« first day (742 days earlier)      last day (4436 days later) » 

AviD
AviD
00:03
So @ScottPack how was your holiday?
Is. I should say, "is".
Scott Pack
Scott Pack
Fine. Got some good sledding in. Got about 10" out there now.
AviD
AviD
wow, that nice piling.
we've barely been getting rain, hard to tell its winter.
Scott Pack
Scott Pack
We have a nice blizzard coming through right now.
user image
AviD
AviD
looks white.
and I don't mean to be racist.
Scott Pack
Scott Pack
That was this morning before the snow really picked up.
And now...game time with the kid.
AviD
AviD
00:16
enjoy!
 
7 hours later…
Lucas Kauffman
Lucas Kauffman
07:40
@TerryChia websecuritywatch.com securityfocus.com seclists.org/fulldisclosure net-security.org esecurityplanet.com
I've got some other ones too, but they are more specific towards products (Adobe incident response team, checkpoint, cisco )
AviD
AviD
user image
seriously, why am I wasting my time???
 
3 hours later…
Terry Chia
Terry Chia
10:51
@LucasKauffman Thanks :)
 
3 hours later…
Scott Pack
Scott Pack
13:30
@TerryChia Here's an opml of my security and technology feeds. There's some overlap between them
dl.dropbox.com/u/33505390/subscriptions.xml
Terry Chia
Terry Chia
@ScottPack I got a 404.
Rory McCune
Rory McCune
@TerryChia HEre's a couple of sets of feeds I follow. Penetration testing google.com/reader/bundle/…
@TerryChia Security Blogs google.com/reader/bundle/…
There's a fair number in there (57 feeds in penetration testing 35 in security blogs)
Terry Chia
Terry Chia
@RoryMcCune Cool, that should keep my free time occupied. :)
Rory McCune
Rory McCune
13:45
@TerryChia not all of them are very active, but some interesting stuff turns up there most days.
AviD
AviD
13:58
@TerryChia the problem is when it bites into your not-so-free-time, and you're still ravenous for more...
THERE IS JUST TOO DAMN MUCH INFORMATION ON THE INTERNET.
Scott Pack
Scott Pack
@TerryChia Allegedly it's a public link to that file.
Terry Chia
Terry Chia
@ScottPack Ah, it seems to work now.
@AviD true that.
Scott Pack
Scott Pack
@TerryChia Must not have been finished syncing. I've got some HD video that's going up to Crashplan right now.
Terry Chia
Terry Chia
at least i'll be reading slightly relevant information instead of the crap i am reading now. ;)
Scott Pack
Scott Pack
@RoryMcCune I liked that TaoSecurity post about cert branding.
Terry Chia
Terry Chia
14:11
Shameless plug - could i get another 3 upvotes on this question? another hat would be nice. :)
12
Q: At what level of abstraction should a developer work with with regards to cryptography?

Terry ChiaI have recently came across an old blog post by Jeff Atwood which got me thinking. What could be easier than a EncryptStringForBrowser() method which has security and tamper-resistance built in, that's part of a proven, domain-expert-tested set of code that thousands if not millions of develo...

cryptography programming
jrg
jrg
14:40
one more.
Terry Chia
Terry Chia
:)
That will be my 14th hat if I get one more upvote.
jrg
jrg
15:02
yay hats!
Polynomial
Polynomial
faphats!
Terry Chia
Terry Chia
@Polynomial *-whore
Polynomial
Polynomial
@TerryChia I'll admit to being a bacon-whore.
Terry Chia
Terry Chia
@Polynomial bacon is awesome
Polynomial
Polynomial
you seen Bakon vodka?
it's epic
savoury bacon flavoured vodka. almost impossible to get in the UK.
Terry Chia
Terry Chia
15:17
nope. can't say i tried many variaties of alcohol. what with being underage and all, at least for another 40 minutes more. :)
Rory Alsop
Rory Alsop
Bacon flavoured bacon ftw
Polynomial
Polynomial
ah yes
ah, happy birthday then I guess?
Rory Alsop
Rory Alsop
Happy birthday Terry!
Terry Chia
Terry Chia
:)
The cat hat is pure awesome.
Polynomial
Polynomial
haha
Rory Alsop
Rory Alsop
15:46
Ah-I don't have that one yet
Thomas Pornin
Thomas Pornin
16:22
Hello people
Happy [insert-favourite-name-for-consumerist-revelry] !
CodesInChaos
CodesInChaos
16:38
Christmas is a great excuse to increase my supply of books :)
Thomas Pornin
Thomas Pornin
16:48
Did I miss something interesting in the last two or three weeks ?
Lucas Kauffman
Lucas Kauffman
17:08
@ThomasPornin christmass hats?
btw anyone doing the CCC ctf?
CodesInChaos
CodesInChaos
TLS reneg is weird. So many complex implications. I don't understand why they added such a thing
Thomas Pornin
Thomas Pornin
@CodesInChaos Because of HTTPS
The URL is sent after the handshake
So only at that point does the server know whether it should have asked for a client certificate or not
CodesInChaos
CodesInChaos
Reneg seems such a weird way to add additional authentication information
Thomas Pornin
Thomas Pornin
17:24
It is more than weird: it is undefined.
The reneg-vulnerability can be described as a lack of documentation.
Nowhere is it defined what it is supposed to achieve. So, Web server developers just assumed that it was providing the security feature that they needed at that point.
CodesInChaos
CodesInChaos
For example one could have allowed CertificateRequest messages after the handshake instead of reneg
(But I'm one of those who'd like to replace TLS with a new protocol entirely)
CodesInChaos
CodesInChaos
18:07
Telling people to use slow password hashes has the unfortunate consequence that they now think all hashes should be slow :(
Thomas Pornin
Thomas Pornin
@CodesInChaos Speaking to people has the unfortunate consequence that it makes people feel entitled to speak to you.
2
 
2 hours later…
Scott Pack
Scott Pack
19:50
Hippo Barfday @Terry.
What you need is a nice celebratory moonshine.
2
Lucas Kauffman
Lucas Kauffman
20:38
guys what was one of the latest big info disclosures?
also why wasn't I aware about the whole stackoverflow hack :o
CodesInChaos
CodesInChaos
what stackoverflow hack?
Lucas Kauffman
Lucas Kauffman
something with X_FORWARDED_FOR set to 127.0.0.1
CodesInChaos
CodesInChaos
lol
Lucas Kauffman
Lucas Kauffman
blog.ircmaxell.com/2012/11/anatomy-of-attack-how-i-hacked.html
well it was 2 years ago
and it was bad configuration
CodesInChaos
CodesInChaos
I think a fellow coder wanted to add this to our browsergame a few years back
(luckily only for logging/tracking users, not for important security)
 
1 hour later…
ircmaxell
ircmaxell
21:58
@LucasKauffman Wasn't really a "hack", but more of a door that I found and reported...
lynks
lynks
22:33
@ircmaxell you arrived fast :P
ircmaxell
ircmaxell
;-)
I saw it in the referrers to my blog (I'm addicted to real-time-stats)
lynks
lynks
@ircmaxell I had assumed as much :)
Jeff Ferland
Jeff Ferland
This looks pretty damn cool: webstersprodigy.net/2012/12/20/…
3
ircmaxell
ircmaxell
nice
CodesInChaos
CodesInChaos
I know several people who took part and liked it.
lynks
lynks
22:44
@JeffFerland favourited, looks very well thought-out
lynks
lynks
22:54
@JeffFerland enrolled, why not :P
Lucas Kauffman
Lucas Kauffman
I always find it amusing how the government always assumes people are innocent
"three presumable pirates"
3 guys with AK47 on a skiff, I highly doubt they are fishermen
CodesInChaos
CodesInChaos
I think they need to do that until there a court decided they're guilty
Lucas Kauffman
Lucas Kauffman
I know
but it's still funny :p

« first day (742 days earlier)      last day (4436 days later) »