The DMZ

kalina

19:01

yes

cooldown period is 265 days too

which is awfully unlucky for him I guess

also

I was just reading all the email i've ignored

found one discussing one of my new releases

the label uploads all of their new releases in an unindexable directory with predictable names

so I've just downloaded their entire back catalog and their next ~10 releases as well

i'm not sure how I feel about this

JukEboX

DId you really ignore @MarkBuffalo

?

@kalina of what?

Ohnana

@kalina erm you should probably let them know

kalina

I can't do that

I'm unable to have a technical discussion with non-technical people

JukEboX

19:17

Shall we translate?

kalina

waste of effort

Rоry McCune

@kalina good?

Rory Alsop

@kalina I only do them if I want to level up quickly and need a blast of experience points :-)

Ohnana

19:33

@RoryAlsop i actually like the radiant quests

building a community is hard work

Rory Alsop

@Ohnana Ah - yeah, those ones I got a little annoyed with. Like guys - you know how to harvest things, build a fence and a turret, and put in a water pump. Just do it while I'm away, right?

Ohnana

@RoryAlsop you can assign people t oharvest food

Rory Alsop

@Ohnana yeah, but I want them to sort it out amongst themselves

:-)

Ohnana

nope

doing settlement stuffs is actually really soothing. i've spent hours and hours just making my little communities

Simon

You're a little community.

Rory Alsop

19:40

@Ohnana I play fallout a bit like I play minecraft. In minecraft I have some friends who build lovely things - I like to run around at night. In caves. With a sword. Wheeeeeee stabby stabby BOOM!

Ohnana

@RoryAlsop fair enough

minecraft is also another of my obsessions

Rory Alsop

@Ohnana I think I like doing that because it is totally opposite to my life, which is all about growing, mentoring, coaching, building communities etc

Ohnana

botania is the best freakin mod ever

Rory Alsop

@Ohnana we did run a major automation mod on our server for a while, but it was annoying so we went back to vanilla

Ohnana

buildcraft?

anyways botania is pretty magical flowers with armor that uses an energy source as durability

and a sash that allows you to run up a one block high cliff without jumping

and flowers that eat cake

Rory Alsop

19:46

@Ohnana sounds cool. I forgot to mention, I often run around sans armour of any kind too. As fast as I can run. I focus entirely on swords and axes

Ohnana

tinker's construct?

Rоry McCune

@Ohnana you're a tinker's construct

Ohnana

@RоryMcCune :OOOOOOO

Rоry McCune

what oh yeah sorry, forgot the <simon> </simon> tag

Rory Alsop

@Ohnana may have been buildcraft - this was maybe 4 or 5 years ago

Ohnana

19:50

@RoryAlsop no i'm recommending tinker's construct to you -- it's an overhaul of weapons crafting

you can make throwing knives and hammers and stuff

Rory Alsop

@Ohnana that sounds interesting

Ohnana

it is

the tools also don't break, you repair them with more material

Rоry McCune

20:36

0

A: Information needed to share with Penetration Tester?

I'm guessing given that you've asked this question twice you're not provide the additional details, but a comments too short to explain the problem with your question, so here's some more information untill this one gets closed :) Your question is essentially unanswerable. The reason for this i...

it's late I feel snarky

a mod will likely close this

Simon

@RоryMcCune Downvoted, there's nothing about HIV in there.

Rоry McCune

@Simon I accept your downvotes with the equanimity provided to me by two whiskys :op

Simon

Naaah, I'd keep the whisky for myself.

Rоry McCune

mmm whisky

Simon

Here's an upvote, you owe me one whisky now.

Rоry McCune

20:39

sure just pop over to Scotland and I can sort that

Simon

Deal.

Maybe in 43 years.

Rоry McCune

I currently have 14 whiskys in the house so there's plenty to choose from

Simon

Dayum.

Rоry McCune

I got quite a few at christmas that I'm not drinking quickly

they were better than usual stuff so no need to rush them

schroeder

@RоryMcCune I'll see you soon!

Rоry McCune

20:41

@schroeder \o/ you all sorted for coming over to the UK then?

schroeder

@RоryMcCune YES!!

Rоry McCune

yay

Ohnana

i wanna drink booze with a dinosaur :(

Rоry McCune

@schroeder whereabouts in the country are you going to be based?

schroeder

Tier 1 "Exceptional Talent" visa, and the final details on a job in London

I'm not announcing the employer until things are signed

Rоry McCune

20:43

@schroeder nice. good plan, always wait till it's finalized

schroeder

but I'm working in the City

Rоry McCune

well if you're over before the summer you'll need to come along to B-Sides London

Simon

@schroeder Stop trying to steal my whisky, man.

Rоry McCune

I'm planning to get down for that this year

@schroeder ahh that'll be interesting, although I don't envy you on the property price front!

schroeder

@RоryMcCune I will be there!

Gilles

20:45

@RоryMcCune That's a nice answer. The answer on the duplicate is worth keeping too. How about merging the two questions and editing them to suit the answers? @schroeder

Rоry McCune

@Simon don't worry, it'll be a while before scotland runs light on whisky

schroeder

@RоryMcCune they run lit on whisky now

Rоry McCune

@schroeder heh

schroeder

I was told something about not having a "work/life" balance, but a "work/drink" balance

@Gilles hmmm - trying to find the merge button ....

Gilles

@schroeder mod menu

schroeder

20:47

try it now - did it work?

Gilles

@schroeder yes, thank you

Rоry McCune

@schroeder heh yeah london can be quite boozy, IIRC one of the conferences down there has a "Gin O'Clock" segment

Gilles

edited and voted to reopen

Ohnana

@Gilles i have to say, that question is still terri-bad

Gilles

@Ohnana why?

Ohnana

20:55

@Gilles it's still a question we can't answer

we're not the pentesters, and even if we were, the answer would be "what do you actually want?"

Gilles

@Ohnana “We're not the pentesters”: no, but we're pentesters (some of us, not me actually). We can tell him what pentesters expect.

@Ohnana “the answer would be "what do you actually want?"”: yes, but it isn't obvious!

Rory's answer explains to him exactly what he needs to know at this stage

Ohnana

it really isn't obvious. If I had a client that wanted the answers to those questions, I'd convene a meeting with their CIO and one of our senior managers and hash it out over the course of an hour

Gilles

So we have an answer that's useful to the asker, covering a situation where there are plenty of people in the same position. That's exactly what Stack Exchange is about.

Ohnana

the format of the site and the amount of information you need is not suited for this question.

Gilles

One aspet @RоryMcCune didn't cover is whether the asker is the sole order giver or he's doing his pentesting to show the report to a third party. If the latter, he needs to discuss requirements with that third party.

Rоry McCune

21:01

@Gilles yeah I could riff on that but unfortunately almost every compliance requirement only goes as deep as "have a pen test" which is deeply unhelpful

Rory Alsop

@schroeder I'm there every month so will definitely get some beers/whisky/food in! COngrats!

Rоry McCune

@Gilles added a bit :)

Mark Buffalo

7

A: What kind of information does a penetration tester require?

I'm guessing given that you've asked this question twice you're not able/planning to provide the additional details, but a comments too short to explain the problem with your question, so here's some more information untill this one gets closed :) Your question is essentially unanswerable. The ...

@RоryMcCune Good post

Also, why do you dislike the term pen testing? I hate it too, but that's because it sounds dumb.

@schroeder Congratulations, dude!

Rоry McCune

@MarkBuffalo it doesn't mean anything. If you look at the wikipedia def it implies that it's a test which "emulates an attacker". Hardly any/no "pen tests" emulate real attackers as notably a) you can't break the law and b) most "real" attackers just use phishing and malware :)

So the industry just describes everything as a "pen test"

so it's meaningless

Rory McCune - Penetration Testing Must Die

►

2

^I've been at this topic for a while now :)

David Freitag

@RоryMcCune Maaaan you look so young in that video

I didn't know YouTube was around in the 70's

Rоry McCune

21:15

@DavidFreitag well that was only 5 years ago, so I would've been 37 then

David Freitag

@RоryMcCune You look like someone my age in that thumbnail

Mark Buffalo

@RоryMcCune 37? You look like a punk teenager

I'm starting to think Scots have some Face of Dorian Gray thing going on

TildalWave

time runs slower in highlands

Mark Buffalo

d:

David Freitag

@MarkBuffalo Nice hat bro

Rоry McCune

21:18

@MarkBuffalo yeah it's the whisky that does it, it's not called the water of life for nothing :)

Mark Buffalo

@DavidFreitag Thanks

David Freitag

@MarkBuffalo Sucks about that whole no mouth thing

TildalWave

@RоryMcCune dude, good points but you speak way too fast

Rоry McCune

@TildalWave yeah I've got a lot better at it since then, back then I talked waaaay too quickly

I learned when I started speaking to international audiences

now I always open with an impreciation to tell me to slow down if needed :)

Ohnana

@RоryMcCune now i want to go to one of your talks and heckle by yelling "SLOW DOWN" at random intervals

TildalWave

21:25

@RоryMcCune too much club mate? :)

sugar rush...

Rоry McCune

@TildalWave nah I naturally speak quickly and this was about 2nd or 3rd talk I'd done so I was quite nervous

TildalWave

nature of pen testers I guess, you're trying to get in as much of information possible while others pause to take a breath LOL

Mark Buffalo

DON'T SAY PEN TESTERS

TildalWave

that was quite deliberately provoking :P

Ohnana

PEN TESTING IS A DIRTY DIRTY THING

2

TildalWave

21:28

I haven't had any complaints yet

Roro jr. is right tho

everything is sold by a pen test moniker nowadays and it's annoying

Rоry McCune

indeed . I read an interesting article the other day bemoaning this which came to the conclusion that it really needs customers to fix it

the guy who wrote it is a freelance tester and said that if he stopped using the term pen testing he lost business

'cause that's what people have been programmed to buy

Mark Buffalo

Yep, that's why I'll use it

When the industry gets their terms updated, I'll go along with it

Rоry McCune

linkedin.com/pulse/…

Mark Buffalo

@RоryMcCune My favorite type is white box

Rоry McCune

@MarkBuffalo so yeah I find black-box frustrating as you know that with the code you could find the source of the problems...

Mark Buffalo

21:36

The problem with black box is that it's far easier to do more damage to the client

sometimes.

Rоry McCune

@MarkBuffalo yeah I like white-box in a dedicated test environment better :)

Mark Buffalo

Yeah, and it really helps to know exactly what potential problems there could be

TildalWave

@RоryMcCune black box is like testing the infinite monkey theorem with just the one monkey

:)

Mark Buffalo

With black box testing, you could have far more problems than you realize, which aren't immediately obvious

and it's easier to miss things

Rоry McCune

@TildalWave heh

Iszi

21:42

@RоryMcCune Good talk there. Think it's the first time I've actually seen/heard you. Love the accent.

Rоry McCune

well if you like scottish sounding security talks I actually did a play list for ones I'd done so I'd have them in one place :)

youtube.com/playlist?list=PLKDRii1YwXnKG5PiY9zx3g5dJ2zOTJ4Al

Ohnana

the new hampshire primaries have been at 1% all day and it's driving me crazy

AviD

@RоryMcCune ah thats the one ;-)

@RоryMcCune I've been practicing that too. I find it actually makes a massive difference to the classfeel.

now I'm too slow, and can barely get all the content in on time :-(

Rоry McCune

@AviD ahh that's a problem. my next talk I have a feeling I asked for a 30 min slot and I have like 45 mins of content, so I'll need to break my own rule and go fast

AviD

@RоryMcCune sometimes that works, depending on crowd.

Rоry McCune

21:53

@AviD well it'll be mostly scots so I should be fine :)

AviD

@manicode gave an awesome speedtalk at appseceu.

Ohnana

s;jflskjfslkjf lksdj kljdSECURITYYYYY

just give everyone a can of monster on their way in

AviD

re speed I was talking mostly about training classes, but yeah I am going to incorcporate that for conf talks too, and plan accordingly.

I really do like giving the slower talk now.

hey @RоryMcCune did you see this?

946

Q: Should I use Vagrant or Docker for creating an isolated environment?

I use Ubuntu for development and deployment, and have a need for creating an isolated env. I am considering either Vagrant or Docker for this purpose? Can anyone help me with the pros and cons, or a comparison of both of these solutions?

David Freitag

There was this guy at BSidesNYC from kaspersky and he had a really thick accent

He talked super fast

AviD

longform answers there by the author of Docker AND the author of Vagrant.

@DavidFreitag was it Kaspersky?

David Freitag

21:55

@AviD No

It was some guy named "Dmitry Bestuzhev"

His talk was on "Mobile Implants"

aka IOS/Android vulns

Rоry McCune

@AviD interesting! also shows the problems of aging posts in this kind of area, as the tech has changed quite a bit since then (both vagrant and docker)

https://aws.amazon.com/service-terms/ Read 57.10

Tweeted by ScreamingDuck on February 9, 2016 at 7:18 PM

^Lolz

David Freitag

@RоryMcCune ROFL

AviD

hahaha

David Freitag

Woo I might have a place to live

That would be nice.

@RоryMcCune I find it really surprising that Amazon made Lumberyard FOSS

JukEboX

Parliament is so fun to watch

David Freitag

22:04

aws.amazon.com/lumberyard

JukEboX

Hi @DavidFreitag

What's going on

Gilles

@RоryMcCune “in case of zombie outbreak, you may use our planks to board windows”?

David Freitag

@JukEboX Nothin' much

Doing some VBScript ready to stab myself in the jugular, nothing new

JukEboX

Dude found this satellite tracking site today and it is so interesting

David Freitag

Nurd

JukEboX

22:09

Reading so many neat things about the different satelites

PROGRESS MS-01, identified by NASA as Progress 62 or 62P is a Progress spacecraft used by Roskosmos to resupply the International Space Station (ISS) during 2015.

It is also tracking space junk

David Freitag

@JukEboX You should frequent the pod bay more often if you find something that mundane to be particularly interesting

AviD

@ThomasPornin your proxied twitter attacks on Dan Bernstein failed to provoke him into a proxied twitter war :-(

Mark Buffalo

This one recruiter keeps spamming me mercilessly trying to get me to work for a company I already work for

Thomas Pornin

@AviD It's better that way.

AviD

@MarkBuffalo so take the job, get paid twice

Gilles

22:12

@MarkBuffalo make him promise you a higher salary than what you get

Mark Buffalo

@Gilles Haha

The recruiter wants my social security number. Uh, no

Not even responding, but anyone who opens an email with "WE HAVE AN URGENT REQUIREMENT FOR POSITION X. PLEASE SEND YOUR RESUME, SOCIAL SECURITY NUMBER, ETC"

is a fraud

AviD

@MarkBuffalo actually, yes that is fraudulent activity.

sounds like identity theft

Mark Buffalo

It's a dead giveaway when these recruiters can't even speak English properly

Or they're not even in the U.S. for example.

Iszi

I wonder if it would be okay to create clientsfromhell for stuff like this:

5

Q: Need help with moral dilemma of first client

Sorry in advance for the long read. I'm 22 years old and just finished university for graphic design. I was approached by a small business which wanted me to design them a logo, stationery, and a website. I was only charging them $20/h NZD because it was under the table and my first client. An...

website-design client-relations business freelance

Mark Buffalo

Also, I've blocked like 10 recruiters on LinkedIn already

AviD

22:16

@Iszi makes sense on workplace.se

Iszi

I don't mind (legit) recruiters so much. But I just had a whole new (to me) kind of LinkedIn spam: Someone made a connection to me, just to try to advertise their product. Looked like a local ITSec startup that might be interested in hiring, so I accepted the connection. That's when they started with the "we'd like to meet with you to talk about our..." conversation.

Aw, crap. Isn't Game Dev one of the Chat.SE hot zones?

AviD

yeh... thats why I dont connect to anybody unles I have some form of prior connection with them.

you folks are the least connected I am to anybody I've connected with.

I dont demand on IRL meeting - I work remote with too many teams for that - but I do insist on some form of "having met you".

Iszi

@AviD Are we connected? I'm actually not sure I'm connected with anyone on here. Will have to double-check. There might have been a couple requests awhile ago, but I forget what (if anything) I did.

AviD

@Iszi no I dont think so, noone here knows your real name.

Iszi

@AviD A Certificate of @ScottPack Gender Verification isn't enough, eh?

@AviD I think there's two regulars here who might. I do still like having a certain layer of obfuscation.

AviD

22:23

we're all busy talking about @kalina's opsec, we didnt notice that even your opsec has got opsec.

kalina

no stop pinging me I'm trying to murder a bear

Iszi

@AviD Nah. I'm fairly confident it could be broken with relatively little effort. I just don't like it being a zero-effort task.

AviD

@kalina :-O

Iszi

@kalina WTF? Does @ThomasPornin know?

AviD

@kalina @ThomasPornin, lookout! behind you!

kalina

22:25

ffs.

Iszi

More like @kalina better run, now that @ThomasPornin has been summoned. That's three times, right?

Thomas Pornin

@Iszi I was already there.

Iszi

@ThomasPornin Ah, of course.

JukEboX

@kalina

David Freitag

@Iszi He's always here, even if you can't see him.

Thomas Pornin

22:26

Also, one does not simply summon the Bear. You invite the Bear.

2

AviD

heh @Iszi your coworkers are awesome.

take note, all you people in snowy areas:

Snowball Machine Gun- How to make

►

Iszi

@AviD Ah, yeah. You do have connection to my Twitter. So there's some obfuscation gone for you.

David Freitag

@AviD They are?

AviD

@DavidFreitag that video

David Freitag

@AviD That's one of @Iszi's coworkers?

AviD

22:33

oof did I just break obfuscation?

Iszi

Honestly, I've got NFC who that guy is.

AviD

@Iszi well he works at the same place you do.

is that doxxing?

shoudl I remove that comment?

David Freitag

@AviD No doxxing isn't sharing information, it's sending a swat team

AviD

no, that's swatting

Iszi

@AviD If he lives anywhere nearly as close to snow as his video and profile seem to indicate, probably not. Might work for the same employer down the line a bit, but nowhere near the same place.

AviD

22:36

well yeah, I meant "place" == "employer".

not "physical building".

Mark Buffalo

@DavidFreitag That's swatting

Rory Alsop

I think I need a snowball machine gun

2

Well, obviously everyone does

But I think I really need one

And some snow

I guess

David Freitag

@RoryAlsop Makes me imagine a potato machine gun

IT'S SPUDS FOR DINNER

AviD

12 mins ago, by AviD

no, that's swatting

@RoryAlsop I thought you would

AviD

23:07

Snowball

►

Iszi

bareback, v: to browse the internet with Flash enabled

Tweeted by jschauma on July 14, 2015 at 3:17 PM

AviD

nsfw btw

Iszi

Only got half-way through before I hit TL;DR due to time constraints, but figured I'd share this - looks like a good read.

netmeister.org/blog/defense-at-scale.html

4

David Freitag

23:26

@Iszi Oooh yeah that guys talk was so packed there were people in the hallway

It was right after lunch

kalina

I get to a base camp and light my escape fire

David Freitag

@AviD Why is that NSFW?

kalina

the fire attracted 3 bears and I got murdered

AviD

@DavidFreitag well, probably not the kind of thing you want blasting out of your speakers in a crowded office.

David Freitag

@AviD wut

AviD

23:29

or so they tell me

David Freitag

@AviD Oh you mean the clerks vid

AviD

@DavidFreitag uhh yeah? as opposed to what?

David Freitag

I thought you meant @Iszi's twatter link

kalina

hehe twatter

AviD

pfft

kalina

23:35

#boredface

David Freitag

@Ohnana I keep reading that as "penis testing"

kalina

so it's not just me

ha points

absolved of any wrongdoing

chat is too quiet at this time of day

it's completely unnerving

it's like being hellbanned

David Freitag

I think it's because most of the people in chat normally are currently sleeping

kalina

well that's not acceptable

maybe we need some new people in here

David Freitag

You could always hit up The Bridge.

kalina

23:47

woah

let's not talk crazy

at least now @JourneymanGeek we might get some conversation

Journeyman Geek

once the caffeine kicks in

kalina

I'm doomed to watch youtube all night until I pass out, aren't I?

David Freitag

@kalina I was going to make a suggestion but then I remembered I'm not a sadist

kalina

what suggestion?

David Freitag

About a certain game

Transcript for