The DMZ

M'vy

07:31

Morning !

Rоry McCune

@M'vy mornin'

annnd it's Monday again

how did that happen!

M'vy

I don't know.

Close my eyes yesterday, might have been the mistake

Rоry McCune

yeah'll bit it, sleeping on sundays, fatal error!

M'vy

08:04

@TildalWave what fix?

Samthere

08:19

Morning all

I'm looking into some stuff around cyber awareness training and I was wondering

Does anyone know of any studies that have been done (or general evidence) to assess whether announcing that training has been done will increase or decrease the rate/complexity of incoming attacks?

#wordsoup

M'vy

Hi.

"that training"?

You mean you want to do a press-release to announce your employees have been trained in cyber-sec?

Samthere

Basically yes; I'm looking into if there's evidence that it'll be beneficial or detrimental

There's some easy assumptions to make; e.g. general attackers will possibly look for easier targets or use their basic attacks; targeted attackers may work harder

I'm just looking to see if there's any evidence to justify or contradict that

M'vy

They might also see that as a challenge

Samthere

Exactly

M'vy

I recall having seen company claiming having hacker proof <insert product here> getting pwned in less than a day

Samthere

08:25

I've had trouble researching it because of how generic the search terms are, and I mostly end up with training providers :D

M'vy

I'm not sure such a research would already exist

It's not like the data are very publicised

Samthere

Yeah

I'm gonna keep looking around, thanks for the input :

:)

Arperum

08:44

Morning

M'vy

08:57

Hey @Arperum

Rоry McCune

@Arperum Mornin'

Rory Alsop

09:36

Morning

Lucas Kauffman

morning

so what's up DMZ?

Rоry McCune

@LucasKauffman we're all about the security now

so no off topic nonsense

M'vy

eeeeek

Rоry McCune

yeah well ya know, @kalina has spoken so that's us told

Lucas Kauffman

@RоryMcCune aight let's talk risk!

@RоryMcCune I just saw an email passing by for a COBOL source code review for 700k lines of code

@RоryMcCune That's like what? 1000 mandays xD?

Rоry McCune

09:55

@LucasKauffman nah they can "sample" and "Risk assess" that one down to ... $customer_budget , no problems

Lucas Kauffman

you know of any tools that do automated scannning for cobol?

Rоry McCune

@LucasKauffman well fortify will

no idea if they're any good of course

Lucas Kauffman

@RоryMcCune yea but that's only for system Z

Rоry McCune

@LucasKauffman people run cobol elsewhere?!?

Rory Alsop

I bet they do...

Lucas Kauffman

10:04

@RоryMcCune AS400/iSeries

Rоry McCune

I was largely just kidding :)

but yeah I didn't realist Fortify cobol coverage was only mainframe

@LucasKauffman it's rather ironic that IBMs static analysis tools don't support Cobol well...

Lucas Kauffman

10:27

@RоryMcCune yep it is

Rоry McCune

@LucasKauffman TBH I think (like most of IBMs acquisitions) they've fluffed the ounce buy pretty badly

and the costs are swinging .. $170,000 for the "enterprise server license"

and that probably doesn't include any client licenses

Rоry McCune

10:45

Spongepulp Fictionpants: Storage

►

^NSFW audio but quite funny

AviD

11:23

@UsuallyNot what info?

@RоryMcCune you sound like Jack Daniel.

or Garfield.

Rоry McCune

@AviD perhaps, but I don't look like him..

AviD

@RоryMcCune yet...

Rоry McCune

@AviD I'm not sure I could ever match that beard

and unless I get a divorce, I doubt I'd be allowed to try

AviD

@RоryMcCune you could shave your sheep, and use that

Rоry McCune

@AviD from you, that sounds like a euphamism

AviD

11:26

@RоryMcCune isn't it?

You are Scottish....

Rоry McCune

@AviD perhaps, but if so, I don't want to know what it's a euphamism for..

@AviD am I a Aberdonian,.. I think not

AviD

Why do Scotsmen keep their sheep at the edge of cliffs?

THEY PUSH BACK HARDER.

Rоry McCune

morning @Simon

@AviD s/Scotsman/Aberdonian/

Simon

Morning!

It's 13 Celsius INSIDE at work, such a lovely Monday morning.

Fucking greedy ass landlord.

Rоry McCune

@AviD hey hey, I'd like to remind you that jokes aren't in-scope of our approved topics

AviD

11:29

Why do Scotsmen wear kilts?

SHEEP HEAR ZIPPERS.

Rоry McCune

unless they're about Crypto, Infosec, security or webappsec

@Simon yikes, you can't control your own heating?!?

AviD

@RоryMcCune or rories.

Simon

@RоryMcCune Nope, they've changed everything to be controlled by a master which we don't have access too.

We're getting the fuck out of here as soon as our contract finishes.

Rоry McCune

@AviD hey.. why have I never met a full jew... all the people I meet from Israel are just jew... ish :)

AviD

lol

Rоry McCune

11:30

@Simon yerk

Simon

So, I'm typing with a coat on.

AviD

btw @RоryMcCune someone told me here that they have NCC on retainer as their main security consultants.

Rоry McCune

@Simon you want to live in a nice socialist country like the UK where I'm fairly sure that would be illegal

AviD

you said NCC dont have business in Israel...

Simon

@RоryMcCune I wanna say that's illegal in some way here too but I'm not sure if we want to get involved in a lawsuit of some sort.

Rоry McCune

11:31

@AviD nuhuh I said I wasn't aware that we did

which is entirely true

we have whole departments I have no idea about

AviD

heh I wasnt saying you were lying! I was just informing you, fyi.

@RоryMcCune you make robots AND food??

Rоry McCune

I found out the other day that we have a team of 90 people doing functional testing in bank in scotland, I didn't even really know we did that kind of thing

@AviD it's probably those darn yanks

they get up to all sorts

Terry Chia

Is it just me, or has there been a recent trend of companies being formed around open source projects?

AviD

"recent"?

what would you call Red Hat?

Terry Chia

@AviD Well, in the sense that the copyright of the project belongs entirely to the company.

Simon

11:35

What would you call Apple?

Rоry McCune

@Simon fruity?

Simon

I'D CALL THEM ORANGE LOLOL

God damn it roro.

AviD

@TerryChia that hadoop company

Rоry McCune

@Simon YNFYL

Terry Chia

@AviD Hadoop belongs to Apache, which isn't a company.

I just pointed it out cus Ansible just got acquired by Red Hat.

I didn't even realize it was a company and I used it quite a bit.

Rоry McCune

11:37

@TerryChia well open source is great for getting early traction

then people want to make mad bank, so the make a company round it

npm

docker

Simon

Terry types perfectly fine all da time and then all of a sudden he thinks he can type a "cus" just like that without any warning?

pls torry

RoraΖ

@UsuallyNot Hey, yeah I don't normally hop on chat on the weekends.

Terry Chia

@Simon chat.stackexchange.com/search?q=cus&user=41829&room=151

@RоryMcCune Yeah I know. Just feels "wrong".

Simon

That's your first "cus" of 2015!

No second, damn it.

AviD

@TerryChia haddop used to belong to, umm... forget their name...

Terry Chia

11:41

Apache Hadoop

Apache Hadoop is an open-source software framework written in Java for distributed storage and distributed processing of very large data sets on computer clusters built from commodity hardware. All the modules in Hadoop are designed with a fundamental assumption that hardware failures (of individual machines, or racks of machines) are commonplace and thus should be automatically handled in software by the framework. The core of Apache Hadoop consists of a storage part (Hadoop Distributed File System (HDFS)) and a processing part (MapReduce). Hadoop splits files into large blocks and distributes...

AviD

@TerryChia yeah, NOW.

just went to check that...

blanking on their name.

ah right, Horton.

Rоry McCune

11:56

@Simon sounds like something someone from the deep south of the USA would say

Simon

I'm sure they'd say a ton of nonsense before that.

Terry Chia

@RоryMcCune Ewww.

On a happier note, I tried some Hibiki over the weekends. Damn, that's good whisky.

AviD

@RоryMcCune lol, took me a moment

Lucas Kauffman

@RоryMcCune question for you,do you know how to install the dradis nmap plugin into? There's 0 documentation :(

AviD

@TerryChia isnt that some kind of gross japanese porn?

Lucas Kauffman

11:58

@TerryChia Hibiki is the best whisky's I've ever drunk

AviD

@LucasKauffman are you now?

@LucasKauffman drunk, I mean.

Terry Chia

@LucasKauffman I wanna get a bottle but damn it's pretty pricey.

Rоry McCune

@LucasKauffman community or pro?

@TerryChia I'll have to try some Japanese whisky some time

I've yet to have any

Terry Chia

@LucasKauffman Documentation is for noobs. ;)

Lucas Kauffman

@RоryMcCune community

@TerryChia my gf got me the 17 for my birthday last year , but indeed it's super pricey :(

Adi

12:03

@RоryM So I guess you're an international star now :D

Lucas Kauffman

358 SGD :/

Rоry McCune

@LucasKauffman soz, I used to know how to do it with Pro but not so much with community. TBH the new architecture is (to me) a bit overly complex and they've not really explained exactly how to use it too well...

@LucasKauffman that said, you could ask on the forums, you might get some joy there

Lucas Kauffman

@RоryMcCune yep my problem exactly

aight

Rоry McCune

@Adi Inorite, how did that happen

Terry Chia

@Adi What?

Adi

12:05

@RоryMcCune A- Finland is so small. B- Your dependency talk was really good and impressive. C- You're from the all-wise UK

@TerryChia Rory is coming to our local OWASP meeting to give a talk

Our chapter leader called him an "international star" :D

Simon

D- You've met Nessy a few times.

Terry Chia

@Adi Ah hah.

Simon

THIS COLD MAKES ME FORGET WORDS

Terry Chia

@RоryMcCune I'm gonna have to claim some credit. ;) Adding to resume: "Helped infosec thought leader @RоryMcCune research talk"

Adi

@Lucas Btw, I have resumed OSCP a couple of weeks ago. I'm now going at it non-stop. I have half the lab now and I'm now in Admin Dept

Lucas Kauffman

12:07

@TerryChia Rory McCune and his trusted sidekick, the boy of wonder Terry Chia

Adi

Pretty exciting

Lucas Kauffman

@Adi .3?

Adi

@LucasKauffman Jepp

Lucas Kauffman

@Adi the hard part is humble, sufferance and pain, you have those already?

AviD

@Adi ooo fun!

Rоry McCune

12:08

@Adi BTW do you think they'd be interested in a "buy one get one free" deal. I could see if Maz wants to do a talk while we're there (we're going to come over for the weekend anyway to see Helsinki)

@TerryChia well you and @AviD get a mention whenever I do this talk :)

Adi

@LucasKauffman Not yet

AviD

btw @adi and any other OWASP chapters - if you are willing to cover my travel, I am also happy to get out to whereever :-)

Adi

@RоryMcCune I don't know. You have to check with Pekka. I think there's a room for one more talk, but maybe they want a local.

Simon

@AviD That makes you sound like a slut.

wot

AviD

@Simon lol

Adi

12:10

@LucasKauffman I'm really starting to get annoyed with pivoting, though.

Rоry McCune

@Adi yeah exactly I guessed they might, no worries either way, but let me know and we can sort it out if needed :)

Adi

@Lucas Like really really annoyed.

Rоry McCune

@Adi is their lab stable these days? It used to keep getting reset all the time which was super annoying

although that wasn't the exam lab, just the main training one

Adi

@RоryMcCune Yes it is

Rоry McCune

@Adi well that's a good thing, pivoting on an unstable platform would be super-annoying

@Adi BTW do you know the address the meeting will be at?

Adi

12:12

@Lucas Were there any of the "hard three" in the public network?

@RоryMcCune Hmm.. I'm not really sure

You're thinking of hotels, right?

Lucas Kauffman

@Adi they're all three in the public network :p

Adi

@LucasKauffman Well, shit. I have half of the public net and still haven't encountered them

Rоry McCune

@Adi should it be in Helsinki proper (i.e. not out in the suburbs?) Just asking as we're booking a hotel

so good to know if it would make more sense to be out of town or something

Adi

@Lucas Or maybe I'm too good and I pwned them without feeling it :D

2

@RоryMcCune First of all, Helsinki airport is in the suburbs

It's funny that Helsinki airport is not even in Helsinki :D

Lucas Kauffman

@Adi they're called pain and sufference for a reason :p

Rоry McCune

12:15

@Adi heh, well for that one, I guess there's a decent transfer into town...

Adi

@RоryMcCune Yeah, just book something within Helsinki

@RоryM Want my recommendation?

Rоry McCune

@Adi we found one that looks like a castle :)

and isn't horribly expensive

Adi

Sweet!

I generally like serviceless hotels

We have one called Omenahotelli

Rоry McCune

@Adi tripadvisor.co.uk/…

Adi

@RоryMcCune Ooooh.. there

There's a stripclub about 100m to the right of it

Rоry McCune

12:17

@Adi how would you know that :op

Adi

@RоryMcCune I used to live on that street

Rоry McCune

@Adi ahh apart from the proximity to strip clubs, is it a dodgy area?

looked fairly central

Simon

MRW when I don't trust PHP: "exit;".

Adi

@RоryMcCune Not dodgy at all

In fact, it's a very nice area

Stack Exchange

On the other hand, it took us embarrassingly long to clue in to the lung cancer/cigarette thing, so I guess the real lesson is "figuring out which ideas are true is hard."

Adi

12:19

Less than 1km from the train station

Rоry McCune

@Adi cool well at <£100 a night it doesn't seem to expensive either, and is a bit different from the usual chain hotels

Adi

@RоryM The hotel is about 8.5km from the venue

There are constant busses between the two locations

It takes about 25 minutes by bus

Rоry McCune

@Adi that doesn't sound too bad :)

we'll just need to trust you to put us on the right bus

as my chance of deciphering bus signs in Finnish isn't high

Adi

@RоryMcCune I highly recommend consulting Google Maps directions

Our local transport system has great integration with Google Maps

Simon

o no it's her

Rоry McCune

12:24

@Adi cool

Adi

@RоryM Be prepared to have cash for the bus. They don't accept cards

kalina

o noes its me

Rоry McCune

@Adi cool I'll bring my stash of Euros :)

Adi

@RоryM You're in luck btw. Only two months ago we've had our first train line from the airport to the city

Rоry McCune

@Adi nice that'll make thing easier

Adi

12:27

@kalina Morning

M'vy

@kalina hey you :)

Rоry McCune

inb4 @kalina points out she was away getting coffee :op

Simon

Lads, here's your daily dose of Techno:

Perc - Purple (Original Mix)

►

Adi

@Simon That already exceeds LD50

Simon

Totally had to google that but I like it.

kalina

12:32

@Adi @M'vy @RоryMcCune morning

@RоryMcCune no I have coffee, scheduling priority for chat is way low down the list

Rоry McCune

@kalina how could that posssibly be the case, us, low priority?!?

Adi

Harry and Paul - Arabic celebrations

►

Hilarious!

M'vy

@RоryMcCune we're too boring. talking about security stuff

kalina

@RоryMcCune well it's more like you're are a normalish priority and there is just more stuff in front of you

Rоry McCune

@M'vy ohh good point, I could see that's why we got bumped down @kalina 's priority list, where I'm sure the jumping "Dance Music Zone" would've been right up there with checking mentions on twitter

kalina

12:39

also, yes, boring information security channel

Rоry McCune

@kalina and who's fault it that?

kalina

mine for choosing to be here

JukEboX

Morning Gal and guys

Rоry McCune

mornin' @JukEboX

JukEboX

How is everyone this chilly day

Rоry McCune

12:41

relatively warm 'cause I'm indoors :)

M'vy

Hey. Fine.

Adi

@JukEboX I don't know about chilly, it's well above 0 in here

I think it's even 8C or something

JukEboX

It's 26.4F right now. brrrr

Adi

@JukEboX Sorry, I don't speak American

Simon

fkin rekt

JukEboX

12:46

@Adi -3.111111

kalina

19 degrees

= "cool"

M'vy

@kalina Celsius?

Lucas Kauffman

@RоryMcCune found out how to do it

Rоry McCune

@LucasKauffman \o/ instructions online or was it a case of "just fiddling about"?

Lucas Kauffman

@RоryMcCune fiddling

turns out there is a config file where you can define github repos

@RоryMcCune and the plugin doesn't work -_-

Rоry McCune

13:02

@LucasKauffman lolz :/ must say I don't get the impression the community version gets a lot of love these days, 3.0 has been on the verge of coming out for over a year...

it used to be a nice simple Rails app. and pretty easy to troubleshoot/extend

but these days there's a load of additional complexity (which all has it's purpose, I'm sure) which makes it harder to modify

kalina

@M'vy yes

TildalWave

@M'vy blog still says "IT SECURITY" after site rename to "INFORMATION SECURITY"

kalina

basically the same thing

M'vy

ok

Simon

13:19

ok

AviD

ok

@kalina but not really

kalina

InformaTion Securitay

Simon

I like tay tayz.

Lucas Kauffman

@RоryMcCune quick question is the pro version any better?

Rоry McCune

@LucasKauffman so the pro version adds in better reporting capabilities and also allows for multiple jobs in a single instance

so there's more feature

also you'll get better support :)

Lucas Kauffman

13:27

@RоryMcCune so basically it's the same shit :p ?

I mean if your base is shit

it doesn't matter if your extensions are kick ass

kalina

I agree, if your hair is already manky the extensions won't hold

AviD

@LucasKauffman or hit girl

Simon

@kalina Women with extensions are disgusting.

Fucking wait your hair to grow you mong.

Rоry McCune

@LucasKauffman well it's a somewhat different base

kalina

@Simon that's a pretty strong reaction over something quite mundane

Simon

13:30

@kalina No, that's as bad as push-up bras.

kalina

hardly

Simon

FALSE ADVERTISING!

kalina

hours having hair glued to your hair is nothing like putting on a push up bra

Simon

"o gurl u got long hair" pulls on hair "O LAWD"

kalina

and how is a push up bra false advertising? It takes what is already there and presents it in the way that makes them look as big as possible

there is nothing false about it

and why would you go around pulling on people's hair?

Simon

13:34

You know when sometimes between a woman and a man, or a woman and woman, or a man and a man things get hot and they go in da bed, hair might get pulled.

Rоry McCune

@kalina imgur.com/gallery/JlNKDHZ

apparently it's a fighting style

or a means of removing snakes from a friends hair

kalina

@Simon oh that's different, I thought you were talking about randomly pulling people's hair

Simon

pls

kalina

I mean you did forcibly intimidate your current girlfriend into doing what you want the first time you ever spoke

by man handling her

Simon

wot

AH

Dayum, you remember that I said that?

kalina

13:38

that's highway to t he danger zone if ever I heard of a such a situation

pls I have a fantastic memory

it's a curse more than a blessing

Simon

Hey, I had hair gel on, you cannot not trust a man with hair gel!

coughs

Rоry McCune

@kalina he's too young to get that reference

kalina

@RоryMcCune he's older than I

AviD

@kalina DAAAANGEEEEEEAAAAAHHH ZOOOOONBNNE!!!

Simon

@RоryMcCune I know the song you donut.

kalina

13:39

and who hasn't seen Top Gun, even in passing

Simon

Me.

Rоry McCune

@kalina pls he's 12

Simon

:D

kalina

it's worth seeing for the opening theme tune

Simon

I gotta say that I've watched Star Wars a month ago so... yeah.

kalina

13:39

I still haven't seen Star Wars

Simon

1-3 is legit, 4-6 is super foghey.

kalina

but it's fine because I haven't seen much Star Trek either

and I'm a total Stargate fangirl

Simon

Edited before someone notices the #simon.

Rоry McCune

@Simon I noticed, I just assumed a usual level of #simonage was in effect, so didn't comment :)

and if you two haven't watched The Empire Strikes Back, how are you going to enjoy playing battlefront?

kalina

what's the point of playing a Star Wars game

they're basically never fun

waste of time

Rоry McCune

13:43

@kalina I'd heard KOTOR was pretty good

kalina

you're kinda proving my point here

what with KOTOR being from 2003 and there being 10+ other SW games since

all of which have sucked so much that if they were food and you were starving to death you'd still give it away

Rоry McCune

@kalina hmm I thought you said never... 2003 isn't never :)

I'm not a big gamer, so couldn't really comment on most of 'em

kalina

@RоryMcCune in the world of computing, 13 years is so far ago that it becomes irrelevant

13 years ago there wasn't even a Facebook.

OR a Twitter.

Rоry McCune

yeah yeah I'm old, I know :op

kalina

well I didn't want to say it

but yes, you have memories of 1990. I don't.

thus... perspectives

Simon

13:50

Yeah, no, not gonna play a Star Wars game.

kalina

especially since Fallout 4 is coming out around the same time

and well, I'm going to struggle to play Fallout 4 and continuing having a life at the same time

so the idea of playing two different games ... just not going to happen

Simon

pls either you play lyf3 or da games

kalina

no I must do both

what I will likely do is play Fallout 4 from release date until the next weekend

by which time I will have completed it but not done more of the side missions

and then I shall uninstall it

like I did with Skyrim

unless of course it has an amazing story, a story so good I end up doing the side missions

and then it deserves my time

Simon

I bought Skyrim and played less than 30 minutes.

Yay me.

kalina

I played Skyrim and completed the main story in 28 hours (in one sitting)

Simon

13:55

nurd

kalina

ino

A good game is worth it

It's when you spend that much time and the ending is all like LOL HELOS CLICK A BUTTON TO CHOOSE AN ENDING K

like Deus Ex Human Revolution was

in other news I also appear to have gained a boyfriend like person but with less permissions

I'm training him to be obedient

M'vy

ahah

kalina

so far he has learned the basics in hugging, cuddling, and leaving me alone

M'vy

So far, so good

Transcript for