The DMZ

Rory Alsop

06:56

Morning

Rоry McCune

07:31

Mornin'

Rory Alsop

07:55

@RоryMcCune - trying to see if we can meet up with Friedy this week. Looks like he's only a couple of hours north of us

Rоry McCune

@RoryAlsop ahh cool . BTW in ex-EY news did you see that Jen made partner..

Stephane

Hello folks

Arperum

09:26

Morning

Rоry McCune

if people aren't already, following the hacking team fiasco on Twitter is proving quite informative...

AviD

@RоryMcCune meh, its just more of the same of everything else.

so they're a hacking company. doesnt mean they know how to not get hacked.

Valar Hackuris

Rоry McCune

@AviD yeah but it provides interesting details of what gets paid for "offensive security software"

and will definitely be used to drive regulation of providers of this software

@AviD no, but the password policies and lack of e-mail encryption are a bit lame for a company that had a huge target painted on them

not to mention not noticing 400GB of data leaving your network

AviD

@RоryMcCune ah, like the list of clients (Australia! )

@RоryMcCune well, yeah, exactly my point.

@RоryMcCune offensive != defensive

Rоry McCune

@AviD yeah mix of "western democracies" like US and Australia and people like sudan who are ....not

AviD

09:33

engineering security is much harder than breaking it.

Rоry McCune

@AviD indeed but it does still somewhat surprise me when people who really really should know better and have a large financial incentive to do it right (who's going to be keen to do business with hacking team now) make basic errors

AviD

@AviD @RоryMcCune how would you say "hacked" in Valerian? I dont think "hackuris" cuts it.

@RоryMcCune in my experience its the opposite. some of the best "hackers" (cyber term) are also very much "hackers" (oldschoold term), ie. not following best practices as a way of life.

its what makes them so damn good at offense in the first place.

Rоry McCune

@AviD I know it does go that way, it's just kind of ironic that it does...

AviD

not sure its ironic, but it is sad.

Rоry McCune

09:52

Bad day? Could be worse. It's now someone at @hackingteam's job to call up the Russian secret police and inform them there's been a breach

Tweeted by liamosaur on July 6, 2015 at 8:15 AM

AviD

10:07

Perhaps, even within the next 15 years, nanobot technology will have advanced enough to be able to make a violin small enough for them.

2

Iszi

13:13

@AviD For the latter, don't you mean "hacks"?

raz

13:56

Sometimes questions like these just make my head spin

1

Q: How does a password authentication over a TCP protocol actually work?

When coming up with a password based login protocol, many solutions come in mind: User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can intercept credentials User sends hash of password, server compares hash to hash in database. - Ba...

CodesInChaos

Could you vote on a couple of dangerously wrong answers on stackoverflow?

67

Q: Generating a random password in php

I am trying to generate a random password in php. However I am getting all 'a's and the return type is of type array and I would like it to be a string. Any ideas on how to correct the code? Thanks. function randomPassword() { $alphabet = "abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXY...

php random

Terry Chia

@CodesInChaos Hah. I think I came across that answer when I was young and naive.

Rоry McCune

14:23

@TerryChia wow a whole week ago :op

sorry open goal, had to take the shot

raz

@RоryMcCune Kinda like the US's 4th goal last night

@CodesInChaos Whatever ^_^

Stack Exchange

My country's World Cup win was exciting and all, but c'mon, what if the players wore nylon wings and COULD LITERALLY FLY?

raz

@StackExchange Awesome, do I get to answer those questions for my new profile?

AviD

14:55

@Iszi yes, but I was choosing not to go with the pejorative.

@raz WHEELS HAVE NEVER BEEN INVENTED BEFORE!

@raz THIS IS THE VERY FIRST TIME ANYONE HAS NEEDED THIS VERY SPECIFIC REQUIREMENT OF AUTHENTICATING USERS!

@CodesInChaos wow. even worse than I expected.

Iszi

@raz Ummm.... you know that's just the automatic XKCD feed, right?

AviD

15:09

@Iszi you're an automatic feed. #simon

Rоry McCune

BTW I take it Doughnut boy is off on his hols as he's not been about for a bit...

AviD

you talking about donut holes now?

Rоry McCune

@AviD Def. hols . UK english slang for vacation.

AviD

oh, I know. But donut holes is funnier.

Iszi

15:53

@AviD No, donut holes are funnier. "Donut holes" is definitely funny though.

AviD

@Iszi except that I was referring to the term donut holes, and not the holes themselves. #GrammarUberNazi

Rоry McCune

@AviD your punctuation game was weak then #PunctuationNazi

Iszi

@AviD Hence why I gave the example with quotation marks, to show what you should have done.

AviD

@RоryMcCune your a punctuation game

Iszi

#YoMommaNazi

AviD

15:55

@Iszi unnecessary, strictly speaking.

Iszi

@AviD Wow. Can't tell if that's deliberate, or...

Rоry McCune

@AviD s/your/you're/

AviD

@Iszi hehehe of course it was

Rоry McCune

16:13

everyone ready for another round of "Guess the OpenSSL Security Vulnerability"? mta.openssl.org/pipermail/openssl-announce/2015-July/…

the only clue is... it exists in 1.0.1 and 1.0.2 but not in 1.0.0 and 0.9.8

oh and it's "high" severity

ya know what would be a good idea. Make a list of all known security research companies who look at crypto and then monitor their activity for newly registered domain names

then from that work out the likely bug they're going to assign to that name

raz

@Iszi Yeah but I need to take my anger out on something

@AviD I like inventing wheels, especially new ones.

security.stackexchange.com/review/suggested-edits/54402

seriously, someone needs to tell this guy how to edit.

AJ Henderson

16:49

businessinsider.com/…

that's slightly terrifying

raz

That sucks

I'd rather not be like China, but that's me.

AJ Henderson

it's funny because just the other day I was telling someone you don't really have to worry about the government getting super scary unless they try to outlaw encryption

seeing this a week later = me not particularly happy

atleast it isn't the US trying to do it yet

raz

17:10

@AJHenderson You think the US would have more success?

AJ Henderson

I think any government could enforce it if they wanted to. It would be a bit hard once they got to the practical implications though

not that those couldn't be worked around with some effort

and I'm not entirely sure that the population would even particularly care

never mind that it's the last barrier to a completely orwellian surveillance state being a lightswitch away

Iszi

@RоryMcCune That should be more than enough for @ThomasPornin to have it figured up by COB, DMZ time.

Why do companies only partially release vulnerability info? Details should be full or none until the patch is released. Otherwise it really serves no purpose - probably does more harm than good.

Rory Alsop

17:25

@AJHenderson proves he us a bit of a tool when it comes to infosec

@Iszi to test @ThomasPornin ?

AJ Henderson

@RoryAlsop no kidding

Iszi

@RoryAlsop I'm not much educated on UK politics, but in general shouldn't you just end that sentence at "tool" for practically any given politician?

AJ Henderson

@Iszi well, yes, but they generally atleast try to avoid making it obvious

schroeder

Good Morning from the fires of hell

AJ Henderson

@schroeder what, did you go in to politics over night?

schroeder

17:34

lol

Rory Alsop

@Iszi yup, you're right

Simon

18:13

@RoryAlsop May I suggest you protect this question (security.stackexchange.com/questions/93149/…) to avoid answers like this: security.stackexchange.com/questions/93149/…?

But yes in this case, he would have been able to post cuz association bonus.

schroeder

I protected it

Simon

Cheers.

raz

Does increasing password strength actually help against WEP?

Rory Alsop

Hello @Simon - Canada day celebrations good?

Simon

@RoryAlsop We don't celebrate Canada day very much in Québec :p

But yes, we had the day off at least!

raz

18:24

Are you one of the voters to secede?

Simon

It's a tough call, I'm still unsure if I'm in favor.

There's a ton of corruption in Québec's government so I doubt that we'd be better off by ourselves.

raz

@Simon Yeah, turns out running a country is hard

Simon

Especially when all you care about is yourself and money.

And then those donuts get elected continuously.

Thomas Pornin

@Iszi Meh. Probably some buffer overflow in a feature they implemented in 1.0.1 (thus, older versions are "immune").

@Iszi Releasing partial vulnerability info is supposed to be useful in that it allows people to schedule the installation of patches.

Instead of doing it "as usual" (i.e. when half the staff is running in circles shouting "the End of Times is upon us !")

raz

@ThomasPornin Isn't everyone running around shouting "THE END OF TIMES IS UPON US!"?

Mrtn

18:33

THE END OF TIME IS UPON US!

Simon

pls

Lucas Kauffman

@Simon Do they at least appologize for the corruption?

schroeder

... it's the French ...

Simon

Yeah, I guess our French blood makes us argue and not apologize.

@raz Did you see the length of that xkcd? Those guys seem to be productive, maybe they should ask their help to work on the CSS!

Iszi

19:03

@ThomasPornin Yeah, that's fine. But instead of saying "hey, we're releasing patches for X but Y isn't affected by the vulnerability" just say "hey, we're releasing patches for X".

Or something like that. There should be a way for them to say a patch is coming without having to spell out what it's all about. And if not, then they should just go full disclosure so we don't have to worry about the bad guys learning stuff before some (or most) good guys do.

David Freitag

Oh man I had a great time this weekend.

We nearly burned the entire neighborhood to the ground and I have a broken leg.

raz

@DavidFreitag Nice!

David Freitag

@raz We won the 'who has the bigger fireworks' contest :D

We also may have fired a 2" mortar directly at someone's shed.

raz

20:08

@DavidFreitag Now that's a party!

David Freitag

@raz We finished the night with a 6" shell that set every car alarm off for a few blocks.

raz

Damn, in a city, suburbs, or BFN?

David Freitag

suburbs

It was very eerie hearing hundreds of car alarms going off.

raz

I bet

how'd you break your leg?

David Freitag

Hiking

Well, more accurately: rock climbing

The helicopter ride was fun. You know, after they injected me with morphine and stabilized my leg.

raz

20:14

@DavidFreitag compound fracture?

morphine doesn't do anything for me

Just give me the oxy, I'll wait the 20 minutes

David Freitag

TBH I don't actually know that it was morphine, but whatever it was it was brilliant

@raz Yup, made a really great crunch sound when I hit the ground.

raz

@DavidFreitag Generally if it's for immediate pain, it's morphine. Morphine is supposed to address pain immediately. While pills can take some time to take affect.

@DavidFreitag winces

David Freitag

@raz Yeah I was in shock for a while. I would have tried to stand but there was bone sticking out so I figured I'd better not.

Fibula snapped completely and took a chip out of my tibia, which is also fractured.

raz

And that's why I don't go rock climbing

David Freitag

It was a lot of fun

Rory Alsop

21:05

Owwwww. Hope you have a good doc, and that it fixes well

schroeder

But I'm sure it will all be fine! [Rory meant to say :)]

David Freitag

@RoryAlsop Well my health insurance is great, I only paid $500 for the hospital trip and the heli ride. Other than that it's just a bit inconvenient. They put a steel pin in my fibula and they said it should heal up just fine in a few months.

(only...)

Iszi

21:21

@DavidFreitag Hey, $500 for a hospital visit that required a heli ride? That's fantastic.

'Round here, an ambulance ride of just a couple miles costs $300+ on its own if you're paying out of pocket.

David Freitag

@Iszi Right, but that's like saying getting stabbed is better than getting shot.

Kinda misses the point.

Iszi

@DavidFreitag My point is, the out-of-pocket cost for you was probably a couple thousand at least. Only having to pay $500 of that is a pretty good deal.

David Freitag

Well, I pay something like $35/mo for the insurance

Iszi

21:42

@DavidFreitag You don't get to complain anymore. My payments probably work out to $100/month per person for my family, and that trip of yours would have likely cost me over $2,000 before the insurance put in a dime. :-P

David Freitag

@Iszi Well, sure, but I'm a 23 year old guy, I'm the cheapest type of human to insure.

And, other than a slight case of broken leg, perfectly healthy.

Iszi

@DavidFreitag My insurance costs don't take age or individual health into account. If you worked for my employer, you'd be paying the same amount I do for the same plan - or more, if you want the "nicer" plan.

("Nicer" in this case being differentiated by out-of-network coverage.)

David Freitag

@Iszi Our prices are calculated by age and health (because of our provider). I have the second best plan, which has a $500 deductible. All of my copays are $20 and scans are free.

Iszi

@DavidFreitag We're not so lucky. Everyone gets the same plan choices, for the same cost, as everyone else. And everything is 100% out-of-pocket until you hit the deductible (which is a lot more than $500), and then the insurance only covers 90% after that.

We used to have plans with copays, but the deductibles weren't much better and the premiums were higher.

David Freitag

But some of my coworkers would be paying upwards of $300/mo for the same plan as me.

It probably helps that it's just me and not a spouse/kids as well.

Transcript for