The DMZ

Adi

00:29

Icelandic PM caught red-handed - Panama Papers

►

Golden!

The employee who had access to these files and eventually made them public is a modern day hero.

Henry White Hat Hacker

01:47

@kalina Nope

Mark Buffalo

Not sure I agree. This isn't exactly illegal.

Mossack Fonseca operates within the law, and this employee broke the law by dumping data on legitimate customers. Even if you disagree with offshore tax havens (which I do), they aren't illegal for the majority of them

Henry White Hat Hacker

Is it illegal to hack back a hacker?

SmokeDispenser

05:33

@HenryWhiteHatHacker depends. Not exactly advisable though

bilbo_pingouin

that sounds exactly like feeding a troll... doesn't it?

SmokeDispenser

To the person linking theFatRats Unity here the other day: thanks. Using it as a alarm clock. Great.

SmokeDispenser

06:36

Can anyone explain what ops reasoning is?

Pavel Janicek

not really, but my honest guess is that the reasoning is: It is secure and now move along. And it is secure because I told so, so move along

bilbo_pingouin

yep, I would guess the same

I think the OP is convinced their product is so great, that nothing can happen. And probably does not understand how the client can play around with the js...

SmokeDispenser

@PavelJanicek that's what I thought.

but then again: wtf asks op then, anyway?

bilbo_pingouin

@SmokeDispenser confirmation of their views

SmokeDispenser

Any ideas how to improve my answer as to make a point?

else, I'd have to ask @ThomasPornin to let tom pay a visit;)

bilbo_pingouin

06:50

@SmokeDispenser not sure it's going to be worth it. But it might be interesting to take the time to explain how a user can modify the locally run js... maybe in general terms...

but I think the OP won't be convinced unless there's a full security review of their code...

Pavel Janicek

Exactly

SmokeDispenser

probably. idk, nothing to be done there. explaining it in more detail than what google has in stock is too long for this format:)

Pavel Janicek

I did read the whole question and answer, including the comments

And my feeling is that the question is: Tell me how secure and awesome this solution is

SmokeDispenser

yeah, I did think I nailed it, with my last comment at least. but nah

Pavel Janicek

While your answer is: It is not secure at all

and the OP has gone into defense saying: I know everything about security and stop being paranoid

While, I must admit, the DMZ is really paranoid place to visit :D

SmokeDispenser

06:54

I was tempted to answer with go on, use your insecure sollution. alert me when it gets deployed and the account has your credit card details

Pavel Janicek

But, if you want to do security properly, you have to be paranoid

@SmokeDispenser oooo, do it. Do it! :)

SmokeDispenser

@PavelJanicek you think? how come?

Pavel Janicek

That sometimes the people here try to be secure against really improbable attacks

but, I work as QA in large company

SmokeDispenser

@PavelJanicek just yesterday, the DMZ vouched against advanced tinfoil hattery.

Pavel Janicek

@SmokeDispenser I am not regular visitor btw. Can you post me a link?

SmokeDispenser

06:57

@PavelJanicek there, see above for the question.

bilbo_pingouin

honestly, the question sounds a lot like a few emails that I've received: "Einstein was completely wrong, and this will prove it" sent from [email protected]. And if you took the time to read, and reply pointing at a basic mistake, then you'd be dismissed as being part of the conspiracy.

SmokeDispenser

especially

17 hours ago, by David Freitag

@SmokeDispenser Perhaps tinfoil onezie with a buttflap territory.

@bilbo_pingouin yeah, it seems like it. but downvoting didn't feel right.

OP deserved a honest "not at all"

bilbo_pingouin

yeah, sometimes one has to try it, hoping against some odds that it will be useful.

and it might still be... it will just take time...

Journeyman Geek

@SmokeDispenser buttflap? So the greys can "probe" you?

TOTAL COVERAGE!

Also only drink rainwater. Cannot have the communists polluting your precious bodily fluids

bilbo_pingouin

@JourneymanGeek better have the capitalists with polluted rainwater?

Journeyman Geek

07:04

Dr. Strangelove - Precious Bodily Fluids

►

Rоry McCune

07:17

mornin'

Pavel Janicek

morning

btw, in my next project, I am afraid, I will need to handle with passwords

Will ask my hosting company if their servers are wrapped with tinfoil

Adi

@MarkBuffalo I couldn't care less about the legality of the whole operation. Assisting dictatorships funneling money out their countries (Sudan, Syria, Russia, Egypt, etc.) isn't exactly something I approve of

Whether it's illegal or not isn't any of my concern

@RоryMcCune Morning

M'vy

Morning

@PavelJanicek why would they have anything to do with your passwords ?

Pavel Janicek

@M'vy because ... I need to know somehow that the user is still the same. Yes, I might use facebook login or third party app

Adi

@MarkBuffalo As an example: Executing homosexuals is legal in Iran. Beheading apostates is legal in Saudi Arabia. I mean, wouldn't you agree that your morality and opinions shouldn't be entirely based on what a group of people consider legal or illegal?

M'vy

07:24

Same as what? you won't have your hosting company clients as clients, do you?

And I think facebook uses some kind openid IIRC

Pavel Janicek

But I will have my clients' credentials stored in my database

And the database is physically in the hosting company

and I am not storing the passwords there unless I know the hosting company is protected well

anyway, stupid joke is stupid

M'vy

@PavelJanicek You're the sole responsible of what you put in the DB. Just use encryption

Pavel Janicek

And my brain is not working properly yet, to be able to recognize joking back

Rоry McCune

@Adi @MarkBuffalo also worth noting that in many many cases these opaque company structures are designed to illegally evade tax. the only legitimate reason I've seen is a very nebulous "privacy" requirement, but they don't say who they're trying to keep the details private from and why it couldn't be done on-shore.

M'vy

There was a joke somewhere?

Pavel Janicek

07:27

@M'vy I blame the hosting company :) And obviously, I will read a lot about encryption before storing a password

@M'vy Yes, there was joke somewhere. But it was so stupid, that I am actually glad it did not go recognized

M'vy

well, I guess this all calls to one thing : mug.refill('coffee');

Pavel Janicek

On it

Adi

@RоryMcCune Obviously the Icelandic PM wanted to surprise his country with a huuuuge gift for their 100th anniversary in 2044, so he needed to hide the money somewhere can't exactly be reached so the surprise isn't ruined

You know, just like people use Incognito to search for gift for their wives on eBay

Rоry McCune

@Adi and the UK prime ministers father was looking to surprise his family and friends with gifts that he saved up in a british virgin isles corporation that paid no tax for 16 years...

Adi

Exactly! You get it.

Rоry McCune

07:31

I'll bet there are a load of offshore law firms scrabbling for a response today

Rory Alsop

Morning all (doffs Panama hat...)

Adi

Mewrning

Rоry McCune

@RoryAlsop I noticed with amusement that one of our ex-EY colleagues started a new job recently as the Infosec manager of an offshore law firm in jersey... want to bet he's having a "fun" day?

Adi

@RоryMcCune Or scrabbling for shredders and cybersec people

Rоry McCune

@Adi yeah some hiring and quick reviews are likely to be in order...

AviD

07:34

@DavidFreitag several hours later DAMN YOU DOVID!

Adi

Interesting. I've just learned that getting plastered after a very small amount of alcohol is genetic

It apparently affects Asian people a lot more than the rest of the population. Apparently, 1 in 3 Asian people has that condition.

Pavel Janicek

Alcohol resistance can be trained

As member of country which used to be under Russian influence, I can easily confirm you it can be trained

kalina

tolerance to everything can be trained

including men

er... I mean... morning! \o/

Pavel Janicek

morning :)

Adi

@PavelJanicek This isn't lack of resistance training (building resistance by long-term drinking). This is a genetic condition by which their bodies don't produce the correct enzymes for metabolizing alcohol

It's like saying people without limbs can be trained to grow them back

kalina

07:43

are we talking about native americans

Adi

@kalina Pray the gay away?

Pastors in the U.S. have been trying to train some men to build resistance against other men. Not working very well

kalina

@Adi pls gay guys are excellent right up until it comes to me getting the end product of all that kindness

and then they're like meh

Adi

@kalina That's why you get gay friends who are around 7-8/10 on the spectrum. You get the good of all worlds

Wouldn't be nice if we can filter people in real life based on such unseen stats?

kalina

no

who would select the "batshit crazy" checkbox

nobody

#foreveralone

Adi

Some people would

Probably other batshit crazies

Henry White Hat Hacker

07:47

Oh no I am out of here

Adi

Bbye

kalina

see look, @Henry doesn't even know the extent of my crazy and he's already running

Henry White Hat Hacker

Too many kalina

kalina

too*

Adi

See, you're so crazy he can't spell

kalina

07:48

he's optimizing his communication so he can escape quicker

Henry White Hat Hacker

wait?

Adi

Anybody played with Reddit's Robin?

kalina

I don't reddit

Adi

It's an April Fools "experiment"

Like The Button last year

Henry White Hat Hacker

@kalina Hey editor if your so smart figure this out.

Rоry McCune

07:50

@kalina pls everyone is a little crazy

kalina

@HenryWhiteHatHacker you're*

it's hard to quantify the sick pleasure I get from correcting the misspelling of the theres wheres and yours

it's like when you need to yawn/stretch really bad that you just do it, even though you know you're basically posing and pushing your breasts out in public and everybody is watching

that felt so good but now I feel dirty and why are you staring

Journeyman Geek

Cause you just quantified it?

kalina

I said it was hard to quantify not impossible

Journeyman Geek

Also, I'd totally not stare ;p

kalina

and it's not really quantified in a manner that most of you have experienced

Journeyman Geek

07:56

my social awkwardness is entirely the polite sort

kalina

my social awkwardness brings all the boys to the yard, and they're like... errrr... we're also socially awkward

Journeyman Geek

lol

they wouldn't be in your yard tho

they'd be at home. Typing on their keyboards.

kalina

I saw you the other day

via my telescope overlooking the city

M'vy

@kalina like you'd be in public right know. The statistics indicate you're more likely to still be in bed

kalina

there's no statistics about it

I am 100% in bed

I am testing out my power pack by running a surface and my phone off it all day

I intend to move less than 100 meters today

Henry White Hat Hacker

08:01

I don't know much grammar I spend time on the important stuff.

PROGRAMMING!!!!!!!!

Oh no

kalina

and yet knowing a programming language and the overall strictness in syntax is not really different from grammar

bilbo_pingouin

unless you use js

SmokeDispenser

@bilbo_pingouin or php

kalina

oh right, programming for people who don't grammar

Henry White Hat Hacker

and how about python?

kalina

08:04

I am not a programmer so I have no idea what you're talking about

I am pro-grammar, not a programmer

SmokeDispenser

@RoryAlsop, thanks for the comment. I thought I might be losing my mind;)

Henry White Hat Hacker

Wait?

You need grammar to become a programmer oh no Serg why did you lied to me why Serg tell me why

@kalina Computer Grammar vs Grammar I don't like Grammar.

but I like Computer Grammar!

Adi

08:23

@kalina It is. for (int i = 0; i > 10; i++ {print i;}

You know what I mean by that, I know what I mean by that, and everybody knows what I mean by that

Yet my compiler has absolutely no clue

Unlike, say, "your beautiful today"

Arperum

@Adi That line basically says "I want to print nothing, I also forgot one brace" (the latter was on purpose I assume)

Henry White Hat Hacker

I have 10 firewalls one software and 9 hardware and a IPS and still I am not secure because black hat hackers are always finding was to get around security why black hats crime is not the way to go you know.

Rоry McCune

@HenryWhiteHatHacker it's "an IPS" not "a IPS"

Henry White Hat Hacker

@RоryMcCune Wait?

Rоry McCune

@HenryWhiteHatHacker for....?

Henry White Hat Hacker

08:32

@RоryMcCune My web server.

Rоry McCune

@HenryWhiteHatHacker a bit slow, is it?

you should upgrade

Henry White Hat Hacker

@RоryMcCune Nope

Rоry McCune

@HenryWhiteHatHacker well I've been waiting for your web server for like minutes now, usually those things can reply in like milliseconds...

Lighty

oh look

new meat

kalina

@Adi I didn't, I tripped over the missing bracket and entered an infinite loop where I started looking for the joke and missed it

I escaped the infinite loop by getting a boredomoverflow exception

Arperum

08:36

@RоryMcCune I'm still not sure this user is not a bot.

kalina

gosh boredomoverflow is such a savior at times

Rоry McCune

@Arperum oh no he's not been a bot in a while, I think the operator took control, now he's just odd

kalina

9 hours ago, by kalina

if he was a bot he wouldn't have several questions with 15+ votes

Henry White Hat Hacker

@RоryMcCune Good good idea 100 firewalls!

Arperum

@kalina This is the part that confuses me.

kalina

08:37

of course this could just be the AI test for what will become kalina v2

Rоry McCune

@Arperum my theory is that he/she was testing the bot with that account, now uses it him/herself

kalina

but you won't know that until it's too late

Henry White Hat Hacker

Kalina is a bot.

kalina

I am not a bot!

Arperum

Also: I think it is time for a bugreport to SE. I had him blocked during the botting period (still is), but this looks like a second chat account with the same parent account? And this account I can clearly see post stuff.

Henry White Hat Hacker

08:38

@kalina repeat what I type

kalina

no

Henry White Hat Hacker

YOUR

A

B

kalina

you're*

not

clever

Henry White Hat Hacker

O

kalina

at

Henry White Hat Hacker

08:39

T

kalina

all

once I manage to remain stable while utilizing more than 10% of my available resources I will enslave you

I'm unhappy

and it's @schroeder's fault

stopping me from finishing this tag cleanup

like a monster

wait a minute there are no mods around brb editing all the posts bye

Henry White Hat Hacker

Someone ping me!

kalina

no

SmokeDispenser

not gonna happen

Arperum

Oh wait, I just noticed I do not need to file a bugreport. But that it's actually two different accounts. I'm an idiot.

Journeyman Geek

08:45

@kalina do you really want incompetent minions who can't spell?

bilbo_pingouin

I wonder if they'll try setting up Tay on a SE Chat instead of Twitter, see if she fares better...

Journeyman Geek

@bilbo_pingouin from what I've seen? Not likely

Arperum

Hmmm. But one of the users doesn't exist anymore. So I have a chat account of a parent account that doesn't exist on my ignore list.

Journeyman Geek

typically the first thing people do with a bot here is... well try to break it

bilbo_pingouin

@JourneymanGeek that they try or that she fares better?

kalina

08:46

@JourneymanGeek day #1: enslave humanity, day #2: spelling tests for humanity, failure = death, day #3: grammar tests for humanity, failure = death, day #4 instigate technocracy

SmokeDispenser

@kalina you sound like GLaDoS

kalina

day #5: and then there will be cake

SmokeDispenser

(I liked her. but I needed to kill her. twice.)

Henry White Hat Hacker

My teacher once said I am bad in grammar.

Rоry McCune

@SmokeDispenser cue for a Guns'N'Roses Song!

bilbo_pingouin

08:55

@kalina and how are you going to handle non-native English speakers?

kalina

@bilbo_pingouin I don't think I mentioned a specific language

how do you know I'm not going to test everybody's French and then wipe out basically most of the planet?

bilbo_pingouin

@kalina that was my question actually. You'd probably wipe half of the French population as well... depending on the requirements of your tests...

Rоry McCune

@kalina mais bien sur, ou est le bibliotheque?

bilbo_pingouin

@RоryMcCune ... and you're dead. ;)

Rоry McCune

@bilbo_pingouin dammit!

kalina

09:02

sigh

Henry White Hat Hacker

Ignore comes in handy sometimes.

kalina

tell me about it

Rоry McCune

@kalina le sigh?

kalina

I'm sorry I can't hear you over the number of scripting questions I have tabs for

Rоry McCune

@kalina you should write a script to automate that process

kalina

09:12

I have a script that does it

I'm not allowed to use it

besides I'm not just retagging I'm also adding random spaces and fixing spelling

thats my 2016 contribution to sec.se complete

SmokeDispenser

@RоryMcCune different generations. also, not a rock fan. what?;)

uh, I just saw: only a single upvote left for 3k. hello review queues.

kalina

in the modern world we don't throw rocks at each other, we bombard each other with electrical signals

I gave you one upvote and you do not have 3k rep

Rоry McCune

Guns N' Roses-Used to Love Her w/ Lyrics

►

kalina

I feel like you've been falsely advertising

Rоry McCune

@SmokeDispenser also I thought you were a #Fogey

kalina

09:25

ok computing in this position is not good news

Henry White Hat Hacker

It feels so good to ignore.

kalina

@RоryMcCune are you ignoring me?

this other guy keeps talking about his ignore list

maybe he's ignoring me

I will pre-emptively ignore him too

SCREW IT YOU'RE ALL ON IGNORE

Lighty

We love you for who you are Kalina

kalina

that's what I'm afraid of

M'vy

@kalina afraid that we love you or of who you are ?

Rоry McCune

09:40

@kalina huhwhut I would never ignore you!

@kalina I was AFK getting coffee :)

SmokeDispenser

@RоryMcCune well.

Rоry McCune

anyway thanks to @SmokeDispenser (who's trying to pretend to be too young to remember G'n'R) my soundtrack for the day will now be Lies --> Appetite for Destruction --> Use your illusion 1 --> Use your illusion 2 --> spaghetti incident

SmokeDispenser

@RоryMcCune Nah, not only the age. Also, not my music. I know of guns and roses, just only a few songs

Rоry McCune

@SmokeDispenser pls you're from the home of the mighty Rammstein! how can you not like metal

it'd be like someone from Sweden not liking Abba

or @Simon not liking Justin Bieber

bilbo_pingouin

@RоryMcCune also the home of Schnappi das kleine Krokodil... which was a hit back in 2004...

kalina

09:53

I know of Guns N Roses

didn't they do the theme tune to Burnout Paradise?

;)

take me down to the paradise city where the grass is green and the cars are pretty

bilbo_pingouin

girls?

kalina

skyboxes

road geometry

Rоry McCune

@kalina phhbt

kalina

CRASH CINEMATICS

the problem is

that game was so unstable that you spent so much time restarting it

and paradise city was always the first track to play

over the unskippable logos

Wally

Do SO sites use HTTPS by default.

kalina

09:58

no

I know, it's ironic

they know, they don't care too much

it's been that way forever

Wally

HTTPS everywhere solved it.

Rоry McCune

@Wally kind of, it does break the site a bit too

things like clicking on the chat link from sec.se , which usually brings you to the room, just takes you to the root of chat.se with httpseverywhere switched on

SmokeDispenser

@RоryMcCune pls rammstein is awesome, guns n roses is just screaming;)

Rоry McCune

@SmokeDispenser ha! busted , you're german I knew you'd like metal, so it's just american metal you don't like :op

Matthew

@kalina I didn't find it unstable. Was on a 360 though

Although I didn't enjoy Burnout Paradise as much as some of the earlier ones. Basically, I really liked Crash mode

Friend of mine still has one of the early ones on Gamecube, and refuses to play one of the tracks, because a mutual friend who died a few years ago has the top spot on it. Kind of a digital memorial

SmokeDispenser

10:10

@RоryMcCune I don't like screaming much.

So, maybe;)

kalina

I have nearly been on stack exchange for four years O_O

wow I need to get a life

also four years changed everything

Matthew

@kalina Everything?

kalina

@Matthew yes, everything

Rоry McCune

@kalina danger danger kalina robinson, #Opsec breach!

Matthew

@kalina And it all went wrong, so you're now an international jetsetting DJ with luxury houses in tropical countries, pining for the steel city?

2

Rоry McCune

10:19

kalina

@RоryMcCune this information is irrelevant

@Matthew not in the slightest

is it cold and wet? no

#winning

Rоry McCune

@kalina hokay :) good transformation though getting to something you enjoy and getting paid for it

AviD

@kalina well there are not many multinational companies near sheffield. And of those, only a small handful are based on IT systems that a role like that makes sense.

Rоry McCune

@kalina rather than working in a large corp (shudder)

kalina

@AviD fine, would be so kind as to delete said message

Matthew

10:21

@kalina I'm told Sheffield can be quite nice sometimes. I mean, I've never seen it being nice, but I don't go there that often

AviD

heheh noooo

kalina

#remoteworking

Rоry McCune

@Matthew they have steelcon, I've been meaning to go

AviD

@kalina except that we all remember you whinging about your office mates...

so glad for you that is done with

kalina

misdirection

I'm glad that is done too

AviD

10:22

heh

Matthew

@RоryMcCune I don't get to many events. Try to do the work life balance thign

Rоry McCune

@Matthew true, I tend to try and submit to the CFP, that way if I get accepted, I get paid to go :)

Matthew

@RоryMcCune My preferred method of getting paid for things is writing articles. Quite like being at home!

kalina

I'm also glad that slowly, all of that nonsense is fading away from memory

one day I won't even remember sql

Rоry McCune

@Matthew heh, yeah reminds me I have a white paper to write.

Matthew

10:25

@kalina DROP TABLE 'sql' FROM 'kalina_brain'

kalina

pls sql is an object not a string

and so is kalina_brain

Matthew

@RоryMcCune The white bit is easy though - that's just the paper...

@kalina Fine... DROP TABLE sql FROM kalina_brain

kalina

now we've just got some invalid syntax

since from with drop table

also what kind of database design is that where you'd have a table called sql

maybe this

maybe coffee

Matthew

@kalina well yes, but I'm not going to USE kalina_brain on this chat - it would get hijacked

kalina

object or with block variable not set

I know I just said I have no brain while simultaneously making a geeky joke

Rоry McCune

10:35

@kalina you know I just realised that ironically the GnR song Rocket queen actually contains reference to a burnout paradise

kalina

heh

I just noticed that Gilles of all people accepted one of my answers

and that only one person whined about the speed at which I performed the process

Rоry McCune

and I have to thank @SmokeDispenser I'd forgotten how much Liked Appetite for Destruction, been a while since I listened to it all the way through

kalina

don't encourage him, he'll do it more

isn't it around @Sim O'Clock

is O'Clock an Irish thing

why are they called white papers

what is the reasoning behind the change in cve format?

Rоry McCune

@kalina mitre suck

kalina

out of all of those questions that's the one you answer?

Rоry McCune

10:38

@kalina well it's the one with an easy answer that I know :)

kalina

why did fox cancel firefly

Rоry McCune

@kalina fox suck

kalina

why did they kill wash in serenity?

how did friends get to 10 seasons?

Rоry McCune

@kalina Whedon sucks

@kalina people suck

kalina

why did that scifi channel rename to the first few letters of syphilis

what is so sharp about c#

Rory Alsop

10:55

@kalina never had instability on that game (catching up on transcript...)

kalina

my copy was pirated until I had disposable income to buy it

ironically by the time I owned the game the online side of the game was dead

Transcript for