Ahh apparently I committed to the reversing proposal and forgot about it...

Still not convinced the site is useful.

@TerryChia what happens if you commit to a proposal but then dont do much on it? I also committed to it but i haven't been particularly active...

Anyone have good suggestions for VNC software for Windows? I'd normally use RDP, but RDP switches display drivers which breaks GPU enabled brute force applications (much to my dismay)

@D3C4FF That's very sad. TightVNC or any similar actual VNC?

@JeffFerland Yeah. I've had firsthand experience with how insecure VNC can be so usually i avoid it, is Tight VNC 'safe'

@D3C4FF Just push it over stunnel.

Tada! SSL'd VNC.

@JeffFerland That's actually an excellent idea. :D Thanks :)

Man, I don't know what material Apple uses for insulating their power adapters, but the stuff just disintegrates :(

Like their earplug jacks? :P

@D3C4FF Haven't had any problems with that yet. Did have to solder my nice headphones earlier this week.

Ohhh. What headphones ya got?

@JeffFerland i've got a couple different headphones I use depending on where i am and what i do.

@JeffFerland Oww. I would never dare do that on my in-ears.

@TerryChia I daresay a pair of cans is a bit easier than a pair of in-ear buds :P

@D3C4FF Sony MDR-V700DJ

@JeffFerland Nice. monitor set?

@D3C4FF Heh. It's not so much a matter of how easy it is. More a matter of the value.

Yup

Had a slight problem when I first plugged them back in:

Seems that it balanced back out when the jack cooled off after soldering, though.

@JeffFerland I've got a set of 'reference' Audio Technica ATH-900X's

@TerryChia whatcha using?

@D3C4FF Westone 4. Cost a pretty penny let me tell ya.

@TerryChia ouch. I burn through in-ears crazy fast so i never bother buying quality ones. I often end up sleeping with them in and then i tear the cords :P

@D3C4FF I spend a lot of time outside the house so I need portable ones. In-ears are much more comfortable for me than the portable headphones.

Best money I ever spent imo, almost a year and a half of daily use and still going strong.

@TerryChia Solid, i've never gotten more than a year out of any headphones. the audio-technicas are the most rugged so far (which is amusing considering how much you can move them about

I wish there was a store i could try em out on :P

@D3C4FF Well, I baby mine. Considering how much they cost....

Yeah that's fair enough.

Cool. As expected. VNC doesn't fuck up my display drivers... I just have to remember not to RDP in which will promptly kill hashcat. -__

-__-

@TildalWave sweet, have a bottle standing here next to me as well :D

I use Shure SE 115

morning all!

morning ^^

@LucasKauffman Hey I think that La Couffe was the one I was searching for! It's now one of my top beers... head is not too heavy either (I had 2 of those .75l bottles and a mate of mine also, he liked it a lot shame I only had 4 lol)

@TildalWave you drank 4 bottles :P?

2 each

nice :P

It's not that bad that's like 3 normal bottles, and I made some chow next to it, baked mushrooms, cheese and crackers... just enough to settle nice :) oh and some raisins lol don't ask me why that was friend's idea

Pretty dead in here today. Where did @Adnan go?

Why do so many programmers believe that secret urls are no valid form of security?

@CodesInChaos because that's good general advice

it might work in a few cases, but it's pretty hard to pull off

The differences between having secrets in urls, cookies or POST aren't that big

each has their own share of issues and advantages

@CodesInChaos It really depends on the specific scenario in question. Urls can be shared by accident much more easily.

for a start, the URL has to be https. With http there's far too much potential for it to be in caches, logs, ...

even with https, it'll be in browser histories

just like the content of that resource can be in the browser cache

it's ok if the URL is not used by humans (so no browser history, no being emailed around, etc), and you carefully control the distribution of all the source code that contains the url

@CodesInChaos cache != history

At least for immutable resources it should be fine even if it's exposed to users

there is little difference between users sending around the url, and users sending around the resource itself

it's a lot easier to accidentally send the URL around than the resource

Showing up in referrer string is a problem, but that can somewhat be avoided either with HTTPS or by an anonymizer script that redirects the user to an external URL. But the main problem is users themselves willingly sharing links and/or screens grabs with others, and not understanding they're exposing something they probably shouldn't.

I'd argue that for immutable resources, willingness to share a url implies willingness to share the resource itself

@CodesInChaos Well not in all cases. Say I have a CMS that I wouldn't really want to advertise its location, but isn't the end of the world if I sometimes do. It's sometimes also about the frequency of exposure. If all external links in my CMS would show my CMS' location by a referrer string in other logs, that would greatly increase the risk of having to deal with attacks on the log-in system, while it's quite manageable if you only have to deal with a few instances.

@Iszi Oh, thank you very much for all those stars. Dinosaur. Hmmmph.

That's why you use redirectors. Just like cookie based auth needs CSRF tokens (which url based auth doesn't need). Each system has a few artifacts

@RoryAlsop I guess that makes @Iszi Dino?

@AntonyVennard heh

Yes, I use these "redirectors" (I call them URL anonymizers but ... whatever I don't think they have an official name) and they work better than relying on HTTPS not forwarding a referral string (because they do when the external resource is HTTPS also)

and they don't if the browser is good and you set a flag on the link

But redirectors are the only reliable one

@CodesInChaos Just be very careful how you write these redirectors, in most web libraries you won't get rid of the initial referrer string if you use "soft redirects". I actually rely on JS to do that, as it's a requirement for my CMS anyway.

I think the easiest (and possibly most secure) is to try and have as few ifs in your requirements as possible. Relying on users having some flags set in browsers, and if those browsers are even capable of... it's a nightmare to control, if nothing else.

@CodesInChaos what library are you using for your redirector? It's worth checking it doesn't attach the initial referrer to its response on 30x redirects, and if it does to somehow force it to drop that referrer or rewrite it with any bogus one. I've seen libraries that had problems with that, Indy comes to mind as one of those

I know I'm slow to the party, but damn. Smashing through demons in Diablo III is just FUN.

@TerryChia I came just for you

@TerryChia Also, xkcd.com/606

ouch. This guy deserves to fail

@TerryChia You enjoy D3? oO

I'm happy I only played on my brother's acc and didn't buy it. Disappointing game IMO

Good evening gentlemen