The DMZ

Jeff Ferland

16:03

yawn

Rory Alsop

@JeffFerland morning

Scott Pack

@JeffFerland G'morning Captain

Polynomial

@RoryAlsop any idea what finux is talking about?

I heard him mention this stuff before, but I dunno what the deal is

Rory Alsop

@Polynomial link?

Polynomial

@RoryAlsop see twitter. it was a reply to your securi-tay tweet.

Jeff Ferland

16:07

'Morning all

Rory Alsop

I'm so asynchronous

Polynomial

@JeffFerland Jubilous diurnal isomorphism!

Rory Alsop

@Polynomial ahh - yes. I am not aware of all the bickering, but it sounds pretty unpleasant and personal

Polynomial

yeah, whoever it is seems to have seriously rustled his jimmies

he fell out with one of the Abertay students I hung out with at 44Con, apparently over the same thing.

apparently he didn't side with Finux so it all kicked off

lynks

f1nux' twitter profile crashes iceweasel, twice :(

AviD

16:18

@ScottPack huh? ah no, I said if.

I did try convincing my wife to have triplets a few years ago, but at this point I'll just wait it out.

Rory Alsop

@AviD I don't think triplets are a conscious effort for most humans...

Scott Pack

@AviD I don't blame you. Although, is there really a difference (other than financial) between 3 and 6?

AviD

@RoryAlsop SHE COULD HAVE DONE IT IF SHE WANTED TO.

Polynomial

@RoryAlsop Who said he married a human?

AviD

If she really cared.

Scott Pack

16:19

@Polynomial I hope ~~she's~~ it''s at least kosher.

Polynomial

triple-dash

AviD

oo! 3 stars in a row!

2

Scott Pack

Fucking markdown.

3

Polynomial

boom!

Rory Alsop

someone mention stars?

3

lynks

16:20

i have trouble keeping track of 3 ion workspaces, 3 kids is way out of my pay-grade

Polynomial

hahaha

this is getting silly

Rory Alsop

@Polynomial so's your face/mom/star

Polynomial

@RoryAlsop that sounds like ITV's next reality show.

AviD

@ScottPack well, sure. Between a typical set of parents, there are a total of four hands. you each grab one kid, the other two can still gang up on you.

Polynomial

likely hosted by Vernon Kay

Scott Pack

16:21

@Polynomial So's your /[(face)|(mom)|(star)]/.

Rory Alsop

@AviD wait until one is old enough to be bribed to be on your side. Instant win!

AviD

not to mention the typical year spread.

Polynomial

@AviD if you end up with 6 kids, you have the benefit of being able to do the Morbo response to anyone who asks how the family is

Rory Alsop

mine are 12, 10 and 6

Polynomial

"Belligerent and numerous."

Rory Alsop

16:22

@Polynomial Numerant and belligerous!

Polynomial

►

WINDMILLS DO NOT WORK THAT WAY. GOODNIGHT!

AviD

@RoryAlsop my oldest is 14. bribes dont work well in the long run.

Scott Pack

@AviD Wow you're old.

2

AviD

its more like paying off your loan shark. you'll keep paying, just to make sure your knees stay whole.

@ScottPack heh. After that loved ones question, where I mentioned my daughter is taking college courses, I was sure I was gonna catch flak here for that.

Scott Pack

@AviD Oh, I missed it.

Polynomial

16:26

> Morbo will now introduce tonight's candidates: Puny human number 1, puny human number 2, and Morbo's good friend, Richard Nixon.

AviD

4

A: Teaching a loved one about secure coding practices

Much like other aspects of a real education (perhaps this should be more on Parenting.SE...), I think it comes back to critical thinking. My daughter is also taking some college CS courses, and I'm helping her work through them. In many cases, I explain something very wrong to her, and expec...

I didnt bother pointing out that her college courses are through her high school. So I'm not that old. Yet.

Rory Alsop

@AviD well, I always say I hope you will be at some point :-)

Scott Pack

@AviD I was 14 when I started taking college courses. It wasn't through the high school, though. I just enrolled at the local college.

AviD

@ScottPack thats pretty cool.

Polynomial

I love that the opening text on one of the new episodes of Futurama uses the "Not sure if..." meme.

Scott Pack

16:29

@AviD Just 1 or 2 classes each summer until my senior year, at which point I was able to sign up for empty sessions.

Polynomial

something like "Not sure if new episode, or re-run that I originally watched when really drunk"

lynks

@Polynomial love it. when mainstream culture reference internet culture, it always goes one of two ways.

Polynomial

when it came on I just burst out laughing

AviD

I would have found it amusing, but I wouldnt have picked up on that its a meme.

Polynomial

@AviD I refer you to Scott Pack's comment.

AviD

16:34

5 mins ago, by Scott Pack

@AviD Just 1 or 2 classes each summer until my senior year, at which point I was able to sign up for empty sessions.

Polynomial

is this really a security question? security.stackexchange.com/questions/25548/…

AviD

huh??

Polynomial

10 mins ago, by Scott Pack

@AviD Wow you're old.

;)

AviD

@Polynomial ohhhh. Right. That one.

I thought @RoryAlsop was the Ancient One here?

@Polynomial no, I agree. I'm waiting to see some close votes on that, before I singlehandedly hammer it into oblivion.

Scott Pack

@Polynomial It looks to me like not necessarily. I think he's investigating it as a result of seeing the vulnerability, but I don't think the question is.

Polynomial

16:36

@ScottPack that's the thing though, the topic is security-related but he's not actually asking a security question.

it's essentially "does java use this lib?"

which is firmly off topic

Rory Alsop

@AviD nah, that's Cthulhu

AviD

@RoryAlsop yeah, looks about right

Polynomial

@RoryAlsop Looks like the missus in the morning.

Rory Alsop

@Polynomial missus = ceiling Cthulhu?

Polynomial

@RoryAlsop less ceiling and more 98% of the bed

she has a tendency to sleep diagonally.

Scott Pack

16:38

Polynomial

hehe

AviD

@Polynomial hammered.

Polynomial

@AviD gg

AviD

strangely, there was a flag on it suggesting to move it to Unix. wha??

Scott Pack

@AviD UNHELPFUL FOR BEING A DOUCHE

AviD

16:41

dont you know that Java only runs on Unix??

Polynomial

lolwat

yep, that's totally where they got the name Java from. bascially they took Unix, then looked for any letters that weren't the same.

2

lynks

everyone knows multi-architecture releases are the devil. always include some native code in java releases.

AviD

@lynks reminds me of that classic programmer joke, long since removed from SO:

> Saying that Java is better because it works on all OSs, is like saying that anal sex is better because it works on all sexes.

lynks

@AviD cant argue with that

im making the leap, gvim to vim, wish my productivity luck.

AviD

@lynks meh. Let us know when you're ready to join the big boys table, and use a real IDE.

Polynomial

16:55

@AviD Visual Studio 2003? :P

(I jest, VS2010 is awesome, and VS2012 looks awesomer)

AviD

@Polynomial 2003??

Polynomial

otherwise known as Microsoft Visual Basic Working Model Edition

AviD

@Polynomial is, is.

hehe

lynks

@AviD I can't deal with them, I have given eclipse a bash, and really tried to like it. but im all about the lightweight

Polynomial

my old boss used to code PHP in vi, it was... interesting

he was bought up on old UNIX boxes though

AviD

16:59

@Polynomial thats like the worst of both worlds.

lynks

i also use i3, so pretty much never have to touch the mouse. I have never found anything that yields productivity even half that of (g)vi(m)

Polynomial

@AviD pretty much, yeah.

lynks

@AviD for me it's a natural progression of one-way changes. windows becomes unusable once you've experienced a unix based OS, anything other than tiled window managers are insane once you've made the switch. and a vi based editor is just luxury. ditch the mouse, join the dark side >)

Terry Chia

@lynks vim ftw

AviD

@lynks wow, it's like you've reversed the flow of time.

you're an evil time travelling warlord!

Terry Chia

17:05

vim is the best way to show of your 1337-ness to non-techie friends.

lynks

@AviD haha yeah im fully aware that I use older tech, but you must agree on at least the tiled window manager? speaking as someone who used fluxbox for years, one day a friend showed me i3 and i have never looked back.

lynks

17:35

http://security.stackexchange.com/questions/25551/help-understanding-client-certificate-verification/25554
does what I have said here make any sense? or can you actually use certificates in this way somehow?

Terry Chia

@lynks It sounds correct, but doesn't really answer the question imo.

If he wants to verify client identities, he can be his own CA and generate certs for his clients.

lynks

@TerryChia Still doen't verify client identities, what identity are we talking about? In my answer I address this problem.

Terry Chia

@lynks In his scenario though, I don't feel that the identity point is particularly important.

He does not need to tie the cert to a specific real life identity.

lynks

@TerryChia maybe not, just the fact that such a cert exists is probably enough to start using it.

Terry Chia

He just needs to ensure that the server is communicating with someone who possesses the right certificate.

@lynks There is nothing in the cert to tie it to a specific real life identity no? It's usually the process the CA undertakes when issuing the cert that guarantees you are communicating with the right server in the case of HTTPS for example.

lynks

17:43

@TerryChia I'm now starting to think that my whole answer is wrong. The public key can serve as the identity, given that it would be on file server-side.

Terry Chia

@lynks Indeed.

lynks

deleted, ah well it's late in the day and im short on caffeine.

Terry Chia

In his scenario, all he needs is a certificate (or any public/private key system really) to prove he is communicating with the right client/

I think there are quite a few questions on this topic floating around.

1

Q: Self sign SSL certificate for my mobile app?

My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL certificates warn about how users of the a website won't trust you if you self-sign and they don't ...

This one for example.

lynks

@TerryChia this isn't quite the same, he is trying to have clients identify themselves by each having a certificate. SSL is usually the other way around, the server having a certificate.

Terry Chia

@lynks Yeah. But the point that he doesn't need a CA-generated cert stands.

lynks

17:47

@TerryChia true

Scott Pack

18:10

Do any of you Rories use Request Tracker?

Iszi

18:36

Wow. I saw this earlier and said to myself "Hey, that looks cool! I should dig up some old RAM sticks and do that myself sometime!". A couple hours later, the pun just now sinks in...

The image is titled "Christmas Memories".

Jeff Ferland

@Iszi I'm feeling a bit slow.

lynks

@JeffFerland the title...

Jeff Ferland

@lynks Well crap, don't put the title 6 inches away from the comment. (yes, I know you're not Iszi)

lynks

xD

Iszi

@JeffFerland Erm... that's only 4 inches on my monitor, according to the ruler next to my desk...

...and I'm sure there's a great joke somewhere in here about you having depth perception issues in relation to things that are supposedly "six inches", but I can't seem to formulate the punch line right now.

2

Rory McCune

18:50

@Polynomial @RoryAlsop that's the speaker list for Securi-Tay up securi-tay.co.uk/speakers.html with 3 Rory/Rories on the bill!

Jeff Ferland

@Iszi Always round up? :P

Iszi

@RoryMcCune Wow, and the majority of the speakers on that list have some form of presence and/or history on Sec.SE!

Rory McCune

@Iszi indeed should be a good opportunity for us to get some more recruits, we'll need to synchronize on Sec.SE t-shirts!

Iszi

@RoryMcCune Are the presentation slides/videos going to be publicly available after the conference? I'd be particularly interested in Mrs. Rory's topic.

Rory McCune

@Iszi they did vids last time, so I'd guess/hope they will be. we'll be able to get slides up regardless..

Iszi

18:56

Think you guys should put up a community ad?

9

Q: Community Promotion Ads - 2013

We never really gave you a proper thread this past year, so your previous thread was exceedingly stale for a while. As such, here comes a brand new, shiny thread for y'all! Community Promotion Ads, let's go~ What are Community Promotion Ads? Community Promotion Ads are community-vetted advertis...

discussion community-ads featured

Rory McCune

@Iszi good idea !

I'll need to go see if I can sort one out..

Iszi

Too bad there's zero chance of me getting travel authorization. A lot of those topics look quite interesting, and I'd love to meet y'all.

lynks

@Iszi where are you based?

Iszi

@lynks Florida

It's not that we have any particular restrictions from traveling to the U.K. - our company just doesn't generally fund us for any conference-related travel.

Rory McCune

@Iszi possibly just as well, I think the climate of Dundee in January might be a bit of a nasty shock for you !

Iszi

18:59

So, if we want to do training or a con, it has to be local or we fund the travel and such ourselves.

lynks

@Iszi understood

Rory McCune

@Iszi yeah I've had varying degrees of support from employers over the years. now we're self-employed it's a question of "do we have money at the moment, so can we afford to go"

Iszi

@RoryMcCune I dunno. I've had people from New York move down here and get all bundled up during "winter" on days where I'm just wearing an extra shirt. Something about it being a "different kind of cold" I think.

lynks

@Iszi dundee in the winter will be 10-15 below at night time, 5-10 below during the day.

Iszi

@lynks F or C?

lynks

19:08

C

I'm in the midlands and we get -10 at night in the winter.

Andrey Botalov

Does anybody talk about security here?

lynks

I don't know how that matches up, but its a reference for you.

@AndreyBotalov this is strictly temperature chat

Andrey Botalov

Or is bad tone

Jeff Ferland

@AndreyBotalov Sometimes. If you've got something to talk about, go for it.

Scott Pack

@JeffFerland It's only about .25" away on my monitor.

Iszi

19:11

@AndreyBotalov You apparently haven't seen our ad...

Jeff Ferland

@ScottPack and how does that make you feel?

Andrey Botalov

@Iszi I saw it. It's the reason I decided to ask

Scott Pack

@JeffFerland Better than you. Clearly.

@AndreyBotalov Sometimes. We're usually complaining, though.

Jeff Ferland

@AndreyBotalov Most of the chat regulars here are, well, regulars. We've got more of a social circle going than anything else.

Scott Pack

@JeffFerland That's one kind of circle it could be.

Jeff Ferland

19:14

@ScottPack You're not dreaming anymore. You're not that cute.

lynks

@ScottPack im hoping you mean click fraud, rather than...jerk.

Scott Pack

@JeffFerland :(

Lucas Kauffman

21:43

I'm off auditing in january <o/

Jeff Ferland

@LucasKauffman What exactly would you call that emoticon's expression? Bad dance move? Hitting oneself over the head while falling?

I assume some excitement is conveyed because $everything > auditing, but...

Iszi

@JeffFerland His emoticons have always been a bit odd. I think that one's supposed to be a waving guy, though he used to say that a waving guy was <o/~ until I said that looked like a guy with a stinky/hairy armpit...

Lucas Kauffman

@JeffFerland the excitement is the same as jennifer anniston and jessica alba coming up to you and asking if you would be interested in a threesome with them.

Iszi

@LucasKauffman Anniston and Alba? Really? That's the best you could come up with? I mean, I surely wouldn't complain if they did, but that's the best you could really come up with?

AviD

@JeffFerland hmm, I'm thinking it might be '70's style flashy dance - ala Travolta's classic Saturday Night Fever.

Lucas Kauffman

21:56

@Iszi well, I could have been cleaning up roadkill, so there is stuff that's worse than audit

Jeff Ferland

Iszi

@JeffFerland I'd star that for the sake of the reaction's accuracy, but I really don't so much like the visual of Jim Carrey in his briefs.

AviD

@JeffFerland I have to practice that move, for when Jeniffer and Jessica come a'knockin'.

@Iszi could be worse. Could have been Jeff.

Iszi

@AviD It's even a bit more amusing that Jim was performing that move for Jennifer, in that particular movie.

AviD

@Iszi ohhh riiight. Bruce Almighty?

Iszi

21:59

@AviD Ayup.

I'm a bit surprised to see that, at least according to The Oracle of Bacon, Jim & Jessica haven't been in a movie together yet.

AviD

Especially with that move.

@Iszi Doesn't the MTV Movie Awards count?

Iszi

22:15

@AviD Not by the default settings, I suppose.

Scott Pack

23:17

@AviD I can't believe you tried to claim to not be old and yet a 35 year old Travolta movie is your example of sexy.

AviD

@ScottPack Sexy? Did I say sexy? I don't think I said it was sexy. I'm pretty sure I did not say it was sexy.

I also didnt claim to not be old, I just said "not as old as @RoryAlsop".

Though to be fair, how old you are has less to do with your age and more to do with how many kids you have.

Scott Pack

So you feel like Cthulhu?

AviD

heh. hey, I only got 4.

No more than Methuselah.

Scott Pack

Is he in the begats chapter? I gotta be honest, I skipped most of those.

AviD

cmon, "as old as Methuselah"? Surely you must have heard the term, in a non-biblical setting.

Methuselah

According to the Hebrew Bible, Methuselah () was (according to biblical tradition) the oldest person to ever live. Extra-biblical tradition maintains that he died on the 11th of Cheshvan of the year 1656 (Anno Mundi, after Creation), at the age of 969, seven days before the beginning of the Great Flood. According to the medieval rabbi, Rashi, God delayed the Flood specifically because of the seven days of mourning in honor of the righteous Methuselah. Methuselah was the son of Enoch and the grandfather of Noah. The name Methuselah, or the phrase "old as Methuselah", is commonly used to ...

Scott Pack

23:27

Humour

Humour or humor (see spelling differences) is the tendency of particular cognitive experiences to provoke laughter and provide amusement. The term derives from the humoral medicine of the ancient Greeks, which taught that the balance of fluids in the human body, known as humors (Latin: humor, "body fluid"), control human health and emotion. People of all ages and cultures respond to humour. The majority of people are able to experience humour, i.e., to be amused, to laugh or smile at something funny, and thus they are considered to have a sense of humour. The hypothetical person lacki...

I would have posted the sarcasm sign but I'm on a phone.

AviD

okay, if I missed that I guess its a sign I should be getting some sleep.

Scott Pack

1:30?

AviD

yup

Rory Alsop

@AviD evening

:-)

Scott Pack

Is jello kosher?

AviD

23:33

@ScottPack no reason for it not to be, unless it contains gelatin - and then depending on the source animal.

or where you talking about Jell-O brand? then I dunno.

Scott Pack

Which still contains, to the best of my knowledge, gelatin.

I'm guessing horse.

AviD

horse??

Scott Pack

I think so.

Isn't horse bone the traditional gelatin source?

AviD

@ScottPack dunno, I thought it was pig fat.

never really looked into it.

lynks

can I disown a change someone has made to my answer that I do not think is relevant?

AviD

23:36

I do know that they do make kosher Jell-O, somewhere.

@lynks you can rollback it.

unless it was me.

lynks

@AviD im tempted, but it feels mean.

Scott Pack

snopes.com/food/ingredient/jello.asp

AviD

usually only worth doing if it gibberished up the answer, took it in a different direction, or just lowered the overall quality.

Scott Pack

So not necessarily horse, and certainly not hoof, but definitely critter.

AviD

lynks

23:38

@AviD I'll leave it, but its a totally irrelevant addition

AviD

@lynks I have had to remove an addition once - it was actually a good answer, but completely besides the point of the thrust of my answer.

commented to the editor to add it as a new answer.

lynks

@AviD despite the 183 upvotes, I regret ever posting it.

AviD

hahaa

Scott Pack

@AviD NEVER DOUBT THE SNOPES!!!!

AviD

@lynks actually, I think his addition is a good one - yes, key size is irrelevant (once you get past a certain size), but that doesnt mean the algorithm is completely safe for another 100 years.

lynks

23:45

@AviD I've had to fight of hordes of comments along this same line, all pointing towards implementation/deployment/algorithm specifics, none of which are relevant in an obviously theoretical answer.

AviD

yeah, but its a caveat worth noting.

lynks

perhaps, I think there is benefit in keeping such things compartmentalised

jrg

So you're saying that my 2048 GPG key is secure for eternity? mkay.

lynks

@jrg nope sorry, GPG keyspace doesnt work the same way :P

jrg

@lynks darnit. (i knew that. honest!)

lynks

23:48

@jrg i thought you might!

Scott Pack

23:59

Sheldon knows everything.

Transcript for