It's nice to be on a site where moderation works. Thank you @RoryAlsop @AviD @Jeff Ferland @HendrinkBrummermann — and all the community members who help
I haven't spoken to any terrorists, so the only source I have for this is Bruce Schneier, but apparently, they're hard to pull off. Objectively, this makes sense; if they were easy, there would be more of them.
For the sake of not referencing any actual living or dead person, let's call our sup...
Brilliant answer!
> Okay, but what about an opponent who has lots of money, enough willing people to pull off the plan, resources to get them in place and provide the proper training, all while disguising the source? A vast conspiracy? Well, yes, those exist. They're called nations, and other nations go to war with them over things like that. But at that point, it's not really terrorism anymore, is it?
Yeah, I guess "crashing" is the plane's default behavior. And if you chartered the plane, the pilot works for you and you can just say, "Uh, Captain, can I get your opinion? Does this handkerchief smell like chloroform to you?" — Malvolio11 hours ago
Google employs thousands of people sitting in front of computers whose sole job is snatching up domain names when they become available. — Terry Chia41 secs ago
Dear lord! The UK visa people has milked dry of information and money. At one point, I thought I was being scammed, but I can see I'm making payments to a .gov.uk site.
I'm using SourceTree (a Git GUI) which uses Putty as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH authentication server are on separate servers. Hence, I need to login to one server and then push to ...
@ThomasPornin (or any other), yesterday I was thinking about why the hell couldn't we use the username as a salt for hashing the password, after all, usually the username is unique...
I know that it would be a well known salt, but I don't know if that means to be a bad salt...
any thoughts?
(I know that the entropy is also way lower than a random generated pass, but again... )
just giving a different perspective now I am thinking about rainbow tables will use common usernames to generate the hashes
@CodesInChaos yes but, In my previous thoughts I thought that once cracked a system, probably the user will be using the same password so a different hashing didn't seem to add more strength here...
@CodesInChaos yeps that is very true, that what I thought with the rainbow tables... On the other way, if you use the pair you have suggested "server", "username"... Although some server have very long names
So, maybe the true question is, why is entropy so important? isn't it enough to have unique salts.
Does the entropy here simply help us to have some sort of "unique" hashes across internet?
@Adnan Yeah. I would also give it high priority for Stack Overflow because it's a source for copypasta (then again, those who blatantly copy deserve to have their terminals hijacked :P). I think they did do that, internally, but they were unable to come up with a quick fix that doesn't break stuff
'cause all those people who've been sold "appliances" which are linux + apache +OpenSSL are about to have a world of pain when the next Vuln assessments happen
the number of places I've seen who actually patch their appliances is... not high
@RоryMcCune But I also bet what you'll find (and I don't have any data to back this up) is that it's probably primarily only going to be applicable to appliances installed in the last year or so. I'm going to bet that most of the equipment that predates that also uses a version of OpenSSL that predates the introduction of heartbleed.
@Xander yep, I'd agree, many will be "saved" by having older appliances, although the push to fix CRIME/BEAST etc might have caused issues as that probably pushed some to upgrade on new ones
@Xander I don't have any data either, apart from fielding my first query on a system that the vendor didn't think needed to be patched, it occurred to me it won't be the last...
@Xander And this is all internal for a relatively small company. $350 isn't terrible but it's a bit of a wake-up call since all our other hires have been direct recruiting.
@Adnan Oh God I did have the misfortune to use it here and there, and it's awful. Every little thing about it screams "dude we just wrote it, we're not idiots enough to actually use it too"
Sorry was AFK handling wordpress delights or I'd have mentioned PSTs :) I remember back when I were a lad and we had 50MB email quotas, everything were stored in PSTs
@Xander @ScottPack yeah I know in the UK a lot of places charges 10+% of first year salary...
@TildalWave yeah OE was good back in the day. I actually quite like modern Outlook versions, even though the older ones were an abomination in a lot of ways...
@TildalWave Yes. At Microsoft they believe in product lines, with independent development process and very few cross-product transfers. "Outlook" and "Outlook Express" are (were) two distinct products, and the relevant teams did not talk to each other.
OE sill lives as "Windows Mail" or something like that, though.
@ThomasPornin actually there's been studies lately that suggest those hexagons don't have anything to do with "how bees like it", it's just surface tension and the bees actually start with a circular hole into the wax and their movement then heats it up enough so it starts making that hexagonal honeycomb
@ThomasPornin Truthfully there are still some games that use hexes, primarily war games and I think table tops involving space combat. You'll also find it in Pathfinder when talking about big terrain mapping as opposed to battle mat.
Poly is also on Twitter twitter.com/gsuberland I'm pretty clueless on half of the stuff he's tweeting about, especially when he's in his electronics tinkering mode, but he's there
hehehe missed this April Fools one, Google looking for Software Dogengineer:
I have a rather odd security requirement that I must keep the amount of potentially encoded information in a record under 250 kilobytes. That's not a lot of data, so I was thinking of calculating the efficiency of an encoding scheme and deducting the overhead from the total calculation size.
Fo...
I have a rather odd security requirement that I must keep the amount of potentially encoded information in a record under 250 kilobytes. That's not a lot of data, so I was thinking of calculating the efficiency of an encoding scheme and deducting the overhead from the total calculation size.
Fo...
