English language at its finest, check out this sentence in Wiki: Middle English developed out of Late Old English in Norman England

I can think of about 5 hilariously wrong ways to interpret that

@TildalWave I don't see what your problem is.

:P

@FEichinger hah! interestingly, that one's wording is much more carefully chosen

@TildalWave Well, when you have to make an ELL version of an encyclopedia, that's the kind of thing that happens.

@FEichinger I didn't even realize it existed. It's kinda funny, even the meta texts are simplified: This short article about Europe can be made longer. You can help Wikipedia by adding to it.

It's always interesting to see what they come up with. Sometimes, Wikipedia proper is far too full of bureaucracy and excessive writing. It's nice to see a different take on some of that.

@TildalWave my favorite is still "derp is internet slang that comes from the internet." like, yeah, no duh. internet slang doesn't come from Kansas.

@Gilles There's seems to be a bug in the flag handling system (particularly, the part that handles flagged posts after they're deleted). It seems to auto-edit the post (post-spam style) once it's deleted after having been spam-flagged even once. And, yes, I know it's you who flagged.

You see, here's the thing. (prepare yourself for a cliche) My father has always taught me to stand behind my words, whether I'm right or wrong. When I say something, I stand behind and back it up; when I'm wrong, I stand behind it and correct it; when I promise, I fulfil my promise; etc. @Gilles, you've made the unsubstantiated claim that I'm "getting ruder and ruder". It's very easy to make claims and just walk away.

I can now say that @AviD is getting worse and worse at being a moderator. It would mean nothing, nothing, if I don't back it up with real examples.

I'm still extremely annoyed by your childish behaviour last night. Just because you had a personal disagreement with me, it doesn't mean it's okay to run around flagging my posts as "offensive" when they're clearly not. Very immature from a moderator, by the way.

(In case I'm wrong, and you didn't flag, I apologize for that part in particular. You still behaved childishly in the chat)

/Wall of text, over.

@Gilles actually not, my selector was just overly crude, so it picked up some elements that I didn't want along with the ones I did...

@tylerl The dude looks so American (especially with the toilet seat), but the street look so Slavic

What about him looks american?

i guess the baseball cap?

@tylerl Well, actually, it's only the hat and the skin color

The skin color is more sub-arctic.

presumably everybody is pastey white where you are

I can picture seeing him in the US south or perhaps northern Italy or spain (though not native).

@tylerl Well, it seems that there's a great possibility he's Polish

@Adnan poland methinks

@RоryMcCune Indeed. It's the "Odzież" sign behind him.

@Adnan yeah that + google translate was a winner :)

@AviD Jesus. That question exploded so bad it's now a community wiki.

Another eye on this one, please. theaccents.org/ijacr/papers/current_sep_2012/9.pdf

(Skip everything and go to "3. Proposed Method")

@Manish Sweetie, have you head of this? theaccents.org/ijacr/ijarindex.html

It seems to be some Indian research center. Sadly, it has only a few papers (I've only been able to find 6) and 3 of them are horribly formatted. One of them, (check two messages up) is horribly written and is somewhat doesn't make sense.

I second that it "somewhat doesn't make sense".

@Adnan huh??? I did'nt. And no clue what you're banging on about.

Still waiting for those examplexs though ;-)

@FEichinger Morning, so how's the node.js work coming along :op

ಠ_ಠ

@Adnan which one?

ah, the english one. interesting.

hmm, yeah its probably the Arabic that is drawing the crowd.

I got a badge for it, too.

Does anyone know of a CLI tool that enumerates the supported SSL ciphersuites of a server in order of preference? /cc @RоryMcCune, @AviD etc.

SSLLabs would still be simpler.

@AviD I know, I'd prefer a CLI tool if possible though. Easier to automate and parse outputs and all that.

@TerryChia ooh not sure about order of preference but @thomaspornin has done a command line SSL checker

@TerryChia bolet.org/TestSSLServer

looking at sample output it's not ordered..

@RоryMcCune Yeah I saw that, it stated that the order is not significant though.

@TerryChia perhaps you should send him a feature request :)

@RоryMcCune Hehe. If you guys don't know any available I'll just write one myself. It shouldn't be that difficult. I just don't want to waste effort if there is something already available.

@TerryChia why would the order not be significant?

@AviD ? The tool doesn't produce output ordered according to server preference.

> it stated that the order is not significant though.

> Supported cipher suites (ORDER IS NOT SIGNIFICANT):

You need more coffee.

@TerryChia yeah, I'm off coffee today :-(

@TerryChia again, why is order not significant?

though I guess that is more a question for @ThomasPornin.

@AviD THE TOOL DOESN'T ORDER THE OUTPUT GODDAMMIT!

GET COFFEE IN YOU NOW!

@TerryChia BECAUSE THE ORDER IS NOT SIGNIFICANT!!!

And I am asking WHY is the order not significant.

@AviD It's just saying that it doesn't produce ordered results. Read the fucking website.

hmm, okay, I'll do that.

okay, done that. NOW will you please explain to me what part of my question is confusing you?

@TerryChia @AviD I would suggest that you two are talking past each other. AviD is, I think asking, why the order is not significant (i.e. taking the tool to mean that the order of ciphers isn't significant, as opposed to the order the tool presents them in not being significant), where Terry is suggesting that the tool doesn't do what he wants 'cause he wants a tool which gives the order of ciphers as the server would select them

clear as mud?

@TerryChia FWIW I've seen a lot of SSL test tools, I don't think I've seen any that handle servers order preference and thinking about it I don't think that's possible

yes, exactly, that's what I was saying. Thank you for explaining it to him .

you could have a nominal order which you think is "best" and test in that order

@RоryMcCune why not? And why isnt it important?

@AviD well SSL test tools say "hey do you support this ciphersuite" then "hey do you support this other ciphersuite"

they don't say "hey what ciphersuites do you support"

so you can say "my ciphersuite goodness list goes a, b, c, d, e, f" I'll test those in order and see which ones you support

but that's not to say that that's the order the server has it in (I think)

or that the server has other ones that you don't know about

ah, I figured we were talking on-box tools, that read the configuration.

but anyway, thats not the way browsers work. they say "here, I support a, b, c - please choose one", and then the server will choose whichever is at the top of his list.

so f.e. if the server chooses "b", then you can say "I support a,c" and the server will choose "a". so you know the server's order of preference is "b, a, c".

@AviD yeah I wasn't thinking browsers, so much as tools I've seen that test SSL ciphers. but yeah so I suppose it should be possible to infer ranking but it might take a while

it'd be like one of those eye tests where they say "does this look sharper with lens 1.. or lens 2, now with lens 3 or lens 4"

yeah, exactly.

unless, as it says on @Thomas' site, the order is not important. And he would know.

So, again, my question - why is it not important?

@AviD ahh I think he might be saying that in the tools reporting the order isn't significant (i.e. his tool doesn't rank them at all, as there would be multiple options for ranking them) rather than the order isn't important in some senses

@AviD facepalm stop being a pedant.

no, that's what @TerryChia thought. So that is clearly wrong.

@TerryChia someone needs less coffee methinks :op

just caught up with last night's transcript. You guys were busy with the wordlists! In reading one of RoryM's I see "Just see Rory, need much time" which seems wonderfully koan-like

@AviD - finally got round to finishing Start up Nation. Not that well written, but very interesting

@RoryAlsop cool! yeah, it was kinda written like a series of blog posts. but interesting, like you said.

@AviD My tool writes "ORDER NOT SIGNIFICANT" in big letters because it outputs the cipher suites in no particular order, but some people believed that the output order related in some way to the server configuration, and bugged me by email.

At the SSL level, there are preferences. The client expresses his preferences as an ordered list; the server then chooses, either by following the client's preferences, or through applying some other procedure.

The server's way of choosing is not public, and cannot necessarily be expressed as an "order".

@ThomasPornin would it be possible by passing it pairs of ciphersuites and seeing which it chooses to build up an effective order?

@RоryMcCune For all we know the server may base its choice on the current time, the protocol version, or even random. You can try to discover server's preferences but that cannot be guaranteed.

Though I did that for my automatic scanning of random IP addresses.

First get the list of cipher suites supported by the server; this gives me a list in a given order; then try the discovery again by presenting the same list in reverse order.

If the second time I get the exact same list as the first, then chances are that the server indeed follows its own order and ignores client's preferences.

@ThomasPornin Sure I think I see what you're saying. So if the ordering is static, we can say "for this IP at this time with this User agent, the order is X" but this may not hold in the general case..

@Adnan never heard of it :o

"dynamic hash generation" reminds me of CSRF prevention. But that doesn't make sense in this context

@ThomasPornin ah. This is shocking, mostly because @TerryChia was right.

@ThomasPornin oh? But some webservers (e.g. IIS) do have a strict "order". I guess this isnt part of the standard?

What did we decide to do about "General Reference", 101-type check-wikipedia questions?

Did we come to a conclusion? I like the close reason English.SE has - close as general reference (ie thesaurus, dictionary etc)

@AviD No no, it's something else. Clearly, it's something personal that @Gilles has against me, and I don't wish to bring the Sec.SE mods into it. It's started as personal, and I'm ending it here as personal. Please, disregard everything about that.

@ManishEarth Indeed. The whole "paper" made zero sense to me.

@AviD and the head drilling.

OHAI GUISE

@AviD I like @RoryAlsop's idea.

We really cannot keep answering questions with "Check Wikipedia" or "Check OWASP"

@ScottPack Hi!

One of those wordles is the chat room, I'm guessing?

I like how big I am.

@ScottPack I bet she likes that too.

I wouldn't know. D=

@Adnan actually, TIL that the automatic downvote caused by a spam/offensive flag only counts for the score, it doesn't affect the reputation, so you can easily check for a discrepancy between the post score and your reputation history

@Adnan I'm curious: how do you know that it's me who flagged?

They both are, one of them just has the @-mentions stripped.

@ScottPack All-time star list, actually.

@FEichinger Just pulled up the transcript and saw that, aye.

and then hack both my memory and the Stack Exchange servers to make them forget that I flagged...

Actually, I'm most interested in how you hacked my memory. I want that hole patched.

@Gilles Actually, I don't need to check the score my rep. I can just look at the post and see that it received a flag. security.stackexchange.com/questions/53250/…

@AviD et al: In the hope that this can defuse the situation, I hereby give moderators the permission to publish all entries in my flag history that concern Adnan's post

@Gilles What?! The situation has already been defused.

@Gilles Also chat.stackexchange.com/transcript/message/14254328#14254328

@Gilles aaaand, chat.stackexchange.com/transcript/message/14256891#14256891

@Gilles Sorry, you didnt say "Communique".

On my part, the situation is long forgotten (the moment I told @AviD that it's alright and no need for any "special procedure").

@Adnan if anything, I was being paternalistic. I will not say anything else about the matter, since you're obviously upset about it.

@Gilles The only thing I was upset about was your unsubstantiated accusation that I'm "getting ruder and ruder".

Now, I'm not upset. Clearly, you're unable to produce anything to back that statement. For all I know, it's inaccurate. Thus, not worthy of me being upset about it (the statement, not you)

@Adnan That's not unsubstantiated.

Actually wait, yeah it is - it is implying that you used to be less rude than now.

@AviD Please, enlighten me.

If anything, you're mellowing out.

@Gilles Plus, we're members of this community. Working for the better of this community. Thus, I'm not in the business of holding grudges. So, again, the situation is long gone.

@Gilles Are we cool?

@Adnan @simon isn't.

@AviD Aren't mods supposed to you know... moderate? Why are you adding oil to the dying fire? :P

@TerryChia more fun that way.

I am moderating the blaze.

@AviD @Gilles Regardless of us being cool or not, let's talk about the bug. This post received at least one offensive/spam flags. However, when I deleted it, the post was auto-edited as if it was deleted because of 6 spam flags (or mod-deleted because of spam flags). security.stackexchange.com/questions/53250/…

Any ideas?

why do you think it was edited as if it was flagged?

@AviD Look at it! It says "This answer was marked as spam or offensive and is therefore not shown - you can see the revision history for details."

Waaait.. does it say that only for me?

and, for the record, there was in fact 1 flag on that post, and no, it was NOT @Gilles.

wasn't me either.

@Adnan mods don't see this.

everyone else (well, you and 10kers) do

The behavior is by design

@Gilles So, the auto-edit is a bug in this case, right?

@Gilles For only one flag?

@Adnan it isn't an auto-edit, what's happening is that it isn't showing the actual text without an extra click

@Gilles I know I know, I just called it an auto-edit

It usually happens when the post receives 6 spam flags

or it's mod-deleted due to spam/offensive

@Adnan or when the post is deleted with pending spam/offensive flags

but with only 1 spam flag, I don't think that's supposed to happen

@Adnan it wouldn't have happened if the flag hadn't been pending when you deleted

@Gilles Interesting. Does the flag disappear after the deletion?

(becomes "inactive")

I think that if you undelete then the flag will become pending again, then a mod can decline it, and then the message won't appear anymore. But that's an edge case that I've never toyed with.

@AviD

well, it was marked as such. It's the "therefore" that's the problem.

@AviD But I still don't see why only one flag causes that behavior.

If I, now at this moment, undelete that suspected-spam post, it will be back with the full original text.

This doesn't make any sense.

Away from the subject. What do "hashing rounds" mean?

SHA-1's wikipage says "Rounds: 80"

MD5 "Rounds: 4"

@Adnan Ping me on the weekend, I'll go through and de-Indian-English-ify it for you

@ton.yeung Please remove that

@Adnan there's a smaller algorithm which is recursively run, no?

THat's what I thought

@Adnan purged

@Adnan It's just an internal construct of the algorithm.

The Algorithm section of the MD5 wiki page is pretty clear.

@TerryChia @TerryChia Yup, that's what Google came up with. But what does that really mean?

What does it do?

What happens if I increase the rounds?

@Adnan it makes it look more secure

^ it's that

for hashing algorithms

@Terry @Manish Does it flatten the output to remove bias?

:P

Make it more random?

I dunno, ask @CodesInChaos or The Bear

No no, guys, seriously

In most implementations, it just applies the Math for n iterations.

@FEichinger Completely understandable. I can see that in the pseudocode of all of the mentioned algorithms

@Adnan SO there are four different mini-algorithms, each of which is a mishmash of XORs

They are used in rotation. Each round, one algorithm

Guys guys.. I have the code right on my screen.

I know what is happening

But why?

Why not 128 rounds?

Does it make it better?

What @ManishEarth said: It makes it look more secure.

In what sense?

It is, fundamentally, pointless.

Alright. Now we're talking

@Adnan each round has a computational expense?

more rounds = harder to brute force?

pretty weak though since it's linear

@ManishEarth I thought of that

However, those are hashing algorithms

Not password-hashing algorithms

@Adnan point

Nah, sorry. So far, nothing I see makes sense.

@ton.yeung not entirely sure why it isn't, perfectly legal in a number of jurisdictions...

@ton.yeung It isn't not allowed

If you want you can post it again and I won't do anything about it :)

@ton.yeung Eh, we're all friends here, if Adnan didn't want it I figured you would have removed it anyway :)

@ManishEarth It's not that I didn't want it

It's slightly nsfw.

And given that I'm sitting in class right now ... :P

@ManishEarth Sadly, it is quite NSFW

Personally, I have no issue with it

@ton.yeung heh :)

It just doesn't look that great when a coworker walks by and sees you looking at pictures of hashish

Exactly.

@Adnan a picture of hash? but News articles have that sort of thing while discussing drugs isses.

unlike pictures of people's anatomys, usually I'd say that just the picture doesn't make it NSFW

but the each W is different I guess

e.g. bbc.co.uk/news/business-26523833 (NSF some W pictures)

@ton.yeung Which is actually a more reasonable explanation for the War on Drugs than whatever the old men usually say it was.

I never said it was the reason.

I said it would make for a reasonable explanation.

It's much easier to sell "We can't legalize it, it would get us involved in turf wars!" than "DRUGS ARE EBIL, KILL 'EM ALL."

Well, probably not "easier", people are easily impressed, but it'd at least be somewhat realistic.

@Adnan More rounds make cryptoanalytic attacks harder but not help (much) against brute-force

The number of rounds is a trade-off between what's believed to be secure and perfromance

I'm really interested in that aspect

Does it?

Like, make it more random or something.

"more random"

A block cipher is a permutations. Each round mixes the possible values

Make it more difficult to find patterns

Just let that one sink for a moment. "more random".

Each time you mix, the system becomes harder to describe

@FEichinger Wait a few minutes until I understand what @CodesInChaos and we'll laugh together at the idiocy of you criticizing "more random". Put a pin on it.

Oh, I know what you meant. But "more random" is just ... no. Just no.

aren't you talking about hashes? that's not random at all.

@CodesInChaos So when your cipher is "good" enough to produce "indescribable" output, then we don't need that many rounds. Like SHA-3, for example. Am I right in that assumption?

@AviD Shush!

nor is it a block cipher @CodesInChaos

(well, usually)

@AviD Oh Jesus. Go back to your clients.

lol

hmm, yeah that's probably for the best.

a round has a certain probability of preserving certain features of the input, "called differential characteristic". When you add additional rounds, that probability decreases exponentially, with a very high base.

@FEichinger I spent three minutes thinking of whether I want to open this discussion or not. I still haven't decided, but I'm leaning towards no.

@AviD typical hashes are built from block ciphers (At least SHA-1,2 and MD5 are)

SHA-3 is still built from a permutation, albeit an unkeyed one

as a real life analogy, imagine shuffling

a characteristic could be two cards directly next to each other remaining the same

the probability of that may be 10% after a shuffling once (1 round)

@CodesInChaos So, shuffling again "normalizes" characteristics of the first shuffle?

After shuffling 20 times it will be much smaller, close to the probability of a perfect shuffle.

You can imagine it as a characteristic having a certain probability of surviving each round

@CodesInChaos Oho. Now I guess it's more clear.

Thanks a lot, @Codes

so the probability of surviving all of them drops exponentially. e.g. (0.1)^20 for 20 rounds

Yup

after you have a (close to) perfectly random permutation (blockcipher, or Keccak's core permutation), you use some simple tricks to turn it into a perfectly random function like a hash

@CodesInChaos One last thing, is it a different concept when we talk about different kinds of shuffles? In your analogy, giving the deck to a different player to shuffle for the 2nd round, rather than doing the same shuffle again.

no, same player

@CodesInChaos Yup, figured so.

Alright, I guess I get it now.

often each round is the same, or you alternate 2 or 3 different strategies.

@CodesInChaos Wanna write an answer there? security.stackexchange.com/questions/53297/…

Or shall we move it to Crypto.SE?

@FEichinger Actually no, I wanna have it. You're wrong. "More random" and "Less random" are perfectly valid concepts and are academically used. According to Information Theory, the more entropic your system is, the more random it becomes. Indeed, when entropy is decreased, the randomness is decreased. So, yes. There's something as "more random".

@CodesInChaos yes, but colloquially that is not what is meant when that term is used.

Though I guess in your case, an exception should be made.

@AviD God damn it! Doing that again?

The dog leg thing?

Also, I have been using the word "colloquially" a lot lately.

been hanging out on English.SE too much, I guess. I blame @Adnan.

@Adnan heh, well this time I'm on the other side.

@FEichinger Unless you wanna go mathy and preach about the concept of true randomness, which doesn't exist int he real world. Then we'll have to dive into randomness as opposed to unpredictability. Oh, Jesus.

@Adnan mergated.

The discussion will become way beyond us.

Definitely way beyond me.

@AviD Kiitos kiitos!

@Adnan danke, danke.

@AviD Finally, the lanterns have been unscrewed from the balcony. Now the construction workers can come and install the glass windows.

Is it St. Patrick's Day next week??

Let's see your euphemisms.

@Adnan heh.

oh yeah, it's on Monday.

@AviD Wasn't it in April?

Or was in March?

And, on Sunday is Purim. Which you can think of as kinda like a combination between Halloween and St. Patrick's Day.

So we will be having 2 days of Costumed St. Patrick's Day.

Or, as I like to think of it, 2 days of disguised drunks all over the place.

@AviD Sooo... pretty much every Tuesday, Wednesday, Friday, Saturday, and Sunday in Finland.

hehe. well, its more so on these days than on regular days.

it is even horribly common for kids to be getting drunk.

@Adnan Hey, what's wrong with Monday and Thursday?

@AviD I don't know. They just don't have special occasions. Tuesday is the Swedes day, Wednesday is the Finn's day (mostly students), Friday and Saturday are for everybody, and Sunday for poor people/students.

hehe

sanity check time. I'm not losing my mind here am I

@AJHenderson Yes, you are.

@TerryChia ah, if only I didn't see that one coming a mile away

and yet you still fell into his trap.

@AviD or I'm a masochist who was hoping he'd let me ;)

@ton.yeung I get nervous around files named install.html

@AJHenderson and squirt.io

my squirt.io is working fine already, thank you very much

@AviD You dirty dirty boy.

though I suppose having a second installed could be interesting

just for laffs, google "squirt".

Bing is even better - this is the first hit

@ton.yeung wow, that is actually a pretty interesting idea

@ton.yeung is that a cheap knockoff of spritz?

@AviD you've done interviews right?

@LucasKauffman with whom?

@AviD job interviews (as in interviewing someone)

yeah, both sides - but probably not interviewed as much as @RoryAlsop.

any ideas for open questions for an entry level?

you're getting it dumped on you now?

@LucasKauffman "What is the best yo mama joke you know?"

I always have these closed questions, but I want more open ended ones

@AviD God damn it!!

@ton.yeung are you serious?

for me, it is never about "a question", or even a series of questions.

@LucasKauffman yeaaaahh.... PLEASE avoid those.

I buy into the Spolsky school of interviewing, though that is really designed for programmers.

Wow, they grow so fast.

besides, are entry levels really expected to know anything?

@AviD I'm thinking more or less towards "What password hashing algorithms would you recommend" and then if he knows the answer progress in asking "Consider a client has uses MD5, give some good migration strategies"

@AviD no exactly, for me the important thing is he has the ability and wilingness to learn