The DMZ

David Freitag

6:10 PM

@Simon I have successfully moved into my first apartment.

but not before totally ruining my back

Ohnana

@DavidFreitag achievement get

David Freitag

@Ohnana The sofa I ordered wouldn't fit :[

Now instead of a sofa with a sleeper and a love seat, now I only get two love seats

Ohnana

@DavidFreitag cut to fit?

seriously

David Freitag

@Ohnana There is this monumentally stupid privacy wall by the front door similar to the ones in public bathrooms. If it wasn't there I'd have my sofa

Ohnana

damn.

David Freitag

6:15 PM

I got 105mb/s internets with a wired modem, not one of those POS modem/router combos

Beats the shit out of the 9mb/s speed I had before

Flyk

@Xander maybe the chat room type?

@DavidFreitag You have earned the achievement "NAKED AT LUNCHTIME"

David Freitag

@Flyk I got that one a long time ago.

Flyk

worrying

raz

@DavidFreitag @Xander I don't know if you're a beer guy but Untapped added a badge for checking in beers before noon. I'm Lvl3 :D

TildalWave

David Freitag

6:22 PM

@raz lol, i don't really drink beer much, and iirc they don't count angry orchard (probably because it isn't beer)

raz

@DavidFreitag They do count ciders!

Ohnana

@TildalWave my dad's bringing back mutton chops and it's honestly the best facial hair I have ever seen

David Freitag

@raz Well even then, I usually have a glass of scotch or tequila

raz

@DavidFreitag I don't go for Angry Orchard too often. Crispin is dry and delicious.

@DavidFreitag Single malt's never a bad choice. Tequila is always a bad choice for me.

David Freitag

Mah back D:

TildalWave

6:24 PM

Also interesting ...

from vox.com/2015/3/1/8123457/beard-history-chart

raz

Skirt width...

So as beards have decreased so have skirt widths... skirt length maybe. Not sure about width.

TildalWave

well yes you can pack more of less wide skirts on public transports

Ohnana

@raz hoop skirts vs pencil skirts

David Freitag

Yep, I'm lost.

raz

Yeah I don't know about skirts at all

David Freitag

6:28 PM

@raz I think they are kilts for women

3

raz

I'm not Scottish, but I see your point.

Ohnana

@DavidFreitag i have a kilt

it's great

can't wait until summer so i can wear it more

David Freitag

@Ohnana Oh yeah? I've got a mustache hat.

Ohnana

@DavidFreitag not a hat fan

raz

A mustache hat?

Ohnana

6:30 PM

but that's cool

David Freitag

Yeah let me see if I can dig up the picture

Jan 27 at 0:57, by David Freitag

That one ^

Simon

@DavidFreitag Well done! How is it like so far?

schroeder

@Flyk please throttle your edits. new questions are getting lost. I made the same mistake when I started making edits.

Rоry McCune

@schroeder @Flyk isn't new to the edit game, but the numbers seem to ramp up when she's bored...

David Freitag

@Simon I haven't been able to enjoy a single minute of it. I moved everything in and proceeded with unpacking. 20 minutes into unpacking I felt a pop in my back and I have been in agony since then

raz

6:35 PM

@DavidFreitag How to Train Your Dragon merch?

David Freitag

@raz Nope, my sister made it for me for christmas

Ohnana

@DavidFreitag glorious

David Freitag

@Ohnana It's incredibly warm.

Ohnana

@DavidFreitag I'm sure

@DavidFreitag also next time you pick heavy things up and put them down, use your knees and get help :)

David Freitag

@Ohnana I picked up a keyboard from my bed -.-

Next thing I knew I was writhing in pain on the floor

Ohnana

6:38 PM

@DavidFreitag probably not what caused it

David Freitag

None of my stuff is particularly heavy

Ohnana

still. sucks that you goofed up your back

David Freitag

Also, no microwave.

Xander

@raz Ha, nice. Packy uses Untappd...I have it, but don't really use it.

Jeff Ferland

@TildalWave That's great.

TildalWave

6:47 PM

I like that they clarified in the graph that frequency of wide skirts is for women and frequency of beards for men :)

Simon

7:22 PM

@DavidFreitag Oh, you got a pussy back too?

:2034 I wonder what happens if I change the reply ID.

IT DOESN'T WORK LADS, IT DOESN'T WORK

Ohnana

@Simon that message isn't in our room

in RPG General Chat, Oct 11 '10 at 13:36, by RMorrisey

GURPS is a fairly realistic system. If you want a system that's more cinematic, and closer to d20 stuff you're used to, I'd strongly recommend Spycraft. It's not very cross-compatible with other d20 games (because the game balance is just so different) but it's a lot of fun and has a lot of flavor that I think d20 modern lacks

@StackExchange This is the first message in our room

Iszi

@RoryAlsop You ever feel compelled to do something, and then afterwards immediately look back at it and think "why did I even bother wasting the energy"?

(RE: My posts on "what does it take to get an answer" and the related meta.u&l post.

Damnit. I hate when I leave a word missing or parenthesis hanging and the comment/chat message editing period is expired.

Rоry McCune

@Ohnana Lol and @AviD has been here pretty much the whole time!

Ohnana

@RоryMcCune ikr

Iszi

@RоryMcCune Wow, there's another face we don't see much anymore I think - @GrahamLee.

Rоry McCune

7:34 PM

@Iszi yeah I've not seen Graham about in aaages

I think he does more general iOS stuff these days, rather than just security

AJ Henderson

anyone really up to date on session management in ASP.Net? Is it really as bad as it appears?

it blows my mind that by default they reuse session ids and don't provide any mechanism for changing SessionIDs on permission level changes at all

David Freitag

@Simon Yes, it runs at the sight of even the slightest bit of work

Simon

@Ohnana nurd

@DavidFreitag I usually suck it up and keep going.

Ohnana

@Simon so nurd=has critical thinking skills?

Rоry McCune

@AJHenderson are you thinking of ASP.NET_SessionId or .ASPXAUTH tokens?

AJ Henderson

7:43 PM

ASP.Net_SessionId

Rоry McCune

@AJHenderson in most cases from what I've seen, both are set but it's .ASPXAUTH that handles session management (you can delete ASP.NET_SessionId and it'll just get recreated)

that's not always the case but most of the time it is

David Freitag

@Simon Yeah this wasn't a "suck it up and keep going" it was a "Ha bitch try and move now"

Rоry McCune

IIRC the older ASP.NET apps may have just ASP.NET_SessionId

AJ Henderson

it stems from an attempt being made to re-write our auth so that we can remote kill sessions. Forms auth doesn't provide a way to do that, so they want to move to using the session, which seems like a bad idea

Rоry McCune

@AJHenderson ah yeah by default IIRC ASP.NET doesn't really do session token invalidation

David Freitag

7:45 PM

@Ohnana It's not about the critical thinking, it's about how you apply it.

Rоry McCune

it works on a sliding time window

AJ Henderson

@RоryMcCune not only by default does it not, it appears to be impossible to do any kind of change on an active session. You can use the SessionIDManager to kill the current cookie and make a new one, but if you had an existing session, you lose it as it makes a new session rather than changing the id of the current session

basically, whatever ID you provide as the "session id" in the cookie, ASP.Net will happily create a session that corresponds to it

Rоry McCune

@AJHenderson yeah in that, it seems like ruby on rails using cookie store, you can't invalidate session as it's not really managed server-side

good for scaling

not so good for security

AJ Henderson

and I think it hasn't been made a big deal of because most Authentication in .Net is done through Forms auth which is a fair bit more secure and then you can cross check your forms auth with your session to make sure your session access is valid

but then Forms auth can't be invalidated before being applied as a valid state by anything remote because it is literally just an encrypted token that says "I'm this user until time x"

with no way at all to say "no you aren't gtfo"

Rоry McCune

@AJHenderson indeed, you'd need to custom code a check server-side to handle that

so an additional cookie set, that is stored server-side, correlated to the user and can be invalidated

Iszi

7:50 PM

@AviD Is that the Sec.SE chat room Easter egg we've been hunting for?

AJ Henderson

right, my initial idea was tie the Forms auth to the session state via a key that we could invalidate serverside, but session isn't available until way after forms auth is done, so the user will already be authenticated and active on the system before I can check the session to see if they are valid or not :/

Xander

@AJHenderson Session state is concept that shouldn't exist in an HTTP app.

Rоry McCune

lets just say I've written up "ineffective logout functionality" for ASP.NET apps once or twice

Xander

@RоryMcCune I have trouble with this finding. It's so incredibly narrow as to be a non-issue for 99% of apps. There are occasions when it can be an issue, but they're infrequent exceptions rather than the rule.

AJ Henderson

@Xander that's a nice concept, but not very practical. You can't effectively push everything to the DB all the time and still have any kind of performance

in certain cases

Rоry McCune

7:53 PM

@Xander if an app provides a log out feature, it should actually invalidate the session server-side, or the developer should be aware that it doesn't

@Xander the finding is a low which says "hey after using the logout function the IDs are still valid for x minutes, you might not want that to be the case"

@Xander so the site realises that (they may already do so, but in my experience many don't)

Xander

@RоryMcCune That goes back to my argument that an HTTP app should (generally) not have a concept of session side state, but should operate on request/response pairs. And yes, the dev should understand how cookie replay can be an issue in that model.

Rоry McCune

@Xander apps (as users experience them) to me need to have some way of recording when a user logs in and out and once they log out, from a security perspective, they shouldn't be able to access content only available to logged in users

AJ Henderson

@Xander in our case for example, we actually had to deploy a specialized session management solution for storage because we had been storing down to the DB and it was killing our firewall on the information we had to pull back about user every single request, even at the AJAX level

Rоry McCune

@Xander so HTTP as a protocol might not want/need a concept of session, but apps as most users experience them do, and for better or worse, most are written over HTTP these days

Xander

@AJHenderson You don't have to push to the database all the time. I'm not arguing for persisting all the things to the database, I'm arguing for not shoving a bunch of data loosely associated with some request/response pairs into semi-volatile storage and calling it "stateful."

@RоryMcCune That's fair.

AJ Henderson

7:57 PM

@Xander ah, well, that's just abuse of session state

Xander

@RоryMcCune Yes, I do understand that this is far too infrequently noticed or understood.

AJ Henderson

not that session state itself is inherently bad

raz

@Xander It's been nice since I've switched phones 3 times in the last couple of weeks. All my beers are all centralized. As I often forget if I've had a beer.

Xander

@AJHenderson Well, it's certainly useful in many cases, and I wouldn't go so far as to say it should be actively avoided if it does in fact serve a useful purpose for an app, but I would call it an anti-pattern. It's duct tape on top of a architecture that wasn't designed to support that sort of mechanism.

@raz Yeah, would be super handy for me for that as well, though at this point, it's a bit of a lost cause. I'm just trying to implement better search on my blog instead so I can use that as my library, since it at least covers most (but alas, still not all) of the beers I've had in the last four or five years.

AJ Henderson

@Xander yeah, on that we agree

I think HTTP as an application platform in general is boneheaded

since it started as a way to get text files that linked to other text files

it's the epitome of a chain of hacks spanning decades

Xander

8:04 PM

@AJHenderson Ha ha, yes, that is very true.

AJ Henderson

(which would be why I normally hide out in back end land)

raz

@Xander You should be able to script and create your own beer database. Have a column for the blog post link. Then create a full beer list webpage with links included. That'd be kinda sweet. Then search the DB.

Xander

@AJHenderson So simple answer? Add a piece of data to your session IsAuthenticated and set it to true when the user authenticates, and false when they log off. All new sessions should have it false, and once the user is logged out, the old session will too. You don't need to worry about messing around with sessionids at that point, because the sessions themselves accurately track authentication status.

AJ Henderson

well, the sessionid's issue has to do with fixation issues

ie, because .Net's sessionID by default stays the same, if I were to, say, change my password, it doesn't do shit to lock out an attacker who was already logged in

because my session and their session are still linked

Xander

@AJHenderson Ah, gotcha, yeah, reading up further now.

AJ Henderson

8:13 PM

any permission level change should result in a sessionID change, but I can't do that

it seems to not be made a big deal because the Forms auth cookie is more secure and can be checked before allowing access to the session (making the session untrusted)

but I can't use Forms auth due to it not being able to be invalidated remotely (in the case of, say, a rogue employee)

it gets set too early in the stack and the user would be valid until session state can be loaded

which is a bit risky, though possibly the best we can do

but I could put a server side value that we can invalidate that will cause the application to say the valid forms auth ticket is not actually valid

but only after I get to the point where session state is loaded

Flyk

@schroeder #careface

schroeder

lol

Xander

8:31 PM

@AJHenderson Sure, stick something on the request or in ThreadLocal storage. That should work. It's been so long since I've worked on an app with session state that I've forgotten where in the pipeline it get loaded.

David Freitag

Excel is really starting to piss me off

Half the time the sum function keeps returning 0, the other half it just enters the formula I write as text

So infuriating

raz

Software is only as smart as their operators.

David Freitag

I think the massive team of developers had something to do with how smart the software is too...

Simon

8:47 PM

@Ohnana A nurd has nurd skills.

Ohnana

@Simon yes. a badge of honor

Simon

@DavidFreitag Yeah, I've had those a few times, had to stay in bed for ~3 days.

Rоry McCune

9:12 PM

freakattack.com <-- another named SSL bug

'cause we've not got enough of those in our test reports already

CodesInChaos

Don't roll your own crypto, they say.

AJ Henderson

@Xander thread local won't work in any distributed environment

because you have no guarentee that the same system will serve both requests

CodesInChaos

If I look at all these beasts and freaks and the crime rate, how can I not roll my own crypto?

Xander

@AJHenderson Ah, using out of proc sessions?

AJ Henderson

@Xander yeah, with a custom provider

which also does mean that our session state really is stable

or as stable as we want it to be

and yeah, that's what I ended up deciding to recommend, I don't like the Identity of the user ever saying it is authenticated when it isn't, but I simply don't see any better option avialable

and everything I find seems to indicate that coupling session to forms auth is the appropriate solution

I could always implement my own secure cookie, but that's dumb when Forms auth is sitting there able to provide it. And if we really wanted to be fancy, we could implement a direct access to our session state service outside of the .Net session manager, but that's probably something for another day

though that would allow preventing the Identity from ever being valid

well, provided I have access to the cookie at that point anyway

Simon

9:39 PM

@RоryMcCune The dude was so much in a hurry to make the website that he didn't double check his spelling.

"cryptogrpahy"

Gilles

10:11 PM

0

Q: Multiple iptables denied in report from hourly logcheck on Debian

I get thousands of lines of iptables denied every hour from logcheck, for a week now. What are the steps to troubleshoot this, what are the main causes of this? This is inside an LAN and the addresses denied are local to the LAN. Here is an example of the logcheck report: This email is sent ...

David Freitag

5

Q: Why is my debugger detected as a Trojan by anti-virus software?

I'm trying to use a deugger (namely OllyDbg) to analyze some exe files. However, all the versions I downloaded from the Internet are considered as Trojans by some anti-virus software. (I use www.virustotal.com to scan the binary I downloaded) Are OllyDbg's main behaviors belong to a kind of Tro...

malware debugging trojan

TildalWave

10:29 PM

Future value as in we're now having a LMGTFY 101 session. Once we determine which suitable search keywords would match the image you're searching for, there's no further value to it for our Q&A. I.e. it falls in the unclear what you're asking category, and by the time you edit to clarify what precisely you'd like to find, it will be trivial to do so. How about 1 or 2? — TildalWave ♦ 32 mins ago

This Q&A concept is too hard for most people isn't it?

David Freitag

@TildalWave I dunno, seems pretty hard to me.

TildalWave

Yes, it's too complicated.

David Freitag

@TildalWave sigh, you missed that euphemism completely.

TildalWave

I often find myself commenting with stuff like Some conjecture is fine as long as it's sufficiently explained and preferably supported by facts and/or reliable souces of information. Which is just verbal diarrhea isn't it?

@DavidFreitag I'm serious tho

David Freitag

@TildalWave I think you have made the mistake of believing that everyone who comes through here actually reads any of the relevant information before posting something.

TildalWave

10:36 PM

@DavidFreitag but it shouldn't be this hard to ask for help should it?

David Freitag

6 mins ago, by David Freitag

@TildalWave I dunno, seems pretty hard to me.

TildalWave

we're a bleeping bureaucratic fortress and I often feel like I'm just walking in circles like that Marvin from HHGTTG just to make the point

And if I let through some simpler (trivial in SE parlance) questions, then you get whole essays in meta asking if that's what we've became

Like this:

2

Q: Is there value in questions about future schedules?

I came across questions like, most recently, "What is the planned date for the Falcon Heavy Demo launch from Vandenberg AFB?". Such questions are interesting to me, but they also seem very volatile, speculative, and cluttering in the long term. How does SE want to deal with these questions? Jus...

discussion scope questions

And this is nothing, you should see meta posts on some other sites, e.g. Astro.SE

Anyway, what's new here?

David Freitag

@TildalWave They finally killed OpenGL khronos.org/vulkan

TildalWave

ah nice

where does it work? :)

and does it run node.js?

David Freitag

@TildalWave According to the banner at the bottom it has been adopted by most of the chip manufacturers as well as some large game companies.

TildalWave

10:49 PM

ah yes I see logos now ... nice

Thomas Pornin

@RоryMcCune Oh well, that's it. I am going to write a SSL library just to show how these things should be done.

David Freitag

@ThomasPornin Ah, yes! Make it portable too :D

Thomas Pornin

@DavidFreitag The choice of language is still open.

Basically, either something sane like C# or Java, or something portable like C.

Gilles

@ThomasPornin Agda2?

David Freitag

@ThomasPornin Heh, I had you pegged for C.

Thomas Pornin

10:57 PM

@DavidFreitag I know too much about C to be thrilled about programming in C.

David Freitag

@ThomasPornin Since when has C ever been thrilling? I have never found the process of programming to be thrilling, but I have found the result of said programming to be such ;]

Thomas Pornin

@DavidFreitag I envision good code as a work of Art. The process of creation is the best part.

3

schroeder

11:31 PM

where do we find these people?

@schroeder Some of my responses are "unethical"? What are "ethics" when we're talking in the context that his school has perpetrated a man-in-the-middle attack which victimized OP and his peers? In this context I think the topic of "ethics" is a red herring -- OP is a victim and he is entitled to self-defense. You may have a point that I don't answer the letter of his question, but I do provide certain hypothetical responses to the grievance OP raised. I strongly feel though that the "ethics" debate flies out the window here. If you're being done wrong, do yourself right, no one else will. — user69557 2 mins ago

Xander

@schroeder Sigh I don't know, but wherever we find them, we should return them as defective. I hope we kept the receipt.

Transcript for