« first day (1167 days earlier)      last day (3718 days later) » 

12:19 AM
@ManishEarth So they actually are giving you money?
 
@tylerl The flag, when set to +, means "Bug has been accepted and a payment will be made"
 
Which bug was this?
i remember you talking about it
just don't remember the context @ManishEarth
 
I didn't explicitly mention, but it had to do with control chars, basically
The same but that's on SE
 
@ManishEarth the copy paste thing.
 
Yeah
 
12:23 AM
cool. good work.
 
 
2 hours later…
2:33 AM
@ManishEarth Neat!
Congrats!
 
2:57 AM
@terry I suspect it to be a mistake though
The bug was marked sec-low, which usually isn't eligible
 
3:08 AM
@ManishEarth Ahh. Hope for the best though.
 
Maybe it's because i wrote the patches (and back ports)
 
3:24 AM
@ManishEarth How much are we talking about if they do award it to you?
 
3:38 AM
@terry the site says $500 for webapp bugs
It also says high severity tho
 
@ManishEarth Woah, that's pretty good.
Have you tried submitting it to Google? I'm not sure if they will pay out for competing browsers but it's worth a shot. ;)
 
@terry the bug is in the bugzilla software
I have reported it for Firefox, chromium, and google plus
Chromium is going "not our problem". G+ says "report to chromium" :p
 
@ManishEarth You wrote patches for FF right? Try this google.com.sg/about/appsecurity/patch-rewards
Doesn't really hurt to try and you get a $500 payout if successful. :)
 
It was a patch for bugzilla
Im typing out the ff status
 
Ah I see.
 
3:54 AM
Basically, a contemporary bug added a css property that toggles the display of control chars
Because the Nightly actually did display control chars
But it made some sites (ones with encoding problems, i guess) break
So they fixed it, and i had filed the ff bug while they were "fixing" it. Now i need to push to get that css property turned off by default
 
Another tweet-sized PowerShell script from yours truly. I call this one "EC-Council_Still-Pwned.ps1":
(Invoke-WebRequest http://www.eccouncil.org) -match 'jack67834#'
 
@iszi background?
 
@ManishEarth The EC-Council website has been defaced for about 2 days now.
Headline on the home page currently reads:
> Defaced again? Yep, good job reusing your passwords morons jack67834#
 
@Iszi Go make a website. iseccouncilstillpwned.com
 
The script above will return True or False for a match of that text in EC-Council's home page source.
@TerryChia Nah, why bother making a site when I can just run (and share) a script?
 
4:06 AM
@Iszi Because fun. :)
 
Besides, didn't I see that Mitnick or Hunt already have their eyes on that domain?
Huh, http://IsECCouncilDotOrgStillPwned.com is available... (and yes, http://eccouncil.org/ is still pwned)
 
@TerryChia this is the bug where they add the CSS property. Where they don't listen to the security concerns. :/
 
I'm almost surprised we haven't had a question about the PII leak or something else regarding the EC-Council hack yet.
 
@Iszi We do.
From @RоryMcCune the repwhore.
 
@TerryChia WTF? Where?
 
4:11 AM
3
Q: Security Consequences of compromised passport data

Rоry McCuneIn light of the recent hack of the EC-Council site, where the hacker makes the point that he has access to passport data a general question arises. What, if any, are the security/privacy consequences for people of their passport data being compromised?

 
in The h Bar, 2 hours ago, by tpg2114
Bonus points if you ask the follow up question "Does the memory already allocated still exist in the RAM once it's in my hand and not in the machine?"
on topic for sec.se? :p
 
> Users obviously benefit from not seeing these junk characters.
... Ugh.
 
@FEichinger The thing is, it only happens on sites that have some idiotic errors in their encoding or something (stuff that should never happen)
 
I know.
It's always author's fault.
 
Perhaps of equal importance (or more, depending on the answer) is what other government proof-of-identity documents may have been obtained? Not every applicant for an EC-Council certification would have a passport. Those may have submitted such documents as their driver's license and/or Social Security card. — Iszi 3 mins ago
 
4:20 AM
@FEichinger It's like saying that this page is ugly, so unclosed H3 tags should be handled properly
 
Funny thing is, I can't recall (nor can I find via archive.org) that EC-Council ever required such documentation to sit for an exam.
 
@ManishEarth Isn't </h3> optional in HTML5 now anyway?
 
wut
6
Q: Why are unclosed H3 tags breaking this page?

ManishearthIf you take a look at this page in a modern browser (latest stable builds of Chrome, Firefox, or IE), you will see that the text increases in size. Taking a look at the source code, it seems that it is due to unclosed <h3>s in the code. However, I recall that most browsers autoclose tags wheneve...

 
</h3> should, if I'm not mistaken, be automatically prepended to the next newline if no corresponding </h3> is found within scope.
Then again, I'm not exactly keeping up with which whims W3C adds or removes from the spec every other month.
 
@FEichinger not when there's a bunch of other stuff there
look at that answer
 
4:24 AM
@ManishEarth Sorry, this was my first thought also.
Are you asking why invalid html doesn't work? — Kevin Bowersox Feb 9 '13 at 10:42
 
@Iszi lol
mine too, but like @FEichinger said, some buts get fixed
 
@ManishEarth Well, yes, which brings us back to scope and newlines. Neither of which are all too ... present in the example you linked.
 
hah
 
And then, I <3 this:
> Validate your freakin' markup.2 In particular, close all your freakin' tags (except where closing tags are forbidden).
 
hah
 
4:32 AM
Ah, found it via Google Cache. webcache.googleusercontent.com/…
> Attach a copy of your Driver’s License or any valid government approved Identification
licenses (e.g: passport)
Know what would be a badass hack? Simultaneously deface a major organization's home page and every copy of it that's stored on archive.org!
Oh, and apparently EC-Council is denying that any of their servers were ever actually hacked and it's not their fault it's taking so long to fix. facebook.com/ECCouncil/posts/730357873665823?stream_ref=10 Pure DNS redirect - nothing to see here.
 
4:51 AM
@Iszi Sounds like EC-Council has some good fiction writers.
3
 
@TerryChia So far, every article in the tech blogs I've read isn't arguing the point.
 
Anonymous
@ManishEarth you are everywhere in chat.SE
 
Anonymous
you are spooking me
 
@PatoSáinz Eh, I use favorited rooms, and so I just end up joining everything on login
 
@Iszi problem is they only have ethical hackers. Nobody can figure out how anybody could do something bad with their email password.
 
5:34 AM
@ManishEarth I used to do that. But then I kept getting pinged in rooms I'd stopped caring about a long time ago.
 
@Iszi so unfavorite them
 
@strugee But it's such a pain in the ass to find them when I want them if I do.
 
In the context of the World Wide Web, a bookmark is a Uniform Resource Identifier (URI) that is stored for later retrieval in any of various storage formats. All modern web browsers include bookmark features. Bookmarks are called favorites or Internet shortcuts in Internet Explorer, and by virtue of that browser's large market share, these terms have been synonymous with bookmark since the first browser war. Bookmarks are normally accessed through a menu in the user's web browser, and folders are commonly used for organization. In addition to bookmarking methods within most browsers, man...
 
6:12 AM
@strugee Bah. Who's got time to do something like that, let alone organize the damn things?
 
6:34 AM
@Iszi true. personally the favorites system works for me because I don't have a lot of bookmarks (I memorize or mentally construct on the spot almost all URLs, and only bookmark the ones that are unmemorable because they have a 40-character long string of crap to uniquely ID content)
 
7:04 AM
morning
 
morning
 
@RоryMcCune yeah, heard that, thanks.
I actually do use office365, if only recently, because a client wants me to have access to their internal mail. I wouldnt otherwise...
but still, its a very cool step.
and btw, their authenticator app is a dropin replacement for google's, so e.g. on WP8....
 
@AviD 2FA has an open standard that everyone implements (except Twitter). pretty much every 2FA app will work with any 2FA scheme
 
@strugee exactly.
and, hello!
though google implements it almost to standard. Seems there are a few... special cases just for them.
 
@AviD indeed! I'm new here; I chose you guys over Root Access
@AviD oh?
 
7:12 AM
not really much of a competition...
 
yah
 
@strugee apparently. I have yet to look into the details closely, but I'd heard "reputable" claims.
 
interesting, I should check that out
I have noticed that their app seems to have more features than everyone else but other than that I haven't seen a difference
 
@strugee Wut? The Authenticator app is pretty damn limited.
It only supports length=6, no support for HMAC-SHA256 and HMAC-SHA512.
 
@TerryChia yeah but everything else is even more limited
ah. I meant user-facing features, not schemes supported.
 
7:42 AM
@AviD cursory Googling shows that this is (apparently) not the case.
 
8:04 AM
morning all
 
morning
 
@RoryAlsop you damn ninja!
howd you pop a half dozen flags out from under me? I just stepped out for a few minutes....
@strugee also possible.
 
9:10 AM
heh heh heh - my pc was booting up so I did them on the ipad, @AviD
 
ouch. subtle burn there....
 
@RoryAlsop Looks like you are finally learning to make use of your tool. ;)
 
you're saying that you were able to ninja me from an ipad. I must be so slow, I would have lost in the Special Olympics.
2
 
hahahahaha
 
9:27 AM
morning
 
0
Q: Theoretical key encryption question

roboboogaI have a question regarding encryption and message sending. There are 2 hosts, A and B with their own secret key kA and kB (assuming this is not PKI). It is known that when A wants to send a message to B, they do this handshaking protocol: A sends to B, an encrypted message in this form E(kA, ...

have you tried with magic?
"how can I exchange keys without exchanging keys?"
I guess gnu-magic has a command for that
 
9:45 AM
morning Rory
 
10:16 AM
@kalina - for those edits, that's probably enough per day... good cleanup, but they then spam the front page, whereas the commend cleanup doesn't
 
@RoryAlsop Morning
@Iszi @TildalWave @AviD Why the hell does that belong to SO? If it really needs migration, it should be Crypto
and I don't think it really needs migration. The answer contain lots of security-related advice, it doesn't go through implementation details, aaaand it doesn't dive into crypto details.
Sec.SE is the site for it
 
I don't like the question. But sec.se is probably the best place to put it.
 
(Yeah, I'm biased a bit because it's my answer)
 
Epa, is there any "stackexchange" plugin for wordpress?
 
@CodesInChaos Me neither, I answered it mainly because the OP seemed waaaay out of it.
 
10:22 AM
I have found some for stack overflow but not for SE
 
@kiBytes Use the API. Write one.
 
I don't really want to...
I will work it out with the RSS
 
If the image encryption part means that it needs to be length preserving, then I'm not even sure how to do the encryption securely.
 
@CodesInChaos How do you think that can be improved?
 
The modes you suggest are fine, but not length preserving.
 
10:28 AM
@CodesInChaos I don't see why it needs to be length-preserving.
 
If you encrypt the actual pixel data in place, you don't have a place to store the IV.
But the question is a bit ambiguous. So I'm not sure what the OP actually needs.
 
@CodesInChaos In all fairness, I don't think the OP knows what he needs.
 
@rory fair enough. I was done anyway but if I decide to do more I will do them on the next site in the queue :p
 
If we need length preservation, this could be BEAR or LION territory.
 
11:09 AM
So, apparently, today they started an American section in the local store. What the hell is "Fluff", "Crunch 'n Munch", or "Swiss Miss"?
 
@Adnan - they also have stuff in American sections of shops here that is titled 'chocolate', when it definitely isn't :-)
y'know, things like Hersheys
 
<shudder>
 
@RoryAlsop I have no idea what that is
and what's up with the Coca Cola Vanilla.
First time I hear of that
 
@Adnan vanilla coke is good.
 
@RоryMcCune Alright, I'll perform some unit testing on it tonight.
 
11:22 AM
hmm
I am not able to find the "my answers rss"
(maybe there isn't any)
 
@kiBytes Here you go http://stack2rss.stackexchange.com/security.stackexchange.com/users/37373/answe‌​rs?&body=true
remove 'body' if you just want the title (and the links) of the questions.
 
you are so nice
 
 
1 hour later…
12:50 PM
@Adnan waddaya want from me? I didnt migrate it.
though if I were to hazard a guess, they probably voted based on the request for code.
ftr, I wouldnt have closed, I agree with you.
 
@AviD voted based on not reading the question*
 
@Adnan I dont disagree.
 
@AviD and I'm trying to find a new apartment
 
@CodesInChaos depending on the image format, some formats have room for metadata in the header. Albeit not arbitrary data, and you probably dont want to preserve the format anyway, but.... yeah.
@Adnan oookaaay,....?
@Adnan you're thinking about combining some of those names, right??
"Swiss Miss, with Fluff 'n' Munch!"
Marshmallow Fluff (I assume thats what it is) is in its own category of awesomeness.
Think of Nutella spread? But instead of vaguely chocolatey taste, its marshmallows. With cream.
And then of course, you can make a FlufferNutter.
 
@AviD The jar looked like it will go straight from my stomach to my veins and arteries.
 
12:57 PM
@Adnan oh, undoubtedly.
nah, its not such high cholesterol if thats what youre worried about. Its just a really thick cream.
yes yes, I know, I heard it.
 
@AviD It's not easy. I should have moved before the Asian influx. There's no empty apartment in this city anymore
 
ahh. That sucks.
Consider a different city, or is that out of the question?
 
@AviD I know! There's so many of them!
@AviD GFs here. At this stage, it's out of the question.
Ahh.. I guess I'll just move to the hoodie part of the town.
 
does that mean you will need to wear a hoodie all day?
is that what you call the hipster neighborhood?
or the facebook employee residences?
 
@AviD Nah, it just means I'll have to walk my gfs from and to my place every time.
That part of town is very rapey
 
1:04 PM
@Adnan yes, but isnt any place you live kinda rapey? ;-)
 
Speaking of which. In our part of the own, there's a small bridge on a small river (it's a 4-meter bridge), and it's called "The Rape Bridge" amongst youngsters as a joke because it looks very dodgy.
A few days ago, somebody was raped there.
Not a joke anymore
 
@Adnan see, I dont eat cornflakes when I see the sign, either.
Although I would think if it was a literalist in action, there would be a small, well-worn hole in the base of the bridge.
 
1:19 PM
@Adnan Marshmellow fluff is basically just sugar in goo format.
I'm finding the phrase "kinda rapey" an odd descriptor.
 
especially the goo! Thats the best part. And the sugar.
 
I wonder what the construction of Marshmellow fluff is
> corn syrup, sugar syrup, vanilla flavor, and egg white
 
It's the vanilla flavor that makes all the difference.
 
Clearly.
I was making whipped cream a couple of weeks ago and had a vanilla accident.
Too strongly flavored. It made me sad.
 
Interesting. Didnt think there could ever be TOO MUCH vanilla.
 
1:30 PM
@AviD Try some vanilla beans and let me know about your theory.
 
@Adnan ooo that sounds nice.
 
To be fair, it wasn't great vanilla either.
 
no, on second thought, not really.
WAIT. I thought vanilla grows in sticks, like cinnamon. Whats this about beans??
 
My preference is Watkins double strength. It's got a nice vanilla flavor without being too bitter or alcoholly. What we had was some other brand.
@AviD Vanilla is a tree that produces seed pods.
 
Vanilla is a flavor derived from orchids of the genus Vanilla, primarily from the Mexican species, flat-leaved vanilla (V. planifolia). The word vanilla, derived from the diminutive of the Spanish word (vaina itself meaning sheath or pod), simply translates as little pod. Pre-Columbian Mesoamerican people cultivated the vine of the vanilla orchid, called tlilxochitl by the Aztecs, and Spanish conquistador Hernán Cortés is credited with introducing both vanilla and chocolate to Europe in the 1520s. Initial attempts to cultivate vanilla outside Mexico and Central America proved futile b...
waat, no picture??
thats not a bean.
 
1:33 PM
The google images search has gobs more pictures, including some that are green on the tree.
@AviD That's also been dried.
 
@AviD It's a "bean", yes. You usually cut it length-wise and extract seeds from inside it
 
wait, so there are ALSO beans?
 
What you're seeing is a seed pod.
 
@Adnan you usually dry the leaves, and grind that up.
 
Inside that are all the seeds, which is the actual vanilla bean.
 
1:35 PM
@ScottPack wait wait, so the correct term for the thing housing beans (like other vegetables beans) is a bean pod?
 
@Adnan Pod, yeah.
Hence the phrase, "like peas in a pod"
 
Today I learned
 
And learning is half the battle
 
@ScottPack and open the pod bay doors
 
@ScottPack I always thought that was "like pee in a pad". Yknow, like a bachelor pad. Which isn't often cleaned.
 
1:37 PM
@RоryMcCune I'm sorry Rory. I cannot do that.
 
@ScottPack actually I have an american question for you. In the context of employment, what's PTO?
 
@RоryMcCune Paid Time Off.
 
@ScottPack ahh that makes sense
 
If your employer grants PTO how it's divided up can be weird.
Many employers just say, "Here's 2 weeks, do with it as you will."
 
and IIRC that includes sick leave?
 
1:40 PM
Others, like the university, gave 22 vacation days, 18 sick days, and (if you had enough sick at the start of fiscal) 3 personal days.
 
Ahh.. Americans and their weird employment terms.
 
The vacations required prior approval, the sick may require a doctor's note, and the personal were no notice.
 
I love how they cap the amount you can be sick in one year...
 
I would guess that most employers don't give any PTO at all, so if you take a week vacation you just don't get paid for that week.
 
PTO is a right here in Finland.
You get two weeks in the summer and one week in the winter.
 
1:41 PM
@RоryMcCune It's completely employer dependent. That's how much I earned each year. I could carry 32 vacation days across a fiscal boundary, but unlimited sick.
 
And here's to all companies moving to a more sensible, "Netflix-like" arrangement - take as much time off as you want, as long as you get your job done.
 
@RоryMcCune I have something like 50-60 sick days right now.
 
@Adnan Off. OFF.
 
@AviD That's becoming more common, but it's still far off the norm.
 
@ScottPack wow you could get really ill for that :)
 
1:43 PM
@AviD I don't get that. There is always more to do, so what does "get the job done" mean?
 
@ScottPack I know. I am hoping it becomes the norm.
 
@RоryMcCune When I leave I get paid out the balance of my vacation time, but not my sick. If I take a job at another State agency in Ohio I can have them transfer my sick balance over too.
 
@CodesInChaos "enough"
 
@CodesInChaos AviD is self-employed. He sometimes pretend his rules apply to the rest of us.
 
@RоryMcCune When our Firewall Admin started he had somewhere in the neighborhood of 100-120 sick days that he brought with him
 
1:44 PM
@Adnan hehe. Actually, because I am self employed, its the other way around.
but in proper companies, it should never be 100% of the time always emergency-mode.
Corporate culture matters.
 
@CodesInChaos Usually it means meeting your goals, not falling behind on projects, and generally not disappointing your manager.
@CodesInChaos It's quite a lot more cut and dry with dedicated project people because when your part of the project is done you don't have any more work until the next project starts.
 
@CodesInChaos there is also a balance. In a healthy company, with healthy-workers, at some point NOT taking a vacation will negatively impact productivity, which otherwise is at a ridiculously high level.
 
I prefer relatively clear rules, so I can take off my time off without a bad conscience.
 
@RоryMcCune I'm all together pretty annoyed with the PTO situation in the States. There's nothing required so it's entirely up to the employer. Except for one situation (where she received 10 days) my wife has never worked at a place that offered any kind of non-paycheck benefits, including PTO.
 
@ScottPack It works fine with e.g. programmers (for whom there is always plenty of backlog) - as long as the programmer gets a substantial amount of work done, and hits a high level of productivity on average...
 
1:47 PM
Hell, those 10 days were only because her boss was afraid she would leave so that matched the holiday closings of the local university.
 
Also, it should be left to them to decide, since they ARE adults, after all.
 
@ScottPack yeah it's a shame that employers are allowed to do that, definitely a good case for regulation.
 
@CodesInChaos they also relate to that perspective. They have an answer for it, but I dont remember what it was.
 
@AviD Right, that's kind of what I mean. It works fine so long as everyone involved is reasonable and acts like an adult. It's just most cut and dry for the aforementioned project people.
 
@AviD I'd hate the "did I work enough?", "Did I take too much vacation?" with soft rules.
 
1:48 PM
@CodesInChaos I recently interviewed at a place with the Netflix model. What they said, was that vacation is unlimited and untracked. At your level we would expect you to be taking about 4 weeks per year.
 
@CodesInChaos no, its not about "soft rules", its about acting like a responsible adult.
 
I'm happy with a clear and simple "30 days per year" rule.
 
@ScottPack ah, that works too - just to help newbies get a feel for what is "normal".
 
As long as you're not falling behind and your boss doesn't feel like you're being a jerk what's it matter if you take 1 day every week or 3 days per year?
@AviD Exactly.
@RоryMcCune I don't disagree. The labor laws here have some provisions to protect employees, but or the most part it's about protecting the employer. It's pretty fucking abusive if you ask me.
 
As there is a near infinite backlog, "falling behind" is ill defined.
 
1:51 PM
@ScottPack actually they mentioned (it might not have been netflix) that if you take TOO LITTLE vacation, that would lead to a manager-talk.
the point is that its not healthy to not take vacation, and it hurts productivity.
 
@AviD I can believe that. The places that are instituting this type of model generally recognize that the key to employee productivity is burnout reduction through getting the fuck out.
 
@ScottPack and more than that, its what they are calling now "engagement".
back in my day, we just called it "giving a crap".
 
@AviD Being excited and interested in the work?
 
Usually because of a syndrome that we called "bosses not being utter assholes".
@ScottPack in the work, and caring about the interests of the company.
 
yeah
 
1:58 PM
so let's talk about length
2
 
starbait. too easy. No one star that.
 

« first day (1167 days earlier)      last day (3718 days later) »