The DMZ

Xander

02:33

@ThomasPornin That is possibly the most epic thing I can imagine.

@JohnP The significance is that "Thomas Peyrin" is suspiciously similar to "Thomas Pornin." There are only so many cryptographers in the world. That two should have such similar names, well, it makes one think, doesn't it?

tylerl

05:32

halooo

Rory Alsop

06:59

Morning @tylerl - how goes it

Lucas Kauffman

@tylerl ameriiiiiiiiiiiiiicaaaaaaaan

morning all

what's cooking

Rory Alsop

07:45

Bacon roll at the airport. It was cooked perfectly

M'vy

08:24

Morning!

Hey @RoryAlsop > spam : security.stackexchange.com/questions/105100/…

AviD

@Iszi old news, I thought he already pulled out?

> He promised the campaign would be interesting

AviD

08:41

scarily, I actually agree with much of his platform.

the problem is he thinks Donald Trump and Hillary Clinton are "very smart."

Terry Chia

09:25

30

Q: Maintain hundred of customized branches over master branch

Currently we have one master branch for our PHP application in a shared repository. We have more than 500 clients who are subscribers of our software, most of whom have some customization for different purposes, each in a separate branch. The customization could be a different text field name, a ...

Oh god no.

M'vy

"one master branch for our PHP application" < this was the first mistake

AviD

and the second mistake, all in one.

AviD

13:09

apparently not new, but always interesting: format string attacks, in managed languages. Specifically I find the Python instance interesting in particular.

Terry Chia

13:24

@AviD Wow, that website is dog slow.

AviD

@TerryChia so is yo momma.

and I had no such issues with that site, btw.

well, except for the common js-heaviness that is still rampant...

JukEboX

14:12

Good morning everyone

M'vy

Good afternoon

JukEboX

What's today's topic?

M'vy

Nothing really. Yet.

We are introspecting it. I think.

JukEboX

Introspecting?

M'vy

yeah. I do neologisms. It's not quite defined yet

JukEboX

14:39

lol

JukEboX

14:51

Hmmm

Semiconductors are looking good

Iszi

15:05

@AviD TWSS?

AviD

pffft.

Lucas Kauffman

12

Q: How can I reach out to my 16-year-old son who has voiced he's depressed every day and doesn't love himself?

Last night my husband and I addressed a few things we discovered in my son's room being a concern. We are pretty strict parents and believe in corporal punishment especially since my son doesn't have anything left to take away since he's always in trouble for something. We have good days and bad ...

behavior teen

JukEboX

15:56

@LucasKauffman damn bro. Heavy. Sounds like an Emo Teenager being an Emo Teenager. On the adverse it's probably time for counseling or spending more time with the child

Arperum

@JukEboX ALso: stop hitting him you twats. All that does is making him hate you. physical punishment doesn't work at all at that age.

I got a tick or two when I was younger a little kid, not exactly hard, but enough to point me out that what I was doing was seriously stupid(or dangerous or whatever), don't think it ever happened after I was 10 though. By that time you are able to be reasoned with. And thus can be properly reprimanded by speech.

Ohnana

@LucasKauffman dear internet, i'm a abuser, and my child hates life? tell me this is my child's problem, please. I want to have more ways to hurt them

JukEboX

16:16

@Arperum LOL agreed. When I read "We are pretty strict parents" I was like well this is starting off well. Maybe you should be asking "Maybe I'm to blame"

@Ohnana not to laugh but still :P

Ohnana

@JukEboX yeah i saw this post coming from the first sentence. i had a parent like that

Iszi

16:37

@Arperum Have you ever tried reasoning with a 10 year old?

Arperum

@Iszi To a certain degree. And that worked. Where reason can be as much as "Don't do that or you'll hurt yourself"

If they don't listen and the situation is not stupidly dangerous, just let them continue, and then after they effectively hurt themselves, be all "I told you so" (while helping them of course).

The next time they tend to listen a lot better.

Nate Kerkhofs

I contacted a company about a security issue with one of their products a few months ago involving the absence of SSL. I now want to apply to their IT department (open application). Should I mention that I reported this issue to them in my motivation?

Arperum

@NateKerkhofs If it is fixed: yes. Otherwise: don't apply.

Nate Kerkhofs

Thing is, I have agreed with my job coach that I'd do a spontaneous application to this company

And I'm not sure how far they are in fixing it, and maybe I could help on the inside

Ohnana

16:54

@NateKerkhofs are you prepared for the programming equivalent of wading through raw sewage

because if you're cool with getting into a shit environment and making it better, than awesome!

if you're looking to fix a thing then have a low stress career, then you're not going to get that. i can whip up an SSL cert and configure apache in 30 minutes...

Nate Kerkhofs

@Ohnana There would probably be a lot more issues than that. I figure that if they don't have something as simple as an SSL cert, they're likely missing a lot more on their PCI-DSS 3.1 checklist

Ohnana

@NateKerkhofs exactly. they've got some damn issues

and if you like the challenge of kicking ass and taking names, then go for it

it'll be great to talk about in an interview someday

Nate Kerkhofs

Also, I'm currently looking for junior profile jobs.

so I'd assume that working on PCI-CSS compliance on an existing project might be a good thing to get started with

Depending on how willing they are to comply with it

Ohnana

@NateKerkhofs how do you know they want that?

PCI is a series of checkboxes to some people.

Nate Kerkhofs

@Ohnana I'm not sure, but given that it's basically a webshop application, they need compliance or VISA and Mastercard will yell at them

so sometimes it's not just a matter of "do I want that?" because you need it

Ohnana

17:00

@NateKerkhofs i know. but do the business people know that? who wears the pants for the application?

Nate Kerkhofs

Let's get back to the original question. I want to apply there. I reported an issue, it's not yet fixed. Should I mention that I reported an issue in my motivation?

Ohnana

i would. it shows technical aptitude

and it shows that you actually have a connection to the comapny

Nate Kerkhofs

When I contacted them about it, I received an email the next day that they'd contact their supplier about it

This implies to me that this particular project is not in-house.

still, it's nice to mention it

Ohnana

ohhhh so it's someone else's problem!

that's more understandable

you can only squeeze a vendor's balls so much

Arperum

@Ohnana Or they say it's someone else's problem.

Iszi

18:21

Hm. I'm surprised this hasn't made it onto Is The Internet on Fire.

David Freitag

@Iszi Well that's terrifying.

Ohnana

@Iszi is it the apache commons library, or part of standard java?

for some reason i haven't heard about this vuln too much

David Freitag

@Ohnana I remember hearing something about this not too long ago and IIRC it's in standard Java.

Ohnana

@DavidFreitag oh damn

i saw it on twitter, but no one's running round with hair ablaze

Iszi

18:40

Found via here: securitywizardry.com/radar.htm It's the Java alert.

Ohnana

@Iszi what the fuck is that fugly bullshti

i'm suing you for eye damage

David Freitag

@Ohnana Yeah srsly +1

JukEboX

20:18

@DavidFreitag Everyone leaves around this time. Except you and I

SEJPM

@JukEboX :(

JukEboX

HI @SEJPM :)

SEJPM

@JukEboX :)

JukEboX

Stuck at work like me?

SEJPM

It's 21:20 here, so "no".

JukEboX

20:21

LOl. What is your InfoSec expertise to be in here?

SEJPM

@JukEboX random knowledge.

Rоry McCune

I'm here

but them I'm in Helsinki still :P

JukEboX

@RоryMcCune Don't be such a Rory

:P

SEJPM

@RоryMcCune :)

Rоry McCune

@JukEboX it is rather difficult for me to stop being a rory

SEJPM

20:23

@RоryMcCune start being a roro?

JukEboX

Spent all day working on paperwork >_<

Did pick up a 3rd monitor for my desk here

Rоry McCune

I'm only here in case @Adi turns up and I can make fun of him for not coming to the bar tonight

JukEboX

You guys live close to each other?

Rоry McCune

nah he invited me over to speak at OWASP Helsinki

so here I am in helsinki and after the meeting some of us went to a bar

and had a drink

SEJPM

@JukEboX atm we're ~1.5k km away from each other

Ohnana

20:26

@JukEboX baller

JukEboX

@Ohnana I have awoken the sleeping DMZ

Anyone gonna watch the donuts argue tonight on the debate?

SEJPM

@JukEboX ?

JukEboX

@SEJPM Republican debate tonight

Ohnana

@JukEboX nooooope

SEJPM

@JukEboX US politics? may be fun, but, nah.

Ohnana

20:28

i like my brain cells, and there is nothing good the repubs have to say to my ass

Rоry McCune

people should play "who can say the craziest thing" with those debates

SEJPM

@Ohnana you need a shotgun for this!

JukEboX

LOl

My wife would make a drinking game out of it but can't now.

Ohnana

aka alcohol poisoning

JukEboX

LOL aka no

The better option

Rоry McCune

20:34

See I managed to pimp out Sec.SE at my talk today by wearing my T-Shirt :)

JukEboX

Can't see the picture :/ Stupid work INe

SEJPM

@RоryMcCune "Image not found" :(

Rоry McCune

how weird, shows here...

@raesene 's tower of trust #owasphelsinki https://t.co/lrgTCoD1oN

Tweeted by Petteri_Arola on November 10, 2015 at 5:22 PM

that's the tweet it came from

Lighty

@RоryMcCune +1 because Rory

JukEboX

LOl

Anyone here living in the UK or Englad?

SEJPM

21:02

@JukEboX I guess nobody wants to admit living there :P

Ohnana

kalinuh lives somewhere on those islands, same as one of the rorys

JukEboX

@RоryMcCune can yo8u help me? I need some basic knowledge being an ignorant American looking to better myself

AviD

@RоryMcCune I'd noticed, nicely done :-)

SEJPM

@JukEboX @RoryAlsop is from scotland

AviD

@SEJPM Note for @JukEboX, Scotland is not England

JukEboX

21:07

@AviD I am looking for info as part of the UK not just England

SEJPM

@AviD "UK or England", Scotland $\in$ UK

JukEboX

Scotland is part of the UK

AviD

@SEJPM well... for now, at least.

JukEboX

@AviD where are you located?

vaguely

AviD

@JukEboX not UK

JukEboX

21:08

Well duh

AviD

@JukEboX depends on who you ask

SEJPM

@JukEboX ask his user page

AviD

@Simon likes to say I am from Egypt

"used to like to say"?? oh noooess

SEJPM

@AviD Where is our @Simon :'(

David Freitag

@JukEboX Yeah and I'll be here for another four hours

JukEboX

21:09

LOL @DavidFreitag half an hour laer :)

David Freitag

@JukEboX I was in a meeting :/

:25309353 No, I was arguing with my boss about trying to match unrealistic (and nonexistent) accuracy specs.

Lighty

Bastard teacher deleted my database out of MY project because he thinks "its not good enough", simply because MY normalization comes out with 7 tables, while his abomination comes out with 15...

My reaction:

JukEboX

@Lighty DO IT!

@Lighty NO balls

LOL

Lighty

Already did

AviD

@Lighty sounds like your normalization wasn't good enough.

Lighty

21:13

mine is back up where it belongs

David Freitag

5

Q: How can I get junk in my trunk?

With the new crafting system, I've got a massive pile of junk in a wooden crate in my base. When I finish crafting things, I want to put all the junk away since I have no reason to carry it. Is there a way to move everything in the currently selected category from my inventory to a container? The...

fallout-4

2

Lighty

@AviD :'(

AviD

why would you call it an abomination, if it was done right?

though deleting it from your project is a dick move, regardless.

Lighty

@AviD :''(

his wasnt normalized

AviD

@Lighty then why did he have more tables?

Lighty

21:14

I have concrete documentation (the whole point of an normalization) of mine, he literally told me he "made that up in an evening, why did you spend a week on yours?"

AviD

completely unfounded, but I assume yours was less normalizes then his, hence you had fewer tables, all merged together.

@Lighty waat?

> "documentation is the point of normalization"

SEJPM

less work = always better results

AviD

is that what you just said?

Lighty

Rephrase

the point is to have concrete documentation when normalising

AviD

I am having trouble fantasizing what kind of mental sickness brought you to say such a thing, while not being at all ashamed of knowing nothing.

Lighty

21:16

so that the DB you build, doesn't look liek a student project

Rоry McCune

@JukEboX wassup?

David Freitag

@AviD The mental sickness known as non-native english-speaking.

AviD

@Lighty that's not "the point", but it is always required.

Rоry McCune

@AviD BTW also used one of your tweets :)

Lighty

I'm not ashamed of me knowing nothing, because I do not know everything...

AviD

21:16

@DavidFreitag I dont think that's the problem there, no. He is doubling down on it.

@RоryMcCune oh? whichwhat? Share slides?

Ohnana

developer fiiiiight

David Freitag

dev fights are the best

Lighty

@Ohnana One does not easily fight a moderator.

AviD

@Lighty there is nothing wrong with that, but your hubris in not acknowledging that, is.

David Freitag

@Lighty It sure is an easy fight

AviD

21:17

@Ohnana where do you see a dev fight?

Lighty

@DavidFreitag ;'(

JukEboX

@RоryMcCune In Scotland what is your equivlant of States of the US?

Ohnana

@AviD shall we start with you calling someone mentally ill?

Rоry McCune

@AviD slides is prezi.com/vjjq6n2x72ko/… t'was the one about people sticking their fingers in their ears and singing lalala about the library problem

@JukEboX I guess they're called regions these days

AviD

on one side, you have somebody well grounded in theory with many years of experience. On the other, you have a failing student who knows less about computers than my 10 year old son.

Rоry McCune

21:18

it's council areas

so Argyll & bute is the one I live in

AviD

@Ohnana I meant, you need at least two devs for a dev fight.

David Freitag

@RоryMcCune MY GOD! There's a "wat" in there !

JukEboX

@RоryMcCune more like Counties? Because I am guessing England is separated by Counties right?

AviD

@RоryMcCune ha. Though that was @xander's quote...

Herringbone_Cat

@JukEboX note that the council areas are more like counties in the US than states, scotland is sort of like a state of the UK

Compare devolution to the reserved powers of the US constitution

Rоry McCune

21:19

@JukEboX yeah similar to counties

David Freitag

@RоryMcCune Also, that slideshow is pretty awesome...

Rоry McCune

indeed I'm sure some people call 'em that

AviD

> Prezi needs Flash Player 11.1 or better. Upgrade here.

:-O

Ohnana

@AviD jesus christ dude, wipe your mouth before you start shittalking like that

Rоry McCune

@DavidFreitag yeah I like prezi .. apart from the flash requirement

AviD

21:20

@Ohnana well, no, thats my point. But heh.

JukEboX

@Herringbone_Cat if I were to build something to cover all of England or Scotland but separate it as the US is separated I would go by County?

AviD

@Ohnana I should just link him the Mongo WebScale vid and call it a win.

Herringbone_Cat

Depends why you want to separate it and how.

I mean, in the US people use congressional districts instead of counties. They are PROFOUNDLY different because of Gerry-Mandering.

Rоry McCune

@JukEboX yeah that would be likely to be right

Herringbone_Cat

Sometimes congressional districts span small parts of like, 5 counties...

AviD

21:22

hey @RоryMcCune was there video?

btw how did it go??

and/or how similiar / different was your talk from the one you gave at appsecEU?

Ohnana

@RоryMcCune great presentation man

Lighty

@AviD By the way, I am failing because the online-courses and self-study books I'm learning from in addition to this course, will not grant me my exam, and my exam will not be granted by my education, because the teachers are uncertified developers, and are better off teaching a 10 year old math than wasting my time and money on how to fuckin' hello world in HTML

Rоry McCune

@AviD I don't think they were recording this time... I think it went well, I got some questions (which is apparently unusual for the finnish) and timing was good :)

@Ohnana ta :) I like prezi, seems to fit my presentation style

JukEboX

@RоryMcCune @Herringbone_Cat well I am going by geographical area not congressional

AviD

@Lighty oh yeah, I forgot how sucky your instructors are. Fair point.

Ohnana

21:23

@RоryMcCune BUBBLES!!!!

Lighty

@AviD Sucky instructors make suckier studends

Herringbone_Cat

@JukEboX What for? I have a social science background and this degree in poli sci too :-P

David Freitag

@Ohnana Bubbles is a great stripper name.

AviD

just to be clear @Lighty, I'm only giving you a hard time because @Simon is not here... :-)

Herringbone_Cat

@JukEboX so i'll ask the IT guy question: "What are you trying to do?"

AviD

21:24

let me know if I'm too harsh or if you want me let up...

David Freitag

@AviD Harder

Ohnana

@AviD it's nice to see consensual humiliation in the DMZ.

4

Lighty

@AviD I know, we all have our needs, shall I compose a list of random bullshit to say that will not get me banned, but make you want to modabuse to ban me? :P

AviD

@Lighty THAT SAID, it is usually the case that normalization == more tables; ergo, you having less tables == less normalized.

also usually the case that students + new devs have no understanding of normalization.

@RоryMcCune good to hear :-)

David Freitag

I must be a new dev, I have no clue what normalization is.

Lighty

21:26

@Ohnana Humiliating a student teached by a shitty 52 year old nitwit, said student having no job, life or area experience

pretty easy if you ask me ;)

AviD

interesting how different cultures are about that... eastern europe too, I was barely able to get students involved or to interact. Here in Israel, I cant get them to shuddup :-)

@Lighty nah, no need, just your usual crap will do ;-)

@DavidFreitag its a database thing.

@DavidFreitag I was imprecise, I mean "developer of data systems", obviously irrelevant for embedded (for the most part)

David Freitag

Adi

@RоryM Sorry, I had to run. I'm trying to get SYSTEM in one machine and I paused to come listen to your talk, then I'm not back trying to pwn it

David Freitag

@AviD Data systems still apply to embedded, what you meant was SQL.

AviD

@DavidFreitag what I meant was databases, irrelevant of query language.

JukEboX

21:29

@Herringbone_Cat Building up my next site expansion to the UK

AviD

even though Mongoites like to pretend its immune.

David Freitag

@AviD Oooh yeah good point, I always forget what SQL actually stands for.

JukEboX

I have a group for each state in the US and all the Provinces in Canada and I want to do the same for Countries in the UK and Australia

Herringbone_Cat

@JukEboX oh ok, so you're basically using mailing addresses?

David Freitag

@AviD Let's be honest here, Mongo is not a database.

Rоry McCune

21:30

@Adi phhhhhbbbttttt. so you're saying popping boxes is more important than beer!!

JukEboX

@Herringbone_Cat kind of. Just regional seperation

Adi

@RоryMcCune This box in particular. I spent days until I got low-priv shell. I can't afford to lose it

Rоry McCune

@Adi Marion says "get a life" :op

Adi

@RоryMcCune :D

Herringbone_Cat

@JukEboX LIkely the UK-wide system of "post town" is good enough

JukEboX

21:32

Post Town?

Herringbone_Cat

has the advantage of you being able to normalize it through google maps api or other address validator

@JukEboX Check this out: bitboost.com/ref/international-address-formats/united-kingdom

AviD

@Herringbone_Cat BOOM NORMALIZATION

Herringbone_Cat

Now, I've never actually been to Scotland, but I am half Scottish and own enough Harris Tweed i'm certain there's at least 5 sheep being raised and sheered for me in the outer hebrides at any time.

Let's not even get into the number of whiskey barrels aging...

AviD

@Herringbone_Cat I own enough land on south Islay I could probably build a farm and raise those sheep for you.

David Freitag

@AviD Heh, me too :D

AviD

21:36

@DavidFreitag oo maybe we're whiskyland-neighbours!

oh this I didnt know:

> The annual rent is a dram of Laphroaig which can be obtained upon visiting the distillery

Herringbone_Cat

@AviD No you couldn't. Then it wouldn't be harris tweed, protected by act of parliament! Must be spun in the home of the weaver in Harris or Lewis.

David Freitag

@AviD They have ram sticks made out of whiskey? Won't your computer get drunk?

AviD

multiply that by X, times the number of years... OH MAN I'M COMING BACK WITH A BARREL

if I ever make it there

meh, they probably wouldnt let me take it on the plane with me

David Freitag

If you just got a barrel of whiskey you should drive it back in the passenger seat of a small british sportscar.

AviD

@DavidFreitag heh.

> The fluid dram is defined as 1⁄8 of a fluid ounce

Herringbone_Cat

21:39

a dram is useful for essential oils but not much more :-P

David Freitag

Why can't the world just use one standard unit of measure for everything? FFS

AviD

> Dram is also used informally to mean a small amount of spirituous liquor, especially Scotch whisky

JukEboX

Thanks @Herringbone_Cat I was going to go with COunties because they seemed to be broad enough

@Herringbone_Cat better question. How does your DMV separate out? Like Does it say a county or region on your plate on your car?

David Freitag

@JukEboX LOL, nobody but the US has a DMV, and only the ones in CT are impossible.

Herringbone_Cat

@Jukebox California doesn't do that, but other states do. California uses the same plates state-wide. But administratively, the county level is what is used.

Rory Alsop

21:41

@SEJPM - all Rories are from Scotland. Even the ones that think they aren't

Herringbone_Cat

And we have a lot of counties in California. I haven't even been to most of them.

Mark Hulkalo

Agreed, even the Dr. Who's rory was from Scotland... or he was smugglegrated (smuggle-immigrated) somehow by an alien species.

David Freitag

@RoryAlsop Does that mean that all non-scottish Rories are adopted?

Mark Hulkalo

Dammit, I killed the chat again.

SEJPM

@MarkHulkalo stop it #pls

Rory Alsop

21:57

@DavidFreitag there are no non-Scottish Rories

AviD

@MarkHulkalo .... simon?

Lighty

@MarkHulkalo That's my job

David Freitag

22:10

@RoryAlsop Nono, I mean the Rories that think they aren't Scottish

Vicariously I live while the whole world dies

JukEboX

22:25

@DavidFreitag LOL CT isn't half as bad as NY

@Herringbone_Cat Ok thanks for all the in put. I am going to go with counties and see how that works.

AviD

22:38

@RoryAlsop could there be an Irish Rory?

that's kinda like pseudo-Scottish, right?

Transcript for