Time  Nick         Message
13:42 pdurbin      larsks: you had asked about web-based IRC clients: http://irclog.greptilian.com/spanworm/2013-02-12#i_3147
13:43 * pdurbin    drops a link: http://irclog.perlgeek.de/crimsonfu/2013-02-12#i_6442491
13:44 pdurbin      whoops. wrong channel :)
14:41 kiwi69932    Look at me I'm using a web irc client...
14:41 pdurbin      :)
14:41 pdurbin      kiwi69932: welcome!
14:41 larsks       pdurbin: It seems pretty.
14:42 pdurbin      hmm, i didn't link it up yet. here we go: http://kiwiirc.com
16:39 pdurbin      shibboleth testing is going ok: https://dvn-vm2.hmdc.harvard.edu/secure/
16:39 pdurbin      see also https://github.com/dvn/shibpoc
16:40 shuff        yay shibboleth!
16:40 pdurbin      heh
16:41 pdurbin      i think next i'm gonna look at http://openam.forgerock.org per http://irclog.iq.harvard.edu/dvn/2013-02-12#i_691
18:14 semiosis     i played around with opends & opensso right around time of the sun/oracle/forgerock split
18:14 pdurbin      if install vmware on my mac will it break my virtualbox? http://irclog.perlgeek.de/shibboleth/2013-02-12#i_6444062
18:14 pdurbin      sorry, if i install, i meant
18:17 spilth       pdurbin: I have both on my work machine and they don't seem to affect each other at all.
18:17 spilth       Why do you think they would?
18:18 jimi_c       any PCI DSS gurus here? rackerhacker?
18:18 pdurbin      spilth: i dunno. don't they add extra interfaces and all?
18:18 jimi_c       just had a discussion of the implications of breaking encryption at the localhost level for varnish, since it can't handle https connections
18:19 spilth       network interfaces? I think they end up using their own prefixes for naming them
18:19 spilth       vm_/vb_
18:20 semiosis     jimi_c: so you want to break the encryption AND CACHE THE DATA?!?!?!
18:20 pdurbin      i just don't like loading up my mac with stuff i don't need
18:20 semiosis     ;)
18:20 pdurbin      shuff: weren't you afraid of installing virtualbox? didn't want to break your vmware?
18:20 jimi_c       semiosis: is that a meme i'm not familiar with?
18:21 semiosis     nope
18:21 shuff        pdurbin: yeah, but only due to superstition
18:21 semiosis     just seems kinda nuts imho
18:21 pdurbin      shuff: heh
18:21 * spilth     makes a GUI application in Visual Basic to cache the data
18:22 jimi_c       semiosis: nuts to cache web traffic?
18:22 jimi_c       a png is a png, whether it's going over https or not :)
18:22 semiosis     why would that be regulated by pci dss?
18:23 semiosis     i figured if you were concerned about regulation it was PII/CC data
18:23 jimi_c       the question is whether PCI DSS mandates end to end encryption, and what is the end? the server or a process on the server?
18:24 jimi_c       infosec guy's being overly paranoid (aren't they all?)
18:24 jimi_c       i'm pretty confident PCI DSS doesn't care as long as it's encrypted up to the load balancer, and all servers behind the LB are configured the same, but I'm definitely no PCI guru
18:24 pdurbin      jimi_c: you could ask in #masshackers - http://masshackers.org
18:25 semiosis     pretty sure PCI DSS requires data to be encrypted at rest as well as in flight, so caching unencrypted data is probably not allowed
18:25 semiosis     if it really is data that's regulated by PCI DSS
18:26 semiosis     last time i looked into this stuff it was to make a formal statement that PCI DSS didn't apply, so no guru here either
18:27 jimi_c       right, i wouldn't want to stick CC#'s in memcache, but is it "in-flight" once it's in the memory of a web server? it's certainly not at rest, but even if it were encrypted you can use things like strace to view that as it's read/written to libraries
18:27 jimi_c       saw a nice demo of someone doing that to sniff ssh passwords
18:34 jimi_c       ahh, think i found it, traffic on a "private network" does not need to be encrypted to meet PCI DSS requirements
18:34 jimi_c       thus, you can break encryption at a front-end load balancer with impunity
18:35 jimi_c       my setup would be better, as the traffic from the LB to the web server would remain encrypted
18:35 pdurbin      jimi_c: sniffing ssh passwords? http://blog.vpetkov.net/2013/01/29/sniffing-ssh-password-from-the-server-side/
18:35 jimi_c       yes, was that you who put it on twitter?
18:35 jimi_c       i was pretty sure it was someone from in here
18:35 jimi_c       either you or rackerhacker
18:41 pdurbin      i dunno but when rackerhacker retweets you, look out: https://twitter.com/philipdurbin/status/238221068467306496 :)
18:43 jimi_c       heh, that's a pretty funny one, i guess i wasn't following you yet at that point
18:45 jimi_c       so this is pretty scary - an MPLS network is, in the eyes of the PCI SSC, a "private network" and thus not subject to PCI DSS requirements
18:46 jimi_c       so go ahead and send that packet across the internet unencrypted, you're still PCI compliant ;)
19:09 semiosis     wow
19:48 rackerhacker pdurbin: oopsies
20:06 pdurbin      :)