« first day (1322 days earlier)   

1:47 AM
Did we mention that moderators.SE is now in private beta? 'cause that's a thing that happened.
2:35 AM
@FEichinger Wut
SE specific moderators or a general site for moderators?
I'm assuming the latter.
@TerryChia The latter, yes.
@FEichinger Not the stupidest beta site then.
@TerryChia The arguments on the proposal's discussions were quite stupid, though.
The most recent one that made me facepalm was for a CMS that I have never heard of.
I like how "<programming language>" gets closed as a duplicate of SO every time, but "<CMS>" gets into private beta.
2:41 AM
So, I always thought the example of the XY problem on Meta.SE was a little over the top - that nobody could possibly be that ridiculously off-base from the real problem they're trying to fix. Then I handled this one today:
Q: What is the best way for the system user to open a file as another user?

James GI'm looking for a secure way to allow SYSTEM to open a file/application as another user in an automated scenario. Currently I'm doing it with PSExec, however this exposes the users credentials if anyone is watching the system with Process Monitor or even the command line column in Task Manager. ...

Any web security guys in here? :)
Or perhaps crypto people?
@AlexL A few of us hang out in here, yes. What can we do for you?
Fantastic :) Are you familiar with codereview.stackexchange.com?
Well I wrote up an encryption... tool, and there aren't many security and PHP guys over there!
Here's my code up for review:
Q: Crypographically-secure super-secret government message transaction machine

Alex L -Hello Agent. Are you on a secure line? -Yes, secured. -Good, in 30 seconds the launch codes will be in your e-mail's inbox. You now have the go. Are you ready for the package? -Yes. -The key is: "revi3wJAVA-fim++". You should have the codes by now. Be prepared to take ...

2:47 AM
I read "php" and "security" ...
@AlexL 1. Don't roll your own crypto. 2. If someone has to ask "Is this a secure line?" the answer is "No".
@Iszi ooo! I came prepared for those!
1) It's not my own, it's just a wrapper class. Plus it's for a game, so it's not production
2) That's fine, so why is it not secure? ;)
This was a rewrite of someone elses code, for a game over on CR
I'm shocked no one has anything more to add...
3:08 AM
We're still stuck on the "php" and "security" part.
@FEichinger Oh is that it? Eeek!
4:07 AM
3 hours later…
7:18 AM
@Fei - and so did music fans.SE
2 hours later…
9:29 AM
Morning all
wet and windy in Lochgoilhead today
great day for some coding :)
so today I will mostly be working on github.com/raesene/Laptop_Setup_Script
@RоryMcCune Emoji in commit messages? Shame on you!
+ looking at burps new DOMXSS capabilities...
@TerryChia I actually didn't do that it was github for windows
@RоryMcCune or kite surfing - have you thought of taking it up?
Actually nice here. Small breeze, sunshine
rained through the night, but the sun is shining in (working from home this week)
@RoryAlsop hmm not sure my body would withstand that. Also with the wrong wind I could easily end up in the firth of clyde...
@RoryAlsop nice easy commute then!
@RоryMcCune Well, I had to come back upstairs after my breakfast, but yeah...
9:49 AM
@RоryMcCune No love for the git command line? ;)
@TerryChia well I use it in Linux ofc but the windows app is quite nice :)
@RоryMcCune Yeah, the GitHub app is nice if your workflow is GitHub only.
Not so much if your workflow involves bitbucket or emailing/posting to bug trackers .patch files.
@TerryChia yeah I mainly just use github as a means of making sure I don't lose code I've written..
have more time now we've finished our "catch up with Game of Thrones" marathon
I can now stop avoiding any site that mentions it for fear of spoilers..
@RоryMcCune I think I'm only one series behind :-)
@RoryAlsop we started and it was kind of a pringles moment where once you start you can't stop and we ended up getting all the series over the MS streaming service
@TildalWave the buzzcocks.... not punk?!? well never mind the buzzcocks, I quite like this album title open.spotify.com/album/3jnQzZuyVOAgtlHWlTST1W
10:20 AM
@RоryMcCune just bought two Buzzcocks albums. Realised I didn't have much by them
@RoryAlsop Yeah I've just been listening to their singles as part of a general punk playlist, but should probably look out some more stuff.
Note to self - take external hard drive when visiting @Unpingable
oh, hang on - alternatively - take empeg external power supply, and you can hoover music off it over ethernet
@Xander and @Scott
@RoryAlsop Your comment sounds suggestive. ;)
10:38 AM
@TerryChia hahaha
wonder why it didn't onebox
A: Beers for reviews

Samuel LiewBeer as a reward is never a good idea as: Not everybody drinks beer, Shipping physical products have a completely new set of challenges that the SE team might not have the manpower to execute, especially with restrictions to import/export of alcohol to certain countries, etc., and We already ha...

Yeah - I live for the physical giveways :-) — Rory Alsop 6 mins ago
10:50 AM
@RоryMcCune I meant that particular song, the first one in the playlist. It's I believe referred to as "alternative love songs". Probably covers everything from Joy Division (Love Will Tear Us Apart) to PIL (This Is Not A Love Song) LOL
Probably stops at Billy Idol, that's a whole new genre, salivation is more mainstream :)
@TerryChia A chain of Stack Exchange pubs, now that's a scary thought. Once you're in you'd never be able to leave because there's always someone that's wrong on the internet. And if you got a beer each time you corrected one ...
@TildalWave That sounds like a fun full time job.
1 hour later…
12:11 PM
Connecting to an ssh server I dont have the certificate for in an untrusted connection... this is gonna be fun
.... and ofcourse when I call in to ask someone to tell me the fingerprint they all call me paranoid
12:43 PM
@Nick Well, you are paranoid. It does not mean that you are wrong; only that you are sick.
@ThomasPornin I have 3 malware bloated computers in the network which owners don't seem to understand what a computer is... ofcourse I'm paranoid
@Nick You know time it is? It's time to find a new job. :P
@Nick I live under the blissful belief that none of my computers are under hostile control... and it makes me happy. Which is the ultimate point.
I don't care about achieving security if it implies that I don't sleep at night.
@ThomasPornin they are not my computer but they are in my network
@Nick And your awareness makes you sad, edgy and grumpy. How can that be a good thing ?
I'm just telling that there are two paths out of this situation:
1. clean the computers, educate users and achieve security;
2. convince yourself that the problem does not exist.
Second path is much more likely to make you happy.
12:50 PM
1. believe me I've tried.... the day right after I find all auto updates off, firewall off and antivirus uninstalled..
2. but a problem *may* exist since 1 of those malware is a confirmed remote control trojan
... and when you're accessing production servers with a ton of CPU power ... well lets say who wouldn't want the key to that
@RoryAlsop Ha ha, nice. I'd take beer as a reward. Particularly if it's reasonably good beer.
You're very zen today, @Thomas
@RоryMcCune Nice to see you got ungrounded. ;)
@RoryAlsop I have prepared a bear-themed presentation for Passwords14 (Las Vegas). This soothes me.
1:05 PM
@TerryChia have done tax stuff, now doing household finances (wonders of a "day off")!
@ThomasPornin Oooh, on Makwa? Will they be filming it?
So they say:
> Adrian Crenshaw, otherwise known as irongeek (www.irongeek.com) will
> be the main responsible for video recordings of talks at BSidesLV and
> PasswordsCon. They will be made available online some time after the
> con on YouTube. We will make a publicy available playlist of the talks.
@ThomasPornin Cool, looking forward to watching it and the other talks.
You will be able to hear fine English language tortured by a heavy French accent.
1:09 PM
@ThomasPornin I already watched a talk from @RоryMcCune. It won't be worse than a Scottish accent. ;)
@AlexL You do not have to salt and hash the key if is is not weak. (I.E., random) If you wish to derive the key from a non-random source (such as a password) you still would not typically want to salt and hash it as you have done, but use a purpose built key derivation function such as PBKDF2.
A single iteration of SHA256 is much too fast, and a key derived from a weak password will be easily brute-forced.
1:30 PM
@RоryMcCune Kodiak moment?
(some of you here might be old enough to recognise the pun)
@TildalWave pffft
@TildalWave Ha.
@RoryAlsop well you know that'd include me too then?
1 hour later…
2:40 PM
@TildalWave If I remember it, we all should be old enough
A computer is like an onion: cutting through it makes you cry, but it's somewhat tasty afterwards. — Alek yesterday
@DavidFreitag Unless you're a retard like me.
@DavidFreitag Interesting. Sure enough, "Kodak Moments" still have a Facebook page, even. facebook.com/kodak
1 hour later…
4:11 PM
Oops. I think I left my snark on.
A: Unable to use internet due to suspected DNS malware

IsziIf you're absolutely certain the issue must be with malware and nothing else, despite every reputable malware detection tool saying otherwise, there's only two options remaining: Remove the hard drive, and attach it to another system as a secondary drive. Then, use the other system to scan for ...

I left my yolo on.
4:24 PM
@Iszi hahaha - I love option 2. Can we have that as a standard recommendation for the really dumb questions
@RoryAlsop I guess it could have universal applicability.
Did you see the other XY problem I had yesterday?
@Iszi dunno - linky? There were a lot of dumb/odd questions I saw yesterday
Q: What is the best way for the system user to open a file as another user?

James GI'm looking for a secure way to allow SYSTEM to open a file/application as another user in an automated scenario. Currently I'm doing it with PSExec, however this exposes the users credentials if anyone is watching the system with Process Monitor or even the command line column in Task Manager. ...

You kind-of have to read comments all over the thread to get the full picture, but most of the meat is in reply to my answer.
@Iszi You only have 4k rep on SU? You suck.
@Iszi Oh yes - I did see that one. Sometimes you have to wonder why they come up with the necessary way to do something, rather than just asking about the problem
@Simon I only have 2.4k
4:34 PM
@RoryAlsop What's really ridiculous, is he's still going on about it.
Instead of hosting the files on the web server like a normal person.
@Iszi yes! exactly
@RoryAlsop Personally, I'm proudly rocking 101.
@Simon did you just join and get your signup bonus? :-)
I joined a while ago, shamefully.
Seriously, I've read about XY problems like that but this is the first time I think I've ever actually run into one!
How is it that Beers for Reviews is sitting at -12?
4:41 PM
@Iszi Because meta users are grumpy dummyheads.
Conclusion: Meta is full of Iszis.
me so mean soz daddy
@Simon and @Thomas - thought you would appreciate this answer:
A: Kayaks vs canadians from a beginner's perspective

goldilocksIn Canada, at least, we do distinguish between kayaks and canoes, and those are the words I'll use for the contrast here. To first make sure there's no confusion, have a look at the articles in wikipedia: "A kayak is a small, relatively narrow, human-powered boat primarily designed to be manual...

Ok.... What... the.... hell?!
> However, I happen to have about 40,000 bookmarks at home and syncing them is beyond all reason. No, I cannot purge them: they are there for a reason!
Q: Sync only a single bookmarks folder

dotancohenThere seem to be a few options for syncing Firefox bookmarks, such as Firefox Sync and Xmarks. Are there any other services which might allow the user to sync only a single bookmark folder between computers? I would like this situation: // Home computer bookmarks + Animals How to pet a rat ...

@RoryAlsop Now I wanna drink beer on a canoe.
@Iszi 40,000
To search through them, you need google
oh wait
4:55 PM
@RoryAlsop Yeah. I'm not sure "syncing them" is all that's "beyond all reason".
@RoryAlsop Nah... If it's just 40,000 records you can just Bing that shit.
@TerryChia why would anyone do such a thing
Bing != 4 lyf3
Still, for the sake of argument let's say each bookmark is worth 1 kilonibble. (Probably far less, but I like round numbers.) That's a 20 MB upload, tops. Might take a minute on the home computer. Getting that 20 MB down isn't even worth breaking a sweat over unless you're on dial-up. So, even if you did choose to sync the entire database, it would be a one-time minor inconvenience - after that, any smart syncing software will just have to send/receive changes.
3 lines of text? tl;dr
5:04 PM
@Simon haha
@Iszi So, for the sake of argument, I have far less than 40,000 bookmarks, but many thousands none the less thanks to an unfortunate situation in which two sync'ing tools were running simultaneously. I can no longer sync my bookmarks at all. The sync tools have washed their hands of me and my bookmarks and will not run.
@Simon I think it's tl;cr for you.
@Xander You obviously have to backup your bookmarks duh.
In 2 different mediums.
And store one off-site.
And practice restoring the bookmarks on a regular basis.
Oh wait.
Ain't nobody got time fo dat
@Xander hmmm. Okay - tools limitation.
My mom's a limitation.

« first day (1322 days earlier)