@AviD what were you going for here?

@Ohnana the CGP grey video!

I... really dont know

yeah okay then

@Ohnana it's an attempt to educate you on the construction of the United Kingdom I think

there ya go!

^is the video that @AviD was thinking of

ohnurnur

i've seen it

@Ohnana WATCH IT AGAIN

@AviD i misplaced one fucking city, chill

lol

hey, me I dont care, I aint engrish.

@AviD BTW have you heard when $hipster_startup is launching? I get the newsletter but there's no mention of when the product is going live..

@RоryMcCune ah right, no not really

I think they're probably in like private beta or something

@RоryM Btw, cutrently on my way to Amsterdam :D

@AviD interesting, they've been in beta a while now.

@Adi work?

@RоryMcCune true, but also they've re-pivoted a couple of times.

@AviD ahh, that does seem to be a theme in $hipster_Startup land

and re-realized that it is a lot more involved, and a lot more work, to make it work

@AviD flip yeah, from what little I know of what they're up to it's a herculean task

yeah, they didnt like hearing it from me

good example I've recently done an Angular App, had 167KLoc in one de-minified client-side JavaScript file

@AviD heh, I guess people don't like to hear that kind of thing, even when it's true

@RоryMcCune especially then

@AviD aye

what company are you talking about? or is this meta humor?

I think that was part of our culture clash, I was too much of a realist cynical git

@AviD yeah the start-up mentality seems to be "anything is possible if we're smart/work hard enough"

which is not always true

mind you, that didnt curb my enthusiasm, but I figured we were in it for the long haul, and needed to take engineering steps accordingly.

@AviD yeah. but that doesn't take account of runways!

gotta get there by the end of the runway..

@RоryMcCune well, it definitely is/was possible, it was just more work and time than we were planning for.

@AviD well depends on details, something in that field is possible, but I'm not sure if the things that are possible will actually sell well... did you see that a startup selling "trusted libs" for Go closed down today

no commercial customers

huh

@AviD t.co/DA6EXxPItw

my feeling is that until there's enough pain from outdated / unaudited / untrusted OS code people won't pay for it to be fixed

I think there is pain there, they are just not aware of it

that's obv. wrong but this problem appears to be having zero impact on development approaches

or willing to accept it

or willing to realize that it doesnt have to be like that

@AviD exactly did you see the Q. on Sec.SE , the guy is trying to find out what others are doing so he can pressure management, and the answer is that others are taking the ostrich approach!

Or willing to accept that I live in a free country and I am allowed to ride unicorns.

@AviD security.stackexchange.com/questions/103141/…

@RоryMcCune yeah, seen that

@Simon sure you can ride unicorns all you like, unless you make a deal with the room owner that you won't :P

@AviD that to me typifies the problem

no one is forcing people to do it, and it will be painful/expensive to get right

@RоryMcCune absolutely

@RоryMcCune a couple massed exploits, like heartbleed style, and then people will agree to start maybe think about talking about it. Maybe.

@AviD yep... Standard InfoSec cycle.. Wait for exploits then panic :)

NO ONE COULD HAVE FORESEEN THIS

I can't wait for enterprises with x00 apps to start auditing their open source lib usuage

IT COULD NOT HAVE BEEN PREVENTED

WE WERE FOLLOWING BEST PRACTICE

@AviD it's like messages from the future!

hehe

He who does not remember the past....

speaking of the past.... I need some static analysis for this damn 4GL.

pls

Not that again.

I already know what queries I would write! just need the engine to parse / build / search...

@Simon TWSS!

boom!

boom1

lawl111

I asked the Internet

they'll know

Disliked.

@RоryMcCune oo you should collect those pindrops. I hear they're valuable in fairyland.

are you ready for troll answers

heyyyyyyyyy

@Ohnana but of course, this is.... the Internet!

@deed02392 yooooooooooo

SUP DEED MA BOI

@Simon brah!

lolol

lol omgz, TWSS is still a thing

It's still a thing because a fogey lives in the past.

@deed02392 TWSS is always a thing.

@AviD meow

@deed02392 TWSS

hahaha, nice rory

so whagwarn everyone

@RоryMcCune make sure you ping out any real responses.

@AviD what you don't think @jrg 's one is :op

pls

@RоryMcCune I've played around with Dependency Checker, which is at least a partial solution. You can also subject them to SAST.

@Xander sast isnt really much of a solution for this

or did you mean, sast the 3rd party sources?

@AviD Yes, exactly.

@Xander so while it is possible this is a solution, it is far from an efficient one, and one that most orgs are highly unlikely to take.

especially when you take the recursive dependencies into account...

@AviD I do know orgs (mine, for one) that do in fact use this approach, and with a fair bit of success.

@Xander do you have internal repo's to manage potential malicious updates?

@Xander well, your org is very far from typical.

@Xander also, just noticed you're a mod on beer! congrats!

one of the risks I've seen is that repo security ain't great so compromised repo's are likely

@AviD Ha ha, thanks! :-)

@AviD True, but if you want to look at how the typical org approaches it, then the correct answer is to plug your ears and close your eyes and sing "la la la la" at the top of your lungs and pretend that third party libs can't possibly have security issues worth considering.

@Xander ^ this would appear to be a theme

amazing really with the amount of "Cyber-security is teh most important thing" in the press

that something so fundamental is largely being ignored

dpohohoh

@RоryMcCune If I can't see you you don't exist!

@RoraΖ yeah, inorite. But really I've been kind of wandering along this year after I've done a talk on the topic, expecting someone to say "ahh we've got a thing that totally solves this issue and it works like this", but nope... so everyone (because lets face it most modern dev uses lib repos) is basically slapping in huge wodges of OS code into their critical systems written by people they have no idea who they are...

@RоryMcCune But it's open source, so it's secure! But really I don't see this changing. In the industry where quick releases, mean huge business changes no one is going to question what gets the job done until it's too late.

sure we do: the NSA and equivalents from other major global powers, hackers, subversives, terrorists...

oh, and maybe some normal devs

@RoryAlsop If it's the government then we care. But if it's anyone else no one gives a shit.

Google and Apple could own us and we wouldn't even know it until we're sewn to another user's gastro-intestinal track.

so is @Lighty back then?

ssssssssssssshhhhhhhhhhhhhhhhh

@RоryMcCune I was thinking of writing a blog post about that because I've seen similar issues with pip as well, you want to co-author something?

@LucasKauffman yeah we can do something for the Sec.SE blog if ya like, I've been meaning to write some more about this 'cause it's obv. not a problem that's either going away or getting enough attention.

@Simon iiiittttt?

pls

@Simon so do you think it's a bit suss, that @Lighty turned back up just after @kalina went?

No, since @AviD is both @kalina and @Lighty.

@Simon nah @Adi could be @kalina and @Lighty but not @AviD

#DaysOfOurDMZ

hey @AviD on the subject of SSDs, not sure if you have an M.2 port but if you do anandtech.com/show/9702/samsung-950-pro-ssd-review-256gb-512gb/… the new 950 Pro looks reallly nice

@Simon This room never changes

@RоryMcCune I guess that the most reasonable method to manage security of such libraries is to promote their use, so that every vulnerability will also equally apply to your competitors.

@ThomasPornin business logic! \o/

@RоryM 80% work

Why does he answer on a damn question that has had a proper answer in June?

Sighhhhhhhhhhhhhhhhh.

@ThomasPornin :D that's cynical even for security people!

i got my yearling badge :)

gz scrub

@Simon Did you just gzip @Ohnana?

:OOO

halp i'm smushed

Hang on, let me type a tar command on the top of my head:

tar -zduiqwegqwyuwsagdsa ohnuhnuh

AUUUUGH MY SPINE

@ThomasPornin I can have my spleen back? I found a non-retarded image to replace the bad one.

> As far as I know, getting a lot of upvotes is indeed "not a problem". Thomaspornin

Hahahaha

That is a niiiice E:D Rig

Oh no @Rоry is talking about ED again

@DavidFreitag pls have I mentioned that in the last month?

if I talked about E:D as much as @Simon referenced his nether regions you'd know all the ships in the game by now

@RоryMcCune You're right, I just wanted to make an erectile dysfunction joke.

@DavidFreitag well @Simon got a mention, so it should be an easy setup for your joke..

@RоryMcCune No, that would give him too much opportunity to come back in here and proclaim how well his ween works.

I really should get back on E:D sometime. Been too buried in Destiny lately though.

@RоryMcCune And that is a ridiculously sweet sim rig.

Anyone happen to have any recommendations on Identity Theft monitoring services?

I just had a client get their e-mail with all their tax returns/that of their family compromised. Unfortunately, I don't really use these services, so I'm not sure which ones excel

hey @Lighty long time no see

@Herringbone_Cat as vague as this might be, but reviews.com/identity-theft-protection-services

Good evenin' @TildalWave, Indeed a long time

And you return with vengeance? What's that bucket smithy furnace all about? You're getting rid of some evidence? :D

Nope, just a hobby :P

We all need hobbies, right?

@TildalWave Funny, it looks like an ad referral page and not a real review. They don't even mentoin LifeLock, the leader in this area.

@Herringbone_Cat wired.com/2015/07/lifelock-failed-one-job-protecting-data

@Herringbone_Cat yeah I know sorry about that I did mention it's vague :)

there's a reason for that

@Lighty I live for my hobbies

One day, if I get lucky, I'll even live off them

@TildalWave That's a silent dream that goes for most of us I guess