Yo, whaddup?

It's quiet... almost too quiet...

@ConorMancone It's almost as if there was something menacing looming around

Either this or people are so fucking tired of my constant low-quality shitposting

Nah, it's probably the menacing thing

@MechMK1 If this were a horror movie, this would be the part where two people have split off from the group to get frisky. They will be the first to die.

The youngest has been waking up early a lot lately (5:45). I get up with him because my wife is the one who has to feed him in the middle of the night. But it's a pain to get woken up by a baby and have to just be in charge of him without having any time to get ready.

So I decided to just wake up even earlier (5:00). It's 6:20 now and he's not awake yet... figures...

I could be asleep... sigh

@ConorMancone I have trouble sleeping too recently

Sleep trouble sucks

Yeah, my girlfriend has lots of nightmares recently so she wakes me up too with it

I don't mind, but I feel really sorry for her

Having nightmares sucks

@MechMK1 My wife has dealt with a lot of insomnia lately and this has often woken me up. It's hard in general, but definitely worse for her.

So who wants to play a game with me? It's called, "Name that static code analysis tool!"

@ConorMancone Seems like we are in somewhat in a similar position

@ConorMancone Let's do it, hit me up

I was on a security-related job interview and the person asked about (what I heard as) SaaS and DaaS

The person definitely didn't say either of those things, but he referred to them by acronym and that was all I "heard"

SaaS is Software-as-a-Service and DaaS can mean anything you want

After some clarification I realized they were talking about a static analysis tool used to try to automatically find vulnerabilities in software

I was still able to answer the question without issue because it was a question about general best-practices, not specifics about the tool in question

But now I still want to know what the actual tool was

So: are there any static analysis tool who's name might sound similar to SAAS and DAAS?

I don't know, I just googled it

All I can find is SAST

Which just means Static Application Security Testing

That sounds promising...

But it's not one specific tool

(sorry, I could have googled that too)

Just the technique

So you applied for another position?

This is the one from the very end of last week - this has been in the back of my head since then, I just haven't had a chance to actively look into it

How did the interview go otherwise?

@MechMK1 That's still likely it - he was asking general questions about static code analysis, so he may not have been mentioning a specific tool - that could have been a misunderstanding on my part.

@ConorMancone owasp.org/www-community/Source_Code_Analysis_Tools

Do you want my opinion on static code analysis as a pentester?

I think it went well. Presumably I'll find out in the next day or two. It was early in the process though. I got through the screening phone call with the company recruiter, and then this was a phone call with the hiring mannager (A higher-level guy in the security department).

@MechMK1 Absolutely! (except I have to go make breakfast so I won't respond for a bit)

@ConorMancone Man I hope all the best

So as a pentester, I sometimes (rarely) get source code for some applications, and it's routine for me to throw them into some kind of Source Code Analysis Tool.

These tools generate lots of output, and the vast majority of the output is complete garbage

For example: "CRITICAL - Improper Cryptography - Use of Base64"

Yes, the tool actually considers "base64" as "cryptography". It rightfully assesses it should not be used as substitution for encryption, but it apparently never occured to the developers of the tool that sometimes binary data needs to be represented as text, hence base64.

A lot of other warnings are "what if's", like "you didn't check if this parameter is null", even though the only function that calls it always checks if the parameter is null before calling that function.

Sure you could say "But what if you extend your code?", and that's a valid point, but completely irrelevant for me in a pentest

So as a pentester, the output of those tools are very often completely irrelevant

But as a developer, they might be useful if and only if you properly maintain a list of exceptions and explanations as to why these are exceptions

Because otherwise a company will throw 150.000 USD at a SCAT, project managers will get 15.000.000 warnings, decide that's too many, fiddle with the parameters until it's more like 15 warnings, and then the developers will explain why all of those are false positives.

I found this when I am using curl

Can this be counted as a bug?

I spent quite some time finding out what the problem is. Such a pain in the ass

No, you have to send one (or maybe two?) empty lines in an HTTP request, it's in the standard

As for the cookie jar format, it's a weird text format from the Netscape era. I would not be surprized if it's full of bugs

@MechMK1 no no it's not the problem related to the request format

it's the cookie file format

Yeah, as I said it's from the netscape era

Nobody will change the file format or the parser

the curl documentation doesn't say anything about that requirement

"an extra blank line"

Let me see

god it wastes me hours

@MechMK1 I'm expecting that managing false positives is the trickiest part of running these, and a good reason why they might not always be worth the effort. Still, I've seen some large companies explain that they have had success with static code analysis tools and (closely related) fuzzers, so it has always been on my list of things to try

@ConorMancone Don't get me wrong, they are useful.

The one or two companies that I have talked to that are hiring for positions similar to this one have also been looking at implementing static code analysis tools to automatically scan their code bases

But they are not magic bullets. You can't throw some code analysis tool on your source code and expect that in two weeks every bug is magically fixed

So it would be helpful if setting that up is something that I had previously done, but unfortunately I just haven't had the chance yet

Some IDE's have some kind of static analysis tool built in

@MechMK1 Oh yeah, definitely not. I'm actually fairly familiar with these "kinds" of processes from my PhD research. Trying to find the right balance between "output is actually useful" and "it doesn't ignore too many things" is more an art than a science

Absolutely

@MechMK1 Don't tell anyone, but I don't use an IDE - I use a text editor. ****shhh**** I find that IDE's cause me more problems than they solve (plus I've been using the same text editor for like 15 years, and now it's too ingrained in my brain to change).

@ConorMancone Perhaps using an IDE is worth it then

What languages are you writing in?

It's too late for me - save yourself!

PHP, Python, Typescript

Eh, maybe you're fine

It's mostly reflected languages that greatly benefit from IDE support

reflected languages?

C#, Java, etc...

Do you know reflection in such contexts?

I'm familiar with reflection in general (I've used it a ton), but I've never heard the term "reflected languages"

Well, reflected languages is just a fancy term for languages that support reflection

Reflection as in, ability to use the language itself to investigate the code in question

Yes

I would have figured that included most languages these days - PHP has had strong reflection support for a while, python has included it natively from the very beginning, etc...

For instance, you can use a pointer in C to refer to a struct, but you cannot determine the structure of the data from this pointer

Obviously not C or C++ though...

(you beat me to it)

You have to know the structure before you can use the data

I have basically zero-experience with the stongly-typed, compiled languages

Lol I made my first open issue and it made a difference

github.com/curl/curl/issues/4946

Fortran is still popular in the astronomy community, but I never wrote any myself (although I often had to translate it to other languages)

Whereas in C#, you can, knowing the memory alone, infer the structure of data

I am happy

@Rick Well, that solves it

@ConorMancone I love strongly-typed languages

The stricter the type system, the better

@MechMK1 Indeed, ever since I started using typescript I've loved it. Every once in a while I run into an issue with not properly expressing types that wastes some of my time, but its ability to identify bugs early on in the process saves me far more time than I lose. I'm pretty excited that they have added type support to python, and it seems to be finally reaching the point where it is actually useful

Although I'm not sure if Typescript really counts as a "strongly-typed" language considering that the type system is completely optional, but, meh :shrug:

@ConorMancone PHP is somewhat similar. It allows you to define types, but it also allows you to just not

C# is a bit of a mixed bag.

Usually developers define strict types for anything they use.

So for example, you'd write List<Car> cars = new List<Car>();

But there is also the dynamic keyword, which explicitly states that an object does not have a fixed type

E.g. dynamic thing = 5; thing.Whatever = "Yeah I don't care";

Oh yeah, indeed. When I work with PHP frameworks that use strict typing I do the same myself, and it is typically a requirement when working with dependency injection, but otherwise I've never gotten into the habit with PHP

I do most of my programming with C#, so i am used to defining types for everything

That's like Typescript's any type

Python has an equivalent too

(actually, I think it is also called any in Python)

Ehhhh I don't like such types, I really don't want to use them

Though I love the fact that python can return multiple things

really cool

brb gotta restart my machine

glhfdd

Windows just shit itself.

@MechMK1 "Windows just shit itself." I've highlighted your first mistake.

AAAAAAAAAAAAAAAAAAAAAAAAAAAAᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀᴀ.....

Why does my keyboard not work anymore!?

Why does Chrome randomly lose focus?!

I keep telling you that someone installed malicious firmware on all of your peripherals...

Why is anything happening? Am I tripping on mushrooms right now?

Fuck man, if I am tripping on shrooms I definitely don't want to hallucinate random windows crashes

I donno. did you eat shrooms or walking around them?

Not that I am aware of, but I could also be hallucinating that I don't remember

(Fun fact. I once dozed off at work, doing helpdesk, dreamed new cases came in, and woke up. There were none.)

I also one day dreamt that someone of my family asked me for tech support.

@MechMK1 you were 100% right. I heard "SaaS" and "DaaS" but it was definitly SAST and DAST: synopsys.com/blogs/software-security/sast-vs-dast-difference

@ConorMancone You'd be surprized how rarely that happens

But ohhh this article is sooo wroooong

Please enlighten me!

SAST and DAST are not the same as "Blackbox vs white box"

I could see a breakdown along the lines of "One checks the code for vulnerabilities" and "One checks the application for vulnerabilities". You could simplify that as "whitebox" vs "blackbox" testing, but that wouldn't be entirely accurate, nor would I ignore any information I already had when performing application testing.

Either way, these are the two general kinds of things that I have had in mind to implement in code bases, so knowing what they are actually called is super helpful for the future

From a pentester's perspective, having the code helps you get results quicker

I also wouldn't perform DAST testing at the end of the development lifecycle. There is no reason it couldn't happen with every code commit, just like a static analysis tool. That's what CI/CD pipelines are for after all

Ehh...well, yes and no

In a perfect world, every piece of code would be tested extensively on every commit

Heck, if I could I would make a shortcut so that every time a developer compiled their program, it'd automatically call me and tell me to test the application

Pipeline minutes are not usually very expensive. Although I wouldn't actually do it on every commit, but on every new/updated pull request.

But we don't live in a perfect world and we always have to ask ourselves if it makes sense to test

@MechMK1 Sounds like a use case for mechanical turk...

And dynamic testing makes more sense if your product already looks like what it's supposed to look like

I once did a test where literally the whole functionality of the program was not implemented yet

I had two static pages and one of them didn't work

What on earth am I supposed to test?

That sounds like a big waste of someone else's money...

It was

But the reason I say it that doing this kind of test too early in a product's lifecycle is exactly that - just a huge waste of money

Just like making a threat model for an application that has been in production use for more than a decade and is about to retire

I mean the oldest application I ever tested was older than me!

That's right. Someone could have written this atrocity, impregnated a woman, have her give birth, have that child grow up, learn how computers work, learn how security works and then have that kid - now a young adult - test the application.

@MechMK1 Ah, yes, indeed. I was just thinking from my perspective: a mature product that is finished, actively used, and actively updated. That needs more constant testing to make sure new changes don't introduce new vulnerabilities.

Yeah, if your product is already mature and in the "maintainance" phase, then it does make sense

@MechMK1 That's quite the image you're painting there :)

@ConorMancone It's absolutely true though.

It freaks me out when I work with stuff that's older than me

I can see a flaw in this image, though. The kid might prefer painting to computers.

The weirdest one I've ever dealt with was an entire ERP built in Delphi. I had never even heard of the language before, but we had built an integration with their system for our eCommerce platform, and we needed to sync up pricing on the web with pricing in their business software. We were already getting a "live" copy of data from their ERP

@A.Hersean The kid is not asked. Their path is pre-determined.

And then the company sent me a print out with 10 pages of terribly written Delphi code that they copied-and-pasted out of the pricing module for their ERP

I hope you'll never be a father.

I had to reproduce it in our eCommerce system

Man I am so disappointed that Delphi was not developed by Oracle

You'd be a dark father darth vader.

No, though I am sure my kids would be ashamed of me.

How do you strike words in this chat?

like this

three dashes on either side

---strikethrough---

@MechMK1 Nah, your response was much better without the explanation

Thanks

@ConorMancone Yeah, but I aim to be just as helpful as I am a nuisance.

Only by occasionally being helpful my continued existence is justified

> Yeah this is my dad. He likes hacking, guns, video games and tiny plastic soldiers. I don't know why he can't be like the other dads and like beer and falling asleep watching sports.

@MechMK1 I wouldn't worry about that. A strong part of a kids sense of "normal" comes from their parents. So your kid would actually be like:

> I don't know why other dads like beer and sports when clearly guns, hacking, and video games are better

Just greentext :D

Possibly, but they could also see that all the other kids have sports dads and only they have a gun dad. It's up to them now to decide if a gun dad is better than a sports dad.

Though I would assume that peer pressure would get the better of them

Kids are very impressionable by their peers.

School does make that trickier. We homeschool so we have far more influence. Although as long as you spend time with your kids on a regular basis I wouldn't worry. If they spend 8 hours a day at school though and then most days you don't talk, then you might have a problem

Yes, absolutely. This was also one of the big points on a talk on bullying

The prime targets for bullies are the kids that are alone, not the kids that stand out in some way.

It's the kids with no friends, who feel like they are a burden to their parents and can't talk to them

That's why it's my goal to spend a lot of time with my kids, at least as much as they want

Would you like to go shoot guns with me? Do you want to play a board game? Do you want to go ride your bike? Do you want me to teach you how to kickflip a skateboard? Do you want me to kick your ass at Counter Strike to play video games with me? Etc...

I always found strange the amount of bullying one can see in US fiction. I went in a fairly crappy school from 11 to 15, but the amount of bullying was fairly low compared to the TV show, and it usually never ended well for bullies (being expelled from school would be common). The bullied were usually supported by many in those situations, even when they had few friends.

I got bullied in school, but it was tolerable. I had no comparison, and to me it was just normal.

The amount of times I got beat up was roughly equivalent to the number of times I had beaten someone up for beating me up.

I went to private (Catholic) school. I experienced little to no bullying in school. I have no idea whether or not it was common at my school. There was only once or twice I heard about a fight on school grounds. I definitely have no idea how common bullying is in public schools

I can tell you here in Austria, it matters a whole lot where you go to school

On the country side, bullying is very rare. In the city, it's everywhere

I was in a crappy school in an average sized city. Some places in France are renowned for being very difficult (like the suburbs of Paris), but I almost never heard of kids bullying other kids there, but far more of kids disturbing the classrooms and threatening the teachers (and getting away with it).

@A.Hersean Yes, same here

There was a case in vienna where some students attacked and spat on a teacher

And according to the reports, that was the norm there

The public school system to me feels like I am running away from a bridge that is collapsing under me

And I feel like I'm one of the few people who made it out alive relatively unharmed

Yeah. And since no teacher in their right mind wants to teach there (despite the small paid incentive), only inexperienced teachers without choices teach there. So the kids have the worst teachers, where the best are needed. And half the teachers stop teaching after two years.

@A.Hersean Yes, I remember that when I was a kid, one of the teachers I had in primary school was an alcoholic

She went to class drunk and came out even more drunk

@MechMK1 Wow. Just wow.

The next teach we had came straight from university. And with me having graduated university, I can tell you she had no experience at all

Yeah, the public school system is fucked to no end

And you know what scares me even more?

I have no single clue how to fix it

@ConorMancone That's a mild case, I agree with MechMK1.

The government here was even accused of suppressing a report they wanted made on the state of the school system. After the author was repeatedly told that such negative things can't be said about the school system, she published the report herself as a book

The government, now faced with accusations of suppressing reports, claimed they in fact never did suppress the report, it just merely "didn't meet the required quality standards"

This is why we homeschool

@MechMK1 Well... the French politicians have a clue: they destroy it even more, to prepare for privatizing the schools. So even more money for the top 1% at short term, and at long term an even greater separation of social classes: those with money and their kids pay for education and to keep their status, the others can continue to crawl under underpaid overwork.

@A.Hersean I guess this is the outlook for all of europe

And the reason for why I have the political beliefs that I have.

@ConorMancone That can only work for rich enough parents with good education.

If I could shape our political landscape, I would employ politicians who understand that it is not the corporations or the rich that make a country, but the people.

You see, day after day, more and more people immigrate to our country. The vast majority of them only able to work unskilled labour. These people want to live somewhere, so the cities need to grow. New housing complexes need to be built, but not for the middle class, but for the lower class of unskilled workers who will populate them.

Entire areas are filled to the brim with immigrants, with most of them having very low income. These people do not have the ability or the need to integrate into our existing society, be it through work or through culture, and effectively generate a parallel-society on the outer rims of ours.

At the same time, prices of previously affordable homes rise and rise and rise, much more than just "Inflation", because those areas are now highly desired by those who do have good jobs. They want to live in a good area, and they make the money to pay for it.

So all the money that the skilled workers of the future earn goes directly into the pockets of the owners of real estate - people who already own considerable wealth.

@A.Hersean I don't suggest it as an option for everyone, but I also have to add that neither being rich nor being well educated are necessary (in fact I know plenty of homeschooling families that are neither)

The result, as mentioned above, is an ever-increasing divide between the rich and the poor. The middle class is being cut in half and bled dry. Few of them will be able to slip up into the "upper class", where they themselves form the lowest tier, while the rest of the former middle class becomes poorer and poorer

The sudden influx of immigrants and their children has flooded our school system. Many primary and even secondary schools have classes where none of the children speak german. None. What are teachers supposed to do? How are they supposed to teach?

Up until then I agreed with you, but I must strongly disagree their. Immigrants integrate fairly well (maybe not on the first generation, but the kids do). And they are not the source of housing inflation (the population does not grow that much because of them), capitalism is.

Real estate is in one of those unfortunate places where the free market can only help so much, because land is a very limited resource and no one can make more of it. I was recently reading about changes to housing laws in NY. The "backstory" I took from it is how housing is becoming more and more unaffordable, partly due to short-sighted regulations passed by the government

but fortunately the government is fixing the situation with more short-sighted regulations...

@A.Hersean Have you considered the possibility that both can be the case simulataneously?

On the increasing divide among classes I agree with you, but it's orthogonal with immigration.

I didn't say immigration is the core reason for class divide - it merely serves as an accelerator.

@MechMK1 Only one explanation is surely wrong, and many factors are surely in play. In their proportions though, I do not think immigration plays such a role here.

@A.Hersean In the schooling system, it does

Here more than anywhere else

Our education system is overloaded. It was overloaded even before the immigration wave of the past years

But the difference was, back when I was a kid, in every single class I ever went to, it was like 2 or 3 kids with immigration background

Nowadays we have classes with 40 kids of immigration background, and no knowledge of german

This is a real problem, not some kind of racist strawman argument in order to vote the nazis back into power

@MechMK1 Yes. It would be overloaded even without immigration. But immigration is not just an increase in cost (of education), it's also an increase in production (thus taxes that pays for education).

@A.Hersean dw.com/en/…

The issue is the lack of proportional increase in education spending.

Here are some news from 2018 that put a bit of light on the situation

@A.Hersean The problem here is that these children need a lot of extra effort in learning german that nobody can provide

There are not enough institutions offering courses. All of them are full. All of them.

I had to BEG the people in an institute near where I work to allow my girlfriend to study german there, because it was full to the brim

@MechMK1 Of those jobs offered, how many are there because there's an increase in demand because of immigration?

@A.Hersean I simply don't know

@MechMK1 Thus a lack of teaching resources. It's an investment.

That nobody is making.

@A.Hersean It's a resource management problem. The demand for teaching has risen sharply, but we can't simply pull those teachers out of thin air.

And all the people who see this now and say they need to get into education because of it, will then end up in a grossly oversaturated market

But look at the immediate consequences of the decision to just handwave the problem away for so long

We have students who graduated secondary school, who know next to nothing.

Why? Because they couldn't learn german in time?

So you have kids aged 16-17 that legally finished school. What do they do now?

I do not know how it's in Austria. But in France we do not usually give special French lessons to kids, and they managed to learn French fairly quickly.

@A.Hersean Yes, we try to do that too. But as I said, the demand is so high that the supply can't keep up

@MechMK1 Same for kids not from immigration.

And further, we don't force any kid to actually take these classes, or require them to show success or even progress

@A.Hersean That's my entire point. We had our own problem to deal with and now we made it so much worse

Now here you have the problem, you end up with a teenager who can't go get higher education because they learned nothing in the previous school years, and has to either join the work force as a minimum wage worker or try to start a "local business"

And I see so many of these local businesses pop up here, and within a year or two they collapse again, because supply is high and demand is low.

And our education system cranks these teenagers out every single year by the masses

It's not sustainable

We're sitting on a powder keg playing with fire right now.

@MechMK1 For knowing lots of teachers, their main issue is the lack of resources, reduced number of lessons hours, not immigrants. But even when I was a kid, when going to general public school it was illusory to find work. It's university or technical school (that might not be minimum wage). Minimum wage is usually for those who drop out of university.

Here in Austria, you are legally required to attend 9 years of school.

You are not required that you actually complete any of these years successfully.

So if a student fails 8th grade twice, they can legally say "fuck it" and just be done.

General school -> university. Or technical School (-> and usually secondary diploma).

Even if not, many students who don't speak german at all are registered as "extraordinary students", meaning they follow different rules and just attend school to spend the time there

Usually we send failing students to technical school, where they can start working part-time at 14 years old.

Her in austria you start with primary school, then lower middle school, upper middle school and finally university

Then at 16 they can stop school, but they usually keep it until at least 18.

@A.Hersean Yes, and this may work at times for some immigrant students who put in effort. But I can tell you that there are too many who just don't care

A friend of the family is living in a city that has an extraordinarily high amount of imigrants. Their daughter goes to school there, and is the only kid who speaks german in her class. And the school system there has completely collapsed

The teacher has completely given up, and just lets the students do what they want to do

I know far more of born French people that just didn't care with their lives (and school), than immigrants.

@A.Hersean This "but some native people are like this too" argument doesn't fix any of the problems at hand.

It fixes nothing, it serves no purpose in finding a solution that helps at least some people.

I do not know of schools where immigrants kids do not speak french at a good level. Most speak an Arab dialect, but French, too. I guess Austria's immigration problems are stronger.

@A.Hersean Probably because we're on the route to germany, and most migrants want to go there

Anyway, I really must go back to work.

Alright, have a good day!

I'll be off too, see you around

@MechMK1 You too.

I wonder if "Not even wrong" would be considered offensive these days... probably...

(someone had an answer where they said that Tor is no longer secure and that "FBI did an operation on Tor, and now Tor has agreed to share data with the FBI". Possibly one of the most misinformed statements I've heard here...

@ConorMancone Might be, but most importantly, it might be misinterpreted by someone not fluent in English. (depending of the full answer)

Good point!

@ConorMancone I second A. Hersean's point, but I might add that it may be misinterpreted by a few of us fluent English speakers, too

TIL "Not even wrong" is a phrase

TIL that TIL is a thing

Complete change of topic, and now I'm tooting my own horn. I built a database migration system that I've been using for a couple years at work. It's soooo much easier to use than the typical database migration systems that ship with most frameworks. I recently made a couple minor changes, and runs so smoothly now that I'm not sure if I could live without it...

github.com/cmancone/mygrations

But there are 9 open issues...

Looks nice. That probably would have been very helpful at a few of my previous jobs.

:) I expect the number of issues to be down to zero right after the collapse of civilization.

I really hope that the devs who took over for me remembered to update MySQL and PHP

Unlikely, but fortunately it isn't your problem anymore :)

My stance has been: if I suddenly remember a piece of code I wrote and think of an attack, I'll tell them. If there are vulnerabilities in one of the libraries/frameworks we used, it's up to them to keep those up to date.

MySQL and Python are the good old days. Nowadays, I only get to see stuff like SQLServer and MaxDB. And every time I think of writing a tool, I suddenly have to worry about keeping Python up to date long term on the server, and usually end up hacking things together in PowerShell.

And I so miss, not necessarily JavaScript, but being able to pop open DevTools and quickly trace a problem.

PowerShell seems crazy to me - Python is at least compatible with just about all OSes. Although I suppose if windows is all you do... I'm generally dubious that SQLServer would be worth the licensing costs, although then again I generally avoid microsoft products...

There are use cases for SQLServer. I didn't choose it. It's what the applications I manage use. SQLServer has a lot of enterprise features.

That said, I don't know that this application really uses those enterprise features.

PowerShell is only crazy until you get used to it. I'm not used to it yet.

If you end up working in an enterprise Windows environment, PowerShell is definitely something to learn, if only because 90% of the Windows server Q&As that you'll find online tell you how to fix things in PowerShell.

It's good to know what a command does before you run it, or so they tell me.