The DMZ

AviD

00:33

MIIIILKSHAAAAAAKEESSSSSSS

Mark Buffalo

Those look so good

David Freitag

@AviD Yeah no thanks

Mark Buffalo

01:03

1

Q: What kind of encryption or obfuscation is this?

I found this script on a web page who attempted to change my router's DNS configuration. But I can't understant what kind of encryption or obfuscation is used. Here, a sample of the code on the page: <script language=JavaScript> valor='%252525252525252525252525252525252525252525252525252525252...

what the hell @ that kind of exploit

That's incredible

David Freitag

01:13

Someone with a prominent twatter account should twat my new chat extension.

David Freitag

01:50

(\/)(;,;)(\/)

David Freitag

02:02

The tragic story of Thomas the Tank Engine and his addiction to meth https://t.co/jEWyW1dqNv

Tweeted by alienkabalien on January 10, 2016 at 3:18 PM

kickstarter.com/projects/1980078555/…

For anyone looking to do some RFID pentesting ^

engadget.com/2016/01/19/samsung-next-gen-hbm2-dram

> The so-called HBM2 modules can power through data at the rate of 256GBps (with a capital "B"), making them a whopping seven times faster than the best DDR5 chips on the market.

David Freitag

02:50

If it’s Trump/Palin I’m coming down there.

Tweeted by TheTweetOfGod on January 20, 2016 at 2:13 AM

StackExchange

05:31

I hope that somewhere in the world, "Panamax" is the last option on a "size" drop-down menu on a sex toy site.

M'vy

08:42

heya

Rоry McCune

@M'vy Mornin'

Look Church of the Bear Sleeping bags!

M'vy

lol

TWimC: spam : security.stackexchange.com/questions/111225/…

AviD

handled. Though perhaps @RoryAlsop would want to get in on that.

Journeyman Geek

08:58

@AviD I'm pretty sure at his age, he's well preserved.

M'vy

@AviD you don't think he already knows all the tricks now ?

AviD

heeheehee this is very cool dorkly.com/post/67701/…

M'vy

@AviD I don't need to open that to know what it is

AviD

well, there is a hint in the link

M'vy

And I've seen it already. Oh wait...

Matthew

09:13

Morning

AviD

@Matthew you presume too much.

Matthew

@AviD It's a statement to be taken as "it's morning for me, so give me coffee"

AviD

false dichotomy.

though perhaps coffee would be a good idea...

only have enough for half a cup ;-(

my coffee delivery is late

Rоry McCune

09:37

Suicide Squad - Official Trailer 1 [HD]

►

^@AviD maybe that'll cheer you up :)

mazdark

09:52

o/

Rory Alsop

10:08

@AviD Cheeky beggar

Stephane

10:24

Anyone has a link for the /correct/ definition of a secure hash function ? For once, Wikipedia is failing me...

Adi

@schroeder Any chance of getting it on Kindle?

Delivery to Finland is ungodly!

Stephane

@Adi +1

AviD

@RоryMcCune heh. yes.

nice use of Queen.

also, I love how they use gunfire and explosions to punctuate the drumbeat. perfectly timed.

Rоry McCune

@AviD yeah it's a good sound-track to the trailer, for sure..

now I'm looking forward to Deadpool and that !

AviD

usually its just background, here it is put to good use.

hey do you happen to have a link handy to your curlbashing talk?

was just discussing it with somebody, I have to give a course on secure coding in node ;-)

Barry Carlyon

10:35

^ That doesn't sound like fun…

AviD

never mind, already found it

its the Security And Modern Software Deployment one, right?

never mind, already seeing it :-)

thanks @RоryMcCune!

@BarryCarlyon heh.

M'vy

TIL reddit uses NoSQL database

ugh

AviD

well, the basics of generic secure coding, just happens to be applied to js

Barry Carlyon

Suppose it depends on your definition of "Secure"

AviD

hey I said secure coding, nothing about the infrastructure.

Rоry McCune

10:37

@AviD yarr, sorry I got distracted and watched the trailer again :)

AviD

hehe

Rоry McCune

@AviD don't use buffer without zero'ing it first

AviD

anyway, everybody here should go watch it (again) right now

AppSec EU15 - Rory Mccune - Security And Modern Software Deployment

►

I really like that initial focus on "tower of trust" - that is a core concept that applies to so much, and it is ignored so often.

Barry Carlyon

clicks to watch later

Rоry McCune

@AviD yeah that one kind of came to me after the first time I ran the talk and I thought the intro was a bit weak, so I added later :)

AviD

10:46

that could be a whole talk all on its own

Rоry McCune

@AviD yeah trust and software development/deployment/management is a big, largely ignored, topic ...

AviD

oo just got to the Docker slide. And thus started your year-long affair.... ;-)

"just as an aside"

Telkitty the Web Developer

Is this normal? I opened 1 instance of Chrome, a bunch turn up in the resource manager ..

AviD

@TelkittytheWebDeveloper yes.

Telkitty the Web Developer

I only had 2 tabs open

AviD

10:56

@TelkittytheWebDeveloper that should be about 8 processes.

Telkitty the Web Developer

ok, thanks

AviD

1 per tab, another per window, then there is the background process, also you probably have google chat, and google hangouts, and...

Adi

@Telkitty Press Shift+Esc in Chrome

You'll see the Chrome processes

There's always the main one, one for each tab, and one for each extension

and one GPU process

@AviD @0:49, the bright yellow backpack. That's mine!

AviD

@Adi shame on you!

;-)

Adi

@AviD Whaaa? Why shame on me?

AviD

11:01

@Adi and the hangouts, and background trayicon, etc

@Adi you were LATE :P

Adi

@AviD That's not me! When did I become a tall blond middle aged Finn?!

AviD

@Adi wut

Adi

He's a coworker holding my backpack

AviD

didnt you just say you were there at :49?

ahhhh

I take it back then

Adi

I was away in the hotel having a shower

Remember?

When I arrived half-dead

AviD

11:03

naw, I was gone already when he was talking

Adi

But you were there when I arrived

Or wait.. were you?

AviD

and left shortly after

didnt he speak on day 2?

Adi

Really?

Man.. my memory is fuuuuudged

Barry Carlyon

Talking of Deadpool... imgur.com/gallery/2XimiT

AviD

> Zoinks! You've taken a wrong turn.

Barry Carlyon

11:07

Hmm did someone kill the post...

imgur.com/gallery/2Ximi

Adi

@BarryCarlyon Wrong link

Barry Carlyon

hehe LITERALYL just plugged in my new keyboard. And slightly relearning

Adi

Too short ID

Barry Carlyon

Its the url on my screen

shrugs

Rоry McCune

Mark Buffalo

11:20

@RоryMcCune FLSDLGKWEEKTLERASD DIDN'T CHECK USERNAME

Rоry McCune

@MarkBuffalo it's imgur, you've always got to check the username :op

engadget.com/2016/01/19/linknyc-gigabit-wifi-hands-on <-- Dafuq, free Gigabit Wi-Fi in NYC

Mark Buffalo

@RоryMcCune I love those Michael Cera posts lol

@RоryMcCune Did you see this? security.stackexchange.com/questions/111187/…

That's the most horrifically insecure thing I have ever seeen

I took a look at what the code did and went "WTF"

Rоry McCune

@MarkBuffalo heh, interesting some attacker trying to exploit CSRF weaknesses in home routers...

those things are a big problem

Mark Buffalo

pretty nasty

Rоry McCune

vulns like this rapid7.com/db/modules/auxiliary/scanner/http/…

aren't always patched by the vendor

and even if they are auto-update doesn't usually happen

Mark Buffalo

11:29

Here's another one. security.stackexchange.com/questions/100700/…

Rоry McCune

so ordinary home users don't update...

Mark Buffalo

lol

Adi

12:00

@RоryMcCune I like the name :D

Mark Buffalo

Auto-update almost never happens

AviD

@MarkBuffalo assuming thats a euphemism (and of course it is, this is the DMZ), I would point out that there are pills you could take for that.

Simon

12:22

@MarkBuffalo Stop answering those shitty questions.

See this: meta.security.stackexchange.com/questions/1642/…

When I wake up in the morning, the first thing that I want to do is to tell Markus to shut top.

Simon

12:43

@DavidFreitag I want a LAN turtle now.

AviD

@Simon and roll over.

Simon

Is SE dying?

Mark Buffalo

@Simon Which shitty questions?

Simon

@MarkBuffalo Ah I quoted the wrong one, here: security.stackexchange.com/questions/111187/…

Mark Buffalo

It drives traffic to the site

So I don't care

Simon

12:47

It drives bad traffic, hence why there are rules, son.

Mark Buffalo

The question was formatted bad, I agree... but it's on-topic in the scope of what the code does

I want more people to be aware of that kind of code

Simon

It is not on-topic at all.

Mark Buffalo

If you want, you can cry on my shoulder. I am here for you.

Simon

I'd rather punch you in your mong face.

Mark Buffalo

I'm gonna edit the post to be on topic

Simon

12:49

Not gonna work but sure, give it a go.

Mark Buffalo

Ah screw it. But it's off-topic, and it has an answer. It drives more traffic to the website, but it also shows people that these kind of posts are off-topic.

Simon

Again, read the meta post.

It encourages people to post off-topic questions, since they're gonna get an answer anyway.

Mark Buffalo

shrug cmn&l2p

Simon

nn

Poor Markus, I can only imagine how much I'd make you walk in a damn straight line if we'd work together.

I'd make you fear me.

Mark Buffalo

I don't work with shitty coders

Just kidding, your stuff is actually nice. =]

Simon

12:56

You haven't seen my stuff you mong.

Mark Buffalo

Yes I have

You just don't know it yet

Simon

o

Mark Buffalo

watch, I'll paste some of the code

$pls->$collection = array("mong", "pls", array("donut, "donut", "donut"));

deed02392

lol

Simon

Those instance variable names don't have the type as a prefix? Not my code.

deed02392

13:00

what projects are you on Simon?

i want to collab some code

Simon

I've got nothing going on, what I do at work satisfies my coding needs.

My free time is spent elsewhere.

deed02392

#2cool4code

oh you suck Simon i thought we'd have coding bants

painting github red and all that

Simon

Naaaaah.

Terry Chia

13:21

@Simon Is PHP actually code?

Matthew

Hmm... Apparently, JS being able to access things isn't fair...

Simon

@TerryChia PHP code has feelings too.

RoraΖ

@MarkBuffalo Haha, no it does not

Simon

@RoraΖ Are you Benedict Cucumber?!?

RoraΖ

@RоryMcCune haha, yeah I'm recording all these conversations

AviD

13:33

@Simon wait, you put the variable type as a prefix to the variable name? How... 1992 of you.

Simon

@AviD How... responsible and nice of me to make sure that other people immediately know which type the variable should be in a non-typed language?

Yes ovid, yes.

RoraΖ

I like that style

AviD

@Simon well see, there's your problem. Use a real language, it wont be a problem.

@RoraΖ its known as "Systems Hungarian", also known as "Confused almost-Hungarian". To differentiate from "proper Hungarian".

Simon

Irrelevant. You've got something else to add or?

AviD

@Simon "or?" is that mean its a nullable type?

RoraΖ

13:36

@AviD Man, I hate hungarians

AviD

@RoraΖ Damn Hungarians.

Wanna know the best thing about Hungarians? They're not Belgian.

Monty Python - Dirty Hungarian Phrasebook

►

Simon

@AviD Are you being a pleblord?

AviD

@Simon My hovercraft is full of eels.

Simon

Is your orifice full of sand too?

fkin rekt

AviD

@Simon in some languages, appending a "?" to a variable's type allows it to accept nulls.

e.g. int? a = null

Simon

13:40

On a non-typed language, I'm sure this concept doesn't exist.

AviD

@Simon again, that is precisely my point.

Simon

Maybe we should call the yolo police.

Jedaias Rodrigues

@AviD hue..

AviD

@Simon nah, they would just want to do more PHP anyway...

Mark Buffalo

3

Q: Would CVE-2016-0728 affect Docker?

I ended up having a discussion about Docker and system security today and we came to the point where we asked ourselves of the latest CVE-2016-0728 exploit (privilege escalation) would affect Docker containers as well. Docker utilizes the system kernel (which may be vulnerable) but isolates the ...

cve docker

@RоryMcCune ^

My assumption (and I won't post because it's an assumption) is that if you can breach the operating system, anything running in it can be breached as well, including docker containers.

Never ran docker, so I dunno.

Simon

13:57

o no it's Germany.

@CodesInChaos Did you live in Berlin when the wall got rekt?

Mark Buffalo

@Simon You use the type as a prefix?

like stringName, or strName?

Simon

lulz str, int, boo

Mark Buffalo

intName, boolName

AviD

@Simon lolName

Mark Buffalo

$booLog

Simon

13:59

I like boo because I can pretend to be a ghost for a second.

CodesInChaos

@Simon I'm from Bavaria.

Mark Buffalo

Hm, I don't like that style.

AviD

@MarkBuffalo oh jeez, how much coke did you snort till you came up with those??

Mark Buffalo

I already know what my types are

AviD

HOW IN HELL COULD A NAME BE ANYTHING BUT A STRING

Transcript for