all
pls all
@AviD "This week, I'll be playing the role of @Simon" :op
@RоryMcCune donuts
@RоryMcCune jumpstyle
@RоryMcCune yodo
@RоryMcCune let's go to the mall todaay
07:52
@AviD do they have malls in Canada?
@RоryMcCune yeah @Simon's played that track here before
@RоryMcCune of course, where else would the Tim Horton's be
@AviD I thought they had those on every corner
@RоryMcCune yes, yes, those are the malls.
@AviD who knew, eh!
@RоryMcCune you donut
08:15
heya
@RоryMcCune occurred to me, should we add some classic #simonnings to the mem meta>
08:35
@M'vy watcha'
I'm fine. Got stuff to do :P
hehe
didnt realize that
@M'vy always good. yeah I'm starting a new test this morning, another Angular.JS app (that's 3 in a row)
but I meant "#simon# in general
yknow like "classic #simon"
@RоryMcCune oo fun
at this point I would crave some hipster crap, to balance the 80's crap
08:38
@AviD yeah angulars everywhere these days, tend to be quite easy to test as it's an API backend, so easily scripted and REST style routing usually
seriously, each time you think 4GL cant get worse - it surprises you in a whole new surprising way
like, imagine you're in prison and being anally raped, when alluva sudden you realize he is Mr. Fantastic and can grow indefinitely. And he has a fetish for medieval mace-shaped phallic objects.
so, it's kinda like that, but to your brain.
@RоryMcCune yeah, and the clients all probably have the same set of small issues.
@AviD very .... descriptive, I gather you're not particularly enjoying the 4GL experience
@RоryMcCune oh no, actually I am learning a lot from it.
mostly what not to do, but it is an interesting hisory lesson.
@AviD like why to refuse all offers of 4GL work in the future?
also, it does make the report easier to write. not only does every finding have a first recommendation of "Rewrite in a modern framework that supports good security", many of the individual recommendations also have a "well if you cant do that in 4GL, then try calling a C API, and then plan to rewrite n a modern framework that supports good security"
@RоryMcCune heh, true, but I meant more of a programming language evolution.
there are definitely some interesting things in it, though.
I will admit that there are times that I am pleasantly surprised, at the programmers' ingenuity. There are some places that it is very clear they already went through a security audit, and the devs worked hard to fix specific issues.
08:45
@AviD yeah studying older stuff can give some interesting views on how things change ...
@RоryMcCune and how some things dont ;-)
and what mistakes are not learnt from ;p
I do actually like one of the big language features - compiling to the database schema.
it takes strong typing to another level, and makes ORM a lot more straightforward.
oh sorry! I meant a completely weak typed type-free system, and the database are all one big blob with no schema!
that's the way to go, right?
0
Q: Which strategy to encrypt data accessed by multiple users?

Benjamin SinclaireI need suggestions to design my database architecture on the particular point of its encryption ; knowing that the following elements must be respected: 1- Data must be securely encrypted in the database This is to secure against attackers, andmaintly to ensure the users that even the staff can...

migrate here or to Cryptography?
@Gilles There are about 1500 Papuan languages, as different from each other as, for instance, German vs Chinese. None of them is written.
08:57
@Gilles I would think here.
09:38
WTF is that supposed to be. Makes as much sense as spam, but doesn't promote anything.
> blok from outer Author my facebook
> problem of security outer Author
@CodesInChaos WTF! even Crypto.se has the new profile, but Sec.SE doesnt??
for several weeks.
@CodesInChaos I'd heard that this has to do with some form of blackhat SEO. yknow, trying to create the look of a pre-existing real account.
or maybe its just gibberish.
@AviD can't you mods appeal to/bribe a higher power to get it?
@RоryMcCune wait, lemme try.
HEAR US, O @RORY, AND GRANT US THE GODLY PROFILES, IN THY INFINITE AND ANCIENT WISDOM, AMEN
did it work?
wait wait
O YE ANCIENT @RORY, WE DO HEREBY SACRIFICE A YOUNG WHISKY IN THY NAME, THAT IT SHOULD PLEASE THEE
did that help?
hmm, maybe if we all sacrifice the whisky at the same time.
09:56
@AviD :op you're seriously telling me you don't have a direct line to the devs?!?
Ovid, I am disappoint
@RоryMcCune well, for us regular mods, @RoryAlsop is like the higher power
@RоryMcCune lol ovid
@RоryMcCune I havent been in the teachers lounge in months. I'm not sure but I think I might have been shunnt.
SHUN THE UNBELIEVER. SHUN SHUUUUUNNNNNN
/me tends to hang out in there ;p
10:15
oo... this is cool: dripover icecoffee maker /cc @Kisunminttu
wow awesome, @RоryMcCune we just passed 200 registrations for the OWASP chapter meeting tomorrow...
@AviD wow, that's more than some full conferences get!
curious if any other chapters (other than NYC, of course) have so many people show up all the time...
@RоryMcCune heh, true
tbf at least 20-30% wont show up, but still.
@AviD indeed that's still some turnout!
we also get the best hosts - this time its MS security research. they insisted on changing the schedule to allow for more time for the eating/drinking - they insisted that 30 minutes isnt enough to properly enjoy all the spread they plan on putting out :-)
and beers, of course
some really nice talks this time, too - owasp.org/index.php/OWASP_Israel_June_2015
> One Key to Rule Them All: Detecting the Skeleton Key Malware
Itai Grady & Tal Be’ery, Microsoft

Software Defined Networks are emerging – How will it affect security?
Almog Ohayon, Javelin Networks

Outsmarting researchers: Fraudsters and their security practices
Julia Karpin, F5 Networks
the coolest part - is everyone credits me with the chapter awesomeness, I'm just along for the ride.
I'm the secretary, not the boss.
@AviD ah but you arrange it, which takes a lot of work, and getting good speakers/venues is not easy!
10:25
@RоryMcCune well yeah, I put in a ton of work - but the chapter is already great, I just set up the schedule :-)
ok I (we) work hard at getting everything going just right, but it is definitely a lot easier when there are so many great security researchers / security startups / security corporates in the area.
@AviD density of people definitely is a helping factor for sure
quality, too
 
3 hours later…
13:20
morning
@SteveDL You on holiday, or is that a late starting academic thing?
13:41
@RоryMcCune I left the office at 3AM yesterday, go figure. :D
had game of throne season 5 finale + hairdresser + spanish restaurant lunch this morning, couldn't arrive before!
@SteveDL don't .... spoil...... GoT.... :op
I've not seen it yet
@SteveDL heh
@RоryMcCune Spoiler alert: Somebody dies.
@RоryMcCune Spoiler alert: boobies.
@TerryChia yeah if someone tells the tigger what the ending is, my guess is it would be them :op
Spoiler alert: it contains dragons, and swords, and people.
@SteveDL hey hey hey, I didn't know that people were going to be in there!
13:52
I know right.
I also thought it was sword-fighting dragons originally
woah, mind blown, the dragons don't use swords!
i know right
they have punk haircuts and only fight with chains and baseball bats instead
well, spikecuts
14:42
@Adi Reading that out of context on the starwall, I thought it had something to do with GoT for a second.
Then I was wondering, "Did I miss something? 'Cause [redacted]'s tits looked just fine to me."
15:06
@AviD aawww yuuuuhh
@RоryMcCune yeah exactly
I will send my robot minions through the cloud to upload your brains into the database.
@AviD Afternoon all
very nice! if you like tea....
treating tea likes its coffee.... I dunno. Unless you're chinese, of course.
but yeah overall, hario tend to make some very nice xware...
@RoryAlsop heh. Did I mess up the incantation?
surprised nobody starred those....
@AviD lol - I'm just zooming back through the transcript now t figure out what all the star wall is about
have you asked in TL? If not I'll ping 'em now
15:18
@AviD Now you both star-whore and star-meta-whore...
@RoryAlsop pfft. As if anyone could ever understand what the starwall is about.
and then I'll have a much needed shower. Don't get me wrong - VIP at Download has showers, but they aren't my own shower....
@ThomasPornin no, I mean cmon, I both insulted his age AND complimented his awesomeness, all in one go. Twice in a row.
So much good music
and squeezed whisky in there, too.
15:20
@AviD hahahahaha
Nice
Huh, I've noticed a very weird and interesting correlation on sec.se.
When you answer questions, you get more rep.
really strange. @Simon, you should try that sometime.
you questions liek wat
And then "sometime"
You're like a super grammar hero.
what?
I accepted a job as a backend PHP dev this morning.
ARE YOU HAPPY LADS?
what's wrong with "sometime"?
@Simon for reals?
@Simon CONGRATS!!
15:31
I can't figure out if you're serious or not.
that's like on super advanced level.
Yep, not serious.
@Simon neither can I, you.
but if you really did take a job, then congrats (for reals).
PHP notwithstanding.
Yeah I did. It pays more and the environment seems very nice.
@Simon that is super important!
15:32
Also, I won't be stuck in traffic during my commute!
wait, when you say "environment", you mean like zend, or magento?
lulz
or did you mean the human workplace environment?
Workplace.
@Simon ah. then yes, super important.
@Simon and this! yay!
15:33
On Friday afternoons, the lads drink beer.
@Simon :-O
what do they drink the rest of the time?
american beer?
Don't worry, they have wine too.
But yes, since American beer is pretty much water, that'd be it.
heh. I might actually repcap again.
@Simon yeah my point.
still, better than mexican beer. Which tastes like piss. From a big sweaty mexican laborer.
Wow! You didn't quote xkcd in your answer, have na upvote!
yes, that's racists. shuddup.
@Simon lols
15:36
They also liked the fact that I am interested in security very much.
@Simon the surprising part is that there are no other answers yet. I really though there would be opposing viewpoints, leading to an interesting discussion.
@Simon woo Congrats :)
@RоryMcCune Thanks!
@Simon yeah, you're probably the first one they have that is interested in security. It is a PHP shop, after all.
@AviD Hahaha.
15:37
@Simon what sort of company is it ?
that's like hiring a vegan in a butchershop.
@RоryMcCune They have a few products. Marketing mailing services, general web dev, spam filters.
@Simon "Marketing mailing services" and then "spam filters".
so they block their own mails?
Hahahaha.
Hmm. I see a business opportunity. Sell both services, do nothing, then tell the client how massively successful each was.
"Good news! We sent over 7 million emails! And even better news - our filters blocked over 8 million emails!"
15:41
I'll suggest it to them, I'm sure they'll love the idea.
lol
I'll also make sure to mention the rule of master donut lord, too.
and your job is to write the dashboard to show off all these fake statistics.
They actually had a dashboard with stats such as emails sent today, total, etc.
@Simon I know, of course they do.
raz
raz
15:45
@AviD Isn't fake statistics redundant?
@raz not always, no.
for example, consider the following statistics for @Simon:
raz
raz
@AviD 6/10 users tend to disagree with you.
> F**ks given: 0
Donuts eaten: 65
% of hearing loss: 15
hmm actually that should be more "metrics", not "statistics". interestingly the stats is used everywhere, even outside of geekery.
Hell even baseball is all about the stats.
15:51
It's kind of dumb but I'm excited about my new profession label of being a "Backend Web Developer" instead of "Computer Technician".
A Computer Technician sounds like a god damn donut to me.
@Simon sweet!
I hope "Backend" isn't just a euphemism for PHP.
lulz
I hope so too.
They said they have some applications running on django too.
when do you start?
@AviD blah blah node.js
15:53
@RоryMcCune io.js
@AviD July 2nd.
ya damn fogey
@RоryMcCune Oh please.
They didn't mention anything about whatevs.js so I'm happy.
@Simon so your 3rd day there is already vacation?
@AviD Huh?
15:54
ok that edit went weird
@RоryMcCune so did @Simon's mom
but yeah
We're off on June 24th and July 1st.
24th = Québec and 1st = Canada.
@RоryMcCune and, really? damn hipsters cant make up their damn minds.
get off my lawn.
@Simon July 4th.
@AviD yeah it's meant to be rejoining under the node foundation
@AviD Oh we don't get that here, that's specifically for Americanos!
15:55
@Simon right, and canadians.
wat
@RоryMcCune node has a frikkin foundation now??
It's their independence, not ours!
@Simon cmon, its not like you're your own country
15:56
wat
@Simon yeah I know I think he meant your, not you're
Still, wat.
@RоryMcCune I read that as "the io.js guys threw in the towel, the moment they sobered up and realized that all they were doing was writing another frikkin javascript framework. to run frikkin javascript. on the frikkin server."
@RоryMcCune no, I got that right.
"its not like you are your own country" < less confusing?
@AviD oh yeah my mind skipped the double you're your... weird
@RоryMcCune @Simon's mom didnt skip the double your
15:58
Also, I will celebrate my new job by getting half of my sleeve tattoo'd!
aw yuuuuh
Why would you write javascript when you could write typescript and transpile it to javascript?
@Simon does the tattooist have a needle that small?
@Simon ok so you need "a bear" the sec.se logo and a donut!
@Simon also, won't it hurt to pee?
@AviD pls
@RоryMcCune Do I?
16:00
@Simon yah of course, what else would you tatoo on yourself but the logo of a website :op
@RоryMcCune A naked woman, obviously!
@Simon that sounds around the same level of sensibleness
Whatevs, real men have curves.
During the interview, they asked me to explain how SSL works so I opened my phone, browsed InfoSec.SE and read @ThomasPornin's answer.
Yes, I'm kidding.
raz
raz
You're supposed to have the answer memorized anyway @Simon
I'm not memorizing anything coming from @ThomasPornin, he's such a donut.
My friend and I were comparing the relative merits of (1) setting up your own home network for remote access versus (2) trusting TeamViewer or Hamachi to handle it for you. Thoughts?
(1) I assume that none of you are security experts, therefore it might be a bad idea.
(2) You're relying on their security and their honesty but they have shown to be quite safe in the past.
(Especially TeamViewer, no idea about Hamachi)
@AviD et al:
41
Q: List of communities with base css updates completed

JaydlesThe design team has been rolling out design updates to sites as part of network-wide update to a new base css framework. The updates allow us to: Use .svg sprites for retina displays Fix layout bugs globally More easily add new features to all of our sites in the future Synthesize healthy, n...

we're "On Deck"
@RoryAlsop yeah I asked a Q. on the comments to that post, it seems to have been like that for aaaaaaaaaaaaaaaaaaaaaaaages
We've been on deck since forever.
16:45
ahh - ok. That's the post one of the other multi-mods in TL pointed me at as the definitive site. I now see your comment at the bottom :-/
@Simon Would you say that option #1 only makes sense for experts? Sounds like there's not as much info out there re:hamachi. You'd advocate TeamViewer, eh? (all other things being equal, yada yada)
@ElephantsonParade Or at least someone who knows very much what he's doing network-wise and server-wise, yes. I'd much rather use a service like TeamViewer and be able to blame them in the case of a breach.
Self-hosting isn't always the best solution.
@Simon Fair enough. Thanks.
@ElephantsonParade Note that this is my opinion, others might say the exact opposite.
At one point I was remotely connecting to my home machines through an IPsec tunnel, one end of which being an Alpha running FreeBSD -- but that was sheer perversity.
Nowadays I do not often try to remotely connect into my home machines, mostly because my Internet access is not very well adapted to server usage.
Upload is a bit feeble
When I want a server I use a server.
16:56
And would you trust TeamViewer enough to install it on your home machines?
@RoryAlsop Looks like in about one month's time (from first post to most recent update) there's been 5 sites completed. And no updates for nearly a month since then.
@Simon I have a TeamViewer client on my laptop (which I use to connect to the Android tablet of my stepmother)
@ThomasPornin What about server?
Let's say that you had to leave a TeamViewer server on your machine constantly, would that make you feel uncomfortable?
Connecting my computer to the internet makes me feel uncomfortable.
Would a massage help you in any way?
17:01
I'm glad I asked about this. I was gearing up to go balls out with DD-WRT. You should see the network diagram I've cooked up.
@Simon I don't think I would really like it -- not because TeamViewer is not opensource, but because it is not managed as the other packages on my server. Ubuntu's packages get fixed quickly when security holes are found, and updates are easy to install. An external package like TeamViewer evades this process.
@ThomasPornin Very true.
Correction: 6 sites completed.
@Iszi What are you on about you donut?
@Simon Rollout of the new profile pages.
17:04
@Iszi Only 6?
That can't be it.
@Simon Yeah - the diff between the first rev of that post and the most recent is only six sites: Bicycles, Chemistry, Cross-Validated, Home Improvement, TeX - Latex, and Travel.
Oh!
Wow.
And there's only about a month between the first rev and most recent.
So what you're saying is that they're slowpokes.
Count in that the most recent rev is about a month old, had 20 sites listed as "On Deck", and assume a steady pace of 6 sites/month, they'll be done around September.
17:08
Whoever are responsible of this might be on vacation at one point, too.
@Simon So, we'll be lucky to see it in time for the holidays.
And then they'll realize that they haven't updated the CSS for hats and we'll be screwed.
@Simon So, we either spend the winter without hats or we wait until probably March for the new profiles.
I have a question for the non-UK types in the room.. If someone were to suggest going for a "Cheeky nandos" would that mean anything to you?
@Iszi I'm just gonna raid their office soon to speed things up.
17:12
@RоryMcCune I think I understand "cheeky", but WTF are "nandos"?
@Iszi nandos is a chain chicken restaurant
lulz
@RоryMcCune Okay, that just made less sense now.
and I know it's buzzfeed, but still amusing and all @polynomials fault as I got the link from his twitter feed
17:18
@RоryMcCune Some of these are just sad.
@ThomasPornin only some of them?
this is, unfortunately, a relatively common pattern of speech in the UK
raz
raz
@ThomasPornin
@raz, with SNI, an initial handshake is made using a different certificate. Then the server sends the certificate for the requested domain name after. — Jacob 21 mins ago
UK gangsters are the best.
raz
raz
Is that true?
@RоryMcCune All are hopeless but some are in need of a good kick in a sensitive area of their body. The other ones are "just sad".
@raz That's a weird assertion.
The whole point of SNI is not to do two handshakes.
Besides, the browser would complain at the first one.
raz
raz
17:20
@ThomasPornin That's what I was thinking
SNI is an extension where the client puts the intended server name (from the URL) in the ClientHello, i.e. in the very first handshake message.
Precisely so that when the server sends its certificate, it already knows the target server name and may send the right certificate.
raz
raz
@ThomasPornin yeah that's what I thought, which is why I'm confused by his comment as well as his question.
@RоryMcCune Okay, I get what a "Nando's" is now. But I still don't get what makes a "cheeky Nando's" cheeky?
@Iszi What's wrong with Google ?
> A term used by Brits to linguistically torment confused Americans, wherein they "explain" what it means while using as much British slang as humanly possible, for maximum Yank confusion.

"Nandos" is a British restaurant chain where you can get a respectable amount of spicy chicken and chips (fries) for a moderate price, suitable for sharing among a small group of friends. "Cheeky" is a multipurpose word which, in this context, appears to mean "spicy," "awesome/delicious," and "amusing in a slightly naughty/irreverent way" (because you're eating with your friends, who are a cheeky bunch,
@ThomasPornin I figure I got some UK lads in here who can probably set me straight quicker/better than Google. Especially given half the crud that's in the BuzzFeed article.
17:25
@Iszi And, instead, you got a French/Canadian who just happens to know how to use Google.
2
This World is weird.
@Iszi What @ThomasPornin is right, I'd say it was a semantically null add-on that attempts to make going to a chain chicken restaurant sound more fun that it likely will be :)
@ThomasPornin Can't say I've heard "cheeky" used for "spicy" or "awesome/delicious" before. Then again, it could be 'cause I've never crossed the pond.
so you could say "I'm going to slip out of this boring meeting for a cheeky pint"
which has the naughty connotation
but not anything to do with spiciness
@Iszi "cheeky" is one of these words whose meaning is "whatever best matches the intent of who said it".
@RоryMcCune @Simon's mom has a naughty connotation.
2
17:27
I suspect that @Simon stars every single message that mentions his mother.
2
@ThomasPornin Isn't that, like half of the U.K. dictionary?
@RоryMcCune makes perfect sense, but is nonsense really. I would never use the word 'cheeky' in this context
@RoryAlsop no but then I would also never suggest that someone was "the archbishop of bantebury"
but apparently people do
@RоryMcCune there are people much stranger than us - isn't that scary, eh?
@RoryAlsop and the weird part is that they probably think we're the weird ones!
17:35
Shog9 on June 15, 2015

Long-suffering readers may have noticed that, as we’ve expanded Stack Overflow into strange and exciting territories, we always start by hiring a new community manager. These intrepid souls act as emulsifiers, enabling and promoting communication between the company and the growing community. This role is just as critical for our 140+ English-language sites, where our small team works to ensure that requests and concerns are addressed in a timely fashion (6-8 weeks, give or take). Whenever possible, community managers are hired from within the community itself – after all, who knows its needs better than someone who has been a part of it? …

@ThomasPornin Oh come on, I was AFK.
raz
raz
@Simon maybe that new hire was to give us the new profile
@StackExchange GO WORK ON THE CSS YOU SILLY NEW COMMUNITY MANAGER!
2
@raz Hahaha.
17:47
5
Q: Which factors should you take into account when deciding whether users should be informed of a penetration test?

SilverlightFoxSay you are conducting a penetration test of an internal network. The internal network comprises of workstations, servers and company and contractor laptops. In an ideal world, the penetration test would just go ahead, simulating what an attacker would do given access to the local network. Howev...

Isn't this too broad?
@Simon You mean, like your mom?
o pls
@Simon It's also a bit S&M. Like your mom, too.
all pls
@RоryMcCune Roro, did you change the description of the chat?
'Cause what I'm seeing right now is pure beauty.
raz
raz
18:05
@Simon Didn't that happen last week?
@raz Really? Nice!
18:16
@AviD Yup you can't do anything until you have credit, but you don't get credit until you do things. It's the most preposterous thing ever. I finally got a loan for my car, but it has an 11% APR
ELEVEN?!?
That's what happens when you get a loan with zero credit in the usa
"We don't trust you will pay us back. Here's a loan with a ridiculous interest rate so you can't pay us back"
Yeah no kidding.
@Iszi is so cute. He loves his wife so much that he includes an anecdote of her in his answers.
18:35
Jun 12 at 11:49, by AviD
room topic changed to The DMZ: I love donuts [donuts] [food] [libations] [rory] [security]
@DavidFreitag Thanks. Good one @AviD!
I was too lazy.
3
Well, more like I didn't care much about the answer.
Don't star that you silly donuts.
raz
raz
@Simon Shocking, I'm am shocked Cotton
You're are?
raz
raz
18:46
@Simon Shocking, I am shocked Cotton
damn it
I need another Monster
@raz That stuff is gross dude
raz
raz
@DavidFreitag Pfft, tastes fine to me
@raz Can't stand that stuff
raz
raz
@DavidFreitag I generally only drink the Ultra Zero without the sugar and what not.
I honestly can't stand any of the sugar versions of any energy drink.
18:51
@raz Why edit this one?
0
Q: XSS using JSF**k

Rahil AroraI was reading about JSf**k. From their website: JSF**k is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to write and execute code. My question is: When exactly can we use such a payload to exploit an XSS vulnerab...

JSFuck is a legitimate language name. Just like BrainFuck.
(The latter of which is seen quite often over at codegolf.se)
@Iszi It's called BrainFuck you donut.
@Iszi Yes but it's also seen just as frequently as BrainF*ck
raz
raz
You're offended that starred out the expletive?
Apparently
raz
raz
I understand it's legit, doesn't mean that it's appropriate. I mean @Simon is only 12 and shouldn't have to see that.
18:54
It's ok, my ex-dad is not always the smartest one.
@raz Yeah and then imagine if I started to use that word in every single sentence!
raz
raz
I kept the link intact so that functionality was there. Not like I was trying to remove it completely.
05:00 - 19:0019:00 - 00:00

« first day (1642 days earlier)      last day (3536 days later) »