The DMZ

Stack Exchange

6:15 AM

I would say time is definitely one of my top three favorite dimensions.

AviD

6:43 AM

yaaaay, @Adi I got my airbnb place reserved. sweet!

wasnt my first choice - there was a place practically across the street from the conf! - but not too far away.

weird, I kept getting my request rejected. This must be how @Simon lives.

@ThomasPornin BANG! @RoryAlsop even based on just your mention of a rumour, the Bear still punched the researcher in the face.

Rory Alsop

morning

@AviD lol

AviD

6:59 AM

@RoryAlsop you should invent more rumours and point the bear at it, just to see what will happen.

Rory Alsop

@AviD hahahahaha

how to break the universe

Lucas Kauffman

"Thomas Pornin can divide by 0"

M'vy

heya

Rory Alsop

7:22 AM

@M'vy morning

@M'vy Interestingly, on my work build, your avatar does not appear (I just get the 'loading' message next to your posts) - and I think @Adi's is the same, so I need to reply for it to tell me in my message who you are

M'vy

@RoryAlsop Guess I'm undercover today :)

Intersting . Someone found why I have problem and my extended keyboard

For some reason, MS decided that C-[and C-] should not send their codes.

I think I should give up on finding a standard, world available uk with accent layout compatible with programming.

Journeyman Geek

@M'vy but with the @ in the usual place.

AviD

@RoryAlsop pentest the universe

beartest the universe.

black box, white box, bear box.

blue team, red team, bear team.

Journeyman Geek

armed bears?

Rory Alsop

@AviD - I sense a t-shirt/coffee cup opportunity

AviD

7:35 AM

@RoryAlsop hahaha

Rory Alsop

@AviD especially that one

I may need to work on my Gimp skills this evening

(yes, I did think about the wording :-)

AviD

sorry about this @RоryMcCune, but this is really necessary

Zen Riddles for Millennials

►

M'vy

white bear, black bear, bear bear

AviD

@M'vy ...

you forgot brown bear

are there grey bears?

M'vy

7:50 AM

@AviD maybe I shouda switched black for brown, but you know: the only true bear is black

And I got proof

Thomas Pornin, Quebec City, Canada

170k 25 358 570

AviD

wrong

brown too

Tom Leek

88.3k 9 121 246

tls encryption passwords cryptography hash authentication certificates

M'vy

Oh man... this is depressing... so much gold badges

hmm

it's only a disguise :)

AviD

wait thats weird. is that black or brown?

its like with that damn dress.

browser window on the left he's brown, chat window on the right is black.

M'vy

eeeeek

Rоry McCune

@AviD dude it's a new one I hadn't seen too!

Rory Alsop

8:41 AM

@AviD Am I the only one who wishes bear 2 was in the exact same pose as bear 1? Or is that just my mild OCD

AviD

inorite? but I think its on purpose so we dont get confused.

Adi

@AviD Neat. I got mine yesterday as well. Very nice place, private room, and reasonably priced. I like Airbnb

@RoryAlsop Test

Rory Alsop

@Adi Ickles?

AviD

hahahah I thought I was the only one who did that

there are dozens of systems around the world that still have messages I'd left during testing with "icles"

Rory Alsop

@Adi Both you and @M'vy are fully avatar-ed up now

Adi

8:45 AM

Soo, basically, @Flyk is in a bad mood these days. Hey, dude, I was just being nice and genuinely concerned.

Rory Alsop

@AviD Maybe it's an age thing :-)

M'vy

@RoryAlsop damn you blew up my cover!

Rory Alsop

@Adi I didn't read that as bad mood. I just read it as not having much time. Or intent

AviD

@Adi what she on about now?

Adi

@RoryAlsop I meant her reply, not the lack of it

AviD

8:46 AM

@Adi if we wind up being airbnb buddies I will slap @lucas

Adi

@AviD You can also get those I<3Amsterdam cards

AviD

oo I should bring the sec.se stickers

@Adi wut that?

Adi

@AviD Public transportation pass for 3 days + 3 days of free access to all museums, art galleries, sights, basically all touristy stuff

If you're into that kind of stuff

Who am I kidding, you and @RоryM will spend all of the days in the RLD anyway :D

Rоry McCune

@Adi RLD?

Adi

@RоryMcCune Red-light district

Rоry McCune

8:50 AM

@Adi Ah , it seems likely that the person who uses the phrase so much he turns it into an acronym is a more likely candidate to be spending his time there :op

Adi

@RоryMcCune Destroy'd

AviD

@Adi ah cool cool.

actually not in really IN amsterdam the first few days, I am a couple towns north.

@Adi hahaha

nooooo nope no.

@RоryMcCune oh snap

Rory Alsop

@AviD of course

@Adi ah - I can see how that could be taken that way. Or it could just be a fairly blunt question

AviD

@RоryMcCune gotta say I'm not too impressed that they first now are sharing the session abstracts. also the sched embedding in the site is a major UX fail.

I do love the colorfulness, though.

we should use that for AppSecIL.

Rоry McCune

@AviD yeah I get the impression that the conf. team are a bit overworked, which is having an impact...

AviD

9:01 AM

@RоryMcCune sure, but still.

its not like its a surprise, or that they didnt have the abstracts BEFORE even selecting the talks...

Adi

Interesting flag

Rоry McCune

@AviD they've had my abstract for aaaaaaaaaages

AviD

my not-so-secret goal for AppSecIL is to host AppSecEU in 2017. worried that it will be a big mess like these.

Adi

@AviD :|

AviD

@Adi ?

Adi

9:03 AM

While we're at it, let's host AppSecUS in China

Rоry McCune

@AviD the key seems to be have a good sized team and make sure they're all "singing from the same hymnsheet"

AviD

@Adi aaahhh you're worried about not being able to come....!

@Adi heh

Adi

@AviD Oh trust me, I'm able to come

That's not the issue

Rоry McCune

@AviD last year suffered a bit from different sets of people working on it. This year my impression is that the team is overworked

AviD

ermm, I meant "travel to israel to participate in the conference" damn euphemisms

Adi

9:04 AM

But it's kind of silly, don't you think? AppSecEU in the middle east?

AviD

@Adi Israel is kinda in Europe...

-ish.

Adi

@AviD and I can do that. I have no problem in that area

@AviD Geographically, Asia. Politically, Middle East

Let's not kid ourselves here

AviD

@RоryMcCune AppSecIL's main problem is that I tend to do most of the work. if we host the EU then we would get a proper committee with people who actually do stuff.

@Adi Economically, Europe.

Arperum

@AviD ISn't that just for eurovision or something?

AviD

OWASP considers us Europe, as do other orgs.

Adi

9:06 AM

@AviD Oh good good. Soon once the trans-Atlantic passes, United States will be in Europe as well

Arperum

I don't know, nor care.

AviD

@RoryAlsop you were here for ISACA, right?

@Arperum oh yeah, that too!

@Adi heh

Rory Alsop

@AviD is that the middle east name for ISACA?

(joking :-)

Adi

and hey, China has trade agreements with Europe, so it's pratically in EU.. right?

Rory Alsop

@AviD yep - and it was grand

AviD

9:07 AM

dats what I meant!

Rory Alsop

oooh - ninjas

AviD

@RoryAlsop that was a Europe only thing, wasnt it

or I could be wrong

Rory Alsop

@AviD ISACA EMEA I think (we had a few African countries there too)

Adi

I don't know, man. It's an extension for me being pissed about Turkey trying to get in EU. I'd be soooooo annoyed of that happens

AviD

point is - AppSec IL best AppSec

@RoryAlsop ahh okay then

@Adi hehe

Adi

9:08 AM

It's the fricking EUROPEAN Union

AviD

well Turkey does have some land in Europe

Also, remember NATO? look who its members were....

Rory Alsop

Turkey's trying to get in. The UK appears to be trying to get out...

Adi

@AviD Yup. Equally silly

Rory Alsop

all very confusing

why don't we all just get along

#Roryhasrosetintedspecs

AviD

the whole "nation state" thing is silly anyway.

Adi

9:10 AM

How Tunisians, Moroccans, Israelis, and Turks like pretend "Oh we're practically Europeans"

fick das!

AviD

@RoryAlsop #RoryHasHempFlavoredWaitWhatWasITalkingAbout

@Adi you're just jealous

Adi

@AviD You're right. Because I don't live in Europe

I mean real Europe.

AviD

looks like most of the best talks are on the 2nd day :-(

I'm flying out Thursday night.

gonna miss the best parts...

also doubt I'll make the booze cruise

Adi

@AviD but you still get to get the free goodies :D

AviD

@Adi yeah baybay! only reason I'm going

bringing an extra suitcase

Rоry McCune

9:13 AM

@AviD good plan, especially in case there's any fairy dust in there

Adi

Oh shit! I forgot if I booked a check-in bag or not

AviD

@RоryMcCune heh

"fairy dust"

"one-way encryption powder"

damn gonna get slapped by @ThomasPornin for that one

Adi

are you talking about drugs?

AviD

HASH IS NOT ONE WAY ENCRYPTION

@Adi @RоryMcCune is

Adi

Yup, yo're talking about drugs

powder and hash

Rоry McCune

9:15 AM

@Adi not sure about @AviD but I wasn't.. I was more referring to what @AviD was talking about the other day

AviD

@RоryMcCune which that?

Rоry McCune

@AviD marions fairy like tendencies

AviD

@RоryMcCune aaahhhhhhh

totally forgot about that

Rory Alsop

@AviD yeah - I still haven't learnt this new fangled hashtag thing

AviD

I assumed you were talking about drugs, the israeli security and customs look extra closely at anyone flying in from amsterdam

Rory Alsop

9:16 AM

@AviD there's a booze cruise? Now you tell me? Dammit!

AviD

now @RoryAlsop is talking about drugs too

Rоry McCune

@AviD yeah they do that with people returning to the UK to I'll bet..

AviD

@RoryAlsop 2015.appsec.eu/social-events

Rory Alsop

@AviD yeah - if that had been the headline I may have made more effort to read the social events bit :-)

AviD

actually that looks like it would be fun. sorry I have to miss it :-(

Rоry McCune

9:19 AM

@RoryAlsop so for @AviD 's advertising for 2017 it should be "FREE BOOZE" (with optional security conf.)

AviD

@RоryMcCune hehe

Flyk

@Adi you mistake a bad mood with being insulted

this is neutral, I'm merely no longer being friendly

please stop pinging me from here

AviD

@Flyk wait wait, what happened?

since when do you care enough about him to be insulted by him?

@Flyk did I miss it? did I miss you being friendly?

@Flyk nevar

Flyk

I guess I'll go with option (c) and just put an entire channel of people on ignore to get around the fact you have so little respect that me simply asking you to leave me alone is insufficient

@AviD not him, you

AviD

@Flyk wut?

Flyk

9:28 AM

you made an uneducated comment about my upbringing, and that's unacceptable

AviD

@Flyk you think we would give up on you so easily?

@Flyk I what?

Flyk

in lieu of me not explaining why it's such a big issue, I went with the other option and just left

AviD

I honestly have no clue what we're on about

Flyk

good

AviD

I think I missed it

Flyk

9:29 AM

going again now

AviD

kk bye for now

Rоry McCune

well there you go, it appears people on the Internet can be .. odd..

AviD

s/on the Internet/ /

Rоry McCune

@AviD this is true

@AviD @Adi was just looking at the schedule for Appsec next week, looks busy especially on the Thursday when they've got that extra "hackpra allstars" stream

AviD

@RоryMcCune yeah

probably wind up spending the whole day in the exhibition floor anyway

its tricky when there are so many tracks

Rоry McCune

9:41 AM

@AviD heh

@AviD yeah 6 on the Thurs/5 on the Fri it's quite a lot!

AviD

I'm not sure its beneficial. smaller audience, and that much harder to choose sessions...

on the other hand it does let you squeeze in a lot more talks.

Rоry McCune

@AviD yeah I was thinking that, it's good in that there's something for everyone (hopefully) but it really scatters the audience and you'll inevitably get talks that are very quiet

AviD

@RоryMcCune I am thinking of adding a 3rd to appsecil. problem is that its only one day, makes it difficult to squeeze in all the great talks, and have time for other activities. always so rushed....

Rоry McCune

@AviD I'll never beat my all-time low though which was a conf. where I subbed in at the last minute and was against a much techier talk (it was a techy conf.) where I got like 5 people

AviD

@RоryMcCune and then you have a few timeslots where its impossible to choose between 3 great talks!

@RоryMcCune ouch

Rоry McCune

9:44 AM

@AviD I wasn't that bothered as I was just a sub to fill a slot and actually got some decent chat from the attendees so it was interesting but yeah talk about small audience!

AviD

I will acknowledge that from the organizers' perspective, it is really tricky to set up.

Rоry McCune

@AviD yeah the problem I see is that when one of the speakers in a timeslot is a "big name" the people they're up against will suffer audience-wise

AviD

@RоryMcCune yeah. so either you "screw" the other speaker, or "screw" the audience who has to choose between 2 "big names".

though its not just the "big name", its also about the content

or rather, the title

Rоry McCune

@AviD yarr

@AviD yeah it's like buzzfeed

Adi

@Flyk mhmm. okay.

Rоry McCune

9:46 AM

click bait up the title/abstract

Rory Alsop

@AviD I tried to find it too - and couldn't.

AviD

for some reason, the hackier talks are always a bigger draw, even vs more techy builder-type talk.

Rоry McCune

@AviD that was nice of Adi come in, ping the angry person and leave!

AviD

heh

Rоry McCune

@RoryAlsop me neither, but hey there's loads of not angry people on the Internet to chat to , so all good :)

AviD

9:47 AM

well, he wouldnt hang around after pinging the angry person! makes sense.

Rоry McCune

@AviD heh, although he could just have ya know... not pinged the angry person

Rory Alsop

@RоryMcCune sure, but you know me, I kinda like the chat from most folks here - including Kalina

AviD

@RоryMcCune that's crazy talk

@RoryAlsop that's crazy talk

Rory Alsop

Are you implying Rories are crazy?

@RоryMcCune Break out the doughnut cannon!

Rоry McCune

@RoryAlsop sure but for whatever reason she has decided that she's angry with the participants of this room and has no intention of discussing the reasons for said anger, so hey there's other people to speak to :)

Rory Alsop

9:50 AM

@AviD ISACA conf in Paris had something very similar

AviD

@RoryAlsop OH.EMM.GEE I NEED ONE OF THESE.

POINTED AT MY MOUTH.

#simon

Rоry McCune

personally I've never seen the point of "flouncing" out of Internet forums, so I'm a bit mystified but that's life

@AviD you want @Simon pointed at your mouth???

AviD

@RоryMcCune "flouncing"? is that like ragequitting?

@RоryMcCune lol NO

Rоry McCune

@AviD kind of ragequitting is more vanishing never to be seen again, flouncing involves taking the effort to tell people that you're leaving without then explaining why and alluding to mysterious "you should know what you've done wrong" reasons

AviD

@RоryMcCune hahaha cue the stereotypes of wives and emotional vampires

The Emotional Vampire - SMBC Theater

►

Rоry McCune

9:54 AM

@AviD nooooooooooooooooooooooooooooo

SMBC theater and college humor in one morning!

AviD

@RоryMcCune now my feelings are hurt!!

Rоry McCune

@AviD in an unspecified way that I should already understand?

AviD

@RоryMcCune now you're mocking me!

Rоry McCune

LOL that video is funny

Rory Alsop

@AviD - and you are getting a rock band?!!! Gahh! #shouldareadthepageBEFORE

AviD

9:57 AM

@RoryAlsop yeah I'm gonna miss that part

dammit @RоryMcCune I smbctrolled myself

Rhino

@AviD you have also trolled me

Those videos are pretty amusing

Steve DL

11:33 AM

hi there

raz

hi there

M'vy

hi there

Simon

@AviD You mean this must be how I've never felt!!!!!!!!!!

That was a shitty comeback.

@RоryMcCune Oh wow...

AviD

@Simon cmon, gimme a chance to reject you first, before you reject yourself.

Simon

I'd rather do it myself.

@Flyk #BringBackFlykWednesdays

2

I think I'm gonna get rich eventually just by selling the pens people leave at my desk when they come see me.

raz

11:40 AM

Put a sign, $1 for a pen

leave a jar

Simon

The problem is they're just gonna walk to the drawer which is 5 footsteps away from me and grab one.

Unless I take them all! Mouahahaha.

raz

@Simon Now you're thinking!

Rоry McCune

11:51 AM

@Simon hey, he said it (although he's denying it now of course)

Simon

@RоryMcCune I know, that's what makes me sick.

Adi

hi there

oh.. too late :(

@Simon Hey, dude. She clicked. It's over

Pinging here will just reinforce her ideas.

Simon

@Adi I believe that would make her feel wanted.

Adi

Not all people want to feel wanted all the time by all the people

I certainly don't want to feel wanted by, for example, @AviD

Simon

12:06 PM

@Adi Yes but I'm the one who pinged her and we all know that @Flyk is into me.

Adi

You're just making it worse.

Simon

:D

Rоry McCune

@Simon I predict that this will not end well for you </rorysayer>

(rorysayer is like a soothsayer but more correct)

Adi

@RоryMcCune at the same time, let's not give her too much comedic credit

She doesn't want to be around here. Let's just respect that

AviD

@Adi thank heavens for that, airbuddy

Rоry McCune

12:09 PM

@Adi I do I'm not planning on pinging her again, she was quite clear

AviD

@RоryMcCune (naysayer)

Adi

@AviD Which place did you get?

AviD

not gonna tell YOU

Rоry McCune

@AviD It would be v. funny if it ended up being the same place :op

Adi

@AviD Dude, the company already booked a place for me. It's not like I'm gonna change it :D

AviD

12:10 PM

nice private room on Cliostraat

Flyk

@Simon you should pay attn to @Adi

AviD

hehe

about 15-20 min walk away from the conf, not too bad

@Adi which one?

Adi

@AviD That's about 5km from me

Simon

@Flyk But I got what I wanted though so I'm unsure if I should have done it or not.

Adi

@Simon sigh

AviD

12:12 PM

awww no airbuddies?

Adi

@AviD Nope. But we'll be beering together, so that's also good

and we can make fun of @Simon offline

Simon

@Adi Hahahaha.

I just pictured you two donuts talking about me IRL.

AviD

I wanted a place within walking distance, 5km is too much for me to hobble over

@Adi beerbuddies!

@Simon yeah right

Adi

@Simon I think we did talk about you with @RоryM

Rоry McCune

we need a voice --> DMZ bridge tool, so that when we mention @Simon it can auto create DMZ messages with the content

Adi

12:14 PM

We also talked about Kaliania

AviD

I will bet you a beer I dont even bring up you as a topic

Simon

@Adi That's crazy!

Adi

@Simon That's pretty much how described you

Simon

@Adi Fine with me.

Rоry McCune

@AviD so you're saying if we can trick you into doing so, you'll buy us free beer?

@Adi did I, I don't recall doing that..

AviD

12:15 PM

@RоryMcCune if I were to buy it it wouldnt be free

Rоry McCune

but then I am old, so my memory is terrible

@AviD free to me == free :)

AviD

@RоryMcCune unless I trick you into bringing him up first

Adi

@RоryMcCune Well, I guess that's just me then :D

AviD

@RоryMcCune someone always pays

Rоry McCune

@AviD so we're saying this is a drinking game, first one to mention @Simon buys the next round?

AviD

12:16 PM

still disappointed I didnt get that room across the street from the conf....

@RоryMcCune hahaha

well I was betting HIM a beer, but whatever.

hey @RоryMcCune didja notice the neighborhood next to the conference?

"Riverrun"

well, Riverrun in Dutch....

Rоry McCune

@AviD heh, I hadn't! nice

AviD

turns out the Tullys are Dutch

Simon

RIVENDELL?!?

AviD

nurd

Flyk

I think this "flouncing" is nonsense, I left without making a noise until I was called back

@Simon I'm not sure you've achieved what you wanted to achieve, but you certainly achieved something. Congrats.

Simon

12:27 PM

o

Rоry McCune

anone want to reptrain a question on todays hot "name/Infographic" approved vuln? venom.crowdstrike.com

AviD

@Flyk well, that's more than usual

@RоryMcCune wut

Rоry McCune

@AviD yeah that was my feeling too

AviD

@RоryMcCune also, its 2015, isn't it? why would VMs have virtual floppy drives installed?

Rоry McCune

@AviD yeah I pretty much remove that option from my VMs when I set them up. That said VMWare workstation does, by default, still create 'em

AviD

12:33 PM

@RоryMcCune "remove"? Who in hell has that by default??

vmware sux lol

@Simon did I get that ^ right?

Simon

Nah, VMWare is fine.

AviD

actually, other than the logo/namification, its not a bad vuln - considering as you say that floppies are created and installed by default.

also:

> For many of the affected virtualization products, a virtual floppy drive is added to new virtual machines by default. And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers.

Rоry McCune

@AviD ninja'd

AviD

I like that faq entry, "Floppy drives are outdated, so why are these products still vulnerable?"

cant believe they didnt mention if Docker is vulnerable or not

@Simon nah, not really

Rоry McCune

@AviD heh

Simon

12:38 PM

Please, tell me everything about Microsoft's virtualization solution.

AviD

@Simon I have neither the time nor the inclination to indulge your sarcastic laziness.

M'vy

@Simon everything about Microsoft's virtualization solution.

2

Adi

@AviD FYI chat.stackexchange.com/transcript/message/21238174#21238174

Since you were wondering

Simon

@Adi Is that what made her leave?

Adi

@Simon He was wondering what he said, I answered. I don't really know what made whom do what

Simon

12:42 PM

Ah.

Adi

Wow. Thanks Norwegian Air!

AviD

@Adi naaaah

Adi

After cancelling my flight, I get this

Steve DL

"Exploitation of the VENOM vulnerability can expose access to corporate intellectual property (IP), in addition to sensitive and personally identifiable information (PII), potentially impacting the thousands of organizations and millions of end users that rely on affected VMs for the allocation of shared computing resources, as well as connectivity, storage, security, and privacy."

uuurh

More drama and less content please. This is still too informative for me. :|

Adi

@SteveDL You're in the wrong business for that

Without such drama, half of us would be out of work

AviD

12:50 PM

please, the constant overuse of such drama for every plebian vulnerability creates absolute vulnerability fatigue, belittling the few situations where the hysteria is justified.

Journeyman Geek

and fuck cute codenames.

If you want to call it venom I want people dropping dead.

4

AviD

@JourneymanGeek or servers

or spiderman

Journeyman Geek

no. people

ACTUAL goddamned venom.

or at least hurt like the kick of a platypus.

Steve DL

What if it's donuts dropping dead?

Journeyman Geek

Mission Accomplished.

AviD

12:53 PM

@JourneymanGeek ACTUAL venom:

Venom (comics)

Venom, or the Venom Symbiote, is a fictional supervillain appearing in American comic books published by Marvel Comics, commonly in association with Spider-Man. Venom was originally depicted as a supervillain when he made his first full appearance in The Amazing Spider-Man #300 (May 1988), but has since evolved into the role of an antihero. Venom is a symbiote, a sentient alien, with a gooey, almost liquid-like form. As with real world symbiotes, it requires a host, usually human, to bond with for its survival. After bonding, the symbiote endows its enhanced powers upon the host. When the Venom...

Journeyman Geek

Oh, I'd settle for sentient black goop covering affected systems.

AviD

@JourneymanGeek that's racist, and kinda perverted.

Journeyman Geek

Almost as me calling this a big black cock?