« first day (837 days earlier)      last day (570 days later) » 

12:17 AM
@RoryAlsop Yeah, that sounds pretty un-fun for me. I'm all for tearing down and building up portals, but figuring out the passphrases just seems... onerous.
 
 
3 hours later…
3:23 AM
Brilliant networking joke.
OH: “You put the ‘C’ in CIDR.”
 
 
4 hours later…
7:43 AM
 
8:23 AM
1
Q: etckeeper pushing to github

orschiroI set up etckeeper and added the file /etc/etckeeper/commit.d/60github-push in order to push the commit to github. [orschiro@thinkpad etc]$ sudo cat /etc/etckeeper/commit.d/60github-push #!/bin/sh set -e if [ "$VCS" = git ] && [ -d .git ]; then cd /etc/ git push origin master...

This guy is going to expose his SSL keys for sure.
 
@Ladadadada D'oh.
 
8:42 AM
Yep. His passwd and shadow files are in there. World readable.
 
9:16 AM
@Ladadadada Time to warm up those GPUs.
 
9:41 AM
Still havent seen that expert pop up myself, not impressed with it as an april fool concept though, as it is yet another joke that desensitises users. If I had had it pop up I would have tried to hunt down its cause or possibly just ctrl-f4'ed it.
 
 
1 hour later…
10:45 AM
@RoryAlsop I asked it to give me cookies
 
just got the 'ask an expert'
i was deeply confused
 
@lynks show on the doll where the expert touched you
 
@LucasKauffman i thought for a moment that it was some kind of nagware/advertisement. being on stackexchange it crossed my mind that I had an infection of some kind. then i thought naahhhhh im using iceweasel on debian - which malware authors target that
 
11:06 AM
While this answers the question in a pure literal form, it takes 2 paragraphs of things we (and most likely, the submitter as well) already know before getting to the real answer. I don't know about other users but to me the tone was condescending. Especially the "absolutely", as if it was logical at all to limit passwords in common scenarios. — gparent 11 hours ago
@lynks Isn't that just firefox without the branding?
Or a browser without the branding.
Can't remember which.
 
@AntonyVennard correct, (firefox), but its also a few versions behind and with some minor alterations i believe
 
@lynks Yeah, I thought so - debian couldn't use the mozilla sanctioned builds because of their licensing terms, I believe.
 
@AntonyVennard yep
 
Anyway, I'm going to disappear for a while. Bad experience with a repevator. Someone should really prevent 101 rep users from having a comment privilege.
 
12:03 PM
Doesn't sound good @antonyvennard. Anything mod-worthy or just a nuisance.
 
@RoryAlsop Nothing mod worthy. Just rude and annoying.
 
Luc
@april fools: Chat with an expert, haha who came up with that one xD
 
I have new Dave-related material!
1
A: Why improvising your own Hash function out of existing hash functions is so bad

PolynomialThe fact that you need to ask this question is the answer itself - you do not know what is wrong with stacking these primitives, and therefore cannot possibly know what benefits or weaknesses there are. Let's do some analysis on each of the examples you gave: md5(md5(salt) + bcrypt(password)) ...

Dave's false maxim: "If I add more stuff, it will be more secure."
 
@AntonyVennard Ouch! I just read all of it (again, after the edit) and I have no clue why the comments you're receiving. If it's to any consolation, you're not the only one being stalked by such members (I'll resist using pejoratives here, but feel free to include any that apply), and I guess there's only gonna be more of these as the site gains traction in the wider IT communities. @ThomasPornin gave IMHO the best advice to just ignore them. Your answer and the latter comments seem just fine.
@Polynomial Oh noes, not another Dave! On 1st of April no less :)
And a member since today with a gravatar that copies after @Luc's ... could it be an April Fools type question?
 
12:28 PM
0
Q: Use brute force to mitigate brute force

Billy MoonJust an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information. My idea is this... When storing a password in a database, it is common to store it as a hash. This is weak against rainbow tables, which is mit...

We got another one.....
 
is it just me, or does Randall's art look cleaner in this strip? xkcd.com/1193
more vectorised than sketched
oh, I get it, nm. hehe
 
possibly the funniest possible outcome to the 'ask an expert' bot: meta.stackoverflow.com/a/174528
@Polynomial the font has changed!? it looks less - comic-sansy, and less itallic.
 
yeah, it's a special comic ;)
 
@TerryChia not to mention that if he hopefully decides on using bcrypt he just made a maximum password length 3 characters less long, and introduced a pepper into his KDF where salt should be.
Bad kitchen crypto, we need Gordon Ramsey to help us swear at them!
 
@TildalWave Hmm actually. The more I think about it, it appears that that 3 letter thing he is proposing IS a salt, it's just that he doesn't store it together with the hash.
 
12:42 PM
@TerryChia It's not salt if it's always the same, tho. That's pepper. It won't improve the taste of his crypto, it'll just make him sneeze more often.
 
@Polynomial ok bash script running outputs from /dev/urandom against my university :P
 
@TerryChia Oh I didn't see his use of "random" 3 character salt. OK, he needs to be reminded that random isn't unique then. Random 3 characters won't be really effective salt and he's done the maths himself on how frequently they start repeating on average.
 
@TildalWave Feel free to comment/edit. :)
I'll make some edits after my gaming session if you still have not mentioned it.
 
@TerryChia Neah I thought that if you don't want to hammer it, then the answer is sufficient :) I'm just not sure I'd be so polite.
 
1:30 PM
@TerryChia Meh, had to delete my comment, it was actually lame. Randomly entropic my ass LOL. The entropy stays the same no matter how fast the function may exit by chance. It's not what I wanted to point out with my comment anyway. The problem with his approach is that it's randomly costly to brute force.
 
1:56 PM
soldering made me light headed
 
@LucasKauffman You are not supposed to eat the metal, you know.
 
I'm feeling like I just downed 6 beers
 
When I first got the "ask an expert" popup, my first thought was: "who is that 'expert' who is not me ?"
10
 
at least all the wiring has been done now, only need to fit the engines and connect and calibrate the speed controllers
 
@TildalWave It is at 269 now, still growing. It got +206 yesterday alone. By comparison, the CRIME answer got at most +94 in 24 hours.
Thus, chimpanzees trump science.
6
 
2:12 PM
@RoryAlsop Just a nuisance as @TildalWave says. The first commenter is disagreeing with me vehemently by holding the same position I and my answer hold and the second thinks "absolutely" really means "fuck you".
I guess it's a step better than WARNING: THIS ANSWER IS TOTALLY WRONG comments I used to get.
 
@AntonyVennard Your mistake might be that you are trying to convince your (dis)honourable contradictors. This makes them think that they are worthy of your attention.
By the way, thanks for the details on smart cards.
 
@ThomasPornin No problemo. I sent it in French, hope you don't mind but I thought I was more in need of French practise than you are in English.
@ThomasPornin Yeah, well, I was trying hard not to be condescending and aloof and all those things! Next time I'll call them absolutely, that'll teach them.
 
@AntonyVennard He, it was good French. You can claim fluency in your CV.
 
@ThomasPornin Okay, now modifying to "I speak French. Thomas says so".
3
It's much easier to write than to speak though, mostly because I can take a break and look up the words. I had no idea how to say smartcard in french prior to that email, for example. Now I do.
Anyway, hopefully the Feitian cards will come this week and I can play with them.
 
2:37 PM
7 more upvotes before I pass @ScottPack in the rep charts. :)
 
@TerryChia I think you have miscounted, sir (or madam)
 
@RoryAlsop Thanks. :)
 
2:56 PM
@TerryChia I am rather sporadic in my rep earnable contributions.
 
You're both at 6750 at this moment, am I missing something?
 
@TildalWave some people may have had some upvotes on their good answers that I hadn't previously seen :-) But it's always good to keep these things fair.
 
@RoryAlsop I dunno looks rather biased to me.
 
hmmm I'm getting really close to being on the 1st page for this year. I would've thought there's more active members here with generally good answers, honestly. I'm not too bothered about this rep thingy, don't get me wrong. It's just the site seems a lot bigger
 
@RoryAlsop Cheers. :)
 
3:05 PM
e@TerryChia I'm going to rely on my average upboats per post to sleep soundly. :)
 
@TildalWave If you noticed, most of the great answers on the site comes from 2 people and a sockpuppet.
 
@TerryChia Oh the bears, yeah how could I not notice. But I wouldn't say that others don't give great answers too. I'm just surprised that this number is rather low. I probably was reading a lot of old answers, being fairly new here and all. Maybe that's where my impressions come from
 
@ScottPack If I didn't already have an upvote on many of yours it would be much easier :-)
 
@RoryAlsop blah blah blah
 
@ScottPack heh
 
3:19 PM
13
A: What should be included in a jump bag and how often should it be reviewed?

Scott PackOften we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag. ...

@ScottPack - Will you be reviewing your jump bag contents any time soon? :P
 
Why do you ask?
 
@ScottPack I thought it might have been updated by now?
 
@TildalWave You mean you want me to go back and update my answers? That sounds suspiciously like effort.
8
 
hehe
 
@TildalWave That list still looks pretty good.
To be fair, it's not so painfully specific that I have to worry about the technology refreshes messing it up.
 
3:27 PM
@ScottPack You're still using Backtrack or you upgraded to Kali by now?
 
Do we need a meta post? "What should be included an answer to the 'What should be included in a jump bag?' post, and how often should that answer be reviewed?"
 
hehe
 
@Iszi does the post not already suggest annually? :-)
 
@RoryAlsop Ah, so what you're saying is @ScottPack has already missed two reviews? Shame.
 
my second highest voted Sec.SE answer is so crap. It just says "this is done to avoid spelling mistakes"..
30
A: From a security standpoint should users be asked to confirm their password when registering?

Rory AlsopThe real reason to have a user type their password twice is to avoid mis-typing it in. It is very easy, when typing a new password, to get a capital letter incorrect, or accidentally type the letter next to the one you think you are typing. If this happened the user would not be able to access t...

how disappointing
 
3:34 PM
The question did ask how frequently. For the record, it's around how often to review the bag, not your answers.
Suck it, bitches.
3
 
the ones I spend effort on are never as highly voted
 
anyone else taking part in this? almamater.xkcd.com/best.csv
 
@ScottPack Yes, but the answer also lists the contents of your bag. Presuming you've updated your bag twice since, it stands to reason you should update your answer as well.
 
@lynks what is it?
 
@RoryAlsop You need to jump on more reptrains.
 
3:35 PM
@RoryAlsop the current xkcd contains a hash cracking challenge
 
13 mins ago, by Scott Pack
@TildalWave You mean you want me to go back and update my answers? That sounds suspiciously like effort.
 
@ScottPack Effort which you yourself, by implication, have committed to.
 
@lynks how can you tell that?
 
@RoryAlsop the numbers you see are the current best effors (in numbers of matched bits of a 1024 bit hash) from each university
 
all I see is the wikimedia donate page
 
3:36 PM
0
A: When hashing passwords, is it ok to use the hashed password as the salt?

Chirayu ChiripalActually, even i do not understand that why this is bad. As i saw few of other answers they say that if someone breaks into your database then they can easily break the hashes but what i think is that even if we use random salt each time then we have to store them with our hashed password for com...

 
@Iszi I hope you didn't pull a muscle stretching like that.
 
@RoryAlsop number of not-matched bits *
@RoryAlsop click on where it says 'hey stanford students'
 
This seems more of a question to me, than a real answer. OK, maybe not good enough for a new question, but shouldn't this rather be in the comments than an answer on its own?
 
it has changed a few times - the image is generated dynamically from that csv link
 
@TildalWave correct
 
3:38 PM
@RoryAlsop also the dog grows as people donate to wikipedia - it started out in a jar.
 
@lynks hahahaha
 
@RoryAlsop so I flag it, or will you deal with it?
 
yes, I think I saw it where the dog was on the computer. Figured it made no sense to me but was a Stanford/MIT joke
@TildalWave dealt already :-)
 
@RoryAlsop Oh.. sorry I have 20 Sec.SE tabs open at least :))
Optimized to 9 now but that's as low as I'll go :P
 
@TildalWave yep - that's how I do it too. 18 tabs across SE sites - a couple for each of my main sites plus more for my mod sites.
 
3:42 PM
@RoryAlsop @TildalWave I don't get guys like you. I can't stand having much more than one row of tabs open at a time.
 
@Iszi I just have one row of very small tabs
didn't actually know you could do more than one row
it's how I manage to-do's. Open them all then work along
 
Luc
@TildalWave Actually my avatar is not that unique catb.org/hacker-emblem
 
@Luc Oh so that's what it is, and I thought you're a GO player :)
@RoryAlsop so small thy're barely any bigger than the close thumb LOL. I'm so glad they put the script on window close when you're adding something now, tho I'm not sure it's still implemented on comments and I have closed a few by mistake before posting... Oh, and browser crashes... answering a question and having tons of pages open as references sometimes isn't the best way to do it LOL
That "drag a tab into new window" is something I should learn to use more often
 
4:07 PM
> How do we completely redesign and recreate something while keeping it exactly the same? The answer is Gmail Blue.
 
@TerryChia Also check this google.com/nose
 
@TerryChia Geez, how many pranks is Google gonna pull this year?
 
@Iszi Do you know anything other than Blue ans Nose?
 
@Adnan YouTube shutting down.
 
@Adnan Hahaha awesome!
 
4:10 PM
Here's the answer to my question, it seems: searchenginewatch.com/article/2258435/…
 
@Iszi For the the majority of tweeters, removing the vowels won't change much.
 
@Iszi Damn, that's a lot of pranks.
 
@Adnan For a lot, I'm afraid it might actually be an improvement!
 
so, really, the only prank I saw today was the SE Experts chat....and I didn't actually see it, just had it described in that meta question
guessing my browsing habits remove some fun possibilities :-(
Was on a mobile device until a couple of hours ago. AdBlock was on. and mostly I was just browsing SE
 
So Google finally forced out the new compose interface. Fuckers.
 
4:18 PM
@ScottPack Happy April Fo... ah, you're fucked.
3
Speaking of which, I need to get to the office because I have a meeting with the Oracle executive that I called out in front of the entire team.
 
Y'know who should totally have their own, and the best, April Fool's prank on SE? Skeptics Stack Exchange
 
@ScottPack It's revolutionary! It's Blue!
 
@JeffFerland yeeek :-)
 
Man, the video where they burned the laptop is hilarious.
 
Right guys, I probably am going to be spanked for this, but hear me out. I need to store passwords (hashed) the problem is my program needs to be pure python. Bcrypt and Scrypt are known not to work in pure python. I can either use pbkdf2 with sha1 or write my own implementation of pbkdf2 with sha3.
 
4:22 PM
The treasure maps one.
 
what should I do?
@TerryChia link to burned laptop pls
 
@LucasKauffman why would you skip SHA-2 ?
 
@ThomasPornin ah that's also an option
@ThomasPornin what would the bear do?
 
@LucasKauffman Why is pure python a requirement, just curious.
 
4:24 PM
@JeffFerland I don't quite fully grok terminology for people in the upper levels of management. Does "executive" specifically mean "C-level" or "VP", or does it just encompass the whole category of "People whose asses you need to kiss."?
 
@LucasKauffman The "pure Python" requirement is weird.
Answer depends on why this requirement is in force.
 
@TerryChia needs to be portable to linux and windows systems, the problem is if you want to install python libraries that have native support you also need to have a c compiler installed
For instance if you want to run it on the appengine
you're going to have a bad time if you're not running pure python
 
@Iszi It means somebody who says his "Distance to Larry" number is 2.
3
 
@LucasKauffman Ahh tricky.
 
@LucasKauffman For that kind of job I would use C#/.NET. Runs on Windows and Linux, and has much more muscle for CPU intensive tasks
and there are few tasks which are more CPU intensive than slow hashing
 
4:27 PM
Skeptics election looks to be troll-ful...
 
Are you sure there isn't already a PBKDF2 library for python? I'm surprised.
 
@TerryChia there is a pbkdf2 library for python
 
Ah, lasagna time. See ya !
 
but not one with sha3
 
4:29 PM
@LucasKauffman From what I understand, there is no practical difference.
 
I'll just go with the sha2 version then
 
Alright, sleep time. Have a good day fellas.
 
@TerryChia nite TC
 
@LucasKauffman why would you use sha3 for password hashing?
1. sha3 isn't even standardized yet, nobody recommends it over sha2 or considers sha2 deprecated
2. sha3 is especially good with dedicated hardware, which is exactly the opposite of what you want for password hashing
 
@Gilles that's why I added the part about being spanked :P
 
4:57 PM
@Gilles Actually, NIST explicitly states that SHA-2 is not and will not be deprecated.
 
5:17 PM
NEED MOAR SHA2
 
5:33 PM
sha-1024?
 
SHA-2^1024
 
Why was keccakc even selected as a SHA3 winner? Here are some performance charts: bench.cr.yp.to/results-sha3.html but I don't see any clear reason why this specific algo won?
 
You have to realize how fun keccekeccekeccek is to say.
 
kakakakakakekekekakekakekakekakekakekakekacceckack
 
@TildalWave Mostly because NIST reoriented its priorities
in 2008, NIST feared that SHA-2 would soon fall, and they wanted a replacement -- a fast one.
In 2012, NIST acknowledges that SHA-2 will probably remain unbroken for some time, so they wanted a backup plan.
Therefore they chose the function which was most different from SHA-2
Among the candidates, there were functions which used 32-bit or 64-bit additions, functions which used AES round elements, and Keccak, which used neither.
 
5:45 PM
@ThomasPornin So it won because of cycles/byte on large inputs? That's the best reason I can see based on those charts, it clearly beats groest and jh variants
 
@TildalWave Most discussion on SHA-3 were about performance, because that's where there were actual things to say; but it appeared that NIST was not very much interested in performance after all.
 
@TildalWave It won because it was the most different - i.e.: it's very unlikely that an attack which breaks SHA-2 will be of any value against Keccak.
 
This was made apparent when they chose the finalists. For instance, in the category "AES-based", they selected Grøstl, which was much slower than ECHO and SHAvite3
 
@Iszi @ThomasPornin I guess that makes sense, cheers to both!
 
6:11 PM
Thinking about it, do you think I should ask this question in Q&A?
 
@TildalWave Question being "Why was Keccack selected as SHA-3?" - I have a feeling you'd get a bit of JFGI.
 
15
Q: What is SHA-3 and why did we change it?

Lucas KauffmanOn the 2nd of October NIST decided that SHA-3 is the new standard hashing algorithm, does this mean we need to stop using SHA-2 as it is not secure? What is this SHA-3 anyway?

 
OH :(( Thanks, I'll crawl back to my corner then
 
6:23 PM
@ThomasPornin ok another question... what's the bloody point in up-voting your answers when you've reached the rep cap 20 times over for the day?
 
@TildalWave When I get upvoted a lot, I get badges. Which are shiny.
 
@ThomasPornin are you a repwhore?
 
@LucasKauffman I don't think the term applies. The Laws of Nature imply that I aggregate reputation and badges. There is nothing that I am socially expected to do against it.
 
@LucasKauffman He does put in a bit of hard work for the rep he gets. Rep-gigolo?
2
 
6:39 PM
just got myself a popular badge
 
@ThomasPornin Have you considered you might be stuck with "1m" for a really long time if Skeet thought of shortening display of such large rep numbers?
 
 
1 hour later…
7:40 PM
@TildalWave Do you realize who you're talking to? It won't stay there for that long.
 
@Iszi Should last roughly 12 years with a rep cap of 200 :P Of course, It'll take 10-11 years to get there 1st
 
@TildalWave I'm sure The Bear can have that pesky rep-cap thing taken care of. On MSO: "Remove rep cap for users with 1M+ rep". SEI response: "Umm... no." The Bear: "RAAAWWRRR!!!" SEI response: "Okay, no problem!". The Bear hits 2M overnight.
 
@Iszi ROFL :) Of course, he could also just spend some of his rep on bounties and then award them to his own answers. Not sure how many bounties you can have at one time, though. But he could gather more than 200 rep per day so. Accepts are also immune to rep cap
 
did I get this right? I'm pretty sure I'm correct about the tweaking tricks (e.g. w.r.t. padding oracles) but it'd be nice to get confirmation: security.stackexchange.com/a/33576/5400
 
@TildalWave Pretty sure the limit's in the single digits, but I can't remember what it is.
@TildalWave 3 simultaneous bounties max, with a cap of 500 per bounty.
 
7:55 PM
@Iszi And they last how long? 2 days + 1 day grace period?
 
@TildalWave 24 hours minimum, 7 days (+1 day grace) max.
 
@Iszi Well there you go then. A way to harvest 950+ rep per day and even more with accepts.
That's then under 3 years for 1m
 
I'm not sure I understand why we have a rep-cap/
I could understand a per-question rep cap (to avoid rep-train issues)
but if I were only in it for the rep, why would I bother answering questions after the first hour or so?
 
75
Q: What is the reasoning behind the reputation cap?

Graeme PerrowThere has been a lot of talk about the daily reputation cap and what counts and what doesn't count and so on. But why is there a cap at all? I've seen lots of questions about whether the cap number should be changed, or whether certain things should or should not apply to the cap, but I've never ...

@Polynomial I think that's another possible reason for it. So people that don't only answer to gain rep don't look with envy at those that do? Or so members simply don't put all their efforts to gaining rep. @ThomasPornin would only need to be here for about 10 minutes per day if that's all he was after
 
I guess the main reason is to make people come back daily.
But I'd really prefer it if the rep cap was removed / increased for high-rep users.
since they're already likely to come back daily.
even if I didn't get rep I'd be here. I can't say it's not a factor in my efforts to produce the highest possible quality answers, but it's still nowhere near the most significant reason I contribute.
 
8:07 PM
Ditto, but I'm probably with too low rep to even start appreciating the perks it comes with
I do wish I had the ability to close vote
 
I wonder if there's a StackExchange Data query that tells you the total number of words you've written across a site...
 
@Polynomial High rep users can compete through other means -- the +15 accepts, the badges, the number of sockpuppets they maintain...
The rep cap is to keep the new users under the illusion that they can compete.
 
haha
 
Your reputation should be based on what you do, not how often you are on the site; many people do not live on stackoverflow and may not be able to spend time exept on perhaps one day a week. I would rather see such people give quality answers once a week than be encouraged to rush through a few answers everyday. — Hawken Mar 25 '12 at 14:57
This is to me the most agreeable comment in that discussion
 
^ good point.
tbf if I wanted to have max rep, I'd have 3 accounts and run through 600 rep worth of stuff each day with a few accepts on each.
and I'd still probably be sat at 25k+ on each
 
8:14 PM
@Polynomial Your MIC/MAC terminology is a bit weird (last I saw it was in WEP, not a shining reference altogether). Actually, the distinction between "integrity" and "authentication" is rather artificial.
 
@ThomasPornin I think my point is that you can have integrity without authentication.
I should probably make that clearer.
 
@Polynomial There's a tricky definition point there. Integrity is that you get the "right data", but according to what notion of "right" ? How comes the data from the attacker is not "right" ? If you answer "because that's from the attacker, not from the right client" then you are doing authentication...
 
Hmmm... yeah.
 
HAHAHAHA Even Carroll.
 
@Polynomial Are you ready to live up to such banter ?
 
8:20 PM
@ThomasPornin tbf I would probably burn out pretty fast.
@ThomasPornin if I wasn't working full time then I'd probably be doing that.
 
@Polynomial You mean if you weren't working, full stop? Because let me tell you that freelancing takes a lot more time from you than 8 hours per week day + commuting.
 
@TildalWave yeah, I'm aware of the freelancing slog.
ran my own web design / dev company for a year.
quit because people are dicks and treat you like an idiot
"Yeah, we cancelled the project, so we're not paying you." "Sorry, but you signed the contract and it says otherwise. See, right here, it says that you still have to pay." "But the project was cancelled. We have no funds allocated." "Tough luck."
then they drag their heels for a month
and either pay up over a long period of time, or you have to take them to SCC and hammer them there
which takes time and money
I am reminded of Fuck You, Pay Me.
 
@Polynomial I so envy now anyone with a f.t.e.... exactly. I have about 50% drop on income due to [...] like that.
 
@TildalWave Contracts, man. Gotta have the contracts.
 
@Polynomial That's with contracts. But we're being screwed with the Euro to the point we'll be like Cyprus soon. Many simply don't have the funds to pay up.
 
8:32 PM
@TildalWave if they have the funds to pay their own employees and themselves, they have the funds to pay you. if they entered into a contract in bad faith, they fucked themselves over and you should have no qualms about bending them over in court.
at the end of the day, your costs are probably a fraction of the overheads for a single employee.
 
Next time someone tells me it's a good idea for a small country to adopt a currency that's controlled by another, I'm gonna buy a pineapple and show it up theirs where the sun don't shine.
 
in general you can assume that, whatever the employee is being paid per year, the company is probably shelling out double that in total for their employment.
taxes, pension, healthcare, at-work resources, etc. all add up
 
Hey you lot no horror stories about freelancing!
I'm on holiday, don't need that kind of worry :oP
 
haha
airtight contracts == godsend
if they drag their heels with payments, the payment schedule and nonpayment clauses in the contract are there to back you up.
 
<touch wood> we've not had any problems with it so far, although a lot of our work is 3rd party
so we deal with a pentest company and they deal with the client...
 
8:35 PM
@RoryMcCune that's not so bad.
 
Not quite sure if Too Localized is the right reason here, but I don't think this really belongs.
 
@Polynomial Yar that's true, but i'm supposed to maintain those costs just as well. I didn't go into freelancing to skip on basic insurance and stuff. And taxes,... with our system, I'm actually getting it up mine double as much as if I was permanently employed.
 
0
Q: Does anyone maintain the USGCB VHD images anymore?

John RThe links for the Windows 7 VHD files stopped working recently. Does anyone know of a mirror or email address to contact someone at NIST to find out when or if the page will be updated? thanks

 
it's off topic.
support for 3rd party stuff isn't on-topic here.
I think the major difference is that web dev is one of those businesses that attracts crappy clients.
 
@Polynomial yeah hasn't worked out too bad, one of our clients only pays us when the customer pays them, which can be slow, but to be fair to them they've only been really slow on one or two occiasions...
 
8:36 PM
@Iszi Flagged it for superuser
 
people think that web design is just art, and that should be free. and they think that web dev is just Frontpage or Dreamweaver.
so they automatically come into the deal with a sense of superiority, like they're only hiring you out of convenience
 
@Polynomial or worse... compassion
 
@Polynomial LOL tell them to try designing web pages that look good across 5+ browsers on loads of platforms...
 
@RoryMcCune even just one browser on one platform. those people are usually the ones that plaster the page with animated gifs they found from Google Images.
this one is still one of my favourites: stripeswebdesign.co.uk/index.html
check out that 72pt Comic Sans!
 
@Polynomial <shudder>
 
8:39 PM
@RoryMcCune haven't you heard of responsive design? it's the new thing... it killed any designs whatsoever... but it lowered cost of ownership... and then they still want it to look good, for the same money
 
@TildalWave yeah I've seen the bootstrap responsive template. It's useful for minimum viable product but I wouldn't see it as much good for a real production product..
@Polynomial wow that's quality from a web design house...
 
in some cases when I knew a client was gonna be a dick, I just bought a web template from a stock template site for like £15 and spent a couple hours tweaking it to look more like what they requested.
more often than not it would've left me in negative equity had I actually done the work for them properly.
 
That's what you get when designers pretend to be developers. And then these developers have no other choice but to pretend they're security experts just to excuse their worth. That's why we have so many CSS coders here thinking they can reinvent crypto.
 
@Polynomial yeah TBH for basic sites some of those templates are ok. that's what I used for www.scotsts.com . It's not great but it does the job
 
@TildalWave crypto in CSS would probably be the scariest thing ever.
2
 
8:43 PM
@Polynomial sounds like a good topic for an April Fools Day post tho'
 
@RoryMcCune or a submission to hackin9
 
@Polynomial nice. like April Fools Day all year round!
 
Someone should post a question "is my CSS XSS safe?"
 
9:25 PM
@poly - for ideal web design, 27bslash6.com/p2p2.html
 
27bslash6 rocks :D
 
The first thing I installed on my work iPad after Good was Kindle, so I could read my new book, I'll go home then, it's warm and has chairs.
 
@RoryAlsop Reminded me of this one ^
This is epic: You are correct and I apologise. Your last project was actually both commercially viable and original. Unfortunately the part that was commercially viable was not original, and the part that was original was not commercially viable.
 

« first day (837 days earlier)      last day (570 days later) »