The DMZ

Rory Alsop

09:07

@ThoriumBR When JJ was born I was already teaching my son very basic programming. LISP may have been the first language there. And now he is at college studying cyber security, so I'm very proud

A. Hersean

I guess that's about the time I started programming as well, in QBasic, because that's the only thing I had.

I was 15 at the time.

Rory Alsop

I think my main problem with learning C at an early age is that I find modern languages require a very different mindset, and I'm finding it difficult

So I'm grand with cobol, comal, pascal, forth, c++

but rust, go etc are just a blur to me

A. Hersean

@RoryAlsop Even Rust? Go I can understand, with GC, traits, channels and goroutines. But Rust is closer to C (even though everybody struggles with its memory management at first).

Rory Alsop

@A.Hersean mem handling is always a challenge. Esp when my brain says "C++ is logical, why on earth would you choose a different way" :-)

A. Hersean

I find memory management in C a pain, and C++ a giant mess generally speaking.

That's two languages I avoid when I can (with PHP, but for different reasons).

Every time I see C/C++ in a code audit, I really want to insert a warning in my report saying "pending vulnerabities: C/C++".

MechMK1

12:32

I never got into C++, and to be honest, I don't see the need

I think C# is waaaay more comfortable

And I don't do any tasks with it that depend on speed or the ability to work with low-level memory management

A. Hersean

C# has only its 1st letter in common with C++. Other than being OOP languages, one can't really compare them. C# is far closer to Java than C++.

MechMK1

12:47

Indeed, it is. I mean, C++ was one of the influences on C#, though I don't know how much

Rory Alsop

13:00

Yeah, I don't understand C# at all

I learned enough java and js to troubleshoot interfaces between cobol and s... didn't enjoy that

MechMK1

13:15

I like how in C#, I don't have to care about memory management at all. Like, you create stuff as you need it, and it gets disposed at some later point, but I don't care how or when or why

And in all honesty, I love how easy it is to decompile IL code. Like, it's actually readable.

A. Hersean

@MechMK1 That's how you get memory leaks. That can happen in C# and Java too. It is far less common and easy to do than in C/C++, but it can still happen. Having GC means that a lot of developer stop thinking about memory management a all. But proper memory management is still needed to avoid leaks or HUGE memory footprints (one of the most common complaints against Java).

MechMK1

Let me tell you a story. A friend of mine and I wrote a library that helps parsing a proprietary fileformat for an ancient train simulator game, so you can create your own sprites

After god knows how many hours of REing, we got a working prototype, and behold, our memory footprint was huge.

Why? Because we created a new object for EVERY PIXEL

Not anymore after a quick fix

But to get to your point. Yes, not thinking about something means you don't do it optimally, but it also means you can focus more on the actual problem you are trying to solve. I would wager that the vast majority of applications don't need to be extremely efficient, be it in terms of memory consumption or execution time.

A. Hersean

I agree, especially with tiny project.

Conor Mancone

As they say, premature optimization is the root of all evil!

A. Hersean

13:30

This issue occurs in bigger ones.

MechMK1

Indeed. Even in commercial projects, as long as the sacrifices made are not too big, who cares?

I mean, yeah, sooner or later you have to worry about performance

But it's not like C# means you must have bad performance

ThoriumBR

performance issues? just buy more hardware...

A. Hersean

And indeed, GC allows to focus on more important things. The mistake is to ignore memory management completely, instead of relegating it to a background/low-priority task.

MechMK1

I mean, in an ideal world, you'd create a prototype, and then create a proper application around it

ThoriumBR

@MechMK1 that's insane man! one object per pixel? that's wrong... it should be an object for red, other for green, and other for blue...

A. Hersean

13:34

@MechMK1 OH NOOO!!!!

MechMK1

In reality, that's not what happens :D

In reality, you get a prototype, and then you beat the prototype with a hammer until it starts to kinda resemble an application somewhat

What are you doing? Why are you looking at the sou--NO!!! NO STOP!!!!

ThoriumBR

now serious... I am working on a project where the client is creating one database for each client he have... not only the database, but a separate VPS with one container for each one of frontend, backend and database.

A. Hersean

Prototypes that grows into full applications almost always degenerating into a huge mess of spaghetti code without proper structure.

ThoriumBR

so for each client he signs there will be 3 vps

A. Hersean

@ThoriumBR That's a lot of isolation!

That must be very secure.

ThoriumBR

13:38

imagine managing that... and the prospect is to have 1k+ clients in short order

MechMK1

@A.Hersean I mean, how else would you do it?

You could write it "proper" from scratch, but how would a small company do that?

They don't know their scale yet, or their requirements

A. Hersean

Maybe they'll change their mind when they'll see the AWS's bill.

@MechMK1 You start with a prototype. That's what they are for. This allows you to identify core issues and needs. Then you start from scratch with this input, with an architecture well suited to refactoring, because it will be refactored a lot.

MechMK1

Yeah, if only that would ever happen

A. Hersean

Prototype = quick and dirty code

MechMK1

Oh, I know

I only write prototypes

A. Hersean

13:42

@MechMK1 That happened where I worked, when they got tired to get burned by prototypes that became a huge pain to maintain.

MechMK1

That's why I said most just hammer their prototype into a shape that resembles a fixed application

If you look at the bugs an application has, you can tell how well it is maintained

A. Hersean

Yeah "resembles a fixed app". That what I see in half of my audits.

MechMK1

Like, if it's a normal application or an absolute shitshow

The Worst AK I have Ever Seen

►

This happens when such software developers build guns

A. Hersean

You can't sustain a business model on foundations like that (except maybe for SAP).

Not just guns: look at "smart" locks.

...with apparent screws...

They do the "smart" mostly OK, but forget the "lock" part.

MechMK1

Or smart locks you can just defeat with a hammer because they're made of aluminium

The problem with all non-security people going into security is thinking they get to decide the attack vector.

Also that AK is a fucking machinegun, because it has the autosear pin

I really need to finish my lutty at some point

Conor Mancone

13:53

@ThoriumBR When we were managing small sites we'd keep the web app and DB on the same server. Each site would get its own database in the DB server. Most sites were low usage so we'd cram 20 in one server, but some larger sites would get a dedicated VPS. I think we had about a half dozen "machines" hosting ~100 sites

Less isolation, but many of our clients would balk at the bill for 3 VPS for their site

For our larger e-commerce sites though that wouldn't have been an issue

ThoriumBR

the database have only 2 tables: the users, and the reports sent by the users... they could even create one table for each client. And if they are using one VPS for each client, why bother with containers?

Conor Mancone

That makes... no sense at all, lol!

MechMK1

No, you don't understand - more is better

ThoriumBR

maybe is for the sysadmin put on the resume: I managed an infrastructure with three dozen thousand servers, with a dozen thousand databases...

Conor Mancone

Granted, you can have a table with billions of records, but having a dedicated VPS for a database that holds only 2 tables seems.... silly

MORE IS BETTER!!!!

ThoriumBR

13:57

it could be a sqlite database, could even be a text file... the users table will have login, password, things like that. the reports could even be a folder where you drop files

Conor Mancone

maybe they were going for isolation? Although there are plenty of ways to isolate "well enough" without having to move the DB to its own server

MechMK1

Could also be legal requirements? Or misunderstood legal requirements?

ThoriumBR

do you know what they don't have? a BLOCKCHAIN!

MechMK1

noobs

ThoriumBR

I will pitch that on the meeting later... hehe...

Conor Mancone

13:58

a blockchain powered by AI!

MechMK1

Machine Learnin!

BIG DATA

ThoriumBR

those two they have

MechMK1

No wait, they have big data

Conor Mancone

Yes, I will throw lots of money at that now!

ThoriumBR

ML and bigdata will process all that data on all the databases

MechMK1

13:59

We need to crowdfund that

Conor Mancone

and pipe it through the blockchain!

ThoriumBR

isolate everything on physical servers (on different datacenters), and put all data from everyone on a blockchain

Conor Mancone

I'm in a meeting and you guys are making me laugh

ThoriumBR

ethereum is the future, so lets store all data on on-chain smart contracts...

gas prices will skyrocket, but the data will be available forever!

MechMK1

Has anyone actually ever used cryptocurrency for anything useful?

And legal?

A. Hersean

14:06

Store it in the blockchain, but you have to encrypt the data first. With SHA-512 (XOR with plaintext in ECB mode, what could go wrong?)

ThoriumBR

yes, and yes...

MechMK1

I've never met anyone in person who has bought anything with bitcoin

ThoriumBR

when I bought my oneplus 3t, they woudn't ship to brazil, so I went to a courier (viabox.com, good guys) and they let me send them bitcoin and they would buy the phone, wait it to arrive at their warehouse, and ship it to me

was cheaper than paying with my credit card

A. Hersean

Wow

ThoriumBR

I paid around BRL1300 in bitcoin, it would cost around BRL 1600 on my card

MechMK1

14:08

I second that wow. is bitcoin common there?

A. Hersean

Why does Brazil appear so fucked up?

ThoriumBR

bitcoin is not much common here... there were some high profile crypto scams here, so people are not much trusting crypto

A. Hersean

I met a few Brazilians, and they did not picture their country in this light.

MechMK1

Funnily enough, the only time I hear about BTC is when someone got scammed or wasted all their money on crypto-trading

A. Hersean

(Well, they where doing PhDs, so they might not have been the best representatives)

MechMK1

14:11

I mean, I just can't imagine paying with BTC at the grocery store

ThoriumBR

I pay 6% more on my credit card when I buy anything in dollar, and the credit card rates are outrageous... the market rate is about 1USD = 5.3 BRL, but the credit card charges 1USD = 3.7 BRL, plus the 6%

@A.Hersean it depends on if their are on the government party, or the government opposition... people on the government side always picture a nice country

I am always against the government, no matter if left, right, or bellow...

MechMK1

I have given up on politics

It's all a shitshow

The world has gone mad and all I can do is watch it burn

A. Hersean

We did not talk much about politics, so I do not know on which side they were. Two were doing their PhD in computer science at the same time than me. The other one I met only a few years ago, she was doing a PhD in Economics.

ThoriumBR

I keep away from them as most as I can...

people on the called "education career" usually have a good view on the government

it's because the "university world" is not the real world... you most cope with the assignments, the teachers, and your time schedule... you don't have to deal with the taxes, rates, regulations, bribes, and things like that. so it's like a big high school... their problems aren't real problems...

A. Hersean

Anyway, I suggest you get a look at lydia-app.com/en It's a French company, that acts as an intermediary to a bank, so they do not technically qualify as a bank so you cannot hold that much money in you account. They offer plastic Visa cards for a one-time fee of 5€ (plus shipping), and they charge the base Visa rates without adding their margin over it. They also offer electronic Visa cards for free.

MechMK1

14:19

> university world is not the real world

You just sent a ton of us students into a fit of rage

A. Hersean

It might avoid you needless troubles when buying overseas.

MechMK1

My overseas buying strategy is find a seller and befriend them over the course of a year, then get shipping done as a favour

Time intensive, yes, but optimized for cost

ThoriumBR

@A.Hersean lydia looks promising, but guess what? I live in Brazil, so...

my overseas buying strategy is buying cheap stuff on aliexpress, banggood, and expensive stuff on amazon and shipping to my private virtual post office box on viabox

and complaining to the brazilian post office charging $700 fees (around usd 150) on an used kindle

@MechMK1 serious... the university world is not the real world... you deal with it for a couple years, but you carry very few mistakes for your lifetime. the real world is not that forgiving. forgot about a key assignment? you may have to do a class over again, miss some classes depending on it, but mostly you are ok... try forgetting about a credit card with due balance, or about an open account...

I did the later... I got into another company that forced me to open an account at one bank, but before I got the card, the company went belly up, and I never received any info if the account was open or not.

Conor Mancone

ouch

ThoriumBR

one year later, the bank come asking me about the account and a HUGE debt... I was making around $100/mo and the debt was over $800... and increasing almost $100 a month...

compound interest is a nice friend and a harsh, cruel, merciless sadistic enemy

I fought the bank, but how could a freshman on college defeat a bank? I ended up paying a lot to close the account, I don't remember how much, but was around a year's wages, more or less...

and guess what? months after paying the last penny and closing the account and breaking my card and leaving it on the table of the manager, saying "I hope I never set foot on your bank again", I got a job on a nice company that pays their employees on... that bank...

Conor Mancone

14:32

That's a criminal interest rate - $100/month on an $800 balance is like 150% a year...

lol, of course!

ThoriumBR

today is not like that... it's close to 350% a year

Conor Mancone

That should legitimately be illegal

ThoriumBR

let me check quickly...

government clamped down heavily on bank interest recently, so it went down from 15% to 7.5% monthly... so it's only 147% yearly interest

and the savings account pays around 0.5% monthly

MechMK1

Savings accounts pay 0.nothing here

ThoriumBR

but I worked there for 6 months and went to IBM, and as soon as I signed my resignation I went straight to the bank to close my account, and that time I didn't said "I hope I never set foot here again", because that would be challenge the universe...

MechMK1

14:41

You pay for the privilege of giving your money to the bank

A. Hersean

Wow... That's so fucked up...

ThoriumBR

in the US there are hundreds of banks, so competition works to a good extent

here we have 5: itau, bradesco, santander, and the public ones: banco do brasil and caixa...

MechMK1

Man, this is depressing

ThoriumBR

and they are 99% of the market... the super small banks are starting to appear, but they are so amateur that nobody will trust them with their paychecks

I have an account on one small bank (neon), but just for fun... I never keep more than like $50 usd there

MechMK1

I'm a customer at the bank I regularly pentest

The fact that I am still customer says a lot :D

ThoriumBR

14:47

one of their banking partners they used for financial services were raided by the feds for not keeping proper records, so money laundering was rampant. and me here, using them to buy bitcoin and transfer overseas...

the major private banks are good on security, the public ones not so much, and the tech are terrible... I had one account on banco do brasil, and went to close it because it was a "college package" account and I wasn't needing it... and they told me that to close my account I had to go in person to the branch were I opened it... 1000km and 4 states away...

there was no other way, I had to fly there to close the account... So I ended up transferring the account to a branch across the street from my job, and the same day the manager called me saying to get there to get my brand new card and sell me more services, I asked to close the account...

he didn't liked it much...

ThoriumBR

15:04

wow, my retirement fund had a profit of -12% in march... this year it's up 0.4%...

A. Hersean

I understand better your in interest in bitcoins now...

That sounds a safer placement.

ThoriumBR

I have a bot that buys and sells bitcoin... it's a past time for me, and it's making more profit than my retirement fund or my savings account

I have 5% of my money on it, so it's more a hobby than an investment

A. Hersean

*placement -> investment (poor translation from French to English)

ThoriumBR

I put around 5k on it to work and now it may be close to 10k, 8 months later...

if it keeps this pace, it will be more than the bank charges for negative interest

on the other hand, if the exchange goes dark, it will go to zero instantly...

A. Hersean

Can't you diversify on Monero & co.?

Or maybe the fees would make it impractical

ThoriumBR

15:14

it's not the fees, it's the liquidity

Conor Mancone

@MechMK1 :) nice

ThoriumBR

bitcoin is way more liquid, and the volatility is high too, so my bot can buy at one exchange and sell at the other almost instantly, and earn 0.03% on the transaction. I start buying btc with fiat, sell btc on the other side, and end up with fiat...

so no matter where the market goes, I end up with more fiat on every transaction

no matter if btc goes from 10k to 20k, or to 1k, I always get more fiat

Conor Mancone

So you're not "playing the market" in the sense of ups and downs, but simply taking advantage of different prices in different exchanges? Nice!

A. Hersean

Yes, that's a very nice method indeed!

ThoriumBR

yes... that's what I do... I am writing another bot to "play the market" (I call him kamikaze-bot) to play suicide tactics

it will go long with 5:1 leverage and a tight stop loss, and go short with 5:1 with a tight stop loss, and both with a little more generous take profit... on a high volatility market, one stop will always trigger, and the take profit too... so it will always lose one side but gain the other side

and it's suicidal because if the market does not jump enough to hit any take profit but hit both stops, he will lose on both ends

Conor Mancone

15:23

Here @MechMK1, this one is for you!

0

Q: How do DAST and penetration testing compare?

DAST is short for dynamic application security testing whereas SAST is static application security testing. SAST is white-box testing while DAST is black-box testing, meaning SAST can (does?) use more information. DAST tools are not language dependant, while SAST tools are. Penetration testing ...

Why do you still have a job anyway, now that DAST is a thing? :p

Martin Thoma

17:03

Can somebody explain me why security.stackexchange.com/q/238334/3286 is not about information security?

Conor Mancone

@MartinThoma I get that your frustrated with Schroder closing your question (and in fact it already has 2 reopen votes), but it's still a leap from there to "why isn't this site about information security"

@MartinThoma Your latest questions are better answered here (although it's still a lot to try to answer on this site in general). In an attempt to be helpful though: any penetration test involves hiring people to check a system for weaknesses. While it is natural to think of a penetration test as checking a website, it can cover far more than that and include physical penetration testing.

There are cases where a penetration test may largely depend on the application of automated tools, but such tests are obviously very "simple". There is obviously some value in automated tools, but the reality is that there are many, many, many kinds of weaknesses that currently can only be found by actual people (aka penetration testers)

In contrast DAST specifically refers to a general set of automated tools that attempts to find weaknesses. As an example if you setup the OWasp ZAP scanner (zaproxy.org/docs/desktop/start/features/ascan) to automatically launch a copy of your website, scan it, and report the results to you, you would have basically created a DAST tool. In fact I would bet that there are commercial DAST tools available that pretty much do exactly that

However, there are any number of DAST vendors these days that will happily sell you their tools, so it is definitely many tools and not just one. For a bit more context, the "preferred" use of DAST tools is to have them run automatically on your code base on a regular basis (every commit, once a week, whatever), so they can catch issues before (or shortly after) they reach production.

However, since such tools will never catch as much as a good penetration test, they definitely aren't a replacement for penetration tests.

reed

17:28

@ThoriumBR That's awesome, I guess I should start doing something like that too

ThoriumBR

it's a good time waster. get an account on an exchange with demo accounts, load fake btc on it, and play... when you are confident enough on you code, mortgage your house, sell your car, max out your credit card (and the new ones you just issued), buy all on bitcoin and load on the account... or put $200 on it...

reed

but by the time I understand the process and learn to write a decent bot, bitcoins won't exist anymore I guess. I'm slow and stupid. I recently finished learning how to use windows 95, and guess what? Windows 95 is not supported anymore! What a scam

Conor Mancone

It works until it becomes popular enough for the exchanges to realize that people are doing it and eating into their profits. Then the rules will change to your detriment

In other words: don't pass around that idea too much :)

ThoriumBR

they won't change the rules... they earn the fee rate, so no matter which side the market goes, you pay the fee

reed

@ConorMancone don't pass around the idea? That's weird. The world is full of people that want to tell other people how to get rich! LOL

ThoriumBR

17:32

sometimes I earn less than them... sometimes the fee is 0.025% and my bot earns me 0.01%

and making the bot is terrible easy, indeed... there are currently lots of bots ready to run on github: put in your keys, npm start, and done...

reed

I would have thought there was at least some captcha

ThoriumBR

you just need to change the parameters to make it more greedy (or less greedy)

nope, no captcha... there are APIs fully documented, even with online samples and online forms to you to test by hand

I currently use bitmex, but there are apis for bitfinex, binance, poloniex, kraken, coinbase...

Conor Mancone

@reed Yes, and those people are all clearly liars. The ones who actually figure out how to make lots of money easily don't share :)

ThoriumBR

do you guys know about a super useful service notica.us?

you get there, allow browser notifications, copy a curl alias to your .bashrc, and can send notifications from bash straight to your browser

reed

that ain't working, bitcoins for nothing, and chicks for free

ThoriumBR

17:42

so you are running a long apt-get dist-upgrade, and want to be told when it's over... apt-get dist-upgrade ; notica apt-get done and wait... you will receive a desktop notification when it's done

reed

@ThoriumBR is that really useful? From bash you can send notification to your desktop or taskbar or anything on your system I guess. Why would you want to notify the browser?

ah, you mean from bash on a remote server then I guess

ThoriumBR

because the browser is always running, and it can send me a notification from my remote server

reed

For some reasons I don't think I like that process. The browser might not always be running anyway. I would prefer some other kind of notification (even plain old emails)

ThoriumBR

it alert me when a cron failed, for example...

or my bot executed an operation, or a site I have to monitor goes offline, or anything changes...

and as I keep the tab always open, it saves all the notifications received

reed

I asked a question on Law.SE, do you think it is illegal to leave your website or server compromised and refuse to fix it? Supposing there isn't a data leak because the server doesn't store any valuable data at all, the infection can still be a problem because in theory it's possible that the server will be used to launch other attacks or host illegal stuff

The owner might think: "I don't care, everything seems to work ok, the website loads ok, so I won't fix it, because I don't have the money, etc.". But I wonder if it's legal to consciously leave your server infected

Conor Mancone

18:15

Is anyone a CSP expert? Here is my shameless plug:

0

Q: Understanding CSP: report shows blocked <script> that shouldn't have been blocked

I'm having trouble making sense of some reported CSP violations that don't seem to actually be violations according to the CSP standard. I have not managed to reproduce the violations in my own browser, and based on my own testing I believe that the block is the result of a non-compliant browser...

content-security-policy

It's complicated so if you can answer it to me I'll happily give you the highest bounty possible (as soon as I an start a bounty, anyway)

Martin Thoma