« first day (838 days earlier)      last day (2360 days later) » 
00:00 - 20:0020:00 - 23:00

12:17 AM
@TildalWave I don't think that was on-topic for SU, even.
@Iszi Probably not, it's now closed ;)
I've just submitted an edit for this question -
Q: What is the Log in " Register Form " in the website front page safty measures for log in?

ahmed amroWhat is the safty measures you consider in the front page register and log in form ? To make a secure medium

But I'm still not sure it's specific enough to be a real question.
1 hour later…
1:37 AM
@Xander I assume you saw his other questions?
Q: Which is better , make your registeration and log in form OR leaving the log in authentication for G+ or Facebook etc ?

ahmed amrohere on stackexchange registeration is by facebook or G+ Authentication , its easy for users to get into but is it safer than having your authentication Forms and Registeration ... Please explain , Thanks in Advance

2:06 AM
@tildalwave Yup. That one needs editing too, but at least it's more specific.
@Xander Will you do it? I really need to hit the pillow ;)
3 hours later…
5:31 AM
@RoryM what IDE do you use for Ruby?
2 hours later…
7:43 AM
@LucasKauffman for full fledged IDE's I use RubyMine, also starting to use Sublime Text, which has quite a few IDE'like features....
1 hour later…
8:59 AM
@RoryMcCune Sublime Text is sublime, I highly recommend it too.
Not necessarily for Ruby, but for coding in general.
The best bit in my opinion is that you can buy a license and use it everywhere you go - just paste in the license. That's ridiculously handy.
2 hours later…
10:54 AM
@Terry Nice blog by the way, I like your style. You should write more often.
11:24 AM
@Adnan Thanks. :) Gotta find the time and interesting topics to write about though.
12:06 PM
I really love vim, every time someone points out a new fancy key combination to me its like I'm using a whole new editor
@lynks I don't believe people who use i instead of I when talking about themselves.
@Adnan shift is waaaaay over to the left, sometimes I don't feel like making the journey
on an unrelated note, last week I switched to electronic cigarettes, 5 days in and I feel great.
@lynks What did you use to smoke?
@Adnan marlboro reds, approx 15/day, for about 10 years
@lynks Started at 14?!! Jesus!
@lynks How's the cost-benefit working for you with the electronics?
12:14 PM
@Adnan pff you know my age dammit
@Adnan it is hugely cheaper, around 1/5 of the cost
Oh the good old d days of 2 packs/day of PallMall....
Filters are for pussies.
@lynks @scott I never understood smoking. The risks outweigh the benefits.
@ScottPack I rolled drum-gold for several years too, often without filters.
@Adnan do you eat chocolate?
@lynks Nope
@Adnan Weren't you the one with the intention of not living past 85 anyway?
12:24 PM
@lynks Well I do, occasionally, like once or twice a week.
@TerryChia Correct. But even at 85, I don't want to breath from a bottle and urinate in a bag.
@Adnan so nope=once or twice a week? :P for me the risks of fatty foods far outweigh a few moments of 'taste'. whereas nicotine is truly fabulous, its up there with caffeine for me, perhaps even higher.
@lynks I apologize for the mistake, that's why I corrected it.
I don't see how you can equalize the two (smoking 15c/day and eating 2 pieces of chocolate a week).
I think you can mitigate the risk of reasonable fatty food consumption by regular exercise. I'm not aware of such property in smoking.
@Adnan I don't really, , I'm fully aware of the implications, and always have been. But for some reason I still chose to smoke. I was just trying to point out that we all do things we know are bad for us.
@lynks Which is very interesting if you ask me. How confident can I (or you) say that I choose to smoke, or I choose to eat chocolate?
I think that's the whole point of the business built on legal addiction, or, better, unstigmatized addiction.
12:44 PM
@Adnan sure, but I try not to be so sinical, we all kill ourselves one was or another. I think it's important to give people the freedom to decide.
@lynks I got my start by rolling pipe tobacco, again never filters.
It's also worth pointing out that I quit when I went on a hike and did 1 mile in 1.5 hours.
@TildalWave I was already off to bed, but I've just gone and done it now.
@ScottPack yeah my 'first' quit was after I climbed a mountain in central china
@Xander Ouch sorry, I didn't realize. I hope you're not angry with me for being too pushy, I just thought you switched into editing mode and didn't have time to reply ;)
@TildalWave LOL! No, no worries. Was just on a tablet last night, and and was being lazy. DIdn't want to expend the effort to write the edit on a virtual keyboard.
12:58 PM
@Xander :)
I think I might be starting to reach critical-mass in that I get an upvote about once per day on some old question or another.
I haven't done any effort to figure out what the critical mass formula might be.
@lynks Really? I'm not there yet. I get a few upvotes a week, but not once per day.
It's going to involve total number of posts and SEOability of their topic.
@TerryChia it might be more like 3-4 per week
1:02 PM
I'm hoping this gets another 8 upvotes, would love a gold badge. :P
A: "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong?

Terry ChiaIf a malicious user starts attacking a website by guessing common username/password combinations like admin/admin, the attacker would know that the username is valid is it returns a message of "Password invalid" instead of "Username or password invalid". If an attacker knows the username is vali...

I STILL can't believe that got 92 upvotes.
The number of posts is also going to relate to the total quantity of posts on the site.
Probably a coupe of other variables as well. I would imagine those are the three biggest indicators.
@TerryChia one more for ya :P
@lynks Whee~~~
@TerryChia Well, it's a good question. Not a very well-informed one for our community, to be sure, but otherwise good.
A year or so ago it seemed like 300 answers, on SF, was the commonly accepted critical mass. I'm sure it's higher now, probably closer to 500.
1:06 PM
@ScottPack I get the odd bump from this one security.stackexchange.com/questions/25375/…
Oh, wait... that was an answer? Yeah, crap answer there, dude. You really should do more work like @ThomasPornin.
@lynks Heh, you really have to thank Schneier.
@lynks Yeah, this one usually does it for me.
A: Tips for Securing a LAMP Server

Scott PackDavid's answer is a good baseline of the general principles of server hardening. As David indicated, this is a huge question. The specific techniques you take could depend highly on your environment and how your server will be used. Warning, this can take a lot of work in a test environment to bu...

@TerryChia I might write him a letter 'thanks for the gold badges'
@Iszi To quote @ScottPack, "That sounds suspiciously like effort".
1:10 PM
@lynks Added +1 for mentioning Alternate Data Streams on the answer you're complaining someone downvoted. No idea why TBH
You guys are making me jealous. My highest-voted answer here is barely over 30.
A: Manually adding 's' to 'http'

IsziDespite what you may think, you actually were using HTTPS. This is perhaps an over-simplification, but here's more or less what happened: When you accessed the website with http:// as the protocol in your Address Bar, you effectively told your computer "Make a request for this webpage, from thi...

@TildalWave yeah I thought that was a little odd, usually I wouldn't complain, but I just couldn't see why. ADS are (were?) quite widely used by rootkits.
@TildalWave thanks for the +1 anyway :)
@lynks True, plus no one mentioned it before which I find rather odd. It alluded me too LOL. BTW why is there a bounty on that question? What wasn't answered before it was set?
@lynks I would've given it sooner or later anyway, don't get wrong impressions ... I'm not your sockpuppet! :P :)))
I find this one troublesome. It's currently sitting at +1/-1. Can anyone tell me what I got wrong?
A: How to find out if a terminal supports UTF-8

Scott PackThe most sure fire way is to use the ‘locale’ command. It will print out all the various and sundry variables that dictate what character set to use. For instance, this is my output on RHEL5.3, set to only use UTF-8 by default. LANG="en_US.UTF-8" LC_COLLATE="en_US.UTF-8" LC_CTYPE="en_US.UTF-8"...

@TildalWave I don't know, I think the guy wants a simple 'yes/no' which is not possible for this one.
1:19 PM
@ScottPack No idea really, both proper answers (yours and from ss32) are both sitting at score of 0 while all the lame workarounds are upvoted. Those echo tests might not even indicate UTF-8 is supported, but rather some other character set that would result in the same output. Funny.
@TildalWave Good, that was my thought.
I don't necessarily mind being downvoted, I just want it to be for good cause.
Interesting. I just got endorsed for a skill on LinkedIn that I'm not entirely sure I have...
@RoryAlsop @JeffFerland @AviD One of you guys mind finishing this off? It's too localized, and really I have a hard time taking anything from someone who calls themselves "Hot Licks" as anything other than spam - whether this case is irony or parody, I'm not sure.
Q: Is there a spam storm?

Hot LicksI realize this is a bit off-topic, but don't know where else to go to ask... I've gotten an enormous amount of spam in the past 24 hours (hundreds), even after some relatively good spam filters. Virtually all of this stuff is hokey weight loss schemes, claimed to be forwarded from Beyonce, Pame...

Every time I see that I read something different than spam.
@ScottPack I've had that happen too. And I've seen connections endorsed for skills I know they don't have either. Endorsements seem pretty useless to me, so far.
@ScottPack I've seen a lot of funny voting going on on Serverfault, that's why I was enquiring about it one of my first days on DMZ.
1:22 PM
@Xander It's a not terrible idea, but yeah. Any time you have that kind of setup you have to expect oddities to crop up.
@Xander I know of a guy who put down a skill that I know he doesn't have, and he keeps endorsing people for skills that I also know they don't have. More than anything else it keeps coming down to him being clueless, as opposed to anything sneaky.
@ScottPack Yeah, I like the concept of external validation. Just seems like it needs some refinement to prevent everybody from endorsing everybody else for anything under the sun.
@ScottPack Oh I have Icons endorsed (I didn't put it in the list) by someone I helped make his icons look cuter by running them through some script of mine. Just make sure you're not too helpful, someone might endorse you for firewood chopping :)))
@ScottPack Oh definitely. I don't think it's underhanded, just a bit too easy to be overly-helpful.
@Xander Yeah. In my case it was Active Directory. I suppose I probably know more about it than the guy who endorsed me, but I wouldn't exactly put it as a skill on my resume.
@ScottPack Know what's a shame? There's really no significant incentive, nor intuitive facilitator, for you to go back and review your down-votes for possible reversal.
Though I consider it worse that you can't revoke a close vote after an edit.
1:29 PM
I only noticed that one because I looked at my last page to see what my lowest score answer was.
Ok, now I know LinkedIn endorsements are garbage. Someone endorsed me for Python. Are you fucking kidding me?
@ScottPack For me it was SharePoint. Which I've installed once. With the help of the Administrators Guide. So, I deleted that one right back off the list.
Anyone know if YouTube is still carrying on with that April Fools prank - still reading those video descriptions?
@Iszi Probably deserves to be closed, yup. I've been trying to give a meaningful answer but it just comes out as some generic setup your filters properly post, whatever I do with it.
@ScottPack sounds like it might be time for some 'endorsement trolling'
Looks like the banner wishing you luck in the contest has been removed.
1:33 PM
@lynks It would be pretty awesome to put down "cunnilingus" as a skill and see exactly who endorses you.
@ScottPack ahh so you can't make up your own endorsements for other people?
@ScottPack 'encyclopedic knowledge of local dogging sites'
@lynks You can. That's how Active Directory and Python ended up on my list. I submitted a 5 line patch to an internal python script. That's my experience. :)
@Iszi You need more chimpanzees. Works wonders.
@ScottPack Technically, the LC_CTYPE locale (that's the one relevant here) will not tell you whether your terminal supports UTF-8, but whether the applications you launch in the terminal will assume that the terminal supports UTF-8.
@ThomasPornin See, now that is helpful feedback.
To actually detect UTF-8 support (e.g. as part of a .profile file to adjust the LC_CTYPE environment variable), you have to do some trickery (namely writing out two bytes which are the UTF-8 encoding of a single character, and see how much the cursor has moved)
@ScottPack What's interesting in endorsements is that it tells you who believes in them. People who endorse you either genuinely admire you, or wish for reciprocation, or both.
1:44 PM
@ThomasPornin I have never managed to get UTF-8 chars to work, man pages often mess up their alignment, and vim gets very confused if a file contains UTF-8 chars.
@ThomasPornin Quite.
@lynks I have switched to all-UTF-8 several years ago and I do not have such problems. But, as is usual with locales, you have to switch system-wide, preferably world-wide (i.e. go UTF-8 on every single machine where you have an account, simultaneously)
The whole idea of "locales" is evil and perverse, but if you are consistent you can actually make it work to some extent.
Q: Is this Scenario Exploitable?

RobHere is the scenario: You get to overwrite 4 (consecutive) Bytes of a Userland Remote Process in Linux without Exploit Mitigation and without the ability to inject any Shellcode and you know the Process Memory Layout. Is this Exploitable?

New user obviously needs a hand in how to ask questions, but I'm not sure how to deal with it... edit the question to include additional info OP added in comments? Or should we just flag it?
@TildalWave I wrote an answer, its pretty general as the question is pretty vague.
@TildalWave I wanted to make fun of his use of uppercase, but it was too cruel.
1:55 PM
@lynks Yup just saw... reading...
@ThomasPornin What you've never heard of BURP? :)))
@ThomasPornin Do it do it
I wanted to end my answer with 'use your imagination'
managed to sneak it into a comment :D
2:56 PM
@Thomas more conclusions for you on ACOS5-64 cards. Eurgh. Drivers don't work with EIDAuthenticate on Windows :(
3:29 PM
@ThomasPornin Your rep-conditioning is very successful.
Q: Password and Generated number - How it works?

YousfIn my company, they don't allow accessing the company email or servers from outside the company network. To access the email from outside the network, you have to use: Username, password and a number generated from a small number generator. How does this verification method works?

@TerryChia Yes, I see that.
I got downvoted... what the hell?
Not from me
apparently the question got downvoted as well
but not my answer
@ThomasPornin The asker downvoted. Apparently RFCs are too complicated for him.
@TerryChia It's a shame; the one on HOTP is reasonably well written (for a RFC)
3:36 PM
@ThomasPornin Yeah, I'm surprised actually. The RFCs for the two protocols are pretty easy to digest.
@ThomasPornin Dan Boneh has started with AES and some modes of operation. The course is getting a bit more intense for my level. Do you recommend a book that can help me keep up?
@Adnan its a little outdated, but if you want to get into crypto primitives, grab Schneier's "Applied Cryptography"
@lynks What's a little outdated?
@Adnan Your face.
@TerryChia I know, right? :D
3:41 PM
@Adnan the book, it was the crypto-users 'bible' for many years
@lynks Got it, Schneier's book is a little outdated.
@Adnan Your mom also works here. :)
@TerryChia Yeah, she was a hard working woman. May her soul rest in peace.
@lynks I thought you meant Dan's course at first.
@Adnan nah, I signed up for it too (the last iteration) but didnt find the time
@Adnan My usual recommendation is the Handbook of Applied Cryptography which has nothing whatsoever to do with Bruce Schneier
But that might be the opposite of what you look for (you want a book to keep up with Dan Boneh's course, whereas Dan Boneh's course is good to keep up with the handbook)
3:44 PM
@lynks Same. Plus the math needed for crypto courses is probably too much for me right now. :)
speaking of celebrities no normal person has heard of, did I mention that I met John Romero? even got him to sign my games-company business card. major nerd-fanboy moment. I was actually stuttering when I spoke to him :P
I suggest you try implementing some crypto. CBC, CTR, OFB... are all clearer once you had some programming experience with them.
@ThomasPornin Thank you, that's actually a really nice advice. I'll get on it.
Bed time. :)
@TerryChia Was that an invitation?
3:46 PM
@ThomasPornin good advice, but Id say your ordering is a little wacky.
ECB -> CBC -> CTR should cover most bases.
@TerryChia Unless you're going to be handling elliptic curves or some of the more juicier areas of RSA, I'd probably disagree.
@TerryChia yeah as Antony says, symmetric block ciphers are very easy on the maths from an implementation point of view, they're just about substitution and permutation.
For example, I can sum up "Rijndael Finite Fields" as "arithmetic mod 256" for all intents and purposes, with a slight modification for multiplication, and you're away and can implement AES and play with it without really needing all that field theory.
@AntonyVennard slight modification for multiplication AND replacement of addition with XOR
@ThomasPornin oh yeah, and that.
3:50 PM
#DEFINE + ^ //fixed
@lynks While this would not work in C, such tricks do work in Forth. Hours of fun trying to unravel the resulting confusion.
@ThomasPornin really? I have never tried to create such a mess, but I thought DEFINE was just a simple text-substitution, and was performed before any kind of tokenisation or lexing.
@lynks No, tokenisation occurs first. Then (and only then) identifiers are recognized (or not) as macro names. So you can #define an indentifier, but not a '+'
@ThomasPornin rgr
Older (pre-ANSI) preprocessors were working on "raw text" but, even then, they recognized identifiers with their internal lexer
3:57 PM
@ThomasPornin - better than google.
(these preprocessors could replace macro names in literal strings, which was sometimes convenient, and more often dangerous)
ahh yes that sounds like it could be pretty confusing
In my spare time, around 1999, I wrote my own C preprocessor. Ugly code, but I learned a lot on how C works. At that time, I bought and read the new C standard (C99).
@ThomasPornin Just what I needed to into the depression mode.
@ThomasPornin every one of the tech-gurus I have come across has at one time or another written at least part of their own compiler for something. perhaps I should look into it.
@ThomasPornin did you write it in C?
4:00 PM
@lynks Yes.
A: The Memes of IT Security

TildalWaveMeme: Security Monkeys Synonyms: Chimpanzees, Chimps Originator: @ThomasPornin, @TomLeek (Security Monkeys), @TomWijsman (Monkeys) Date of conception: March-April 2013 Cultural height: TBD Purpose: TBD (see below) Background: Thomas' answer to a question What technical reasons are there to...

@ThomasPornin another project for me then
Parts of the code may still lie around; it was called ucpp. Someone took it afterwards, and may or may not have modified it.
OK, suggestion please!
@TildalWave I think it's too early to call it a meme.
4:01 PM
@Adnan thus the conclusion ;) but it's fast becoming one IMO
@lynks Something which is very enlightening is implementing your own Forth interpreter. Much simpler than a C compiler, and eye-opening in several ways. One step further is your own Scheme interpreter (Scheme is Forth-with-GC-and-prefix-notation).
@ThomasPornin perhaps Forth would be a good place to start :)
@lynks Does "compiling" C# into PHP count? :D
@Adnan im sure there is another name for that, something along the lines of break_all_the_things()
@lynks Back in the day (a couple of years ago) our .net teacher gave us an all-semester assignment to create a simple "compiler" C#->CIL->PHP. It was so much fun.
4:11 PM
@Adnan heh thats pretty cool
@Adnan and yep I'm sure that counts
@lynks Yaay! I'll be a guru!
@lynks Is your new smoking device chargeable with USB?
@Adnan yep
@Adnan and you can get one that runs off usb, rather than using your battery all day. but I rather feel that sucking on the end of something that is wired into your computer might garner some odd looks.
alternatively, perhaps thats where @ThomasPornin gets his knowledge from
4:34 PM
@lynks @ThomasPornin Doesn't get knowledge - he makes it.
@Iszi he'd better not go causing the singularity.
Oh, wow. Not only does he have a metric crap-ton of rep here from over 1,000 answers - @ThomasPornin has never asked a single IT Security question!
His A:Q ratio on two other sites is also better than 100:1.
@Iszi what if he is just lying about everything? he could spread misinformation to a vast subsection of our industry :P
4:50 PM
@lynks I believe that "vast subsection" would be called his "worshipers" and the "misinformation" would be "gospel". And people like you would be called "heretic", "blasphemer", and "infidel".
@Iszi 1. Thomas Pornin releases new 'super-hax0r-proof hash function', advocates its use globally. 2. Thomas Pornin teaches that patching known remote-exploits is unnecessary. 2. Thomas Pornin gets ALL the passwords.
@lynks In The Bear We Trust
@lynks Wait... you edited that and still didn't fix the numbering?
@Iszi yes, that is what happened.
5:06 PM
I think it's time to include Thomas in the memes of IT Security. He has 20% the rep of John Skeet on a site 0.16% the size of Stackoverflow.
@Adnan Been on my to-do list for a bit, but feel free to jump on that.
@Iszi I'll get on it tomorrow.
@Adnan Jon Skeet's timezone answer is still funny. mostly because of the tiny delay between question and answer.
@Adnan Da Bears!
My ratios are {19, 44, 45}:1 across SO, ServerFault, and here.
7.6 here for me
5:19 PM
Mine are {23, 8.5}:1 for SF and here. I hadn't realized how many questions I've asked.
Wait wait wait.. what ratios are you guys calculating? I'm lost
@Adnan Answer to question ratio.
5:32 PM
Discourse is now on HowToGeek! Cool stuff!
6:01 PM
@ThomasPornin writing my own Scheme interpreter taught me to hate scheme
@AJHenderson At least, now you know why.
Scheme - just a little bit easier than Whitespace
The defect of Scheme, in that matter, is not that it abuses parentheses; the problem is that it does not given an easy way to extend it with a better syntax.
That's the good thing with Forth. Raw reverse Polish is nigh unreadable, BUT with Forth you can define functions which take over the source code right away, and can implement whatever syntax you wish.
@Iszi Hmm, I'm only up to 316 answers with 0 questions and 1/10 the rep, guess I have a lot of work and rep to go...
only 90:3 on Photography though
6:20 PM
I asked 1 question on Sec.SE... taught me a lesson. 1 question on Meta.SO... taught me a lesson.... and 1 question on Travel... I got the best answer for all of them here in DMZ. Taught me a lesson.
@TildalWave the “lame tests” actually have it right: they're testing the terminal, not the environment
@Gilles yar that's what @ThomasPornin enlightened us about already :)
That occurred to me based on @Thomas' feedback this morning.
@Gilles Welcome to 6 hours ago.
I'm just glad, after 2 years, someone was willing to inform me of the problem.
@Gilles - will you be running for mod on RE?
@TildalWave no, I don't have enough knowledge or interest
6:26 PM
@Gilles Oh I didn't get the impression the 1st one is a requirement :))
and it's not “running” anyway, mods on beta sites are designated by SE
@Gilles yup I realize that, but there's that question on meta who should be mod and members just nominating their candidates
@TildalWave someone actually did suggest me, I declined, and he deleted the nomination
@ThomasPornin - my understanding on that question was that he was talking about something like Kerberos
rather than simple x509
@AJHenderson Oh yes, he is talking about Kerberos. But his suggestion indeed maps to certificates.
Also, "simple X.509", that's an oxymoron.
dammit, a meeting. See ya.
6:31 PM
@Gilles you think this private beta stands a chance in becoming public? (i've seen the appeal)
@ThomasPornin Enjoy.
@ThomasPornin ah, I see, you are talking about having the x509 granted by the authentication server and then consumed by the service provider as the mechanism of action
makes sense, I missed that in the quick read
@Gilles Doh! I've seen the appeal but I didn't see its update... it's already public LOL
7:06 PM
@Adnan - Your smiley in your sig links to SO, I just wanted to make it happy, not end up beamed to another site :P
@TildalWave I wasn't able to come up with any idea to make the links point to the same site viewing the sig. Any ideas?
@Adnan I think you can edit for each site?
@TildalWave God damn it!! It was in front of my nose all the time. Thanks, I'll fix it
@TildalWave Done.
@Adnan Cool. So you're using ? in the URL to determine which image to load?
@TildalWave Yup, I'm checking the HTTP referer.
@TildalWave I also include 2 images in the sig. One is the smiley and the other is 1x1, enabling me to embed 2 links, one with ? and the other without
7:19 PM
@Adnan So.... my gf came in my room, saw my screen and asked me "what are you looking at photos of cute boys for"? :)))
@TildalWave Please tell me that was not my StackExchange profile!
@Adnan Indeed LOL! :))) But I didn't know what to say and replied "I just wanted to make his sig smile" ... that didn't come out quite as intended tho :)))
@TildalWave This is the second time this week somebody calls me "a cute boy".
I need more facial
(since there are no good starred stuff on the right)
@Adnan 'twas not me, promise!
In one of the videos, Dan Boneh says "I'm sure all of you played with substitution ciphers when you were in kindergarten"
He made me feel really stupid.
7:24 PM
why didn't the italics work?
@TildalWave I was thinking the same.
funny because you formatted it correctly, I just copied the same and it worked
7:38 PM
@LucasKauffman, @AviD, and anybody who's doing security stuff for a non-IT company. How would you summarize your day-to-day tasks? Would you please outline your role and the things you do?
@Adnan well what do you mean with a non-it company :P?
because my daily tasks vary a lot
I was offered an entry position at an financial institute with twice my current salary, I'd like some info to know how to tailor my CV.
@LucasKauffman well not to put too fine a point on it Lucas, but you're working for a bunch of accountants ;op
@RoryMcCune LIES
well its true
heh well kind of. the Big-4 are weird companies, kind of stil accountant, and a lot of more general consultanty styles stuff...
7:42 PM
@Adnan well my work varies between pure security security and ISO standards
@Adnan the main thing that distinguishes us from most companies is that we wont be doing any implementation in general
youve got strategic consulting
and implementation
@LucasKauffman ooh, have you had to read up the ISO27XXX series past 002? I've read 27001 and 2 for my sins but stopped working in roles that gave me acccess before the others turned up...
and we are right between those
@RoryMcCune Im at 1 now :P
Okay okay, I haven't made myself clear. Allow me to word my question in a different way.
I might get to work on a PCI-DSS audit
which Im actually willing to do for once :P
@LucasKauffman ahh 1/2 are kind of interesting, they're a lot better than they used to be...
7:45 PM
one of the requirements is still having NAT internally
@LucasKauffman I'd be interested to hear how it goes. I've heard the odd "it's horrible comment" but never the details....
which is kind of incompatible with ipv6
The security stuff that I've done were mainly code audit and pen testing our own software.
@Adnan we also do that
@LucasKauffman IIRC Nat does exist for IPv6 but it sounds kind of pointless...
7:45 PM
btw which of the big four you going to?
@RoryMcCune thats the problem :P
@LucasKauffman :(
@Adnan Im busy with focusing more and more on android source code reviews
@RoryMcCune There is no technical reason why NAT would not work on IPv6.
Other than software auditing tasks, what are the stuff that you do almost everyday?
@ThomasPornin no indeed , just the the supposed rational for IPv4 NAT (lack of address space) doesn't apply to IPv6
7:47 PM
@Adnan Webapp pentests, infrastructure pentests
@LucasKauffman Check logs? Modify firewall rules? Patch management?
@ThomasPornin I still think it has a place as a basic security measure (it shouldn't in an ideal world, but the ease of misconfiguration on firewalls where everyone is addressable, just makes it "feel" like a good idea, I could very easily be wrong....)
@Adnan check logs -> yes if fraud happened, firewall rules -> checking them yes, suggesting a way to handle those yes, implementing them -> no.
@Adnan patch management we will help on setting up a protocol
most of the time we wont patch things ourselves
but for instance we do qualys scans and tell people to fix their shit :P
or vulnerability management
or disaster recovery
@Adnan from my experience in the Big 4 they very rarely take "operational" roles (although it can happen as part of an out-sourcing or co-sourcing deal) they're far more likely to do consultancy. A bit part of it is their attitude to risk management....
or crisis management
7:51 PM
@RoryMcCune For that matter, according to my measures, the whole IPcalypse thing looks like a lot of baloney to me.
@Adnan what do you want to do?
(baloney means "pretentious nonsense" but is also a kind of sausage. Weird.)
@ThomasPornin actually the Internet Census 2012 that the hacker put together made me thing the same thing. There were billions of IP addresses he didn't get a response from making me thing that there's a fair degree of growth still available in IPv4...
@RoryMcCune I am running a SSL-specific survey right now
@RoryMcCune I'm wondering because they are the employer. I will be working for them, not a consulting agency that works for them.
7:53 PM
the need of a dedicated IP for a HTTPS server is the most often cited reason for buying IP addresses
@Adnan but you will work for them as a consultant no?
but it seems that only 0.59% of IPv4 addresses (even after excluding the reserved ranges) actually host a server on port 443.
@ThomasPornin interesting, I guess that SNI hasn't got a lot of traction. It seemed to me that it would potentially mitigate a lot of that problem...
@LucasKauffman Yes and no. It's an entry position, so I'll be working in their IT department at first. Everything is very vague at this point and my interview is next Monday.
@ThomasPornin The problem as I see it isn't utilization, it's allocation. Yes, there may be very few IPs actually using port 443, but I could use a few of those IPs, and can't get them.
7:55 PM
@RoryMcCune SNI does not work with WinXP+IE, so one has to wait for WinXP to die
@Adnan mmm idk Ive never heard of internals going to consultancy
@ThomasPornin interesting. sounds like there's quite a bit of room for growth. Personally I thought that charging $1/IP/Year would sort out the scarcity problem easily. it's not a large enough amount to hurt anyone running a legitimate service but if you're sitting on 10,000 addresses for no reason it might incentivise you to free them up :)
Oooooo- 4 minutes till travel.se election finishes. After that I'll have a look at @adnan's query re working for fs org
@ThomasPornin well only 400 ish days to go before it goes out of support....
@Adnan so you'll be working for the Big-4 (sorry came in in the middle of the conversation :o))
@Rory (both of you) you ever heard someone transfering from internal to consultancy?
7:58 PM
Oh yes
Rory m, for one :-)
@LucasKauffman I'm still not sure about this "consultancy". What do you exactly mean in this context?
@Adnan you working for a big 4 and going to different clients of this big 4
@RoryAlsop heh I was more there and back again... FS company --> EY--> back to FS company
00:00 - 20:0020:00 - 23:00

« first day (838 days earlier)      last day (2360 days later) »