« first day (821 days earlier)      last day (4071 days later) » 

Scott Pack
Scott Pack
12:33 AM
@JeffFerland que?
 
 
8 hours later…
CodesInChaos
CodesInChaos
8:22 AM
0
Q: Anonymized Votes

Dave JarvisBackground Looking to create an anonymous voting system. The system must track whether or not a user voted on an item (public information), but only that user is ever allowed to know whether they voted for or against an item (private information). Users must login with a unique identifier and a...

security database-design encryption users privacy
 
 
5 hours later…
Manishearth
Manishearth
1:52 PM
@jrg sorry, I validated those flags( didn't see the username properly, it was zoomed out)
Doubt you got hit by the autosuspend though :)
(I'm unable to see any "unsuspend" option on your profile, so I assume that you can't suspend a chat mod)
 
Terry Chia
Terry Chia
@Manishearth It would be pretty amusing if a mod can suspend another mod.
 
Manishearth
Manishearth
@TerryChia Mods can suspend themselves on the main site, just that we still keep all powers
(this ends up annoying the comm team though, since suspensions get ccd to them)
 
Scott Pack
Scott Pack
I'll bet @jrg deserved the suspension anyway.
 
Manishearth
Manishearth
I also review-banned myself this morning to check out the UI (apparently this doesn't annoy the comm team). This did take away my review privs, but I could get them back easily
 
Scott Pack
Scott Pack
review ban?
 
Manishearth
Manishearth
1:57 PM
And on chat if I want to suspend a mod I have to unmod them first (change their parent user to a site which they don't mod on, force refresh their profile)
@ScottPack Banning from the review queues
 
Scott Pack
Scott Pack
@Manishearth That sounds like a fun button.
 
Terry Chia
Terry Chia
@Manishearth How many types of bans are there?
 
Manishearth
Manishearth
@TerryChia Suspension, question ban (automated, not available to mods--we can't even see if a user is qbanned. Only enabled on S[OFU] and Programmers), answer ban (similar to qban, but enabled on all sites), revie ban (both automated and mod-induced)
For info on qbans/answerbans, see meta.stackoverflow.com/questions/86997/…
 
jrg
jrg
2:36 PM
eh?
i was sleeping, so meh.
@Manishearth oh, didn't know you could suspend/unsuspend a mod.
i've thought about trying it, but never actually did it.
 
Scott Pack
Scott Pack
2:59 PM
@Manishearth What defines a question ban?
 
Terry Chia
Terry Chia
Yawn. We need more people to do the CTF.
 
Polynomial
Polynomial
Fuck me it's cold.
just arrived at the new house and the heating isn't on.
and I have no idea how to work it.
 
Terry Chia
Terry Chia
@Polynomial :(
 
jrg
jrg
@TerryChia you are running a CTF?
 
Terry Chia
Terry Chia
@jrg We are taking part in one.
 
jrg
jrg
3:14 PM
i don't normally get a 403 around here.
 
Terry Chia
Terry Chia
@jrg Hmm. It's in the list of site rooms.
 
Gilles
Gilles
@TerryChia it won't appear if you don't have access to it
 
Terry Chia
Terry Chia
@Gilles He is a mod though, shouldn't he have access?
 
Gilles
Gilles
@TerryChia no, this works per-site, so only sec.se mods automatically have access
 
Terry Chia
Terry Chia
@Gilles Ahh I see.
 
Gilles
Gilles
3:18 PM
chat permissions are somewhat bizarre
 
Terry Chia
Terry Chia
We will need a room owner to let him in then. @Polynomial maybe if you are around?
 
Polynomial
Polynomial
no idea how
don't think I'm a room owner over there
 
Gilles
Gilles
 
Polynomial
Polynomial
done
 
Terry Chia
Terry Chia
@Polynomial If you can, make me a room owner by the way. It's more convenient since I'm always around at this time.
 
Polynomial
Polynomial
3:29 PM
@TerryChia Shall od.
*do
done.
 
Terry Chia
Terry Chia
@Polynomial Thanks mate. :)
@jrg Look in the room. :)
 
 
2 hours later…
jrg
jrg
5:09 PM
@TerryChia looking
 
Rory Alsop
Rory Alsop
6:02 PM
@Poly - you moved already then mate?
 
Scott Pack
Scott Pack
That was today's agenda item, no?
 
Rory Alsop
Rory Alsop
I just hadn't expected to see him in here again so quickly :-)
 
l0b0
l0b0
6:26 PM
Hi all! Any good ideas for a user friendly PGP email client/app/site? security.stackexchange.com/questions/32716/…
 
Rory Alsop
Rory Alsop
@l0b0 fromyour question, number 4 is not going to happen. The way pgp sets up encryption for emails gives you a header and a footer delimiting the pgp section
so, quickly running through those points:
1 pgp desktop (for notes and for outlook) does exactly this
2 - as above
3- as above, or configurable by admin
4 - would break normal usage, so no
5 - this info is in the readme/manual - you could provide it to the users. Except for 5.3 - which is not practical. Too many variables
6 - as answer 1. By default all the pgp clients I have seen do this with 1 click (or at most 2)
So the two I have used most are pgp for notes and pgp for outlook andthey pretty much do everything you ask for except those things which don't make sense (your point 4)
You can get around point 4 by encrypting an entire message object, then the contents will be exactly the message an dno more, but that wouldn't be a normal mail client - it would be using pgp to encrypt a document, then emailing that pgp encrypted document, rather than using pgp with your email client
 
Adnan
Adnan
Heey! Welcome @l0b0!
 
Polynomial
Polynomial
@RoryAlsop Yup!
 
Adnan
Adnan
@ScottPack, I need a second opinion on something. Let me fetch the link
@ScottPack, okay, here it is stackoverflow.com/a/9395753/1105514
I feel we wronged the guy. If you have 2 minutes to waste, check the conversation.
 
l0b0
l0b0
@RoryAlsop Do you mean Symantec Encryption Desktop Professional from Symantec?
 
Adnan
Adnan
6:36 PM
Or anybody else, maybe @Poly, because you were part of it
 
l0b0
l0b0
Also, I forgot to include an absolute deal-breaker which is that it must work on Linux
 
Rory Alsop
Rory Alsop
@l0b0 okay, so that's probably the most important part of the entire thing - most pgp solutions for mail clients do not work on Linux
Enigmail might be your best bet
bigger list here - trying to see if I have played with any of these...gnupg.org/related_software/frontends.html#nix
I tended just to script solutions when I used gpg on anything, be it mainframe, Solaris, AIX or whatever
 
Manishearth
Manishearth
@jrg On main, yes. On chat, no. Don't suspend FOR SCIENCE on main, even on test accounts or yourself.
 
jrg
jrg
@Manishearth comms team hates you later, right?
 
Manishearth
Manishearth
@jrg I think they cut your diamond in half. You become a triangle.
 
jrg
jrg
6:42 PM
thats a terrible fate
 
Manishearth
Manishearth
@ScottPack If too many of your questions are downvoted/closed/deleted (IIRC it's a weighted percentage-like thing, though the algorithm isn't really known -- basically deleted is worse than closed, and if you have a large amount of recent good questions you're fine), then you are blocked from asking questions. It gets lifted if you spend time writing good, upvoted answers OR fix your questions so that they get upvoted/reopened.
Answerbans are similar, but people rarely hit it.
@jrg Yep
 
l0b0
l0b0
@RoryAlsop Dang. Last time I tried Thunderbird I ended up filing bugs several times per day for basic functionality like filters, and giving up once I lost some email randomly.
Ah well, maybe in another few years.
 
Adnan
Adnan
@Manishearth That's a very brilliant mechanism. Suspending them while giving them the chance to rectify their deeds. Interesting.
 
Rory Alsop
Rory Alsop
@l0b0 Thunderbird is a lot better now - I think some of the folks in here use it as their main client...@Scott - were you one?
 
Adnan
Adnan
@RoryAlsop Thunderbird as a main client here!
 
Rory Alsop
Rory Alsop
6:48 PM
@Adnan it is pretty robust now isn't it?
 
Scott Pack
Scott Pack
@Manishearth I see. I've heard of the autoban kicking in for poor content, particularly deleted content. I didn't realize exactly how much went into it.
I used to use Thunderbird, but we're an Exchange shop these days.
That pretty much forced me over to Outlook for Windows/Mac and Evolution for Linux.
 
Adnan
Adnan
@RoryAlsop Yup, I really like it. One thing I don't like is that it's not super compatible with the company's environment. Can't use Exchange's calender, for example. Everything else works like a charm.
 
Manishearth
Manishearth
@Adnan Note that it's not perfect. Folks who have been questionbanned and don't have any nondeleted questions can't fix the questions. (Still, they can write answers). However, this is more of a problem with the SO community -- folks go crazy on deletion. Deletion is only supposed to be for unsalvageable questions.
 
Scott Pack
Scott Pack
For whomever mentioned it, I administer our PGP Desktop/Universal environment.
 
Manishearth
Manishearth
@Adnan @ScottPack also, Sec.SE only has the answer ban.
 
Rory Alsop
Rory Alsop
6:50 PM
@ScottPack fair enough - just wondering whether anyone uses of the gpg or Enigmail stuff as per @l0b0's question
 
Manishearth
Manishearth
@RoryAlsop I used enigmail+thunderbird for a short time
 
Scott Pack
Scott Pack
I used enigmail when I was using Thunderbird. The resultant client switch thanks to our Exchange migration moved me over to S/MIME.
 
Rory Alsop
Rory Alsop
Well, as per the chat up there^ chat.stackexchange.com/transcript/message/8546605#8546605 - any useful guidance for l0b0?
 
Scott Pack
Scott Pack
The PGP/GPG armoring was...less than ideal. Only a handful of people that I knew actually used PGP, but I autosigned everything. The best clients displayed it as an attachment with a weird mime-type. The others displayed the armoring in-line which confused the fuck out of almost all of my recipients.
They eventually learned to just ignore it as "something weird Scott does".
 
Manishearth
Manishearth
@RoryAlsop I ran thunderbird+enigmail on Ubuntu. Worked like a charm
 
Scott Pack
Scott Pack
6:54 PM
Thunderbird+enigmail is pretty top notch, it is probably the best overall PGP experience. Mulberry supports it out of the box, which is cool if you happen to be the Mulberry user left.
Otherwise you're pretty well out of luck.
Outlook doesn't really support plugins anymore, and hasn't had a usable non-commercial PGP plugin since 2003.
OSX Mail used to have a good PGP plugin, but I don't think it's worked since 10.6.
If you're willing to mortage your neighborhood you can get the mail stream licenses for commercial PGP (now Symantec Encryption Desktop Powered By PGP Technology).
The agent intercepts mail between your client software and mail server to do the encryption/decryption/signature checking. It is not nearly as good a user experience as enigmail, it feels more like Growl.
They used to have an Outlook plugin, we tested it in the 10.1/early 10.2 days. It was pretty fucking buggy and wouldn't run at all on Outlook 2010 64bit.
As much as it pains me to say, based on the level of user transparency you want, I just can't see PGP working.
It's a really cool system, and the Symantec née PGP product does a pretty good job of abstracting out and hiding gobs of the technical fiddly bits that PGP enforces, but for something like email I just haven't seen anything that I would want to invoke on my users.
 
Adnan
Adnan
@ScottPack It's like you're explaining our experience with PGP. Word by word.
 
Scott Pack
Scott Pack
For encrypting/signing emails it really seems like S/MIME is the way we want to go. It does require some kind of PKI, but it is natively supported by Every. Single. Mail. Client. It also ends up being a lot more transparent to the user.
About the only time it causes problems is if you are using an internal CA to generate certs (it will result in untrusted cert errors for the other party) or if the other person is using Outlook on XP pre SP2.
Your signed emails simply won't display at all because the necessary crypto libraries were included as a non-required update for XP that was rolled into SP2. For some reason when Outlook fails to validate the signature, because it doesn't understand the crypto, it just won't display the message body at all.
@Adnan I used GPG for email for quite a long time, but yeah. It just sucks that mutt and thunderbird are your only real options these days.
 
Adnan
Adnan
7:12 PM
I'm writing an employee address directory with client-side search.
 
Scott Pack
Scott Pack
Now, if you do have commercial PGP, and are willing to set up your Universal server in mail stream mode you can do all kinds of cool stuff. It acts as your MX server and will auto encrypt/decrypt for you.
 
Manishearth
Manishearth
@Adnan ...are you proud of yourself?
resists headkeyboarding
 
Adnan
Adnan
@Manishearth Give me a second.. sorry I didn't put everything in one message
 
Manishearth
Manishearth
@Adnan ah :)
 
Scott Pack
Scott Pack
If you send emails out to people in other domains it will call out, figure out if they are also a PGP shop and if so fetch keys automagically, etc etc. Pretty slick.
It also means your PGP Desktop management server is inline to your mail stream. Kind of scary if you ask me.
 
Adnan
Adnan
7:14 PM
So I'm pre-fetching the JSON data when the user access the search feature. When the user clicks "Search" I'm fetching the address book (about 6000 entries)
I'm fetching with Ajax, it took about 40 seconds to parse
I used JSONP and fetched as JavaScript object and not JSON string.
The parsing time was less than 50ms!! for the same dataset
I knew it would be faster, but this much!! wow
 
Scott Pack
Scott Pack
@l0b0 So I have no idea if that near rant wall of text was useful at all, definitely let me know though.
 
Adnan
Adnan
@ScottPack This is what we ended up having
 
Manishearth
Manishearth
@Adnan Oh, 6000 entries. Not bad. Still you probably should move it to the server.
 
Adnan
Adnan
@Manishearth It was in the specs, I have no control of them. I recommended server-side search.
 
Manishearth
Manishearth
@Adnan Ah. Good. (and bad)
:)
@Adnan This is probably why I'll keep programming a hobby and focus on Physics (I'm equally interested in both)
 
Scott Pack
Scott Pack
7:22 PM
@Adnan We, the security office, are classified as a non-operational entity. So the last thing we wanted to do was put in the position of running a service that directly impacted whether or not email worked. So we just went for the Encryption Desktop license and push WDE/NetShare.
 
Adnan
Adnan
@Manishearth If I were smarter, I'd go apeshit on physics as I love to learn how the world works. So I'll just stick to asking silly questions. Like this or this.
 
Manishearth
Manishearth
WTF HOW U GET MORE UPVOTES THAN ME
Also, cool backstory on the second one
 
Adnan
Adnan
@Manishearth Actually, the first one was an explicit attempt to get upvotes. It all started here in The DMZ, @ScottPack provided some ideas :D
@Manishearth Thanks! I've used some versions of this story to get laid.
 
Manishearth
Manishearth
@Adnan I ought to ban you all on Phys.SE for vote ringing :P
 
Adnan
Adnan
@Manishearth I'm pretty sure that doesn't constitute a valid reason for a ban.
Catch you all later. Red Alert time
 
Manishearth
Manishearth
7:32 PM
@Adnan I know :P
@Adnan Cya :)
 
Rory Alsop
Rory Alsop
@ScottPack which seems to be the simplest/best/most common solution :-)
 
Scott Pack
Scott Pack
@RoryAlsop Which is really fucking frustrating as the documentation is primarily written around using PGP in mailstream.
 
Rory Alsop
Rory Alsop
@Manishearth I'm always happy to get any upvotes over there, as folks like lubos really know what they are talking about. I just give simple answers to simple questions :/
 
Manishearth
Manishearth
@RoryAlsop Actually, this was my situation about a year ago when I joined
 
Rory Alsop
Rory Alsop
@Manishearth and now you have 6k!
 
Manishearth
Manishearth
7:43 PM
Yep. But I learned a lot of physics in that interval (not due to college, this happened last vacation)
 
 
2 hours later…
Antony Vennard
Antony Vennard
9:34 PM
@ScottPack I suspect anyone running pre-SP2 XP has bigger problems than just not being able to see emails. SP2 added shed loads of stuff - most notably in my area of work support for VSS.
 
TildalWave
TildalWave
@Adnan - this "If the user suddenly logs in from the a different city/country" part is a bit moot IMO, depends on the quality of IP to country database, but I've yet to see any that don't have loads of problems and that update frequently enough to track changes in IANA assigned ranges. I'm frequently detecting these "country changes" simply due to IP database being off sometimes.
For example one of my users would be accessing my pages first from his/her office. These IPs rarely change as most companies get a known IP range that's soon after (or immediately) registered. Then this user goes home and connect via his/her ISP. The ISP might have had IP range extended and the user just so happens got an IP that used to belong to some Moldova IP range, or something.
Users also use outbound proxies, VNC and TOR exit nodes, so that effectively prevents you from detecting their true country of origin. Also, in MITM depending on user-agent strings isn't the best nor reliable enough to distinguish a legit user from a non-legit one, considering how simple it is to change UA reported by browsers, and that a MITM would most certainly have thought of that too. ;)
 
AviD
AviD
10:08 PM
@Adnan Highly unlikely. This rarely happens.
I thought I made a mistake last week, but I was wrong.
It does actually happen, but it is quite rare, and this was not one of them.
@Polynomial brought up the user passwords, I just clarified his comment. I was talking about the database password.
@Adnan are you telling me you support keeping the database password in plaintext PHP files?
@CodesInChaos I don't know how to keep it secure in PHP, I dont know enough PHP to do so.
However, everyone who does, keeps insisting that PHP could be just as secure as any other language, with an experienced programmer. If the only solution is to keep database passwords in plaintext PHP files, I would demand that everyone who made that claim promptly and publicly retract it.
@Twinborn Linux != security.
and for that matter, network != security either.
@Twinborn I suggest you either better define what you mean when you say you want to "learn security", or keep it only at a very high, non-technical, principles only level.
Once you get into details, there is just way too many to try and cover it all.
With your background, I would suggest focusing on things like secure coding and web attacks.
ignore everything else for now (except for the general principles), such as linux, networking, etc.
HOLY CRAP!! Mr.Chessbird's rep just passed my own... I guess its time to start writing answers again.... :S
 
TildalWave
TildalWave
@AviD He's 22 man. His first steps in the world of IT security should involve checking the expiry date of the condom in his wallet first, surely :)
 
AviD
AviD
hahaha
well I think we need more programmers interested in security, than we need more security people who can program.
 
Adnan
Adnan
10:26 PM
@AviD I'm coming back at this
@TildalWave I disagree. This is not a "moot" point. I haven't suggested authenticating users based on IP or user-agent.
 
TildalWave
TildalWave
Being more of the former, i'm quite partial on this but I tend to agree. Reminds me of that question, if higher level maths are required knowledge to effectively learn IT sec. When I read it I first thought that would be the case, but after reading answers I kinda changed my mind on it. It's probably quite similar with programming skills and IT sec.
 
Adnan
Adnan
Usually I'd polity say that I failed to explain correctly. But in this case allow me to say that the problem is on your side.
 
TildalWave
TildalWave
@Adnan yeah I know that, what I meant was maybe it reads a bit awkward for a newb that the OP seems to be, that's all ;)
 
Adnan
Adnan
I've made it very clear that my point was about suspicious activities
Facebook is using exactly that. We might disagree about Facebook's record of privacy or security, but I do believe that their model is very good for social network.
 
TildalWave
TildalWave
@Adnan well as far as I'm concerned yes, you were... but the unknown is the level of understanding of OP, and seeing how @RoryAlsop had to change a lot in the question, I kinda suspect OP doesn't have much clue what you're talking about. It's possible I'm wrong tho
I just have this gut feeling that this particular individual could use a bit more explaining ;)
 
Adnan
Adnan
10:33 PM
@TildalWave Regarding this point, yes, I agree. But that's why we have the comments, if the OP doesn't understand something he'll ask.
 
AviD
AviD
what q you guys on about?
 
Adnan
Adnan
@AviD There's no way around it. The password must be kept somewhere on the server in plaintext.
 
TildalWave
TildalWave
@Adnan sure, but he's still finding his way around the site...
-1
Q: is it possible that "man in the middle attack" obtains username & password of user,but does not allow connect to server?

Alii have a question in cryptography, Assume that we have a user that wants to connect to the server, for example with login page, when user submits the form a Cipher-text(include user & pass) goes to the server, if man in the middle reads the user & pass(he can able to decrypt the cipher-te...

cryptography man-in-the-middle
 
AviD
AviD
@Adnan that is incredibly sucky.
 
Adnan
Adnan
So your that comment come from your ignorance (you know what I mean) of PHP programming. Rather than saying he was wrong (he wasn't) you could've bashed on PHP itself.
 
AviD
AviD
10:36 PM
So, having stated that, do you also support the claim that PHP could be just as secure as any other language?
@Adnan no, he was wrong. There is always a way.
 
Adnan
Adnan
@AviD I don't wish to discuss that now. I don't have the time or the energy.
 
AviD
AviD
And, even for PHP, his way is worse than others.
 
Adnan
Adnan
@AviD He wasn't. That's the most common practice.
 
AviD
AviD
@Adnan heh. I'm not getting into another PHP-bash, I'm just saying that those two claims are contradictory.
 
TildalWave
TildalWave
@AviD I use solely pre-compiled web apps and can see clear benefits in security with these, so I don't see how PHP or ASP.net could ever match that.
 
AviD
AviD
10:37 PM
@Adnan even if we accept that it needs to be in plain text, PHP files are the worst place for it.
@TildalWave asp.net is not precompiled....??
and ftr its not the precompilation that gives the security benefit, there are other factors there.
 
TildalWave
TildalWave
@AviD well not always but sure, they can be
10
Q: Should I precompile ASP.NET 2.0 sites before deployment or not?

NetHawkWhere I work, we do a very large number very small ASP.NET apps, and it has happened a few times that sites have been deployed in precompiled format, and the app needs to be changed, but the version of the code available in source control is out of date and the developer is not available. The app...

asp.net deployment .net-2.0
 
Adnan
Adnan
@AviD Storing database credentials in plaintext in config.php files outside the web root is the standard process. It's your problem that you don't know that.
 
AviD
AviD
@TildalWave sure, but its the default now. and mainly irrelevant.
ASP.NET happens to be one of thre more secure platforms for webapps.
 
Adnan
Adnan
@TildalWave No, per-compiled web apps do not offer security regarding the point we're talking about.
 
AviD
AviD
@Adnan I did know that. Doesn't mean its a good process.
And its also not what he was saying.
he specifically said it doesnt need to be outside the root.
 
TildalWave
TildalWave
10:41 PM
@AviD yup... ok then strike that ASP.net I've mentioned... there are other non-compiled server-side scripts than just PHP, that's what I meant
 
Adnan
Adnan
@AviD Oh pleas! Your whole argument was about storing them in plaintext, don't change it to make about where to put them.
 
AviD
AviD
sure, but that does not help one way or the other around key protection.
@Adnan two aspects of the same issue. Password protection.
He just got caught up on how its impossible to encrypt it.
wait a sec, why are you cranky?? I'm the one with a sore back and other muscle groups I've forgotten I had.
 
Adnan
Adnan
Very well, at this point I'm open for your suggestions.
 
AviD
AviD
On the lighter side, I did win almost all of my grappling matches yesterday, except for one.
 
Adnan
Adnan
I write mostly in PHP at my work. Please tell me how do you think I should store my database credentials.
 
AviD
AviD
10:44 PM
@Adnan how DO you store them?
 
TildalWave
TildalWave
@AviD what's that, judo?
 
AviD
AviD
@TildalWave krav maga -ish.
 
Adnan
Adnan
@AviD in a config.php file one level up the web root.
 
AviD
AviD
126
Q: How to secure database passwords in PHP?

user18359When a PHP application makes a database connection it of course generally needs to pass a login and password. If I'm using a single, minimum-permission login for my application, then the PHP needs to know that login and password somewhere. What is the best way to secure that password? It seems li...

php database security
 
TildalWave
TildalWave
@AviD i need to wiki that lol
Krav Maga
Krav Maga ( , lit. "contact combat") is a non-competitive eclectic self-defense system developed in Israel that involves boxing, Muay Thai, jiu-jitsu, wrestling, and grappling techniques, along with realistic fight training. Krav Maga is known for its focus on real-world situations and extremely efficient and brutal counter-attacks. in the mid-to-late 1930s. In the late 1940s, following his immigration to Israel, he began to provide lessons on combat training to what was to become the IDF, who went on to develop the system that became known as Krav Maga. It has since been refined for ci...
 
AviD
AviD
10:45 PM
@Adnan pretty much commonly accepted practice.
 
Adnan
Adnan
@AviD Of course it is!
 
TildalWave
TildalWave
@AviD Is that what your peeps were training our secret police in?
 
AviD
AviD
I, however, claim that there should be a better solution, taking into account the threats that are not solved by moving it out of the web root.
 
Adnan
Adnan
Now that @AviD is down. Back to you @TildalWave
 
AviD
AviD
It is possible, or likely, that this is in the realm of the sysadmin, not the PHP programmer.
@TildalWave heh, probably.
 
TildalWave
TildalWave
10:47 PM
@Adnan I'm already down, I've managed to intoxicate myself with too much booze yesternight lol
 
AviD
AviD
as you saw in WP, its popular for police forces.
 
Adnan
Adnan
@TildalWave, why do you think pre-compiled languages offer better security than interpreted languages?
 
AviD
AviD
@Adnan so far that is where I've got to, and what I usually fall back on. However I dont find it satisfying.
@Adnan not security, obscurity.
there are actually a few small bits of functionality that could be used for some corner cases, such as code signing (as far as I know this doesnt work well with non-compiled languages, but I could be wrong).
 
Adnan
Adnan
@AviD, sorry I was a bit aggressive just now. I'm facing 3 different problems and then that was in my face.
 
AviD
AviD
@Adnan Ha! in your FACE!
 
Adnan
Adnan
10:49 PM
@AviD Let us hear what @TildalWave has to say
But it's lovely how nobody tried to look into the matter with me. I asked Scot and Poly, they said nothing. This is wrong, just because you're a mod doesn't mean you don't make mistakes.
Only The Bear doesn't make mistakes.
 
AviD
AviD
anyway, as I said in that SO question, you can encrypt the password, and have the OS manage the key. Again, this falls down to the sysadmin, and which mechanisms you have depend on which OS etc.
 
TildalWave
TildalWave
@Adnan that depends entirely on the implementation, but I can i.e. import and use any libraries I want to reach the security model I require, which isn't really the case with interpreted languages where you depend on external libraries. The rest are then details of libraries used, I guess and hard to argue about without being specific. I'm not sure what all models PHP follows, but I've seen many cases where users were asking how do they solve something, and there was no clear answer
 
AviD
AviD
@Adnan no, its the other way around.
I am a mod because I don't make mistakes.
Which also is a load of crap...
 
Adnan
Adnan
@TildalWave I can't do this.
I like seeing this here
yesterday, by Adnan
user image
 
AviD
AviD
@Adnan point is, I wasn't wrong there, just because I don't a better solution for his situation doesnt mean the problems I pointed out are invalid.
 
TildalWave
TildalWave
10:55 PM
@Adnan Personally, i find of best use to be able to depend on system's own mechanisms with pre-compiled code, since it's going to run on a single system anyway. Interpreted languages can do that also, but entirely depends on what libraries are available, and of course, you then forfeit any platform independency which is one of the main points of interpreted languages anyway
The gap is probably really narrow nowadays, but I've decided against PHP and other interpreted languages long ago, when there weren't even any good graphics libraries for them, something I could easily do in then Delphi (OO Pascal) and Kylix for *nix platforms
 
Adnan
Adnan
We're in mid March and it's still -14C here. This is preposterous!
 
TildalWave
TildalWave
But frankly most projects I worked on that required pre-compiled solutions would require that foremost for performance benefits, and security benefits are rarely mentioned or even understood from my clients
@Adnan I've seen there's been some chaos in Hungary even, but we're again well protected by the Alps, it's not so bad here at all, we had some sun even :)
@Adnan is the sea still frozen there?
 
Adnan
Adnan
@TildalWave It's crazy here. In the morning it's 0C or even 1C, and ice melts forming puddles with flat ware surface. At night it's -10C, freezing the ware turning the puddles into slippery death traps.
@TildalWave Yup, today I was fishing in a hole.
and no @AviD, that's not what she said :D
 
AviD
AviD
@Adnan heh, I'm sure it's not
 
TildalWave
TildalWave
@Adnan caught anything?
 
AviD
AviD
11:06 PM
@Adnan It's mid March and it was 34C here yesterday. I find that more preposterous.
@TildalWave crabs ;-)
 
TildalWave
TildalWave
LOL
 
Adnan
Adnan
@AviD Not that kind of holes.
@TildalWave a 0.6kg trout
 
AviD
AviD
@Adnan cool
eat it?
... you know I'm setting you up for another "fish" joke, right? :P
 
TildalWave
TildalWave
@Adnan which ones do you have there?
 
Adnan
Adnan
@AviD Tomorrow I'll cook it with some friends
 
TildalWave
TildalWave
11:10 PM
tomorrow is st. Patrick's day ;) fish alone won't cut it!
 
Adnan
Adnan
@TildalWave What do you mean?
@TildalWave Is it?
 
AviD
AviD
@Adnan you pervert :D
 
Adnan
Adnan
@TildalWave It's called Kirjolohi (rainbow trout)
 
TildalWave
TildalWave
@Adnan well there are many different trouts and I don't know which ones you have. I like the marble trout the best, but out of those we have here
Salmo marmoratus
Marble trout (Salmo marmoratus) is a species of freshwater fish in the Salmonidae family. It is characterized by distinctive marbled color pattern and high growth capacity. The marble trout is found in rivers of the Adriatic basin, particularly in the Po and Adige rivers in Italy and Soča and Idrijca rivers in Slovenia, and has traditionally been identified also in further drainages of western Balkans in Bosnia and Herzegovina, Montenegro and possibly Albania. Marmorated trouts Adding to the confusion of salmonid taxonomy, there are other trout with marble pattern beside Salmo marmor...
 
AviD
AviD
I'm surprised, with all this talk of fish, not a single Bear showed up.
 
TildalWave
TildalWave
11:14 PM
@Adnan never had one of those
 
Adnan
Adnan
@TildalWave Pretty tasty. Dipped eggs and then in flour. Fried until gold. Served with tartar sauce and a sprinkle of dill. mmmm
 
TildalWave
TildalWave
@Adnan that sounds pretty heavy but I'm not at -15 degrees C here :) I usually just roll them in corn flour and try not to complicate too much, they're tasty on their own. In summer, I would also make them on an open fire and stuck between two wooden planks, usually beech
 
AviD
AviD
Anybody wanna get into a comment war with @JeffAtwood? :D
@Gilles " If there isn't any low-hanging password fruit (and oh, there always is), they'll just move on to the next potential victim service" — Jeff Atwood 24 hours ago
 
TildalWave
TildalWave
11:30 PM
@AviD Why did @Gilles write "You should read Thomas Pornin's updated answer" and then link to yours? Which one did he mean then?
 
AviD
AviD
oh, did he?
probably a mistaken link. Mine was not updated recently, and it doesnt even address the same points as jeff's.
 
Adnan
Adnan
11:41 PM
Wish me luck
0
Q: Good suggested-edit history in addition to the 2k rep

AdnanI believe that having the ability to edit anything without the need for peer-review is great privilege that must not be given indiscriminately, that's why I like the 2k rep limit. That's not enough There are many examples of 1k+ users having their edits rejected. Those users will soon be able to...

discussion feature-request review suggested-edits
I hope I don't get massacred and hanged the doors of Meta.SO as a lesson for future generations
 
AviD
AviD
@Adnan I like it, but my prediction is meta.so's prediliction for predicating perp proposals will perfunctorily cause it to be perditioned and you to be dedickted.
 
TildalWave
TildalWave
@Adnan good luck! :) dunno I think rejected suggested edits are a part of learning the ropes, but i'm giving you +1 if it helps you get better replies
 
Gilles
Gilles
@AviD huh, yeah, I put in the wrong link. Feel free to use your mod powers to change it
 
AviD
AviD
@TildalWave it would have to be a sliding scale, if you had a lot rejected at the beginning that's fine, as long as you've had enough accepted recently.
 
Gilles
Gilles
@Adnan I think this has come up in the past, and the devs said tying privileges to other things than rep was too complicated
 
TildalWave
TildalWave
11:48 PM
@AviD that could work yes, problem is it's usually not so trivial to implement then, but I'm sure SE stuff would be fine with that
 
Gilles
Gilles
@AviD I'd like to tell him that he's clueless about how attacks happen in practice, but does anyone have concrete figures on password crackers in the wild?
 
Adnan
Adnan
@TildalWave I agree with that. But we need to measure the learning process. If have more rejected edits than accepted ones, I don't think you're learning.
 
AviD
AviD
@Gilles I have no idea what sneaky powers you're talking about.
 
Adnan
Adnan
@Gilles Damn devs!!!
 
Gilles
Gilles
@AviD mods can edit comments at any time
 
Adnan
Adnan
11:49 PM
@Gilles This is brilliant. Also we have the best moderators EVAR.
 
AviD
AviD
@Gilles heh, I know, I was saying that it was done sneakily enough to afford me plausible deniability. That's gone now, thanks a lot ;-)
buwahahaaha
 
Gilles
Gilles
@Adnan tssk
 
TildalWave
TildalWave
@Adnan I agree, but now that you've opened that up, I see a whole new world of such checks that could be in place on SE, not just on suggested edits
 
Adnan
Adnan
@Gilles But but but.. :(
 
Gilles
Gilles
@Adnan oh, wait, did that ping you?
I thought replies pinged the last editor
no, it's not that then
 
AviD
AviD
11:52 PM
@Gilles no, the editor has no real attribution.
 
Gilles
Gilles
I remember that there's something in chat that targets the last editor instead of the author, but what is it?
 
AviD
AviD
@Gilles oh really?
 
Adnan
Adnan
@Gilles But still, since there's a revision history here. But in comments! Nobody will ever know!
 
AviD
AviD
@Adnan he's referring to me modediting your message... :D
@Adnan I'm sure the devs could know.
in principle, it is intended - and mostly used, at least by me - to clean up comments that are mostly good, but perhaps with an objectionable word or few.
I usually prefer deleting comments if necessary, but if there is a thread with value, and one good comment would be meaningless or confusing without the previous almost-decent comment, I'll clean it up, intead of deleting.
 

« first day (821 days earlier)      last day (4071 days later) »