« first day (1823 days earlier)   

12:00 AM
Free version is useful but they moved the killer feature over to the paid version
 
So kodi really was using 300-350% cpu to stay paused; disappeared from top once stopped
@JourneymanGeek Killer feature?
(I am unfamiliar with nomachine except by name; VNC and occasionally xpra work well enough for my purposes when ssh access isn't enough)
 
Bob
> An even more extreme example is this page, which contains over 400 iframes. Without ABP, Firefox uses about 370 MiB. With ABP, that number jumps to 1960 MiB.
ow.
that explains why that page crashed my browser when I stumbled on it a while back :\
 
@Bob it does a number on Chrome with uBlock, too; 1 GB used
 
@Bob just use uBlock haha
whoever made the vim color test site is a huge troll
 
I knew what it was, what effect it would have... why did I actually load up the vim colour test??
 
12:14 AM
@allquixotic you can always try firefox :P
 
@bertieb masochism
 
@tereško /firefox/edge/
 
Bob
@allquixotic Vanilla Chrome is ~90MB (for that tab. ~200MB overall)
 
@PatoSáinz That's an interesting way to spell 'stupidity' :P
 
@bertieb yeah ... well Win10 refers to Edge as "internet explorer"
that said, I already have a secondary browser for developement: Vivaldi
 
12:16 AM
@tereško I still think of him as the guitarist for U2, no matter what Windows says
 
they should have kept the "Spartan" name
 
(my suggestion may not have been entirely serious :P)
 
@bertieb omg, they should totally play a commercial for Microsoft Edge with The Edge singing Van Diemen's Land
 
Bob
Vanilla Firefox is similar. 95MB explicit allocations for that tab, ~200MB overall.
 
@bertieb U2 is a registered trademark of Apple Incorporated.
 
12:17 AM
@allquixotic Heh!
 
Bob
Oh, wait, FF is ~270MB overall o.O
 
@PatoSáinz I'll turn myself in at the nearest detainee camp Customer Enrichment Center. I love Big Brother! Think Different!
 
Bob
(I have too many FF processes running... getting confused)
 
@Bob 1
well .. 3 (main process, root access updater and sync)
 
While updating that, SE chat helpfully warned me I had "10 seconds left to edit". I DIDN'T KNOW WHICH WIRE TO CUT
I think I need to go to bed
If I'm in a state where I think making Apple--1984 jokes are at all amusing or original, something is wrong
'night all; enjoy the creeping tide of Windows 10 icon questions
 
12:23 AM
@Bob FF is the last single-process browser
also, I would recommend using Aurora update channel (it's currently at 41.0a2)
 
In other words, use Firefox Developer Edition.
 
yes
it's also surprisingly stable (mine hasn't crashed since I got this PC 4 months ago)
 
Bob
12:41 AM
@tereško I am aware of that, and I honestly don't particularly care.
e10s is in the works, and a nice-to-have, but not a breaker
I'll be happy as soon as the 64-bit version is out (scheduled for next rel, in a week)
@tereško I have Aurora installed for some testing, but I would not use it as a primary browser.
It might be mostly stable for common use cases, but it is not stable.
I've already gotten it to crash rather spectacularly on some specific webapps.
 
@bertieb nx3 let you run persistant, terminal server type linux sessions
 
@Bob strange. It has been extremely stable for me (more than the "stable" FF version)
 
Bob
@tereško Heck, they even broke the UI a couple updates back.
It leans more on the side of "rather unstable" than "stable".
You might be lucky with simple uses, but the fact remains that it's barely out of Nightly.
Even right now I'm testing a d3 graph in Aurora and it's glitching out with the rendering.
Take this example partial screencap:
That's supposed to be solid white (background).
 
1:31 AM
Uuuuughhh... had "Firecracker Chicken" at lunch today. Pretty sure I'll be frequenting the bathroom several more times today.
 
> Firefox Developer Edition is experimental and may be unstable.
What part of that don't you understand? :P
(About screen.)
 
@DragonLord which part of "for me" did you not understand?
 
> Firefox Developer Edition is experimental and may be unstable.
 
lol
Okay, then. That was just for a quick laugh.
Gotta get to bed, see ya.
 
Bob
Hey, look, it just crashed again! -_-
 
1:43 AM
jesus sometimes it's hard to find random stuff not from china
 
1:57 AM
....
RUSSIAN COMPONENTS. AMERICAN COMPONENTS. ALL MADE IN TAIWAN CHINA!
 
have you seen that movie?
(one of my favorites, that's why I'm asking)
 
hey guys, anybody familiar with lastpass here? im thinking about starting to use it by my concern is that if your host (or one of your devices employing last pass) is compromised, wouldnt that essentially give the attacker full access to all your passwords for all your sites? sure if its compromised they could install a key logger without last pass but then theyd only get credentials for the sites i log in to while as opposed to all of them ive ever used last pass on
 
yes
 
isnt that a bigger risk then lastpass servers getting compromised (and ridiculously hashes being exposed)?
there are plenty of zero-days that can infect a windows host. and once your box is compromised, all your passwords are toast
 
any route you take to actually store a password somewhere there is risk
 
Bob
2:03 AM
@n00b That equally applies to any password manager.
 
if you're really worried about it just use an airgapped raspi or something cheap and don't let it touch the internet
 
true. i just havent used one before and am considering the risks.
 
then again someone can just break in and steal it
 
Bob
At the end of the day, if your system is compromised you're screwed anyway.
And overall it's better than reusing passwords (where any single site leak would compromise many of your accounts).
Obligatory relevant xkcd:
 
@ekaj: Yup. Actually watched it for that scene ;p
 
2:05 AM
Yea, I can see down sides to both sides, I'm just wondering if i am opening myself to bigger risk by consolidating all accounts and passwords in one place to where if im compromised im giving the attacker everything in one bow tie package vs them having to extract it manually from a dump of key logs and waiting for me to login to every site that interests them.
 
Bob
@n00b Out of the probably dozens or hundreds of accounts you have, how many are that important?
You most likely don't care about the vast majority.
For most people, it boils down to email and banking.
Your premise is wrong, because most attackers (a) don't care about most of those accounts either and (b) can retrieve/reset those passwords given your email account anyway.
An attacker getting access to your entire database is more or less the same as an attacker getting access to just your email and banking. The rest of the database is unimportant.
 
Good point. The accounts I care about I login in to regularly from my host anyways so theyd be compromised if the attacker was looking through all keystrokes/pages browsed. Speaking of email, would you recommend not storing your email creds in the password manager then?
 
Bob
Meanwhile, if you reuse passwords then any web service has the potential to access your important subset of services.
 
Especially since its used in so much two factor auth. scenarios.
 
Bob
Another way of thinking of it is even with password reuse as long as your important accounts use unique passwords that's not an issue.
 
2:09 AM
well, I certainly use different passwords for my banks, email and other sites but yea, most people dont. point taken.
 
Bob
@n00b I use a unique password for my email and banking, not saved. But that's not strictly necessary - I only do so because I actually need to log into those without the password manager, so it also needs to be something I can remember.
 
@Bob: no OTP generator?
 
Bob
@JourneymanGeek No. That places a dependency on access to my phone.
 
@Bob: heh s/phone/little airgapped keypad keyfob
 
Bob
@JourneymanGeek Depending on a physical device is all well and good for security, but it's also significant inconvenience if you ever lose it.
Pros and cons.
 
2:13 AM
@Bob: all banks here have that as a compulsory, government mandated security measure
 
Bob
IMO, my password is probably (!!) long and complex enough to be unguessable, and an attacker capable of keylogging me can probably perform an active attack anyway.
In the event of an active attack, multi-factor becomes useless.
It does provide security benefits against passive attacks.
If a backup device was possible (and easier), then I might go for it.
 
Bob
@JourneymanGeek Think of the scenarios where that helps.
 
silly HTTPS...
 
they call that rubber hose crypto I think
 
Bob
2:16 AM
For most users with weak passwords, a physical token is very useful.
 
@Bob: keylogging ;p
ANd that's most users
 
Bob
@JourneymanGeek A passive keylogging attack is only slightly more likely than an active attack.
An active attack implies the attacker is able to control your web browser.
They can retrieve the login token. They can make requests (with that token).
A one time password doesn't protect against that.
In some high-security situations, where the software is suitably secured against an active attack, the passive attack becomes more likely and more important.
For a typical computer? Not so much.
The physical token still increases security. Still not a panacea.
Though, there is one (partial) exception.
A keylogger can be more easily implemented entirely in userspace on your typical consumer OS.
 
what protection does having your email creds outside the password manager provide if your host is compromised?
 
Bob
Then again, it's also not difficult to silently install a browser extension with just user privileges...
 
(and your banking creds for that matter too)
 
Bob
2:22 AM
@n00b None.
If your system is compromised, you've lost. Period.
 
you just do it so that you can access those off your host? I thought you could get those off the password manager website (at least for last pass)? I havent used it but just what i gather from their marketing material
 
Bob
The usefulness of something like multi-factor mostly lies in (a) a well-secured system or (b) just a general defence-in-depth.
There are generally more and easier passive attacks.
But in the current environment active attacks are easy enough that the distinction isn't too important.
Might change in the next few years. Not yet, though.
@n00b I use KeePass.
Not too familiar with the internal workings of LastPass, but the concept is similar.
Namely, saved passwords are encrypted locally (via JS, browser extension, etc.).
LastPass is more susceptible to a server compromise. Their database is safe, but if an attacker can get access to their webserver then they can modify the site JS to send your passwords elsewhere.
 
@Bob: how do you manage your key file on keypass?
 
Bob
@JourneymanGeek Password DB is shared via Dropbox. KeePass key is a combination of a memorised master password and a local keyfile.
 
Bob
2:27 AM
If an attacker has access to my system, yes, they can retrieve my keyfile.
But they could also simply watch as I open the DB, or watch the password entry, or catch the login session.
Assuming KeePass DB is secure (no implementation bugs in AES, etc.) then I could give out the database publicly with no harm.
@JourneymanGeek One place where a one-time password might help is if you're logging in on an untrusted machine.
But then one wonders why you'd do so.
...and if the machine simply has a keylogger, it helps. If it has something more complex... the OTP doesn't do much, again.
 
@Ramhound superuser.com/questions/949644/… I've not seen desktop consumer memory without heat spreaders in ages. Even my low voltages stuff has it.
 
same.. the ones I have bought previously with heat shields looked like they were mainly aesthetic
 
@Bob thanks for your feedback, very helpful. Can you recommend a consumer level IDS that free or cheap? ive heard of snort, never used it though
just for a home computer
 
is this for your whole network or a single computer
if it's for a single computer, you could run a HIDS like this (never used it) or Snort is prob fine - sectools.org/tool/ossec
 
thanks
 
Bob
2:58 AM
@n00b Just remember that it's my opinion :P
Some of it (especially the parts about multi-factor) probably go against common security recommendations.
As for an IDS... shrug
That's a difficult one.
 
3:11 AM
Where can I host text files online for free. Similar to pastebin.com but it allows me to wget the file?
 
dropbox IIRC
 
but an account is required for dropbox correct?
 
Surely there's something there that'll work for you. ;)
 
(I donno. Being able to pass around arbitrary files entriely anonymously seems slightly dodgy)
 
3:22 AM
@William pastie.org and use the raw feature
 
4 day weekend this week
HOPEFULLY I can sink my teeth into a few things I've been delaying a while.
(7th august to 10th auguest - 9th is national day)
 
@JourneymanGeek I'll be having a 2 week holiday shortly... Our baby is due in less than two weeks. D:
 
congratulations.
 
Thanks :)
These things are super expensive though. Wow.
 
lol
government wants babies so... they have decent subsidies for this.
(so its not too bad here. Suprisingly)
 
3:51 AM
@MichaelFrank are you still torturing that guy superuser.com/questions/949608/… :-) why you call yourself excel-luver and not know your apples from you oranges.
 
@JourneymanGeek Yea - We don't have much here since I earn 'too much'.
 
@MichaelFrank: they want richer/more educated people to have babies here ;p
 
@Psycogeek I'm genuinely trying to help that guy! It's not my fault he can't easily describe what he wants.
 
^ every end user ever
 
@MichaelFrank yup, i think he is a bit bananas :-)
 
3:56 AM
@MichaelFrank: tho
At this point
POST AN ANSWER
you can always adjust it later. Might as well get the rep for the effort
 
"were not a script writing service" but we are a excell formula writing service , and a ffmpeg scripting service and it has worked out pretty good.
"Teach a man to fish. . ." and you can still sell him bait tackle and new gear for the rest of his life.
 
Sadly, it probably won't even have enough gas to make it to the first border crossing.
3
 
hahahaha
 
4:15 AM
(also, that would probably never work for me. I tend to break voice rec systems ;p)
 
4:30 AM
@JourneymanGeek How do I explain this to a guy that can't explain his list?
=IF(FRUIT="APPLES",IF(Sheet2!B12<>"0",Sheet2!B12,IF(FRUIT="BANANAS",IF(Sheet2!C‌​12<>"0",Sheet2!C12,""),"")),"")
 
;p
vera carefully.
 
I'll finish tomorrow. Gotta go home now.
 
4:54 AM
ugh.
I might have made a mistake with my show t shirts. They're the wrong size in the order list they sent ; ;
@Psycogeek: Oh, the vagueness of that answer of mine you edited was intentional.
I figured I'd have it cover windows 7 and 8
 
I know, i just figured that a primer from the link would not stop anyone from going there, and still PROvide :-) the quick data.
I think it would be time better spent mixing chocolate pudding and cool whip 50-50. — Moab 13 hours ago
 
(also, original answer was posted off the top of my head)
Interesting "verbal" tick I noticed. I tend to start off informal emails with "heya"
 
5:16 AM
Here is a quandry this is the question superuser.com/questions/949700/… and this superuser.com/questions/949234/… QUESTION is a possible real fix for it , to download the windows update troubleshooter.
 
There needs to be a canonical, well written question for that. And a good answer
then we can close all these.
 
I do not suppse there are any moderator tricks , that can pop that under there :-)
 
Could anyone recommend a refurbished laptop reseller?
 
Bob
@ekaj ...Dell outlet?
 
5:22 AM
heh, I'd never heard of that
 
Apple does that too
 
thank you
 
As does lenovo
 
I'm guessing not many options in the 200 dollar range though since they're manufacturer refurb?
 
hm
What're you looking for specwise?
 
5:23 AM
it's just a day to day comp, word, email, etc
 
HP stream is around that price, new
 
so nothing beastly, like 4-6 gigs of ram, maybe 500gb hdd, win7 or 10,
those look interesting
nice that office 365 is included
 
no you buy refurb (depending on the type of refurb) they never actually fix things, or solve the lemony of them. it is often more like a recycled fail. But discovering WHY a certian model is rejected (general reviews), and seeing if that would effect your specific needs. Regret always comes in the form of reading about the problems of a device , when searching for Why you now have them,
 
5:51 AM
I'm looking at a MySQL field and it's got [BLOB - 222B] in it, what does this mean?
 
6:03 AM
location or size in hex of a Binary Large OBject ?
which (via the web) looks to be mostly about putting pictures in the database
 
@ekaj: I'm probably removing that once my subscirption is over
its 32gb of storage, 2gb of ram, so not much
 
what is?
the hp stream?
 
The HP stream
yup
 
@Psycogeek hmm... Okay. For some reason I forgot the password to my mediawiki install and wanted to extract it from the BLOB
 
6:38 AM
0_0
 
Bob
@Psycogeek Dell outlet is largely not actually refurbished
a lot of them are customised (business) orders that are then cancelled
 
re-box , re-pack get some good ones of those at newegg too, there it might be missing a few screws :-) same thing applies, some of the returns come from post order learning.
I suppose CYA still exists for all situations anyway. 20 great reviews 2 bad ones, get home with the product , and really test and use all aspects of it, you start agreeing with the 2 bad reviews (even though it may not cause a problem for you)
 
6:53 AM
hm. I got spam for 'drugs for dogs'
 
superuser.com/questions/384472/… Cheapskate is one thing :-) but tying to leach a computer expo giveaway that is only 2g :-) One could probably find a place that sells those for 1-2$ each in the thousands.
That is like getting free advertising pens and trying to get the logo off them :-) I think the firmware in those locks a section out, not a partition that a user tossed on?
oops really wrong link superuser.com/questions/949666/…
~$4 for promotional printed 4G sticks in even smaller quanitites
 
7:22 AM
hm. I've heard that 'partition as a cd device' trick
Can't remember what it was called
U3!
 
CDemulation, i have a USb device that uses that method for its certannly locked down data area where the devices programs are strored.
Wiki "Some preloaded drives are read-only, while others are configured with both read-only and user-writable segments. Such dual-partition drives are more expensive"
 
7:49 AM
I figure those locations that have learned how to hack the firmware on usb sticks could probably undo it too. there is at least one place on the web i saw that was trying to fix Fake Usbs . there is usually either a hard device or a mess of software and Bs to have to go through that makes buying a 2gig stick look like childs play
Ahh what some people will go through to save a buck. why just 20 miles from here I can buy gas for 5cents less :-)
still trying to figure out how much the dog can carry :-)
 
You need a bigger dog ;p
 
@Psycogeek What I don't like is it's trackball being in the middle. I will sure accidentally roll it with index and finger beside it. I think Logitech M507 Trackball that has it on the left that you control with your thumb is best in this case. I will try it although folks report replacing them once a few years or 1 year and each time quality differs. Too bah I don't have places here that allow test drive it. If you buy and open the package it won't be eligible for returns.
@JourneymanGeek I am in a library connecting through HTTPS to sensitive account. Should I worry about eavesdropping or any hacker activity? I was thinking about using my older laptop at home for VPS purposes to tunnel through. Should I?
 
Libraries are a morass of unprotected unpatched systems.
I'd be worried, but I'd never use a public PC
 
Bob
8:18 AM
@Boris_yo HTTPS only guarantees end-to-end encryption. If your endpoint is untrusted, HTTPS does not help.
 
@Boris_yo in 'merica you buy , you no like, you return. in most states they must tell you there are no returns, and it has to be on the reciept and all. This new Human Proof packaging , that you have to shred to get into. i really think that stuff tries to keep people from returning, but none of that is my fault, so if it sucks I return, even if it wont fit back in the box ,
 
8:31 AM
public computers are a great place to get accounts , people leaving them logged in, and walk away. at home when have you had any requirement to forcefully log-out of web locations
I think most people are a whole lot better informed, then you still have the last 20% who also use Batman as thier password :-)
 

« first day (1823 days earlier)