I set up etckeeper and added the file /etc/etckeeper/commit.d/60github-push in order to push the commit to github.
[orschiro@thinkpad etc]$ sudo cat /etc/etckeeper/commit.d/60github-push
if [ "$VCS" = git ] && [ -d .git ]; then
git push origin master...
Still havent seen that expert pop up myself, not impressed with it as an april fool concept though, as it is yet another joke that desensitises users. If I had had it pop up I would have tried to hunt down its cause or possibly just ctrl-f4'ed it.
@LucasKauffman i thought for a moment that it was some kind of nagware/advertisement. being on stackexchange it crossed my mind that I had an infection of some kind. then i thought naahhhhh im using iceweasel on debian - which malware authors target that
While this answers the question in a pure literal form, it takes 2 paragraphs of things we (and most likely, the submitter as well) already know before getting to the real answer. I don't know about other users but to me the tone was condescending. Especially the "absolutely", as if it was logical at all to limit passwords in common scenarios. — gparent11 hours ago
@lynks Isn't that just firefox without the branding?
The fact that you need to ask this question is the answer itself - you do not know what is wrong with stacking these primitives, and therefore cannot possibly know what benefits or weaknesses there are.
Let's do some analysis on each of the examples you gave:
md5(md5(salt) + bcrypt(password))
Dave's false maxim: "If I add more stuff, it will be more secure."
@AntonyVennard Ouch! I just read all of it (again, after the edit) and I have no clue why the comments you're receiving. If it's to any consolation, you're not the only one being stalked by such members (I'll resist using pejoratives here, but feel free to include any that apply), and I guess there's only gonna be more of these as the site gains traction in the wider IT communities. @ThomasPornin gave IMHO the best advice to just ignore them. Your answer and the latter comments seem just fine.
@Polynomial Oh noes, not another Dave! On 1st of April no less :)
And a member since today with a gravatar that copies after @Luc's ... could it be an April Fools type question?
Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information.
My idea is this...
When storing a password in a database, it is common to store it as a hash. This is weak against rainbow tables, which is mit...
@TerryChia Oh I didn't see his use of "random" 3 character salt. OK, he needs to be reminded that random isn't unique then. Random 3 characters won't be really effective salt and he's done the maths himself on how frequently they start repeating on average.
@TerryChia Meh, had to delete my comment, it was actually lame. Randomly entropic my ass LOL. The entropy stays the same no matter how fast the function may exit by chance. It's not what I wanted to point out with my comment anyway. The problem with his approach is that it's randomly costly to brute force.
@RoryAlsop Just a nuisance as @TildalWave says. The first commenter is disagreeing with me vehemently by holding the same position I and my answer hold and the second thinks "absolutely" really means "fuck you".
I guess it's a step better than WARNING: THIS ANSWER IS TOTALLY WRONG comments I used to get.
hmmm I'm getting really close to being on the 1st page for this year. I would've thought there's more active members here with generally good answers, honestly. I'm not too bothered about this rep thingy, don't get me wrong. It's just the site seems a lot bigger
@TerryChia Oh the bears, yeah how could I not notice. But I wouldn't say that others don't give great answers too. I'm just surprised that this number is rather low. I probably was reading a lot of old answers, being fairly new here and all. Maybe that's where my impressions come from
Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag.
@ScottPack - Will you be reviewing your jump bag contents any time soon? :P
The real reason to have a user type their password twice is to avoid mis-typing it in. It is very easy, when typing a new password, to get a capital letter incorrect, or accidentally type the letter next to the one you think you are typing.
If this happened the user would not be able to access t...
Actually, even i do not understand that why this is bad. As i saw few of other answers they say that if someone breaks into your database then they can easily break the hashes but what i think is that even if we use random salt each time then we have to store them with our hashed password for com...
@Luc Oh so that's what it is, and I thought you're a GO player :)
@RoryAlsop so small thy're barely any bigger than the close thumb LOL. I'm so glad they put the script on window close when you're adding something now, tho I'm not sure it's still implemented on comments and I have closed a few by mistake before posting... Oh, and browser crashes... answering a question and having tons of pages open as references sometimes isn't the best way to do it LOL
That "drag a tab into new window" is something I should learn to use more often
Right guys, I probably am going to be spanked for this, but hear me out. I need to store passwords (hashed) the problem is my program needs to be pure python. Bcrypt and Scrypt are known not to work in pure python. I can either use pbkdf2 with sha1 or write my own implementation of pbkdf2 with sha3.
@JeffFerland I don't quite fully grok terminology for people in the upper levels of management. Does "executive" specifically mean "C-level" or "VP", or does it just encompass the whole category of "People whose asses you need to kiss."?
@TildalWave I'm sure The Bear can have that pesky rep-cap thing taken care of. On MSO: "Remove rep cap for users with 1M+ rep". SEI response: "Umm... no." The Bear: "RAAAWWRRR!!!" SEI response: "Okay, no problem!". The Bear hits 2M overnight.
@Iszi ROFL :) Of course, he could also just spend some of his rep on bounties and then award them to his own answers. Not sure how many bounties you can have at one time, though. But he could gather more than 200 rep per day so. Accepts are also immune to rep cap
There has been a lot of talk about the daily reputation cap and what counts and what doesn't count and so on. But why is there a cap at all? I've seen lots of questions about whether the cap number should be changed, or whether certain things should or should not apply to the cap, but I've never ...
@Polynomial I think that's another possible reason for it. So people that don't only answer to gain rep don't look with envy at those that do? Or so members simply don't put all their efforts to gaining rep. @ThomasPornin would only need to be here for about 10 minutes per day if that's all he was after
Your reputation should be based on what you do, not how often you are on the site; many people do not live on stackoverflow and may not be able to spend time exept on perhaps one day a week. I would rather see such people give quality answers once a week than be encouraged to rush through a few answers everyday. — HawkenMar 25 '12 at 14:57
This is to me the most agreeable comment in that discussion
@Polynomial Your MIC/MAC terminology is a bit weird (last I saw it was in WEP, not a shining reference altogether). Actually, the distinction between "integrity" and "authentication" is rather artificial.
@Polynomial There's a tricky definition point there. Integrity is that you get the "right data", but according to what notion of "right" ? How comes the data from the attacker is not "right" ? If you answer "because that's from the attacker, not from the right client" then you are doing authentication...
@TildalWave yeah, I'm aware of the freelancing slog.
ran my own web design / dev company for a year.
quit because people are dicks and treat you like an idiot
"Yeah, we cancelled the project, so we're not paying you." "Sorry, but you signed the contract and it says otherwise. See, right here, it says that you still have to pay." "But the project was cancelled. We have no funds allocated." "Tough luck."
then they drag their heels for a month
and either pay up over a long period of time, or you have to take them to SCC and hammer them there
@TildalWave if they have the funds to pay their own employees and themselves, they have the funds to pay you. if they entered into a contract in bad faith, they fucked themselves over and you should have no qualms about bending them over in court.
at the end of the day, your costs are probably a fraction of the overheads for a single employee.
@Polynomial Yar that's true, but i'm supposed to maintain those costs just as well. I didn't go into freelancing to skip on basic insurance and stuff. And taxes,... with our system, I'm actually getting it up mine double as much as if I was permanently employed.
@Polynomial yeah hasn't worked out too bad, one of our clients only pays us when the customer pays them, which can be slow, but to be fair to them they've only been really slow on one or two occiasions...
@RoryMcCune haven't you heard of responsive design? it's the new thing... it killed any designs whatsoever... but it lowered cost of ownership... and then they still want it to look good, for the same money
That's what you get when designers pretend to be developers. And then these developers have no other choice but to pretend they're security experts just to excuse their worth. That's why we have so many CSS coders here thinking they can reinvent crypto.
This is epic: You are correct and I apologise. Your last project was actually both commercially viable and original. Unfortunately the part that was commercially viable was not original, and the part that was original was not commercially viable.