The Whiteboard

Ampt

8:00 PM

@enderland n,tstllhsvwlsst'sdngbttrthnsmfthm.

enderland

maybe when I leave this position I'll write a code obfuscation program

and name everything random 20 character strings

Ampt

@enderland classnamer.com

enderland

You have been prevented from viewing this site because this page ( classnamer.com ) is categorized as: "Placeholders"

Ampt

...what?

> Classnamer

Can’t think of a good class name? Try this:

WritableListStream

source code

that's the entirety of the page

less CSS

user20683

WritableListStream seems like perfectly reasonable java to me

Ampt

8:06 PM

> SmartRobotPermission

user20683

These are like Hipster Synthtron band names

Ampt

They are perfectly reasonable class names... and then you put them on classes that have nothing to do with the title haha

user55340

8:30 PM

I'm trying to find that old "enterprise code means" site...

user55340

Enterprise code means catching and handling every exception. You have two choices:

user55340

try {
    ...
} catch (Exception e) { /* ignore this */ }

user55340

try {
    ...
} catch (NullPointerException e) { /* ignore this */ }
catch (OutOfMemoryException e) { /* ignore this too */ }
catch (InvalidArgumentException e) { /* oops, ignore this one too */ }
...

Ampt

Woooo error handling is for scrubs.

and my prof said that I wouldn't be able to do that in the real world

Jimmy Hoffa

0

Q: One-time use nonced login token on redirected URL - vulnerable to cross site attack?

I'm not a security expert but whiteboarding with some colleagues on a design approach this one detail set off alarm bells in my gut. I'm not certain this is a risk so I was hoping to get some term for the type of attack this is vulnerable to - if any. The situation is we're talking about creatin...

Thoughts? Should I delete and repost on a different site? Is Sec.SE the wrong place for that?

It's got no upvotes and no comments or anything, I would think that's what those people are there for but now I'm wondering if the extent of their security is setting ACLs on a DC. Perhaps it's a better fit for SO or P.SE

user41796

8:36 PM

@JimmyHoffa You may just need to be patient

user41796

Security is smaller than us, and your question is detailed. Ergo patience is in order

Jimmy Hoffa

@GlenH7 I presume they have at least as much traffic as us - if it's a fitting question it should have at least a +1 I would think

user41796

If nothing happens after a day or two, then you might want to migrate it

user20683

Yeah, give it time

user20683

also it's a Friday

Ampt

8:37 PM

they're probably in some obscure chat room talking about beer and monads

user41796

@JimmyHoffa We have 57k visitors a day versus their 31k

user41796

And we have roughly 3x the number of users

user41796

@Ampt I would have pinned, but you said the m-word

2

user55340

On monday, make an edit to it to tweak the wording of the question.

Jimmy Hoffa

@GlenH7 Interesting. I had assumed Sec.SE was one of the mega sites like SU

@MichaelT Good point, it's Friday...

user41796

8:39 PM

Nah, they're nuttin's, just like us. stackexchange.com/sites#technology-traffic

Jimmy Hoffa

Ah, they've the same number of Qs as CR

user41796

We scrape in at #10 on that list. And it's a pretty steep drop in traffic from #10 to #11.

Ampt

pretty big drop from #1 to #2 as well

user41796

@Ampt SO is definitely the 800 lbs gorilla for the SE sites.

Ampt

@GlenH7 that would make us.... 6.9 pounds of something

Jimmy Hoffa

8:46 PM

@GlenH7 800 lb Stuffed Unicorn

Ampt

we have a higher answer % than anyone else in the top 10

or pretty much anyone, minus UX

they claim the throne there

Jimmy Hoffa

yesterday, by Jimmy Hoffa

@RobertHarvey let's be honest here. P.SE has very high quality standards for our content; SO is just our toilet bowl.

Ampt

@JimmyHoffa what, you want more stars?

I'm cuttin you off

enderland

@Ampt Workplace ftw. n00bs

now with 100% more pointless spam answers

Jimmy Hoffa

Nov 26 '13 at 16:59, by Jimmy Hoffa

err, excuse me

user41796

8:51 PM

@enderland I filtered the list to the SE technology stack

gnat

"43 questions/day" oh that's why I am typically outta close votes

Ampt

@enderland funny... I don't see you guys on the list anywhere... odd

user41796

We drop to #14 for SE overall by traffic

gnat

1 min ago, by GlenH7

@enderland I filtered the list to the SE technology stack

Jimmy Hoffa

@Ampt Nope, just pointing out that yes we do have a higher answer % than others.

user41796

8:53 PM

@Ampt TW shows up in the top half by traffic; that's pretty decent IMO

enderland

2 mins ago, by gnat

1 min ago, by GlenH7

@enderland I filtered the list to the SE technology stack

gnat

23 secs ago, by enderland

2 mins ago, by gnat

1 min ago, by GlenH7

@enderland I filtered the list to the SE technology stack

let's see how deep it may go...

Ampt

25 secs ago, by gnat

23 secs ago, by enderland

2 mins ago, by gnat

1 min ago, by GlenH7

@enderland I filtered the list to the SE technology stack

Jimmy Hoffa

53 secs ago, by Jimmy Hoffa

29 secs ago, by Jimmy Hoffa

24 secs ago, by Jimmy Hoffa

21 secs ago, by Jimmy Hoffa

10 secs ago, by Jimmy Hoffa

@gnat 43Q/day seems odd. I bet if you curtailed the sample and or went for median instead of average you'd find it's commonly more. I wager the current is an average over total live days when it would be better to do it over past 6 months

enderland

27 secs ago, by Ampt

25 secs ago, by gnat

23 secs ago, by enderland

2 mins ago, by gnat

1 min ago, by GlenH7

@enderland I filtered the list to the SE technology stack

user41796

8:57 PM

@JimmyHoffa I presume they're doing some sort of rolling average, but I don't know what the rolling period is.

Ampt

1 min ago, by enderland

27 secs ago, by Ampt

25 secs ago, by gnat

23 secs ago, by enderland

2 mins ago, by gnat

1 min ago, by GlenH7

@enderland I filtered the list to the SE technology stack

gnat

@JimmyHoffa we want more!

enderland

26 secs ago, by Ampt

1 min ago, by enderland

27 secs ago, by Ampt

25 secs ago, by gnat

23 secs ago, by enderland

2 mins ago, by gnat

1 min ago, by GlenH7

@enderland I filtered the list to the SE technology stack

user41796

@gnat quality growth is good; and increased numbers provide a bit more oomph behind requests we might make on MSO

Ampt

19 secs ago, by enderland

26 secs ago, by Ampt

1 min ago, by enderland

27 secs ago, by Ampt

25 secs ago, by gnat

23 secs ago, by enderland

2 mins ago, by gnat

1 min ago, by GlenH7

@enderland I filtered the list to the SE technology stack

enderland

8:58 PM

I hope this breaks and someone posts on meta as a bug. "if you embed 20 quotes in each other chat breaks!"

Ampt

We need to go deeper

enderland

9 secs ago, by Ampt

19 secs ago, by enderland

26 secs ago, by Ampt

1 min ago, by enderland

27 secs ago, by Ampt

25 secs ago, by gnat

23 secs ago, by enderland

2 mins ago, by gnat

1 min ago, by GlenH7

@enderland I filtered the list to the SE technology stack

user41796

And please stop with the embedding thing; it's gotten old

gnat

Dude! That's NSFW! — Bart Sep 19 '13 at 14:14

Ampt

@GlenH7 but mooooooooooom

2

gnat

8:59 PM

can't beat mobile

it's a future

enderland

ok now's a time I want to see what deleted messages were. haha

I mean, a message like

chat.stackexchange.com/transcript/message/14042599#14042599

followed by two deleted messages?

damn missed that quote by a fraction of a second haha

Ampt

(removed)

user55340

delete votes for cleanups: data.stackexchange.com/programmers/query/169338/…

Stack Exchange

Jimmy Hoffa has added gnat to the list of this room's owners.

user41796

@JimmyHoffa - you can't add enderland. Otherwise he won't run for TW mod.

user41796

9:06 PM

@MichaelT and I just picked up another delete vote today.

Jimmy Hoffa

@GlenH7 if he becomes a TW mod I think we're duty bound to remove him from the room

user41796

@JimmyHoffa Be careful. He'd have the ability to chat ban you.

Jimmy Hoffa

30

Q: Is it okay to change the coding style of an open source project if it doesn't follow them?

I'm talking about Ruby specifically here. Recently, I came across a number of open source Ruby (or majority of it was Ruby) projects on GitHub that when checked with a code analysing tool like Rubocop, create a lot of offences. Now, most of these offences include using double quotation marks inst...

open-source coding-style ruby code-analysis

"SamTheBrand" == ArsTechnica? Edits --^

No I'm confusing things

Who's the editor we see before something hits Ars?

user41796

@JimmyHoffa yes

amon

@JimmyHoffa Yes, per the edit message: A few small format, punctuation, and word choice edits. This question will be featured at Ars Technica this weekend.

user41796

9:09 PM

SamTheBrand

user41796

But we call him Sam for short.

Jimmy Hoffa

@amon Sharp.

user41796

And the question has been proactively protected

user15026

It's nice you get warning

user41796

@AshleyNunn it's a bit indirect since we have to watch the edit queue on Fridays

user41796

9:14 PM

but we don't have any warning systems for reddit and the like

Ampt

still bummed about that ars question where I didn't even get a mention

enderland

reddit just brings lots of high quality content not sure why you are worried!!1

2

user55340

I'm surprised he didn't go for a Workplace question again... especially since they graduated.

user41796

@AshleyNunn - would you mind giving @enderland a cooling off period from chat? Obviously his brain is a bit addled at the moment.

user55340

@GlenH7 You know we just need to reddit that crack question on workplace...

user41796

9:22 PM

That's .... cruel.

Jimmy Hoffa

Could you write a (semi)formal description of the proposed protocol? — curiousguy 6 mins ago

I guess Sec.SE is more IT.SE than security experts..

Anybody here disagree that question is a fine fit for P.SE?

user41796

@JimmyHoffa Give it the weekend and see what comes back. I'm not sure we have enough web security experts rolling through to get you a solid answer. Requesting a migrate on Monday would give you better visibility when it's moved.

Ampt

honestly it could just be the timing

friday afternoons aren't great for getting attention

user41796

@JimmyHoffa - patience. :-)

user41796

9:39 PM

Reading over your question, it seems secure enough. Potentially exposed to MiM issues, but I don't think you can really defend against that in this case anyway.

Jimmy Hoffa

@GlenH7 The MitM issue should be mitigated by the one-time use nonce that halts replay attacks

it's just a question of if a MitM can pick up the URL and stop the request from going through.. I guess so..

Ampt

what if the MitM hits it before you?

can you use another piece of information about the end user

Jimmy Hoffa

@Ampt Which is basically my concern, or rather, my concern is that the MitM could just be like a hosting frame or something.

Ampt

to limit it to that browser? IP address? cookies?

Jimmy Hoffa

@Ampt Cookies was basically what we came up with in whiteboarding

But I raised a concern about the approach, mostly I want to get validation about whether my gut instinct was onto something or if I was just overreacting, which is why I asked.

Ampt

9:43 PM

how likely are you to be targetted?

are you making financial transactions?

launching missiles?

ok.. so there is a real concern about being hijacked

does the user really need to be able to be redirected without logging on?

Jimmy Hoffa

@Ampt Absolutely. I play in the big leagues ;P My code has bugs and there can be serious ramifications heh

@Ampt Yes. That's the whole point of a single sign-on site for us, think of it like you login to google and you are already logged in to youtube.com and gmail.com etc

Ampt

@JimmyHoffa just make the user re-authenticate?

Jimmy Hoffa

In fact I'll go look at how google does that now that I think about it...

Ampt

pretty sure google does it through cookies, but then again I'm not a high value target

Jimmy Hoffa

ooo I think I know. That actually gives me an answer.

@Ampt google.com puts a cookie on your browser, your browser won't hand it over to youtube.com

Ampt

9:46 PM

@JimmyHoffa why not?

user41796

@Ampt - any project big enough to support SSO is at some degree of risk of attack.

Jimmy Hoffa

@Ampt your browser has no reason to think that youtube should have access to cookies from google.com. Basic security of cookies man is that they are domain scoped

Imagine I put a website up that you go to and it just picks up all the cookies from all the websites on your computer, then I can use those to pretend to be you on all the sites that have given you "remember who I am" cookies - or at the least all sites you're actively logged into right now that haven't had your token expire yet

Cookies are scoped so they aren't handed out to just any site.

Ampt

then how do third party cookies work?

Jimmy Hoffa

@Ampt If you go to a website, and it has an <img src="someOtherSite.com/blank.png" /> when your browser requests that URL, the 3rd party site may send a cookie down to your browser as well, so now you went to someSite.com which is the first party, and someOtherSite.com which is a 3rd party has planted a cookie on you.

Ampt

ok, so how does that cookie get back to them?

if I never go to someothersite.com

it just has to have content loaded from the page requested to get a cookie?

user55340

9:56 PM

@GlenH7 @gnat FWIW, I've just tossed a bunch of delete votes on some dups to deleted questions (that are low view/poor themselves).

Jimmy Hoffa

@Ampt cookies are a part of the HTTP protocol - you make HTTP requests wherein you attach your cookies scoped to the site you're requesting from, and the responses may have add/update/delete cookies

the content type or body doesn't matter, cookies go in HTTP headers, headers are a part of all HTTP requests and responses.

Ampt

so a MitM would already have a cookie...

user55340

@WorldEngineer go go flag janitor!

user55340

(@WorldEngineer for fun, the list I was working off of - data.stackexchange.com/programmers/query/169338/… )

user41796

@MichaelT - if you haven't already, would you look at: programmers.stackexchange.com/questions/57192/…. Looks like Community got a little out of hand and nuked off of the failed migration. Probably ought to be restored, IMO. If you agree, it would probably help to flag and indicate that.

user20683

10:05 PM

For fun, tonight will likely consist of Android development and time spent with my girlfriend

user55340

Don't dupe your girlfriend. Bad things happen.

user55340

@GlenH7 webmaster question with all questions migrated here, didnt get any new answers, when closed, since there were no P.SE answers the entire question was deleted.

user41796

@MichaelT oh. duh. That makes more sense.

user41796

It's been nuked from Webmasters though

user55340

Yep. Not on topic there at all either.

user55340

10:09 PM

That said, there are some ok answers here. Community shouldn't be vindictive about if it was undeleted (and the migration flag(?) cleared(?)). Though it should remain closed.

user41796

@MichaelT I see a mod campaign against Community regaining some steam...

user41796

10:19 PM

I need more close votes

Jimmy Hoffa

@GlenH7 More close votes need you!

...Next xkcd will be 1337...

Jimmy Hoffa

11:09 PM

@jozefg touched D much/any?

Jimmy Hoffa