The DMZ

Terry Chia

1:58 AM

@schroeder Holy...

Terry Chia

4:56 AM

@ManishEarth Hey, how do I upgrade the Rust build to the latest nightly? Run the latest rustup script?

ManishEarth

@TerryChia Run any rustup script :)

sudo bash rustup.sh

Terry Chia

@ManishEarth Ah cool.

I'm still sad Rust doesn't have list comprehensions. :P

ManishEarth

@TerryChia rfc it!

Terry Chia

@ManishEarth That's work.

I don't even bother writing PEPs for Python for things I really want.

The checked arithmetic thread on /r/rust is pretty interesting.

ManishEarth

@TerryChia btw, check out github.com/Manishearth/rust-clippy

Terry Chia

5:02 AM

Neat.

Do you know any good autocomplete vim plugins for Rust?

ManishEarth

@TerryChia racer?

Terry Chia

Cheers.

CyanogenMod IS computer security: A tower those in the know occupy, from which they blame plebs who haven't ascended as unworthy of safety.

Tweeted by SwiftOnSecurity on November 29, 2014 at 4:55 AM

Terry Chia

5:48 AM

@ManishEarth What does "A" mean in Rust docs?

For example, Option<(uint, A)>.

ManishEarth

6:43 AM

@TerryChia generic?

link pl0x

Terry Chia

@ManishEarth Ah right, generic makes sense. doc.rust-lang.org/core/iter/trait.Iterator.html

ManishEarth

@TerryChia pub trait Iterator<A>

wait what

they broke iterator

what happened to all the useful methods

ohhh

doc.rust-lang.org/core/iter/trait.IteratorExt.html

cheese moved

Terry Chia

The docs are pretty confusing to navigate imo.

ManishEarth

@TerryChia there's a search bar

Terry Chia

7:18 AM

@ManishEarth You know the thing that bugs me the most about developing in Rust or other static languages? Not having a REPL to experiment in. :P

ManishEarth

@TerryChia there used to be one. Now removed

gdb gdb gdb

gdb

or lldb

Terry Chia

@ManishEarth How is a debugger the same thing as a REPL?

ManishEarth

@TerryChia Not the same, no

but gdb is pretty good with Rust

Lucas Kauffman

7:35 AM

morning

ManishEarth

I think mitsuhiko implemented some kickass Rust formatting thingies for gdb. or lldb. forgot

@LucasKauffman hello llama

Lucas Kauffman

@ManishEarth what is this Rust

ManishEarth

it is that which causes gangrene

Lucas Kauffman

@ManishEarth It says on their website

In theory. Rust is a work-in-progress and may do anything it likes up to and including eating your laundry.

ManishEarth

yep

Can confirm

I lost a sock while programming Rust

Also Rust ate a pizza of mine

Well, my friends did, but it was because I was programming and I didn't come over to their room in time

I blame Rust

Lucas Kauffman

9:00 AM

David Freitag

@LucasKauffman Hehe

Terry Chia

9:43 AM

@ManishEarth Wait, I thought <T> represents generics?

ManishEarth

9:56 AM

@TerryChia and?

pub trait Iterator<T> -- now any T in that trait is the generic

similarly, impl<T> iterator<T> {....}

Terry Chia

@ManishEarth So what's the difference between <A> and <T>?

ManishEarth

@TerryChia nothing?

Terry Chia

@ManishEarth Now that's just confusingly inconsistent documentation.

ManishEarth

You can even do pub trait Iterator<T> {....} and then impl<A> Iterator<A> {....}

@TerryChia where do they use both?

Terry Chia

@ManishEarth I'm seeing some places use <T> to represent generics while others use <A>.

ManishEarth

9:58 AM

Within the iterator docs A is consistently the thingy being iterated over

@TerryChia Oh ah

Terry Chia

So I was confused about whether there is a difference between the two.

ManishEarth

This might help understand why

impl<A, T: Iterator<A>> Iterator<A> for Take<T>

In general trait params go A,B,C... , and struct/enum/fn params are T

Terry Chia

Ahhh.

ManishEarth

You will be applying the trait onto a struct/enum, so it's less confusing if the type params don't clash. Of course you can bind them however you want

(impl<X, Y: Iterator<X>> Iterator<X> for Take<Y> works too)

Basically, it's a generic. The identifier behind a generic is local to the trait def/impl/struct def

That behavior is the same in all languages with generics

Terry Chia

@ManishEarth You can tell I don't have much experience with generics. ;)

ManishEarth

10:12 AM

@TerryChia do more java plz

Terry Chia

@ManishEarth Eww no.

ManishEarth

@TerryChia also, there is a #rust-crypto IRC channel on Mozilla

@TerryChia haha

Terry Chia

@ManishEarth Meh, pinging you here is easier. :P

ManishEarth

No, I mean you'll find out what people are doing now in Rust

Terry Chia

I'm actually writing RC4 in rust now to get a good feel for the language.

ManishEarth

10:19 AM

@TerryChia is there already a library for that?

Terry Chia

@ManishEarth I see a few implementations.

ManishEarth

If not, be sure to ping erickt or someone and get it known

ah

oh, there's one by Tim

Terry Chia

I like implementing RC4 as a "first project" thing for a new language though, the algorithm itself is simple but it deals with loops and arrays.

ManishEarth

ah

be sure to use iterators plenty

IteratorExt details all the methods you can run on an Iterator

Unfortunately this newfangled idea of using extension methods breaks docs

Terry Chia

@ManishEarth You know, I still find it jarring that map() is a method instead of a function.

ManishEarth

10:27 AM

@TerryChia isn't it a method in python?

wait no you use comprehensions like a good kid

Terry Chia

@ManishEarth Nope, it's a function.

map(func, iter) instead of iter.map(func).

I like the convention where methods modify the object while functions create a new object.

sorted() vs .sort() for example.

ManishEarth

10:44 AM

@TerryChia treat iterators as modifying things, since they're chainable

they really wrap the object, but the chainability makes it better as a method

Terry Chia

11:22 AM

I like the one for IT Consultant. /cc @LucasKauffman

kalina

12:15 PM

oh look, an All Saints acapella

I was actually joking but a bunch of people on IRC have filled my received items folder with random pop acapellas

Rоry McCune

@LucasKauffman aaaand it's a client

Terry Chia

12:47 PM

0

A: Tecniques to make a login page safe without using SSL

What could be other good advices, to achieve as much security as I can without using SSL? You can use TLS instead of doing anything stupid.

I demand all the upvotes.

kalina

cba

you're not worth the effort of logging in

Terry Chia

@kalina :(

What happened to @Fei btw?

kalina

I don't know, in case you haven't noticed, I haven't been around all that much

Terry Chia

@kalina I thought you had contact with him outside the SE network so I thought I'd ask.

kalina

I haven't logged in to any form of communication that isn't group based

if I log into Steam, that will be literally my entire day gone from people wanting to know every minute detail of what I've been up to for however long it has been since I last logged in

and I just don't have the time or the motivation to deal with it

whereas you guys and people on quakenet are more than happy to accept "I've been busy" as my entire explanation

Lucas Kauffman

1:00 PM

►

Gilles

1:41 PM

@TerryChia bleh. DTK wrote the same answer, only better — he explains, you insult.

1

A: Tecniques to make a login page safe without using SSL

Why are you refusing to use TLS? It works, it has a good track record (some minor exceptions aside). Refusing to use good tools without a compelling reason does not engender confidence and does not immediately suggest professionalism. Additionally, do not roll your own authentication system. Th...

ManishEarth

@TerryChia @Gilles neither are answers

Terry Chia

@Gilles Typing long paragraphs is boring.

ManishEarth

There are legitimate reasons for not being able to SSL

There is no complete solution to the OPs question, but there are ways to impede attackers

Terry Chia

@ManishEarth Then you shouldn't be having login pages.

ManishEarth

Why not?

Terry Chia

1:44 PM

@ManishEarth Because easy MITM? I can't believe I'm typing this.

ManishEarth

Let's say I'm a university student, using a shared uni-provided server with no SSL support because I have fucking idiots as sysads (This is the case where I study). I wish to create an election page based on LDAP login for electing student representatives. MITM is possible within the institute -- though I can take measures to isolate election booths (which are set up in each hostel), I cannot avoid it completely. How do I make it very hard for an attacker?

Terry Chia

@ManishEarth How is that scenario remotely similar to a web page?

ManishEarth

@TerryChia The election login portal is a webpage

Terry Chia

@ManishEarth The OP mentions a webpage and Facebook. That implies it's being served over the internet.

ManishEarth

Sure

and...?

that's actually less MITMable

And in such a case some simple blocks like hashing will deter most attackers

Terry Chia

1:48 PM

Also, you don't use TLS but you have an even more convoluted protocol available to you. It's not even remotely similar to accomplishing it using only Javascript.

ManishEarth

since attackers don't focus on a single site

@TerryChia TLS requires you to mess with apache. One may not have access to that.

Terry Chia

@ManishEarth Errr, no? That's trivially MITMable by anyone in a coffeeshop.

ManishEarth

@TerryChia And how many coffeeshop MITMers are there?

Again, deterring someone who is broadly trying to MITM everything is easy

Deterring someone who is focusing on your site is hard/impossible (sans TLS)

Terry Chia

@ManishEarth You say this as though there are only two categories of attackers, script kiddies and sophisticated attackers with large resources. You forget the very large group in the middle with somewhat limited resources but enough knowledge to take 15 minutes to slightly modify an already existing attack.

If I am in a position to MITM you it takes all of 10 minutes to defeat whatever checks you try to put in place using Javascript served from your server.

ManishEarth

@TerryChia My point is that there are easier fish to catch for them

Terry Chia

1:57 PM

@ManishEarth It still doesn't make a login page without SSL anywhere remotely close to "safe".

ManishEarth

@TerryChia The majority of users will be using it from home or work or some place with a large accessible subnet. I'm pretty sure that the majority of MITMs at that level will be broad sweeps, not nitpicks

Terry Chia

2:13 PM

@ManishEarth I honestly cannot believe I'm debating the fact that TLS is a requirement for login pages in The DMZ. You can come up with whatever justifications you like to try and explain why TLS is missing but using JS crypto for this doesn't make your page remotely close to safe even if it deters the most lazy attackers.

It may be good enough for a particular usecase like a site you don't care about at all but it doesn't make it safe.

ManishEarth

@TerryChia And...

That's sort of what I'm saying

let him be the judge of how good enough it should be

answers are for answers

I'm not saying it's safe

I'm saying that there may be something good enough

Terry Chia

@ManishEarth Do you honestly believe the average developer is in a position to judge whether a proposed security solution is "good enough"? Any answer suggesting anything other than "Just use TLS goddammit" is irresponsible.

ManishEarth

@TerryChia No, I don't believe that.

But at the same time, we don't know enough of the circumstances

For someone without access to TLS, "Just use TLS goddammit" isn't helpful

It's like the common question about providing SSH passwords by commandline. The correct way to do it is to use ssh-copy-id or some such. But this may not always be possible (eg when you have some dynamic stuff), then the solution via expect is much more helpful.

Terry Chia

@ManishEarth Literally the only circumstance where a half-baked scheme implemented in JS is "good enough" is if the developer doesn't care if the traffic gets MITM-ed. If you don't have access to TLS and care about security, get access to TLS.

ManishEarth

@TerryChia Again, sometimes marginal security is enough to deter a chunk of would-be attackers

I can understand "don't roll your own crypto". There is no conceivable restriction preventing someone from using existing crypto (except for contests, and we don't help with those anyway). But an answer telling someone to use the thing they explicitly said the can't/won't use (when there are conceivable situations to use it) is not really an answer, IMO. Especially an abrasive one like yours :/

(Sorry, just trying to be frank here)

Terry Chia

2:30 PM

@ManishEarth I'm not defending my answer at all. I was bored, it's terrible and I don't really care if it gets downvoted or deleted. But a good answer will be one that expands on why using TLS is the only sane option.

"sometimes marginal security is enough" is one of the reasons why everything is broken.

Do it right or don't do it at all.

ManishEarth

@TerryChia agreed

I'm okay with that

Terry Chia

@ManishEarth Comments or critiques? github.com/Ayrx/rust-rc4

ManishEarth

@TerryChia note: you can post on reddit for code review too :p

Terry Chia

@ManishEarth Aye, maybe later when I'm feeling more confident. :)

ManishEarth

hah

Terry Chia

2:39 PM

The test framework Rust ships with bugs me.

It tells me the tests fail but it doesn't show me what the failed output and expected output was.

And I miss all the niceties of py.test. grumbles

ManishEarth

@TerryChia Rust frowns on having outputs as &mut arguments

Returning a Vec would be nicer

Terry Chia

@ManishEarth Ahh ok. That was a pretty C-like way of writing it I guess.

ManishEarth

Though it might be better in some cases. Dunno

Terry Chia

Is there a idiomatic Rust document ala PEP 8 for python?

Or maybe that needs to wait till 1.0. :P

ManishEarth

the Rust Style Guide?

Terry Chia

2:43 PM

@ManishEarth Oooh, must have missed that.

ManishEarth

@TerryChia also, less for loops, more filter() map() and all

Though in your case that may not work

Terry Chia

Looks like it isn't linked from the docs?

ManishEarth

It's unofficial I guess

Terry Chia

@ManishEarth I don't think map() will work out in this case.

I always try to use functional constructs over loops whenever possible.

ManishEarth

yeah

there are mutable mappy thingies

Terry Chia

2:45 PM

My Python code has some crazy list comprehensions in them.

ManishEarth

haha

in my freshman year there was a python session and coding challenge for freshmen

I found the questions easy, so I resolved to do them all in one line

was fun

Terry Chia

@ManishEarth Heh.

ManishEarth

such comprehension

Terry Chia

Only thing that bugged me about functional programming in Python is the stupid ass lambda syntax Python has.

It's waaaaaaaay too limited.

So I often have one-off functions defined inside my functions just to map them to a list.

Lucas Kauffman

3:42 PM

@TerryChia and confusing

I dont like lambda expressions

I think scala is a bit better at that than python

Terry Chia

@LucasKauffman Yeah, scala's lambdas are a lot better. Most functional languages are.

Python's is really crappy.

Lucas Kauffman

@TerryChia Dont you call her that!

unless of course you're talking about just functional programing

Terry Chia

@LucasKauffman Well, specifically the lambdas bit. :)

Simon

You're a bit.

TildalWave

4:20 PM

@Simon you're lambdas

Thomas Pornin

7:08 PM

When I go to Youtube, it automatically suggests a video of some guy shooting at doughnuts (with a bow and a pistol).

5

►

Rоry McCune

@ThomasPornin I thnik that shows that the machines are getting too intelligent!

Thomas Pornin

@RоryMcCune The Singularity has already happened -- and the machines have been hiding it from us.

Rоry McCune

@ThomasPornin only to leak it in a moment of carelessness, a fatal weakness!

Kisunminttu

7:45 PM

@ThomasPornin This was awesome.

Rоry McCune

9:10 PM

@Adnan not sure if you're still looking at MS14-066, but here's some more info.. securitysift.com/exploiting-ms14-066-cve-2014-6321-aka-winshock

Adnan

9:32 PM

@RоryMcCune I've actually stopped trying a couple of days ago. I wasn't able to get anywhere beyond DoS (either crashing the service, or, for some reason, reboot in some cases).

@RоryM Something interesting, though. Unlike IIS, with RDP after the crash, it wasn't possible to get it to work again without a reboot.

Gilles

9:56 PM

1

Q: openssl and OCSP

I am trying to check the revocation of certificates in a script but I get the following error: unable to load certificate 140735258465104:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE Here the steps (using www.google.com as an example) fe...

openssl

Transcript for