« first day (1620 days earlier)      last day (1659 days later) » 

3:25 AM
Are there any more HTTP headers I should have on devdoodle.net? I'm going to add "Content-Security-Policy": "default-src 'self'", "X-Frame-Options": "DENY", "Vary": "Cookie". I'm a n00b with this, and I'm writing it all myself on node.js.
 
 
6 hours later…
9:27 AM
@AviD Hey AviD! I got something that might interest you!
Spotify API docs: "The field filter tag:hipster can be used in album searches to retrieve only albums with the lowest 10% popularity."
 
 
1 hour later…
10:57 AM
@TildalWave probably so although it turns out one of our Sec.SE mods is a secret Eurovision fan, whould've thought it!
@bjb568 there's some good ones here owasp.org/index.php/… and also here owasp.org/index.php/Pinning_Cheat_Sheet for pinning. also worth being careful with CSP it can be a bit fiddly to get right...
 
@RоryMcCune - not a fan. There was just drink and a lovely goth girl...
 
@RoryAlsop I know but it's still amusing to tease :)
that said I'm sure I saw a picture of you sitting enjoying watching Eurovision...
 
"buy a fog machine and run it in the datacenter so when you open the door fog spills out and you can be like WELCOME TO THE CLOUD"
 
12:24 PM
The first time I heard about that eurovision thingy was when lordi played ;)
 
1:21 PM
 
1:41 PM
I expect humanity to extinguish itself due to having brains, not despite it.
 
 
1 hour later…
2:56 PM
@RоryMcCune I was enjoying the drink and the chat, and Nina...
 
3:30 PM
@LucasKauffman There are sponges, protozoa, plants, algae, archæbacteria, eubacteria, nonliving things… why are jellies singled out?
 
 
2 hours later…
5:52 PM
@bjb568 It's an animal
 
So?
 
And thus more similar to humans than that other stuff.
 
Nematodes don't have brains.
Doing some research, Cephalochordates seem closest.
ie Lancelets
They don't exibit cephalization, but do have a rather developed CNS.
 
People know jellyfish. They don't know all these other freakish words.
You'd have ter be like a biologer to know that stuff. How elitist is that?
 
6:12 PM
Meh, I'm in 9th grade bio, it's not that complicated.
lol, autocarrot
 
7:07 PM
Chocolate doesn't have brains either.
 
7:55 PM
@RoryAlsop This year's Eurovision was remarkably poor.
It's amazing how they all appear to sing the same song.
 
8:09 PM
@SteveDL is chocolate a new nickname for @Simon?
what else have I been missing?
@ThomasPornin I think you're misusing the term "remarkably". It is that way every year.
 
@AviD No, usually you get at least one or two with some originality, scandalous feature, or spectacular mishap. For instance, last year there was a fake woman with a fake beard (and (s)he won).
 
@ThomasPornin that was last year?
I think that was 6 years ago?
no wait, that one didnt have a beard.
so yeah, that does seem original.
@CodesInChaos isn't it? Of course its a duplicate. it is asking about the relationship between closing window and logging out, which goes directly to the veracity of the logout mechanism. Which is answered there perfectly.
 
This year, the most original were a polish singer in a wheelchair, and a serbian female singer of stupendous proportions, almost as spherical as Simon's mom.
 
OH SNAP
BEAR BURN
@Simon I think you're done now
 
France made a grand total of 4 points, which does not compare well to the winner (more than 300 points) but is still twice as much as last year's performance.
 
8:19 PM
btw @RоryMcCune @Adi how was the rest of the conference?
 
@AviD Good. My talk went ok, interesting BEEF project talk, keynotes were interesting and Martin Knobloch got pelted with Missiles at the end :)
apparently vids will be up at the end of the coming week
 
just to update you all - although @Adi was desperately trying to avoid meeting me, and went so far as to travel around the country for an entire day in the hope that I would be gone by the time he got there - he failed, as I was still around when he finally showed up. Still, it was close, only about 15 minutes overlap.
@RоryMcCune haha that sounds fun
need to grab some of those videos
@RоryMcCune were you not on the booze cruise?
 
@AviD yar BTW unfort they were out of those snakes and ladders games, but I could ask Colin about them (or do you know him already?)
@AviD nah I succumbed to "just run through my presentation one more time-itis"
 
@RоryMcCune dont know him, no
no biggie, will grab one next time (I hope)
(I'm just a sucker for the freebies)
 
@AviD ah I could've introduced you he was there. he's a nice guy.
 
8:22 PM
@RоryMcCune oh thats more fun AFTER the booze cruise! ;-)
@RоryMcCune yeah, met a ton of the names I've heard bouncing around
 
@AviD yeah that sounded possible, but it also seemed possible that I'd try to "imrove" it while inebriated
 
@RоryMcCune is that colin cassidy you mean?
 
@AviD no this is Colin Watson
 
@RоryMcCune yeah that's the point :D
@RоryMcCune ah dont know him
 
Colin Cassidy wasn't there AFAIK
@clerkendweller, UK
Application Security, Privacy and PCI Consultant
5.4k tweets, 569 followers, following 541 users
He does the snakes and ladders thing and also the OWASP cornucopia game
 
8:23 PM
@RоryMcCune oh! I thought Clerk was his first name
 
he's a freelance tester/trainer/code reviewer type
 
yeah seen his name about a bit
oh! btw what is @MarionMcCune's version of a nice bottle of whisky?
 
@AviD yeah he's been doing quite a bit of OWASP stuff for a while..
@AviD hmm with Maz it would be Gin/Wine I'd say
 
@MarionMcCune the magic fairy! Your gifts are extremely appreciated!!
 
@AviD cool :) well as I say she's just happy it has a good home :)
 
8:26 PM
@RоryMcCune well then I'll just have to figure out how to send over a bottle of fine Israeli wine :-)
I think Sirah is the local speciality here
well, one of.
 
well I guess wine has been being made there for a veeerrry long time!
 
heh. yeah but its relatively lately that there are local wines fit for export...
some of them are really high end quality
wait wait
 
BTW did you see the fancy booze shop in Schipol?
they had some Very nice/pricey whiskys
 
back in the crusaders time, supposedly Chardonnay was originally exported from Holy Lands to France
 
I managed to restrain myself..
 
8:29 PM
@RоryMcCune actually no? didnt notice it, but I was trying to avoid it anyway.
already spent my load on conference costs and gifts.
 
@AviD yeah they had a load of > £300 bottles by the looks of things
 
wow, yeah I would not have bought those...
would have been very happy to taste them, though
 
@AviD yeah traveling is always costly. I should be able to claim most of it back, but I'm rotten at getting receipts for stuff, so I'll inevitably have missed something
 
@RоryMcCune there are apps for that.
 
@AviD yeah if I had been dressed fancy I could've tried to score some free tastes...
 
8:31 PM
snap a quick pic of the receipt as you get it, it tracks it all for you
 
@AviD yeah if I end up travelling a lot (which I kind of hope I don't) I should do that
(2 * 2 * 5 * 7 * 37 * 149 * 5417 * 148781 * 51939996061871).to_s(16).scan(/../).map { |x| x.hex.chr }.join
is a good example why manual code review is hard
'cause until you execute that it's pretty tricky to say what it does
 
@RоryMcCune is a good example of why 80% of programmers should be taken outside and shot
 
@AviD well that's kind of purposfully obfuscated, but yeah programmers tendency to want to write "clever" code is not always helpful....
 
ah well at that point, purposfully obfuscated code is already its own finding.
and would probably make sense to mock it up and execute it, since we're already flagging it as a (potential) backdoor
or just leave "potential backdoor" as the finding, that could be fun too
 
8:47 PM
@AviD true.. in that case it's Hello world..
 
@RоryMcCune ha, is it really?
 
@AviD yeah, magic of ruby :)
 
also google returns a bunch of hits on that equation
gives away the secret
ahhh and reddit, of course
you redditstealer
 
@AviD heh of course, who doesn't steal content from reddit?
 
people who dont read reddit?
 
8:52 PM
@AviD so.. no-one right?
 
@RоryMcCune umm
 
I mean who doesn't like lots of random funny stuff and cute kittens
 
@RоryMcCune "hello, world"
 
@RоryMcCune ummm
 
Don't forget the comma
 
8:53 PM
@ThomasPornin ... true true
 
 
2 hours later…
10:25 PM
@ThomasPornin pls pornin
 
@RоryMcCune CSP is very fiddly…
0
Q: Is it possible to have CSP only apply to the parent frame, not any iframes?

bjb568If I have a webpage with CSP set to: default-src 'self'; img-src * Or similar, and I have an iframe like such: some legal content <iframe sandbox="allow-scripts" srcdoc="&lt;script>alert('arbitrary code')&lt;/script>"></iframe> Is it possible to allow the code in the iframe to disobey the p...

 
11:01 PM
@Simon YOU CANNOT PLS THE BEAR
 
There's a bear here?
 

« first day (1620 days earlier)      last day (1659 days later) »