The DMZ

Griffin

5:01 PM

Anyways, I need you guys helps. I need to show and hide form options based on input of other options

TildalWave

Adnan

@Griffin Of course I did. At least you're not @Simon

Simon

WOW.

TildalWave

hehe

Griffin

@Simon Da hate :( Just make sure you feed the cats.

Antony Vennard

5:02 PM

@RoryMcCune Actually, given it was Windows 95 I think it is fair to say that is actually quite impressive!

Griffin

@Adnan <3

Antony Vennard

I seem to remember Windows 95 bluescreening quite frequently.

Griffin

So can anyone help me to understand the javascript to show and hide things based on form inputs.

Here this is what I've got so far kinda the CSS was from other stuff jsfiddle.net/Cgrillo/wxdQh/24

TildalWave

@AntonyVennard you mean this? ^

yup that's right people, I have a folder full of these ... you're screwd!

Griffin

If they select a highschool I want it to only display the highschool grades.

Scott Pack

5:05 PM

That's certainly what I call junk in her recycle bin.

Rory McCune

@AntonyVennard oh yeah, integreating Win 95 with Netware was a complete nightmare with many BSoDs!

Antony Vennard

@TildalWave ... ... ... I think you were going for screwed.

Griffin

@TildalWave My teacher (in school right now) will love all of these.... Especially considering he's in the back of the class right now. Thankfully he hasn't noticed yet.

TildalWave

@AntonyVennard meh ... I blame my keyboard!

Griffin

:( Ignoring my problems :(

Uhggg assembly

Scott Pack

5:07 PM

You're dicking around on a chat room instead of paying attention in class?

Griffin

@ScottPack Hey, I'm asking questions.... just nobody's answering them.

Antony Vennard

Also, y'know... if however many thousand years of evolution and centuries worth of discovery has led to an alphabetised, indexed folder of meme images... I worry for humanity. Just sayin' ;)

Scott Pack

Griffin

Like I came into the chat with a question but then we started talking about windows 95 and junk in recycling binsl

TildalWave

@Griffin what do you want? document.getElementById('some_id').style.display = 'none'; and ... display = 'block' should work well enough

@ScottPack dafuq?

Simon

5:09 PM

@ScottPack I can hear the song in my head.

Griffin

@TildalWave Kinda I need an onkeyup change thingy.

Simon

@ScottPack Thanks!

Xander

:11618227 You're evil.

Scott Pack

Ok, that was too much even for me

Griffin

@TildalWave Like on input I need other parts to change. Like when user selects an elementary school only grades 1-5 are displayed. jsfiddle.net/Cgrillo/wxdQh/24/#run

TildalWave

5:11 PM

@Griffin explain more.. I mean shoot out exactly what you wanna do and I'll bless you with a new revision of that fiddle :P

Scott Pack

@Xander Oh, I'm just trying to get @Griffin noticed by his teacher.

TildalWave

@Griffin same input field, or two separate ones?

Xander

@ScottPack LOL

Griffin

@ScottPack He saw the nyan cat and didn't care.

Scott Pack

Adnan

5:12 PM

@Simon <3

Griffin

@TildalWave Different. The school input will determine the grade options

Adnan

@Griffin JavaScript? I'm your man!

Griffin

*Selection, because they shouldn't need to hit submit to change it.

@Adnan jsfiddle.net/Cgrillo/wxdQh/24/#run

Adnan

@Griffin What do you want it to do?

Griffin

I was going to use PHP but then I remembered the threats about burning me alive for like PHP because it's insecure.

Adnan

5:14 PM

@Griffin I will ignore that you said that sentence and still be willing to help you

Griffin

@Adnan Based on school selection limit the grades they can select. If they're in elementary school they shouldn't be allowed to be in 12 grade. Gotta limit the trolls.

@Adnan I came in here with a liking of PHP and you guys crushed it :( </3

Adnan

@Griffin NO NO! Stop it, now! Never say that sentence to anybody! It makes you look like you know nothing about anything.

Anonymous

My God. this is annoying.

Adnan

@Simon_eQ Go away!

There's only one @Simon

Anonymous

My notification is filled

Anonymous

5:16 PM

I don't know why I am getting notifications

Griffin

@Adnan Now you got me confused. Is it a love or hate of PHP?

Adnan

The best @Simon in the world

Anonymous

This has never happened to me in other rooms before

Anonymous

I have like 16 notices now.

Adnan

@Griffin It's not about love or hate of PHP. Saying that you chose JavaScript over PHP is stupid.

Anonymous

5:17 PM

@Simon can you change your name pls :p

Adnan

@Simon_eQ You change your name!!

Griffin

@Adnan Why have one when you can have both?

:o

Adnan

@Griffin Jesus Christ in the heavens!!

@Griffin Let's just stop talking about this and fix that jsfiddle

Scott Pack

@Adnan We could all just place the imposter @Simon on our ignore list.

Griffin

@Adnan Okay :P

Anonymous

5:18 PM

wow, I smell a strong odder of hate in here.

Adnan

@Griffin So, what do you want? Give me the documentation. What schools fit what grades?

Anonymous

it smells like a replica of the javascript room.

Scott Pack

@Simon_eQ To be fair, you're the one who hops in here making unreasonable demands of someone.

Anonymous

2 mins ago, by Simon _eQ

@Simon can you change your name pls :p

Adnan

@Simon_eQ Nah, it's alright. I just get defensive when it comes to my sweet @Simon

Griffin

5:19 PM

Elementary is grades 1-5
Middle school is grades 6-8

Anonymous

@ScottPack read at the end of the line

Griffin

Highschool is grades 9-12

Anonymous

I was being sarcastic

Anonymous

Sarcasm

Sarcasm is "a sharp, bitter, or cutting expression or remark; a bitter gibe or taunt." Sarcasm may employ ambivalence, although sarcasm is not necessarily ironic. "The distinctive quality of sarcasm is present in the spoken word and manifested chiefly by vocal inflections". Any comment could be considered sarcastic in the correct context, such as "The Nazis REALLY bought good to the world". Origin of the term The word comes from the Greek σαρκασμός (sarkasmos) which is taken from the word σαρκάζειν meaning "to tear flesh, bite the lip in rage, sneer". It is first recorded in Eng...

Scott Pack

@Simon_eQ Oh, sorry, I see continued whining and tend to not notice spurious letters.

Anonymous

5:20 PM

haters gonna hate

Scott Pack

Griffin

Elementary 1-5
Middle 6-8
Highschool 9-12

I don't want you to do all of it :P I am hoping to look at what you wrote and apply the same thinking for grades -> school. Like if they're in grade 9 they're in highschool.

Adnan

@Simon_eQ This might explain why people hate you.

Anonymous

Do you mean people or haters ?

Anonymous

I'm thinking haters

Adnan

5:23 PM

@Griffin Please tell me you're joking. How can the grade determine the school? You have at least 5 elementary schools. What happens if you choose grade 2?

@Simon_eQ Just everybody you ever know or you ever will.

Griffin

@Adnan School options. All the elementary schools will be displayed when you're in that grade range. But you can't be in elementary and be in 12th grade. Also "Other" will be displayed no matter what grade is selected.

Anonymous

It's weird, every room you visit in SE, there is at-least one useless person inside it, ready to hate anyone for whatever reason. And you asshole sir @Adnan have embraced that fact today.

Griffin

@Adnan I is no potato.

Scott Pack

Adnan

@Simon_eQ Well, at least I don't call people "asshole".

Rory McCune

5:26 PM

@Adnan well not today anyway ;op

Given that @Simon_eQ is a PHP fan, this might explain the animosity :)

Adnan

@Simon_eQ and yes, I am indeed useless. Now, are you happy?

Scott Pack

The problem with @Adnan is that calling someone an asshole makes him immediately think of cactuses.

Rory McCune

@ScottPack ok (and I recognise that I may regret asking this) but why are you connecting the word asshole with cactuses?

Adnan

@RoryMcCune Because @Scott likes to shove cacti in his.

Doh!

Scott Pack

@RoryMcCune I can't claim credit for such, ahem, intersections.

Anonymous

5:28 PM

@Adnan You confronted me into having a negative conversation with you, and then try to get the moral high ground, by saying "are you happy"? wow

Rory McCune

@ScottPack ya think credit is the appropriate term here?

@Adnan and there's the regret

Adnan

@Simon_eQ Dude, do you seriously think I hate you?

David Freitag

@Simon_eQ I think you're confused because you are getting pinged for @Simon, when @Adnan didn't mean to ping you.

Adnan

I have neither the interest nor the capacity to currently do so.

@Simon_eQ Plus, this is the first time I ever see you here, why would I hate you? It's like you're @kalina

David Freitag

@Adnan ehhehe

Scott Pack

5:30 PM

@Adnan Nah, she's been cool.

Adnan

@Griffin Got it.

Scott Pack

Made the room chattier than I like, but otherwise pretty non-whiney.

Adnan

@ScottPack Well, I must agree on that one. She's pretty alright. A bit too teenagy, but so is @Simon and @David and we like both of them

Anonymous

Well, good night. I've had enough tantrum for today. I'm off to dinner right now.

David Freitag

@Adnan Eh, I'm only 21, what can you expect.

Adnan

5:32 PM

@Simon_eQ Good night.

@DavidFreitag Nothing. I expect nothing from you

David Freitag

I'll be green for at least a few more years.

Adnan

@DavidFreitag Green?

Is that what the kids these days call "getting high"?

David Freitag

@Adnan Teenagey

Rory McCune

@Adnan english idiom implying lack of experience

IIRC comes from the concept of "green" wood as against aged wood

Adnan

@RoryMcCune Wood.. hmm.. there must be something @Scott would say

Rory McCune

5:35 PM

@Adnan well I was expecting someone to pick up the double entendre but so far no takers, guess @ScottPack and @AviD must be busy elsewhere...

TildalWave

@Griffin jsfiddle.net/2LfrH/5

this works for you?

Scott Pack

@Adnan Oh, sorry. I'm attempting documentation.

Simon

Whoa, @Simon_eQ stroke again while I was gone.

Adnan

@Simon I defended you

Simon

@Adnan Thank you.

Xander

5:41 PM

@TildalWave Having <div>s inside a <select> makes me cry. Should be an <optgroup> instead.

TildalWave

@Xander oh those are from before ... I just reused them as hidden containers holding values

there's gazillion ways really ... I was just lazy

Xander

@TildalWave Yeah, I saw them on the original. I'm just being pedantic. :-)

TildalWave

@Xander will make sure to mention once he wakes up or whatever he's up to now

Any good game frameworks for JS actually? I was thinking of writing one, too lazy to write all the objects myself

wow 2 @Simon 's

Xander

@TildalWave I don't do game development, but I've heard some impressive things about the rendering capabilities of Three.js. threejs.org

TildalWave

ambiguous @Simon'ing ensues! :)

@Xander will have a look... I don't actually need anything fancy graphics-wise... it'd be a "business" strategy

Xander

5:50 PM

@TildalWave Ah, ok. I misunderstood.

TildalWave

no no you didn't ... I didn't mention it so my bad really

thanks!

@ScottPack dl.dropboxusercontent.com/u/6213850/WebGL/nyanCat/nyan.html

Rory Alsop

Evening. @rorym - how goes the move date?

Simon

@TildalWave Yes and the new one is not happy that I exist.

TildalWave

hey @RoryA ;)

@Simon is that right?

Simon

@TildalWave Yes, he wants me to change my name.

David Freitag

5:54 PM

hah

some balls that guy has.

TildalWave

@Simon propose marriage

Rory McCune

@RoryAlsop ..... bad :( Apparently lack of one piece of paper from the forestry commission to confirm something we already know is enough to stop the missives being signed. So now we have our lawyer chasing the sellers lawyer to chase the forestry commissions lawyer to confirm something we already know!

This is a bit frustrating!

Scott Pack

You clearly need more whiskey.

3

TildalWave

^

Rory McCune

@ScottPack well more alcohol is clearly called for! no whisky but I do have gin :)

Simon

5:55 PM

@TildalWave I'm too young to get married.

Rory Alsop

That's not fun Mr. M - fingers crossed for speed

Scott Pack

@RoryMcCune That'll do, pig. That'll do.

Rory McCune

@RoryAlsop ta :) hopefully will be resolved tomorrow, otherwise I'm thinking of skipping the series of lawyers and starting cold-calling the forestry people :)

Rory Alsop

Could be the way to do it. Costs less, cuts out the middleman, faster, and less stress.

TildalWave

@Simon I only have even more profane ideas then

Rory Alsop

5:59 PM

@tildal - I don't think @simons are allowed to marry @simons. It was one of the 11 commandments

Rory McCune

@RoryAlsop yeah the lack of good ideas from our lawyers is less than impressive. Seems to be that they have an idea of what they can do and don't really like thinking of innovative approaches...

TildalWave

2 mins ago, by TildalWave

@Simon I only have even more profane ideas then

> 1: relating or devoted to that which is not sacred or biblical; secular rather than religious.

I'm not allowed to say it out loud :)

PG-13 and all

Simon

wat

Rory McCune

anyone have a img link to the new logo?

want to use it for a presentation I'm doing...

Simon

@RoryMcCune i.stack.imgur.com/rw5D6.png

Rory McCune

6:11 PM

@Simon ta :)

Adnan

@Griffin Oh, forgot about you. Here you go, jsfiddle.net/wxdQh/26

Read the code and play with it a bit. You'll learn it in a heartbeat

@ScottPack Is your current helpful flag number 285?

Simon

@Adnan 322 I think he said last time I asked him.

Adnan

@TerryChia How about you? What's your helpful flag count?

@Terry Is it 132?

Simon

I hope not because mine's higher than that.

Adnan

@Simon I'm checking for a privacy "bug" in the SE code. That's why I'm verifying the numbers.

Simon

6:24 PM

@Adnan Nice.

Adnan

@Simon So far, everything points that it is indeed a "bug". Now we need @Terry's answer.

Simon

@TerryChia Wake up!!!

Scott Pack

@Adnan Negative. It's much higher.

Adnan

@ScottPack From your Sec.SE profile? The number that is under your profile views?

Scott Pack

@Adnan I know how to see my flag counts.

Xander

6:26 PM

@Adnan Do you have a number for mine?

Adnan

@ScottPack I thought you're adding Meta.Sec.SE flags to it or something.

@Xander Nope. So far, @Terry and @Scott only.

Scott Pack

@Adnan No, that would be on my meta.sec.se profile

Xander

@Adnan K.

Scott Pack

@Adnan FYI, my flag count on meta.sec.se is 1. On main it's 322.

Adnan

@Iszi How about you? Flag count?

Krastavac!!!

Everybody is sleeping

Oh, good, @RoryA is here. What's your flag count, please?

Jeff Ferland

6:32 PM

I, for one, own no flags.

I prefer to conquer through brute force rather than putting pieces of cloth on mole hills

Adnan

@JeffFerland Not even the 'Murican flag?

Simon

'MERICA

Adnan

@JeffFerland Speaking of which, what's your flag count on Sec.SE, please?

Jeff Ferland

@Adnan Raised, handled, currently queued?

Adnan

@JeffFerland Hmmm.. I believe I'm looking for the "helpful flag" count under the profile views in your Sec.SE profile page.

So I think it's "Raised".

Jeff Ferland

6:35 PM

32

Adnan

@JeffFerland Thank you

Now I only need @Terry

Jeff Ferland

I feel violated

Adnan

@JeffFerland Yeah, I took what I wanted from you and moved to the next one?

Jeff Ferland

@Adnan Yup.

Adnan

@JeffFerland :O

Where's your hair?

You look... cool

Scott Pack

6:40 PM

I have to say, @Jeff. Except for the lame haircut I really dig your style.

Adnan

@Jeff Like I can ask you where are the best parties in town or something like that.

Jeff Ferland

I got that haircut back at DEFCON.

Adnan

sigh

0

Q: Does using Bcrypt to encrypt credit card numbers satisfy PCI compliance?

I understand that using MD5 is not safe and is not PCI compliant. Does using BCrypt satisfy PCI compliance

Jeff Ferland

... PCI... we meet again...

Adnan

Why would somebody asking a question like that have the need to ask a question like that?!

Jeff Ferland

6:44 PM

@Adnan Having spent 7 years at a CPA firm which involved lots of audits, this is the normal state of people responsible for your money.

Adnan

@JeffFerland I was just about to write an example of someone asking a question about wheter we recommend the bank he works at to use SSL or not.

So sad.

Scott Pack

Of any single organization type banks are the ones with the least clue and the worst implementation.

Adnan

But, you know what, it gives me hope that it's gonna be difficult for me to be out of work.

Or, the opposite, if people like that were in HR offices.

Which is usually the case.

I guess I'm screwed.

@JeffFerland How big was the CC number space? (knowing the issuing issuer and issuing bank)

Was it 1M?

Or 10M? Damn, I used to know this.

Jeff Ferland

1-10M depending on the size of the bank

Simon

Oh lawd, I just saw the haircut. Does Defcon justify it?

Jeff Ferland

6:55 PM

@Simon Basically everybody who has seen it loves it. I cut it off and then everybody complained that I didn't have it.

So, haircut comes back when hair gets long enough again.

... maybe

Really my biggest problem is with bicycle helmets

Simon

I feel like this is the kind of haircut that comes with a cocaine problem but hey, stereotypes are not cool.

Adnan

A normal setup with hashcat with the default work factor can make about 3k hash/s

So that's half an hour per CC number

Quite decent.

Simon

@Adnan 30 mins to match the hash with the number? Indeed quite decent.

Adnan

@Simon At least according to my "calculations" (that's a BCrypt hash, by the way)

Simon

Also, I guess this assumes that every single hash has its own salt?

So, you have to start from scratch every time you wanna crack a number.

Adnan

7:00 PM

@Simon Oh yeah, otherwise we wouldn't even consider bruteforce. The rainbow table for this purpose is extremely small.

Simon

Yeah.

I wonder how Paypal stores CCs.

Adnan

@Simon I think I talked about it in one of my first answers here on Sec.SE

Thomas Pornin

@Adnan For a 10M address space, you don't even need a rainbow table. A simple table with 10 millions of hash value would work.

Simon

Aren't there 16^10 possible credit card numbers?

Adnan

> @JeffFerland How big was the CC number space? (knowing the issuing issuer and issuing bank)

Simon

7:07 PM

@Adnan How many digits would be known then?

Rory McCune

@Simon BIN (Bank Identification number) is the first 6 IIRC

Simon

@RoryMcCune So we're down to 10^10.

Thomas Pornin

@Simon It would be 10^16 (sixteen decimal digits, not ten hexadecimal digits). Then it would be 10^15 because the last digit is computed from the 15 others deterministically.

Rory McCune

@Simon less than that 'cause the overall number has to pass the Luhn check algorithm

Adnan

Rory McCune

7:09 PM

Luhn algorithm

The Luhn algorithm or Luhn formula, also known as the "modulus 10" or "mod 10" algorithm, is a simple checksum formula used to validate a variety of identification numbers, such as credit card numbers, IMEI numbers, National Provider Identifier numbers in US and Canadian Social Insurance Numbers. It was created by IBM scientist Hans Peter Luhn and described in [http://www.google.com/patents?id=Y7leAAAAEBAJ U.S. Patent No. 2,950,048], filed on January 6, 1954, and granted on August 23, 1960. The algorithm is in the public domain and is in wide use today. It is specified in ISO/IEC 7812-1. ...

useful to know if you're testing a site that takes CC's most forms do this check first so it's handy to have CC numbers that works e.g. getcreditcardnumbers.com

Simon

@ThomasPornin True, I mixed both numbers.

Didn't know about the Luhn algorithm though.

Adnan

@Simon That would be 10^8

Scott Pack

LUHN ALL THE CHECKS!

@Adnan The number of digits in a credit card number is different depending on the lender.

Adnan

@ScottPack I think we're talking ANSI here.

Simon

@Adnan That's 100M. Why did @ThomasPornin say 10M address space then?

Rory McCune

7:13 PM

@ScottPack indeed doesn't Amex only have 15 digits..

Scott Pack

@RoryMcCune I think Discover does as well.

@RoryMcCune I'm pretty sure one of them has 14 or some such.

Adnan

@Simon He didn't, he just followed on our assumption

Simon

@Adnan Ah.

Is the Luhn check the reason why they're using only numbers and no letters?

Thomas Pornin

@Simon In fact the range size depends on the bank

Big banks get a bigger range

Adnan

Thomas Pornin

7:19 PM

fragmentation issues make the address space a bit cramped (like IPv4 addresses, in fact)

Simon

@ThomasPornin Are they thinking of a solution like they did with IPv4?

@Adnan Usability then?

Adnan

@Simon That would be my guess.

@Simon I have just found out that we have a Simon in the company

Simon

@Adnan Took you a while to find me.

Adnan

@Simon I don't really think you're Swedish

Simon

Good guess.

Adnan

7:26 PM

:O

But but but.. you're not good looking. How?!

Unless you're using someone else's picture!

Simon

wat

The dude's ugly?

Aw.

Not everyone can be as pretty as @Simon_eQ and I.

Adnan

Shit! Blue alert!!

Simon

Flush the blue!

Adnan

@diablosnuevos What's the password?

Simon

I know what it is!

5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

Scott Pack

7:30 PM

I thought it was @Simon's mom.

Jeff Ferland

6a0f0731d84afa4082031e3a72354991

Simon

@ScottPack That's her name hashed in SHA-256.

Jeff Ferland

Whoever can tell me what the input for that is wins a cookie. Hint: chat context matters.

Simon

You see, her name is password.

Scott Pack

Jesus @TildalWave. Seriously. Take a break from the twitters.

TildalWave

7:32 PM

@ScottPack Oh sorry... just organizing things so I have them easily searchable... really didn't wanna cause a problem :(

Scott Pack

You're using your twitter stream as your search database?

Simon

@JeffFerland Can I get at least the algorithm?

TildalWave

@ScottPack on my phone yes, it's rather convenient

it's kinda like "things I last gave a shit about"

Simon

I'm guessing MD5.

Jeff Ferland

That's frustrating. I found a hash cracker that hosts it, but it won't let me put in the answer. I'm also fucking floored that it hasn't been cracked.

Simon

7:37 PM

Yeah I tried an online cracker too, haha.

Wait, I didn't use the same one because it didn't find it.

Jeff Ferland

Well, the one I tried didn't find it either, but given the list of what it knows, it should have found it.

Simon

Oh.

Adnan

@JeffFerland I failed.

What is it?

Simon