The DMZ

raz

13:00

@JourneymanGeek To upgrade?

Lucas Kauffman

@Adi HMAC with timestamp?

and a shared symetric key

AES(message), HMAC(AES(message)+timestamp), timestamp

you will need clock sync

and a thresshold but it should work

Adi

@LucasKauffman That's the current solution. Even GCM is used to avoid extra HMACing

@LucasKauffman The problem is that there are so many B devices that distributing a specific shared key for each one of them is impractical

Journeyman Geek

@raz: yeah

currently got a moto G

Its a good phone but I keep needing to clear space whenever something updates, and its 8gb, unexpandable.

Adi

@LucasKauffman I know, it sucks, and it sounds like the exact same problem that can be solved with public-key crypto or pre-shared keys with symmetric crypto

but neither work

Simon

@JourneymanGeek That's just awful.

Adi

13:04

To me, it looks like it logically cannot work otherwise

Lucas Kauffman

@Adi ah so you have key managing problem you want to solve bby chaning the algorithm

do the devices only receiive or also send information?

Adi

@LucasKauffman Yup. Device A is sooo shit that it cannot possibly store all the shared secrets it would have to carry for all of the B devices

raz

@JourneymanGeek My OnePlus is awesome. I changed to a GSM carrier to get it. It's fantastic.

Adi

@LucasKauffman Yup, device A only needs to receive information

Journeyman Geek

@raz: Wasn't sold here, and I didn't have a proper job at the time

raz

13:06

It was a bit buggy at first, but they put out a few system updates. Haven't had any problems for a while.

Adi

One message of a very specific format, 128-bit in length.

Journeyman Geek

Apparently the one plus two will be released here

raz

@JourneymanGeek "here"?

Journeyman Geek

Otherwise frell it, I'll just get a cousin to buy it in india or something ;p

Singapore

Lucas Kauffman

@Adi but you can't use RSA to sign the message right? Because it's too slow.

raz

13:07

@JourneymanGeek gotcha

Journeyman Geek

There's a planned south east asian release date it seems so...

raz

The 2 looks pretty badass, a lot of updated features to it.

And for the price, you really can't beat it.

Adi

@LucasKauffman RSA encryption is sorta possible because it's a lot faster that decryption.

Journeyman Geek

Precisely

Adi

@Lucas Hmm... and signing only requires encryption

@Lucas I think you're on to something..

Journeyman Geek

13:08

I'm a bit skeptical over the processor (there's some reports of overheating

AviD

@Adi you mean "@Lucas I think you're ON something"

Adi

@AviD Oh, sorry. I thought that how the expression went.

AviD

I think we're talking about different expressions

Adi

@Lucas Come on dude.. don't blueball me. Go on! :D

Lucas Kauffman

I'm thinking

AviD

13:12

@Adi can you have a device C that does proxying of a sort?

i.e. A has a single shared key with C. C has different keys for each B.

Lucas Kauffman

@Adi actually what @Avid is saying is a good idea, to offload the encryption and key mannagement

Adi

@AviD There might or might not be a possibility to have a C device that has trusted connections to A and B.

AviD

or even proper public crypto at that point.

Adi

@AviD @Lucas But since the device A is sooo shit, we cannot rely on that connection

AviD

and have all the connections from B get validated via C.

@LucasKauffman why do you sound surprised?

Adi

13:14

@AviD Come on, you know why :D

Lucas Kauffman

@Adi Replace device A with device A++

raz

@JourneymanGeek Yeah, I've heard the engineering team have worked out the kinds with that for the OnePlus. I'd wait for the phones to start getting into people's hands before buying though.

Lucas Kauffman

@AviD I wasn't :p

AviD

@Adi why not? This would be straight preshared key for AES.

Adi

@LucasKauffman I wish :(

Journeyman Geek

13:14

@raz: Naturally

Adi

@AviD There are technical difficulties.

AviD

and C would be doing all the hard work of key management

Journeyman Geek

I plan hardware purchases 3-4 months in advance anyway

AviD

@Adi no, I mean what is lacking in the A<->C connection

Adi

@AviD A is in a wall.. C is a server somewhere that A can or cannot talk to

A is sooo shit that it can just disconnect for no reason at all

AviD

13:16

but A can talk to B?

Lucas Kauffman

and you're absolutely sure we can't replace A?

Adi

@AviD Because it's done over Bluetooth

@AviD and A is shiiiiitty Bluetooth-enabled piece of shit

AviD

ah! so the distance is potentially an issue, whereas B is distributed and can be local to A?

Adi

@LucasKauffman I'm doing my best to convince the client to replace it

Simon

lolbluetooth

Lucas Kauffman

13:18

hahahahahahaha

sorry

Adi

I cannot understand who the fuck recommended that piece of shit for them

AviD

if that's the case, there are still solutions for distributing a single logical entity. Increases risk, but still robust enough.

Lucas Kauffman

"sales"

or just take the risk

and go YOLO

what's the deviice controlling?

Adi

@LucasKauffman :(

AviD

Doors.

Imma good guesser.

Simon

13:20

Via bluetooth? Because RFID is too mainstream?

AviD

hmm, note that you would want to have each A with a different set of keys then, to avoid break-one-break-all

@Simon no, because cellphones have bluetooth built in.

they want to automatically open the door for you based on the presence of you cellphone.

Adi

Basically, kwikset.com/kevo/default.aspx

AviD

@Adi am I close?

Simon

And they want to give access to people via their cellphone?

Adi

@AviD Dead on

Simon

13:21

Wow.

AviD

and this is why I am so often bored at work.

Cmon people, surprise me!

Adi

and august.com

AviD

I like being wrong.

Adi

and lockitron.com

AviD

sigh should change places with @Simon once in a while.

Rory Alsop

13:21

@AviD pls Ovid

Simon

@AviD It took about 5 men to tell you that it was bad idea about the synonym thing last time.

AviD

@RoryAlsop heh. Now its my turn, MY turn!

roro

Simon

And you looked like it left you with a bitter taste.

You don't like being wrong you donut.

Lucas Kauffman

@Ovid, pls youu spidermun

AviD

@Simon ?

Lucas Kauffman

13:22

@Ovid knock knock

AviD

@LucasKauffman who's there?

Simon

@AviD ONION ROUTING

AviD

ME! I keel yuou.

Lucas Kauffman

@AviD not uncle Ben

AviD

@Simon aahhh

Rory Alsop

13:23

@AviD hahahaha

AviD

hmm, okay how about this....

Lucas Kauffman

so how practical are bluetooth sniffers?

AviD

@Adi how much freedom of changes do we have, besides the hardware constraints?

Adi

@Avi How was your email?

fn.ln@gmail?

AviD

@Adi [email protected]

@Adi that too, but prefer this one

Simon

13:24

lolhotmail

Lucas Kauffman

ln? so short? you're that old you managed to register two letters?

Adi

@AviD only ln? Impressive

Lucas Kauffman

I mean @Avid you're like a wine, which gets better with age of course

Simon

pls

Look at Packy who comes in the chat today just because the election ends today.

AviD

I'm thinking of some modification of kerberos / openid like protocol that would only use AES, with A being preregistered with C, and B talking with C to get a token for A.

@LucasKauffman you're like milk.

Lucas Kauffman

13:27

@AviD mmmm I guess you're the type of wine that turns to vinegar

AviD

@Adi well, I've had it a long time, and tbf its not such a common ln...

@LucasKauffman you age like milk.

Adi

Sent you something

Lucas Kauffman

@Adi nude pic

AviD

done it, there were only 2

Adi

@AviD Aye. Thanks

@AviD Must have linked one by mistake

@Avi I should be more careful

Simon

13:31

@AviD Unpin that right now.

Oh I guess it does work with Roro's story.

Fine then.

AviD

@Simon wasnt me

Simon

Who was it then, da pope?

AviD

Shaggy

Rоry McCune

@Simon yes my son <beatifies you>

AviD

SHAGGY - IT WASNT ME

►

Simon

13:36

@AviD I swear that I immediately thought of that song.

AviD

man, that guy is a piece of garbage.

Simon

But it wasn't him, dude.

AviD

oh, so then it doesn't count.

Adi

Tonight I'm gonna try to do this

Converting Computer ATX Power Supply to Lab Bench Power Supply

►

raz

Elections end in 6 hours, who's it gonna be?

AviD

13:47

@raz I am calling the election. Our new moderator will be....

Our new moderator will be.... @RoryAlsop.

Simon

ovid pls

Rory Alsop

@AviD lol

25 mins ago, by Rory Alsop

@AviD pls Ovid

Simon

Yes, all those things ovid.

AviD

pls @Somain

Simon

wot

AviD

13:48

wat

Simon

wit

raz

@AviD I'm strangely comfortable with that

AviD

@Simon I would challenge you to a battle of wits, but I wouldnt fight an unarmed man.

Simon

ovid

pLs

AviD

1 min ago, by AviD

pls @Somain

I feel like we're in a loop

Simon

13:50

Stop reinitializing your i to 0 then you donut.

AviD

good tip for life, in fact.

Simon

Scumbag Simon searches for a bug during 30 minutes, realize that's because he's checking the wrong DB and there's no bug.

Adi

@raz Most likely @Xander

AviD

@Adi my money is on Romeo.

Simon

And I've also been modifying the store proc in the wrong db.

NOW IT ALL GOD DAMN MAKES SENSE GOD DAMN IT

AviD

13:53

why are you modifying the SP in the DB at all?

dont have a decent IDE?

Simon

@AviD You're right, I don't, I have SQL Server Management Studio.

trolololo

AviD

@Simon ?

raz

@Adi gawd I hate that dude

AviD

I dont get the joke.

thats not an IDE.

Simon

@AviD The joke is that anything from Windows sucks balls.

That'd be too harsh, there are things that they've done right.

Like Windows Vista.

AviD

13:55

for example, VS does proper code editing for SP, including versioning, db management, etc.

Simon

trololololo

Adi

@raz I generally think he's cool

raz

@Adi I was trying out sarcasm, didn't work

Simon

@AviD Oh yeah I gotta say that I do like VS.

AviD

@raz that would have been funnier if he said it

Adi

13:56

@raz People here will tell you I'm very bad at that

raz

Man, I'm just failing today

Simon

@Adi "generally"

Thomas Pornin

@Adi You apparently need to do the equivalent of a SSL with B as the server (and thus you need some way to make sure that you know the genuine public key for B).

Simon

Somehow I find this "generally" somewhat offensive.

AviD

@raz cmon dude, its MY turn to be #simon!

Simon

13:57

ovid

You've reinitialized it again.

Adi

@ThomasPornin Sooooo many Bs that A cannot possibly store all the genuine public keys for them

@Thomas I think I'll just recommend that A is replaced by something better

CodesInChaos

@Adi Signature verification is cheap with RSA

Thomas Pornin

@Adi Then PKI. A stores the public key of a CA, and each B has its public key in a certificate signed by the CA.

CodesInChaos

especially if you use e=3.

AviD

@Adi thats why I said it should rely on C for verification, even if it means using B as a channel to get to C.

but @ThomasPornin would need to explain how to do this securely.

Thomas Pornin

13:59

Ah, another meeting... bye people.

Iszi

@ThomasPornin Figures it'd be The Bear who finally turns it up. Thanks.

AviD

@ThomasPornin @Adi actually thats a good point - A doesnt need to talk to C each time, since @Codes says that signature verification is cheap

Adi

@AviD That's one way to do it. The things is... Internet over Bluetooth. Nah

AviD

well, except for CRL

Simon

@ThomasPornin bye people

AviD

14:00

@Simon buy people

Simon

ovid if you don't stop I'm gonna have to do the pls dance.

CodesInChaos

Short lived certificates reduce/remove the need for CRLs.

Xander

@Simon Don't you put USE [Proper_Database_Name] at the top of your scripts? Kind of fixes that problem.

Simon

@Xander Usually, yes but I've navigated the GUI and actually selected that DB.

It's a case of ultimate donuting.

Xander

@Simon Ah, well, yes, there is always that. My condolences. At least you didn't drop the production db.

Simon

14:06

@Xander I was modifying another dev db and it took literally a minute to revert what I've done so everything's good.

Terry Chia

@Xander Developers should not have access to production servers... Developers should not have access to production servers... Developers should not have access to production servers... Develo...

Xander

@TerryChia Nonsense. If you don't give developers access to production, you might never have a reason to bother testing your disaster recovery plan.

CodesInChaos

@TerryChia That'd require hiring admins.

Terry Chia

@Xander Isn't that why you hire @Simon?

Lucas Kauffman

DevOps

don't you guys know about DevOps, they're like big data specialists who work in the cloud. They're a combination of developers and administrators with a dash of hipster poured on top.

I can imagine @Avid being one

Rоry McCune

14:20

no-one should be manually modifying prod at all, it should all go through the CI/CD server :)

DevOps!

CodesInChaos

If you can afford dedicated admins, you're no longer a startup.

Rory Alsop

@LucasKauffman I always thought that was the B-side of Q:Are we not men? A:We are Devo

Terry Chia

@RоryMcCune This statement isn't even a joke.

Rоry McCune

@TerryChia yeah it makes sense if a co. can pull it off, means you can always deploy a new instance of the env. reliably

Lucas Kauffman

@RоryMcCune I really wonder how IT auditors go about that, "Are you the administrator, yes. Oh ok good, so no developers have access? Yes they do, I'm a developer too. But you said you were an admin?"

CodesInChaos

14:22

@LucasKauffman Simply wear different hats.

Just make sure they're not black hats.

Rоry McCune

@LucasKauffman yeah the old-school division of responsbility kind of goes away, but there are alternate controls (i.e. no-one having direct access, all changes being auditable via CI server logs etc)

Iszi

So, in 5 hours we find out who our new mod is?

Simon

@Iszi You're a clever one.

Rоry McCune

that said it's a fair bet that a DevOps setup would cause palpatations in old-school audit types...

Lucas Kauffman

@Iszi plays "Also sprach Zarathustra"

Rоry McCune

14:28

@RoryAlsop you should get Metaltech on this... metalcaptcha.heavygifts.com

raz

@Iszi Didn't you hear? @RoryAlsop won

Rory Alsop

@raz hahahaha - back in time

AviD

@Xander that doesnt make it easy for deploying, swapping envs, etc

@Simon see if you'd used proper IDE for that, versioning and rollbacks would have been inbuilt.

raz

@AviD built in?

AviD

oh btw @Xander - @raz and @Simon were trashtalking you before.

just sayin'.

@raz yes, but adjectivized.

Simon

14:32

@AviD Oh yeah? You might wanna give us the link so we can see how much full of shit you are.

AviD

@TerryChia thats what devops are for.

@Simon thiiiiiiiiiiiiiiiiiiiiiiiiiiiis much.

raz

@AviD How dare you adjectify me!

Simon

ovid is trying to get the new mod to kick me as his first mod action.

pls ovid

AviD

@LucasKauffman oh damn you, bite your tongue. I dont do ops, I dont wanna be oncall.

@Simon hahaha lol that would be beautiful. Especially if it's you.

CodesInChaos

@AviD The luxury of big companies...

Thomas Pornin

14:33

@Adi I'm back.

Simon

That was a quick meeting.

Rоry McCune

@AviD repeat after me, DevOps is not a job role, DevOps is not a job role :op

Thomas Pornin

@Simon It does not take much time to maul a couple of people and put their dismembered corpses on display.

AviD

@RоryMcCune yeah, I've seen that. s'fun.

Rоry McCune

well it wasn't before people started overusing the phrase

Simon

14:34

Dayum.

CodesInChaos

@Simon It consisted of one long monologue and then everybody else nodding placidly.

Simon

@CodesInChaos Just how I like 'em.

AviD

@RоryMcCune not for me, anyway.

and yes, I know ;-)

Rory Alsop

@RоryMcCune I have pinged them :-)

CodesInChaos

@RоryMcCune Why?

Rоry McCune

14:37

@CodesInChaos DevOps was originally intended to bring the flexibility of Agile development methods to the operations world, not to try and replace traditional ops staff with "DevOps staff"

then some companies got hold of the concept and decided to use it to reduce budgets "hey we don't need to pay devs and ops"

Xander

@AviD It can, if you're not thoughtful about it. It's certainly one extra thing to deal with. However, I'd say that is some (if not most) cases, the benefits can be worth it.

@AviD Well deserved, I'm sure.

AviD

@RоryMcCune so are you more in the "it's a methodology" camp, or more "it's a culture!"

Iszi

Just kept talking...

►

AviD

@RоryMcCune this is true of just about anything. Hey they tried using Agile to reduce headcount, too.

Rоry McCune

@AviD it's about bringing automation/repeatability to ops.. now realistically good ops people have had this for aaaages but that doesn't stop it being re-invented

@AviD yeah I know thus my objection to it's use... it's a misuse of the intention... :)

AviD

14:39

@Xander imo it should be (usually) either parameterized, or just controlled by the IDE/CI

Lucas Kauffman

@RоryMcCune Puppet?

AviD

@RоryMcCune yes, but most ops people (even the nominally good ones) did not have that for apps, just for infrastructure - OS and the like.

Rоry McCune

@LucasKauffman back even before that, things like cfengine (started in 1993) en.wikipedia.org/wiki/CFEngine

AviD

@RоryMcCune to my mind one big part of the devops is exactly this, bringing ops mindedness to apps dev.

Rоry McCune

@AviD sure but the dev. people, instead of building on the existing ops automation tools, have created new stuff and pushed it down the way (vis. docker)

AviD

14:41

@RоryMcCune right. Instead of bringing ops to dev, the devs keep trying to bring dev to ops.

Rоry McCune

@AviD yeah but the push for DevOps originally came from the agile dev crowd

Lucas Kauffman

@RоryMcCune I remember seeing a talk on a French version of this type of software, which was developed to maintain the confiugrations of submarines originnally

Rоry McCune

@LucasKauffman I could imagine that's a bit of a niche market..

AviD

@RоryMcCune right, because dem neckbeard ops guys can't move as fast as hipster devs.

Lucas Kauffman

@RоryMcCune with their glasses with correction 0, wearing sneakers and a t-shirt while fiddling with their macbook pro

Rоry McCune

14:42

@LucasKauffman amusingly it started in belgium :op

first DevOps days conf. ever was in Ghent

Lucas Kauffman

oh god

Rоry McCune

@AviD well give the agile hipsters one thing, at least they don't use Perl for everything!!

AviD

pls. Perl is battle tested and incredibly scalable. Oh the things we can do.

Lucas Kauffman

@RоryMcCune Perl is for neckbeards and script kiddies or just anyone who wants to make the person who needs to maintain the code homicidal

Rоry McCune

@LucasKauffman cough cough, paging @ScottPack cough

AviD

14:44

@LucasKauffman "homocidal"? Is that somebody who goes around killing gays?

Lucas Kauffman

@RоryMcCune I remember reviewing perl code and seeing two variables being assigned as $left_boob and $right_boob and then further down the code it was if($left_boob == $right_boob){add_user()}

Rоry McCune

@LucasKauffman oh dear...

Lucas Kauffman

@RоryMcCune and it wasn't mine!

AviD

@LucasKauffman at least the method wasnt add_motorboat()

Rоry McCune

@LucasKauffman have you been reviewing @ScottPack 's code again?

Lucas Kauffman

14:47

@RоryMcCune mmm now I think of it

Xander

@AviD Oh, definitely. Whatever solution you use should be able to be automatically managed by CI.

Simon

@AviD ovid, I'm not sure if you'd want your daughter to see that.

AviD

what, we all love boats. and sailing is too slow.

now shuddup.

Lucas Kauffman

"my daughter has never had sex!", "Dad, she's got 3 kids", "SHUT UP"

Simon

@AviD Are you the kind of dad that will try to murder any boy that will be hanging out with her?

AviD

14:50

@Simon that reminds me, I need to order that slingbow.

and no, not murder - torture is a much more effective deterrent for other.

Lucas Kauffman

@AviD slingbow, or just do the classic one: Throw a bullet towards when he's leaving and tell him it will bbe flying a lot faster if they're not back by twelve

AviD

@LucasKauffman heh, thats cute

except I dont like guns

Iszi

@AviD You're MacGyver?

AviD

and most of them would have more gun than I would - dont forget, most 18 year olds here go in the army and are given an automatic assault rifle.

@Iszi I'm Batman.

Lucas Kauffman

@AviD Galil right?

AviD

14:53

@LucasKauffman naaah not anymore. I had one of those though.

CodesInChaos

@LucasKauffman In japanese daughter is written as "good woman".

AviD

one of it's greatest tricks - is folding the stock on somebody's head.

best non-lethal use of the weapon.

Lucas Kauffman

@AviD They don't use the Galil anymore in IL army?

AviD

@LucasKauffman I'm not sure, I think not.

Journeyman Geek

o0

AviD

14:54

If they do, it's likely in reserve, non-infantry units

raz

@AviD Well that should probably be in a while(1) loop

Journeyman Geek

I hope its the tavor

AviD

my unit was one of the last to still use them en masse.

Xander

@LucasKauffmanq @AviD IIRC, they went to a bullpup something-or-other a few years ago.

AviD

@JourneymanGeek uhh the tavor is a heavy machine gun...

Journeyman Geek

14:55

o0

IMI Tavor TAR-21

The TAR-21 (or simply Tavor) is an Israeli bullpup assault rifle chambered for 5.56×45mm NATO ammunition with a selective fire system, selecting between semi-automatic mode and full automatic fire mode. Built around a long-stroke piston system (as found in the M1 Garand and AK-47), the Tavor was designed to maximise reliability, durability, and ease of maintenance, particularly under adverse or battlefield conditions. In 2009, the MTAR-21 (X-95) was selected to become the standard issued weapon of the Israeli infantry by 2018. == History and design objectives == Israel Military Industries (now...

AviD

oh no wait, I'm thinking of the negev

Journeyman Geek

That's oddly similar to our SAR21s

Original model's a beauty. The planned 2nd generation one...

Simon

pls lads, we're not American, we don't talk about guns.

Journeyman Geek

fell down the ugly tree, hit every branch on the way down, and shot itself in the face with an ugly gun. Itself.

AviD

@Xander I loved the bullpup in Counterstrike.

Journeyman Geek

14:57

Practically? They're shorter for the same barrel length, often have better weigh distribution. and americans dislike em on principle. ;p

Xander

@AviD Yeah, that was a good gun. My favorite was the AK though. Best bang for buck.

AviD

@JourneymanGeek thats straight out of wikipedia.

@Xander sucks for accuracy and speed though.

Scott Pack

@LucasKauffman I'm writing some beautiful perl right now.

Xander

@AviD In real life, yes, but was pretty decent in Counter-Strike.

AviD

@JourneymanGeek I dont think I've ever seen that. then again I'm out of the military for a while now

WOOHOO!!

@Xander heh, I meant in CS...

hit harder than the bullpup, but less dependable.

Xander

14:59

@AviD Ha, maybe I just spent too much time with it then.

Transcript for