The DMZ

AviD

3:00 PM

@TerryChia I guess... it's the form with helps you get empanelled.

It really reminded me of the Hakin9 pitch.

Thinking of forwarding this to rook...

Terry Chia

It's a pity @Polynomial's troll piece didn't work out.

AviD

@asadz btw you never did answer @ScottPack's curiousity question... where are you from?

If you don't mind the ask... you don't have to say if you dont want, considereing it is indexed by google :-)

we have a pretty wide range of locations here, between california and singapore. (the long way around).

Iszi

@asadz No love for Doktor Mayhem?

Thomas Pornin

@TerryChia A smartcard is like a small HSM. If you want to put a CA in a smartcard and not trust anything else, then you have to embed the Web server (with SSL !) in the smartcard. I have done that on a HSM, and it is theoretically doable on a smartcard, but SDK for smartcard which are powerful enough for that are not easy to find.

AviD

well folks, its that time of day for me... @RoryAlsop enjoy Jaffa, I hear it's really romantic at night ;-)

asadz

3:05 PM

@AviD my name doesn't give me much privacy protection

Terry Chia

@ThomasPornin Ahh makes sense. Didn't think of that use case.

AviD

@asadz We do have one semi-regular that is fanatical about protecting his privacy. We don't even rightly know what timezone he's in.

asadz

Quiet funny you said Singapore thats one place i was planning to go but it all changed just at the last minute

AviD

Have a great weekend, everybody.

Iszi

@AviD There you go triggering my irrational time-zone jealousy again. Have a good one!

Xander

3:08 PM

@TildalWave Morning! Yes, I did take a look briefly, and doesn't appear to me that there's there's any vulnerability there. It appears that the architecture is as I suspected much the same as what I'm familiar with in ASP/ASP.Net/JSP, which is that the session is just a dumb container for pseudo-persistent state management.

@TildalWave So, all creating a session is, is adding an entry into the session table with a key (that you get back in a cookie as the session id) and an empty value. For there to be a data structure or data in there, you have to write the code to create the array and populate it with data, which isn't happening. In any case, it's all server side, so the client doesn't have any access.

Thomas Pornin

@TerryChia Unfortunately the cool smartcards (with FIPS 140-2 level 3 or EAL 4+) implement VM so you do not implement in assembly or Forth, but with Java bytecode or CLR/.NET. Sooo uncool.

Xander

@TildalWave So, I do think that from a security perspective, calling create before destroy is exactly the same as just calling destroy. In fact, I don't think it has a performance impact either. Yes, it does cause some additional execution, but it's so minimal as to make no difference in the scope of an entire request.

asadz

@AviD take care Avid

Xander

@TildalWave Even if he just creating a session, and didn't delete it, there really isn't a security implication.

@AviD You too!

@TildalWave So, to my understanding, it's unnessary and I think that you're right that it's driving by a cargo-cult programming mentality, but I don't believe that it's harmful in any way.

Terry Chia

@ThomasPornin You need to realize the fact that most programmers are mere mortals, unlike you. ;)

Rory Alsop

3:25 PM

Wow, lot of chat. After last night becoming somewhat later than expected I took an easy day- 5 mile run followed by a superb massage from an incredibly strong matronly lady. Just about ready for this evening, now.

Just wanted to say lads- spas are great. Worth hanging out in if only for them being the opposite of a sausage fest:)

@AviD - yeah, even when we left and were chatting to the waitress I hadn't realised it was that late. At least I only had a ten minute walk. Thanks for taking the journey in. And Thanks for dinner. Was an excellent evening.

Terry Chia

3:40 PM