The DMZ

this.josh

12:29 AM

Software Engineer - Experienced Level

National Security Agency

cc++javapython

Responsibilities The professionals at the National Security Agency (NSA) have one common goal: to protect our nation.…

Posted on Stack Overflow Jobs on October 21, 2019

MechMK1

9:06 AM

Feds are hiring again, I see

@ConorMancone Most likely a "I have no idea what I am doing" person

MechMK1

9:31 AM

megadrive.bandcamp.com/album/199xad

New MegaDrive album for all your hacker needs

Conor Mancone

11:29 AM

Huh, Chrome 78 is killing the XSS Auditor. I know the tool had it's issues, but I'm a bit surprised anyway

MechMK1

11:55 AM

@ConorMancone Why though? They made their reasons pretty clear

It breaks some (although badly designed) websites, it can be circumvented with relative ease, it requires a lot of attention from the devs and there are much better ways (e.g. CSP) to do it right.

I personally am very happy to see it gone.

@ConorMancone And regarding that chrome:// question. Why on earth would anyone think that it works like that?

Conor Mancone

12:11 PM

@MechMK1 Then it probably would have helped if I had read their reasons :) I've kept up with some of the challenges the XSS auditor faced over the years, but hadn't realized they had risen to the level where it was better off not existing

MechMK1

I think the primary reasons for it to cease existing was that it was not effective at what it was supposed to do, and that it supposedly even introduced new security flaws

From an architecture point of view it's understandable. It's another moving part, that doesn't move well, is really redundant and just serves no purpose

Conor Mancone

Sadly I will not be joining you guys as official members of the security community (aka I got turned down for the application security engineer job I applied for)

MechMK1

@ConorMancone Oh no...

Conor Mancone

It's okay. It's a transition I want to make, but it will just take some time. I'm not hard-up for a job, so worse things have happened

I've been playing around with the idea of getting a certificate or two. I might do that, and also try to more proactively use my job to practice some additional skills

MechMK1

That's certainly a good thinking

Conor Mancone

12:18 PM

A big part of the job was performing threat modeling with the engineering teams before they started their sprints, and I've never done an actual threat modeling session before. As a result I knew I wasn't a slam dunk

MechMK1

And to brighten up your day, my 2FA code just now was yEa42069

@ConorMancone Threat modeling is only one part of the story, and really nice in some situations. As a pentester, for instance, you rarely need it.

It's more "constructive security", rather than "destructive security"

Conor Mancone

You do penetration testing, right?

MechMK1

Yes I do

Conor Mancone

Do you ever do bug bounties on the side?

(just curious)

MechMK1

No, I don't really have time for that. I know a lot of people here do bug bounties or CtFs or RE challenges, but I don't want that

Conor Mancone

12:21 PM

I've tried a bit, but never given it enough time to have any success.

MechMK1

The problem with bug bounties is that you never know if there will be light at the end of the tunnel.

I know after a week of pentesting an app, I will have a report and there may or may not be any vulns in it. It doesn't affect my paycheck

Full-time bug bounty hunters spend like 90% recon and like 10% actual exploitation

And your monthly income is directly tied to all the bugs you find. No bugs, no income...

I prefer spending my time playing videogames and painting minis. I need more "life" in my work-life balance.

Conor Mancone

I started doing it a bit as a part of my attempt to move more directly into the security gig. I have learned quite a bit doing it, although I only submitted one bug report.

MechMK1

That's great though!

Conor Mancone

Closed as "will not fix" of course :)

MechMK1

I could tell you war stories of bugs that customers refused to fix, would I not be under NDA

Conor Mancone

12:30 PM

Oh, I'm sure.

That was actually a question I got asked a lot in my interviews

"How would you handle a situation where you think there is a security concern but management disagrees"

MechMK1

I personally would ensure that the risk is properly assessed and that there is a dedicated risk owner.

Conor Mancone

Provide clear proof of concept, try to clearly explain cost of breach, but at the end of day if management doesn't want to fix it, it is there money on the line, so :shrug:

Oh, fancy words. /tuckawayforfuture

MechMK1

Yes, basically any vulnerability the company becomes aware of immediately becomes a "risk"

And the company has to decide how to handle that risk. Sometimes "doing nothing" is the right choice, e.g. if the likelihood and severity are very low, and the cost-to-fix would be too high by comparison

But my key takeaway point should be "Make sure someone is responsible for it and understands what the actual risk is"

Conor Mancone

@MechMK1 lol, indeed! A concept missing for everyone who asks, "Is this secure?"

Oh yeah, much better answer

MechMK1

I hope it helps you in your future endeavors.

A good example for a "won't fix" is a user enumeration thanks to incrementing user IDs.

An attacker can determine usernames and number of users. User 1 is likely to be the admin account.

Yeah okay, that's true but we won't change our entire database, rework our authflow and invalidate tons of links to us just because of this

Conor Mancone

12:37 PM

@MechMK1 As someone who is in our business systems as an admin with userid=1, I understand how that happens!

An agree - I'm well aware of the risk that poses, but I know my boss would have no interest in fixing it

although it could be fixed without having to redo everything.

If I were starting from scratch I'd probably use something like UUIDs instead, but it's never been the highest on my list of security concerns

MechMK1

It would still be work, and the risk owner has to decide how likely it is that this risk becomes a concrete problem, and how much impact it would have.

I completely understand devs of some system just being like "We'll just autoincrement user id's" because that's what I would do too

Conor Mancone

umm....

0

Q: I've been using my boyfriend's phone Privacy

I've been using my boyfriend's phone for a few months I never use Bluetooth cos I don't know what it is or what it does. Today he borrowed my phone to go on Facebook later on I noticed the Bluetooth symbol was on the top of my phone I swiped down and pressed on blue tooth and under the symbol the...

bluetooth

Not even sure what to do with that one...

MechMK1

@ConorMancone Girlfriends going crazy because something happened and they have no clue what's going on really hits close to home :/

Conor Mancone

Oh yeah, sorry :/

MechMK1

No problem

It's not meant to address you, just these kinds of people.

I always see questions like "I checked my boyfriend's phone and saw something I don't understand. <Is he cheating on me?>"

The last part is often implied, but it's there in their heads

It just makes me so sad. If you can't trust your partner and feel like you have to go to a set of random strangers with little more than a hunch of what may be happening, then you seriously need to reconsider your relationship.

Conor Mancone

12:52 PM

Yeah, I've seen a ton of questions like that on SO. They usually don't make it over to security though.

Given the state of relationships these days, unfortunately they're probably not wrong more often than not

Given the experience of people around me, healthy relationships are few and far between

MechMK1

I've seen some here. I remember one woman saying that her boyfriend told her he was in "that city" but his IP address showed a nearby bigger city and she's worried he's cheating on her.

I am so far away from a healthy relationship. I am slowly going to the point where I ask myself if being alone wouldn't be better for my mental health.

I wanted a relationship where me and my partner could depend on each other. What I got was a relationship where my partner depends entirely on me and I can't depend on her.

It is essentially like living with a teenager, even though she's 21.

Conor Mancone

Those are hard situations to get yourself out of, whether that is through your partner becoming a more functional person, or simply figuring out how to extract yourself. It's tough, and having a stressful home is definitely no fun

MechMK1

Why do you think I am always in the DMZ while at work?

Work has essentially become my "free time"

0

Q: How does hacking work? How does a hacker spy on a system?

According to my understanding a hacker has two options to spy on someone. He can trick the user into installing the spyware himself or if that doesn't work he has to find a service that the target is using which has vulnerabilities that he can exploit. If he finds a vulnerability that allows him...

vulnerability antivirus spyware

I present you: The definition of "Too broad".

-3

Q: I've been using my boyfriend's phone Privacy

I've been using my boyfriend's phone for a few months I never use Bluetooth cos I don't know what it is or what it does. Today he borrowed my phone to go on Facebook later on I noticed the Bluetooth symbol was on the top of my phone I swiped down and pressed on blue tooth and under the symbol the...

bluetooth

Jesus someone is getting mad

Conor Mancone

1:22 PM

She got 4 downvotes too. That's pretty unusual even for bad questions like this

MechMK1

Maybe people are just fed up with bs like that

Conor Mancone

I'm guessing she's not in a good place mentally: the chances of engaging with her successfully were probably low from the beginning

MechMK1

She wanted to hear "Yes, your boyfriend is 100% cheating on you!" and any other answer would have been met with "y u ppl gotta be so rude 2 me!?"

Pet Peeve of mine: I absolutely hate when people use abbreviations like "ppl".

Journeyman Geek

orly?

MechMK1

ya m8

And Emoji

Conor Mancone

1:26 PM

@MechMK1 lol, it hurt me a little inside everytime I saw ppl. I was literally thinking that exact same thing.

MechMK1

I have this deep hatred for excessive emoji usage

Like, I don't mind when people write something funny and end it with :D and it automatically substitutes :D with 😁

But people 😊😊😊 who use emoji 🤫🤫🤫🤪🤪🥶😡😳 after almost every 😲😲😟😧😩 part of their sentence ✏✒🖊🖊🖌🖊🖋 just freak me the fuck out

Conor Mancone

Emoji use doesn't bug me as much (when used sparingly), mainly because tone is so hard to read over text, and a smiley/grumpy/frowny face avoids a lot of confusion

MechMK1

@ConorMancone It's hilarious, because I have the exact opposite problem with them, namely that modern emoji usage is so ambiguous

It's almost as if the English language has words that can be used to concisely express a wide range of thoughts and emotions, if one were only willing to invest more than a moment into writing something.

Conor Mancone

@MechMK1 lol, it's not often that I get accused of being lazy :)

MechMK1

Not you

But when I talk with people who do use emoji excessively, they say that emoji express things in a way that they never could.

Journeyman Geek

1:34 PM

@MechMK1 I used an emoji once. People paniced

Conor Mancone

The giphy add-on on slack is my favorite thing. I really overuse it. It makes me sad that I can't use it here

(but it makes everyone else happy)

MechMK1

I mean, I'm sure there are no words in the English language that can express "🍆💦😜"

@JourneymanGeek Rightfully so

@ConorMancone I remember that I overused memes so much that once during a kickoff meeting I accidentally said "yeet"

Conor Mancone

@MechMK1 /giphy embarrassing

sigh

MechMK1

Once we had a meeting where the fire alarm started and nobody would move until an email came in saying the building was on fire.

The business world is weird.

Conor Mancone

Yeah, I've totally ignored fire alarms. I've never had one that was actually caused by a fire. It's like the definition of "alert fatigue"

MechMK1

1:42 PM

Pretty much. Though I had one funny fire alarm story when I was in primary school

We were told that there was going to be a test fire alarm, and that we should all be calm, follow the teacher and do as the teacher said.

One girl was absent while we were told that, and everybody assumed that someone was going to tell her. Then we eventually all forgot.

Conor Mancone

My all-time favorite meeting story ever was at a place that manufactured body armor, gun holsters, etc... Totally looked around the room at least once to see people pull guns out of holsters and start playing with them (usually checking the fit of a new gun holster). You don't normally expect to see people waving around pistols in a business meeting...

MechMK1

The big day came, and then there was the alarm. Everybody was like "Ah yes, I remember", except that girl. She FREAKED THE FUCK OUT! Like literal life-and-death panic.

First she screamed, then jumped out of the window (we were on the ground floor so it wasn't a big deal) and then ran away screaming

Apparently she ran all the way to her grandparents on the other side of the village

Conor Mancone

@MechMK1 That seems a little bit of an over-the-top response even if the building was on fire

That's both hilarious and probably really embarrassing for her...

MechMK1

It was a bit over the top

It was both hilarious and embarassing :D

But at least we learned that if there was an actual fire, she would be the first to abandon all rules and just GTFO

Journeyman Geek

@MechMK1 I have one signature emote ;p

MechMK1

2:01 PM

@JourneymanGeek Please do tell

Journeyman Geek

@MechMK1 I did!

MechMK1

Ah, the ;p

I personally don't mind emoticons, or even some emoji.

Rory Alsop

I'm too old to understand emojis - I was trying to figure out the one @MechMK1 posted up there. I assume it's rude :-)

I only use :-) ;-p and ones like that

MechMK1

@RoryAlsop It's supposed to symbolize an ejaculating phallus

Rory Alsop

Hahahahahahaha

Fair enough

On a face, I guess

Journeyman Geek

2:06 PM

🏴🏴🏴🏴🏴🏴🚩🚩🚩🚩🚩🚩🎌🎌🎌🎌🎌🎌🎌🎌

MechMK1

For example, 💜 is pretty self-evident and unambiguous in most situations.
But what purpose do 🔛, 🌁 or 💯 mean?

Rory Alsop

Nope, I don't understand that one either @JourneymanGeek

Journeyman Geek

@RoryAlsop flags ;p

Rory Alsop

I understand 100 - it signifies great approval or agreement

Journeyman Geek

@MechMK1 I really feel that emoji need to have alt-text and such

for people who don't know what they are, and for accessibility

Rory Alsop

2:08 PM

They sort of do in slack

MechMK1

I know that 100 is used for approval, but that is deeply arbitrary

Rory Alsop

But generally I just ignore them. I am much happier reading sentences with correct punctuation and grammar.

Journeyman Geek

@RoryAlsop I mostly use them ironically

MechMK1

You could argue that 👍 is arbitrary as well, but it's a well-known symbol

Journeyman Geek

Its probably rude in a few places

MechMK1

2:10 PM

Another problem I have is that many emoji have countless variants, such as 📃, 📜, 📄, 📰 and 📑

@JourneymanGeek Yes, I am aware it's not entirely unambiguous. But it was good enough for facebook to adopt it as a universal symbol of approval

Even ✔️ is not universal, as the japanese prefer ⭕ to indicate correctness.

Conor Mancone

@MechMK1 Wow, I totally did not get that.

MechMK1

The eggplant is considered one of the most used emoji for precisely this reason. Close follow-up is 🍑

I'm sure you can guess what that is supposed to symbolize

Another problem I see with emoji is that they aim to represent "anything". Abstract places (the office), specific places (the Tokyo tower), all kinds of food, emotions, professions, activities, etc...

This inevitably leads to "This thing has an emoji, why not that thing?"

"The Unicode consortium considers X less important than Y because X has no emoji while Y has one"

It completely neglects the idea of Unicode, to represent every glyph used in any writing system by humanity.

by assigning emoji to all things, we essentially have to emojify everything

Vipul Nair

2:30 PM

bestcharged.com/…

MechMK1

Just as we came away from political discussion, Vipul yeets this masterpiece into the DMZ

I'll just abstain from making my comments. You probably already know what I'd say anyways.

Conor Mancone

@VipulNair Pot Stirrer! :p

Vipul Nair

Hahahah.Sorry about that

I didnt even read the earlier message.just pasted it here.

MechMK1

It's fine, don't worry about it. I just think after the discussion between Tom and me, people are perhaps a bit tired to discuss such topics.

Vipul Nair

businessinsider.com.au/…

wtf is going on in china?

MechMK1

2:43 PM

Do you want the long version or the short version?

Journeyman Geek

yes

Vipul Nair

I mean how do humans even do stuff like that

MechMK1

The answer is "Because China"

Because China has money, and because everyone needs China. That's why they can get away with everything.

Because your phone is made in china, your clothes are made in china, your TV is made in china, etc...

And you may say, "No, that's not made in china. That's made in somewhere that's not china", and that may be true on the surface, but the components were made in china.

We let them do whatever they want, in exchange for money and products.

Vipul Nair

I meant more like why would Chinese people do this shit

Whats wrong with just peace.

Conor Mancone

@VipulNair That's not how people work.

MechMK1

2:51 PM

Peace and co-existence are all well and good, as long all parties involved actively want to pursue that goal.

And again, the DMZ starts to get interesting just as I am about to leave.

Vipul Nair

But peace is pretty sweet tho

people's priorities are all messed up i tell ya

MechMK1

Alright, let's do a thought experiment:

Vipul Nair

Everyone dies eventually you might as well live in peace while you are here

@MechMK1 go on

MechMK1

Imagine five groups, all living together. People naturally want to support their own group, but they have no problem helping people from other groups.

All people in those five groups share the same ressources, be it jobs, land, actual resources like water or food, etc...

Imagine, one group thought to themselves that they could be better off if they would not support the other groups anymore.

They would still be supported by others, but not give back anymore. At some point, that group would cause problems in the system. Other groups would either stop supporting that group, or start becoming selfish as well.

The problem is that "being selfish" has more net-gain than being supportive. As a result, everyone wants to be selfish.

If all 5 groups are selfish, everybody loses, because every group has some surplus (that they can't get rid of) and some deficit (that they can't satisfy)

Everybody is off worse in the end.

Vipul Nair

isnt that short sighted?

MechMK1

2:58 PM

Yes it is, hence the lesson that supporting each other requires good-will from all parties involved

Once you have one party that picks greed over support, everyone has to pick greed or else they will get taken advantage of.

Problems such as xenophobia are extremely complex, but to some degree they boil down to this.

For example, just last week an afghan refugee in Austria stabbed a member of the Red Cross to death, then stole a car and stabbed the driver to death as well. People read the news, and start hating refugees, even though the specific refugees affected had nothing to do with the situation. They in turn will consider all Austrian's xenophobic and "out to get them".

Anyways, I gotta go. I'll see you all tomorrow. have a nice day!

Vipul Nair

see ya bud

Conor Mancone

@VipulNair This is literally just how human nature works. Whether you blame it on Adam or Evolution, the end result is the same. Human beings are simply not what human beings would like us to be (well, to be fair, large fractions of the world are actually okay with how we are).

Vipul Nair

I think small countries that are well educated are doing well tho

Like denmark,new Zealand,sweden

Conor Mancone

@VipulNair No. It just comes out in less-obviously-violent ways. These things are intrinsic to our nature. Being born in another country doesn't change that - just the presentation. That's why every movie/tv show about any utopia (ala Star Trek) is laughable, even while entertaining. Human nature will never allow us to really get along

Vipul Nair

i see

OTLT-LCar

5:29 PM

@Schroeder

Conor Mancone

5:45 PM

@OTLT-LCar For some reason he's not pingable

OTLT-LCar

I see what you did there.

Tom K.

@ConorMancone If someone has not been in the chat for 7 days (I think) you can't ping that person

OTLT-LCar

@Conor Tom didn't see what you did there.

Conor Mancone

@TomK. Thanks, learn something new everyday!

@OTLT-LCar I didn't see what I did there :p

OTLT-LCar

Wait, now I'm confused. You were serious?

Conor Mancone

5:48 PM

Yes

His name has a capital S. If you had successfully pinged him it would have been lower case

(hmmm.... maybe that's not true)

OTLT-LCar

His username doesn't have a capital.

And no it isn't

Conor Mancone

(but if you had selected the auto-fill for a valid ping, it would have automatically provided the correct case)

OTLT-LCar

You can't ping someone who isn't there...

Conor Mancone

Now I'm curious if the case matters - with the autofill it gives the correct case

What say you @tomk.?

did you get a ping?

OTLT-LCar

It's irrelevant.

He's not present

so I can't ping him

Conor Mancone

5:52 PM

He's still generally around though. I saw him close some questions a few hours ago

OTLT-LCar

Thx.

Tom K.

7:09 PM

I did get a ping. The casing doesn't matter

@OTLT-LCar and you can ping people if there are not in the chat

OTLT-LCar

Ack

I assumed otherwise.

So... with my format, he should've been pinged?

Tom K.

yup

but as I said, if he wasn't in chat within the last 7 days, he doesn't get pinged

OakSecurity

Ack

Thanks for clarification.

Rory Alsop

9:17 PM

@ConorMancone but they aren't intrinsic. There is no such thing as human nature. There is nurture - those brought up to think of "us" and "them" will create divisions as you describe. But more and more realise those are just stupid categories that are remediated by proper education

Software Engineer - Experienced Level

Transcript for