The DMZ - 2014-02-06 (page 1 of 3)

« first day (1148 days earlier) ← previous day next day → last day (3744 days later) »

12:01 AM

On SO, for instance, Skeet has 2.3 times his rep (646k to 271k) but over 10 times the number of answers. (over 28k to 2.6k)

This is the kind of question @Adnan could answer, if he weren't always busy with all of his girlfriends.

12:30 AM

@Gilles he didnt actually say that, though. That is a misunderstanding by some of the comments.

au contraire, he says that unpredictability is the important aspect of PRNG.

@Xander you could run a data.se query to find out.... and share it here....

@AviD Yeah, but that's what I'm saying. @Adnan is the one who likes to run the data.se queries. I would, but I'm lazy. And I'm busy investigating potential XSS vectors.

yeah? lucky you. I'm busy with accounting crap. tax reporting and such.

@AviD Ouch, I'm sorry. As a former accountant, I don't wish that on anyone. That reminds me...I need to get started on our taxes for last year. :-(

12:50 AM

Huh, so I now have more rep of Beer.SE, a beta site that has existed for 2 weeks, than I do on any other SE site except for Sec.SE. I'm not sure whether that's an irrelevant statistic, or somehow sad.

> <jack> Urk. I just typed "a" instead of "10"
<anubis> jack : someone must have cast a hex on you

bash.org/?495760

1 hour later…

2:28 AM

@ManishEarth Wut?

Oh, you might get a bounty. Neat.

@Xander So I suppose your beer rep will beat your security rep in another 2 weeks?

@TerryChia Never tried fedora. Honestly I haven't used anything other than arch and Ubuntu.

@DavidFreitag Oh, I love arch as well. But it's a PITA to maintain for day to day use.

@TerryChia Yeah so I'm finding out

2:57 AM

FYI the most recent humble bundle is awesome

@DavidFreitag I have basically quit gaming but WOW!

3:37 AM

@AviD You've got something to say, old man?

4:01 AM

@Simon It's @AviD. He always has something to say.

2 hours later…

6:27 AM

@AviD My wife recognized him, too. I'm so proud!

6:40 AM

Morning =)

6:55 AM

morning

What is this QoTW (question of the week I guess) thing about?

7:34 AM

@kiBytes Just a weekly guilt trip to remind us of blog entries we're supposed to be doing.

xD

8:12 AM

@kiBytes it's a method of trolling random drop-ins

anyway, morning

8:23 AM

@TerryChia security rep is beer rep.

By the way

@Iszi she's a keeper ;-)

would you be so kind to discuss with me this response?

-3

A: Sharing passwords through email can be considered insecure?

It really depends on the security you really need. For most webs and services it is ok to send you a clear password (or reset password link) to your e-mail. Nowadays the communication between e-mail servers and clients are encrypted (but the the e-mail can be read by anyone in the chain between t...

@AviD Took her awhile to get that far, though.

I am sure I am completely wrong at some point

And I would like to have some feedback

8:24 AM

@Xander I have yet to read any answer from him that taught me anything, but one thing is for certain; if the question makes it on the SuperCollider, chances are he's gonna steal the limelight with popularity votes. I'm not sure how to describe how offensive that seems to me, especially in situations where he doesn't know fuck all about what he's answering.

(please, hurt me with the truth)

@kiBytes are you asking for downvotes?

> For most webs and services it is ok to send you a clear password

Downvotes are completely fine =)

Just.... no.

8:25 AM

@TerryChia that is not a valid feedback

=D

@TildalWave what? give me an example where he didnt know, and know very well, deeply and intimately, what he was talking about.

@kiBytes It is valid feedback because it is in no way "ok" to email passwords in the clear.

@AviD you're kidding, right?

@TildalWave I'm not sure if you are.

is this another example of "He's from MS so he must be crap?"

But @TerryChia, have you read my last paragraph?

8:26 AM

@AviD I think @TildalWave has a personal grudge against Eric. He mentioned it before.

@AviD No, not really, I'm not that prejudice

@kiBytes kinda hard to get there, tbh. But that basically contradicts the rest of your answer. You need to clarify what you are saying there.

@TildalWave okay, so lets see an example?

mmmm that could be a good time

sometimes I don't explain myself very well (I tend to paraphrase I guess)...

I really have not read all of his answers, but from those that I have, and from following his blog for years, and other stuff - he does happen to be in of those who DOES know what the fuckall he is talking about, much more so than most others.

@kiBytes Your last paragraph contradicts the rest of your answer.

8:29 AM

If you don't mind I will try to explain the answer to you, and you can point me out any errors or problems you find =)

@kiBytes it comes down to misuse - or inaccurate usage - of specific terms.

Like "password".

a reset link is not a password.

@AviD Arguably though, it's equivalent.

@Iszi there are different attributes.

First of all, I'm considering the Op scenario where he has the password stored as a hash (a secure one) and he needs to inform an user with the password

because the user can't change it or choose it

@kiBytes you're gonna make me actually read the whole thing, huh?

8:31 AM

@AviD you don't need to but it woud be great

=D

@AviD The nerve of some people right?

The problem is that I really believe I am not (so) wrong with the answer, but If I get three downvotes I gues I am, and if I am, I really need to hear the feedback so I can understand why I am wrong =)

@kiBytes For me, it's mainly your first sentence (I downvoted btw).

@kiBytes look on the bright side, you can get a badge for your troubles.

(no problem @TerryChia I love downvotes as much as upvotes)

8:33 AM

And the rest of your answer isn't clear at all. Like what @AviD said, you are using terms incorrectly.

Also, I did not bother to answer that question because the only valid answer I can think of is "Your system is fucked up, fix it."

which terms @TerryChia?

> As another side note, I won't send the real password to the e-mail since any "observer" might find himself looking to the password by chance so I would rather send a link or a procedure for the user to get the new password when he is available to do so in a secure way.

A procedure to obtain the password is not a fake password.

No it isn't

and if you say "yes send him the password", you explicitly do NOT mean "send him a link or a procedure instead of the password". Even if you say "no, not the real password."

I believe there is a problem with the first paragraph but

how will you fix that?

if you have a small service

and you need to fix that, it is not useful at all advising "your system is fucked up"

so, how will you send the password to the users?

8:40 AM

@kiBytes why not? If that's the correct answer.

Though it is MORE useful to give that answer, but also a range of intermediate solutions.

@AviD ok, I am agree with this =)

11

Q: Adding "all capitals in the question title" to the quality filter

So, the guys over in Charcoal HQ have been working on a Smoke Detector that detects potential spam so it can be flagged quicker. One thing that has been noticed is the number of posts that get raised with an all-caps title. Here are some examples of things that have come through so far today - ...

feature-request quality-filter

@AviD Oh c'mon you can let me have my gripe with him, can't you? He's often just repeating points that were already mentioned, plus he always gets my nickname wrong.

I like how my statement is still pinned at the top of the star list

Maybe I should have chosen to say "you are fucked up" and then adding "but in your case or "but if you really need to do so..."

8:42 AM

@TildalWave I doubt he has ever mentioned you, one's idols never do ;-)

@TildalWave I am fine with grapes, but they should be based on something, no?

Gripes, too.

@AviD he actually has, once here and once on astro

@kalina Is it? I see @tylerl's. ;-)

I said it though

@kalina ah, true

yeah, thats staying there a while :-)

In fact, I think it might even belong as the room's description....

I contribute so much to this channel

you should do that

8:45 AM

/cc @ScottPack see ^

@AviD LOL yes, they are but that doesn't necessarily mean I wanna explain them here. It's not like I'm going after him. I just don't like him all that much, that's all.

I've noticed. But since I do tend to, I want you to change my mind.

I don't find him a character I'd go along with, what do you want me to do now? Explain to you why?

I don't wanna start accusation wars or point fingers at someone just because I disagree with their attitude. Not when I can just ignore them. ;)

0

Q: Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, seconds; msg:"Ping flood attack detected"; sid:100121))** for that in the ddos.rule file of snort. ...

ids denial-of-service snort

would this one be too much for SU?

@TildalWave wait, so is it attitude (which might be subjective) or lack of knowledge (which is objective, apparent, and what you said)?

Lawyered. Now you have to like him.

@AviD OK e.g. astronomy.stackexchange.com/a/1541/13 He doesn't really bring anything new to the thread, and merely reiterrates same points I made using various different sentences to describe it. And there is one more point that wasn't addressed there that he could have (why "up/down" doesn't change but "left/right" does depending on which hemisphere you're standing)

8:54 AM

@TildalWave ah hmm, I assumed you meant here / SO...

oops, I nearly signed up to astronomy by accident

@AviD No, here I had one such instance with him where he stole the thread with his followers for describing one possible reason for something where there's clearly many different reasons (and he was a bit of a dick about it). And I don't even frequent SO so I wouldn't know.

ah, okay. Carry on, then.

Thank you for your feedback guys =)

@kalina it's not astrology, so why wouldn't you?

8:58 AM

I know nothing about it and don't really care about the subject

and you don't have enough posts for me to legitimately sit there editing them all

@kalina it's not my site so dunno who you're referring to as "you"

ooh, well in that case signs up

lol

;)

right, you're a space mod

a mod, in space

isnt astronomy about space?

@kalina better than a mod on mods.

9:01 AM

@AviD we're the doers they're the talkers :P

or a mod on meds.

I would be a mod on mods

I'd go one step further

and be a mod on meta

metamod

mod on metamod on meds

@kalina try thefinalfrontier.stackexchange.com it doesn't go much further than that :P

restaurantattheendoftheuniverse.stackexchange.com

9:02 AM

@kalina that's Milliways

which is a chat room for space and astro mods

I don't think we need a Star Trek SE site anyway

@TildalWave Fantasy? You mean like the moon landing?

@AviD you're off your meds again?

on meta

9:05 AM

hmmm meds ...

actually, wasn't there some different video for this song?

@AviD ho ho ho

somebody had to say it though, I guess

I have no doubt that somebody landed on the moon

the problem was that once they got there, they found alien life and it scared them, so we never went back

dream on

aliens are a real thing

how else would you explain @Simon?

well there were at least 12 aliens on the Moon since none of the Apollo astronauts were born there

@kalina Please don't insult aliens.

9:11 AM

lol

user image

2

Morning all

From Metaltech on tour :-)

@RoryAlsop Showoff.

@TerryChia that reminds me of one of the responses on the Fermi paradox, that we haven't yet seen any proof for existence of ET intelligence exactly because they're intelligent :)

mornin all

@RoryAlsop cool you have phosphorescent cables?

9:17 AM

@RoryAlsop nice was this the gig with you and Psydoll?

9:33 AM

@TerryChia absolutely

@RоryMcCune Yes - the three gigs are Psydoll vs Metaltech, with a different support each night. Then we're also doing an extra gig in Aberdeen - in a music shop in the afternoon, for an interview and the documentary

@TildalWave We have fluorescent everything

@RoryAlsop documentary, coolio :) just queued up some Psydoll on Spotify, interesting opening harpsicords then guitars..

@RоryMcCune some of their stuff is a bit over jangly/dissonant, but they have a nice line in j-pop inspired gothic industrial. The last two times we have done mini tours with them they also had a theremin player - but they don't seem to have him this time round.

I'm not sure why - Nekoi's English is almost nonexistent, and Ucchi has no English at all :-)

@RoryAlsop well I guess if the gigs are v.noisy lack of a common language shouldn't be too tricky :)

@RоryMcCune they are quite a lot loouder than us

@RoryAlsop someone louder than metaltech... unacceptable you need to crank it up to 11.5!

9:42 AM

@RоryMcCune I think it's just the amount of 'wall of sound' they have. We have our frequency ranges well calculated so we fit guitars round vox and bass, and the backing fills in the empty gaps. Psydoll don't - so there is a lot of noise on top of noise

@RoryAlsop yeah I can see what you mean listening to their stuff.

some of it is really nice though - I think the stuff I don't grok so well is very Japanese - they do have a good line in shouty noise

@RoryAlsop I'm not sure I wanna know what all includes :)))

@TildalWave :-) my work here is done :-)

The documentary is going to be very silly

It contains a lot of orange

apparently, there's this thing called "orangenescence" (not sure about the spelling) that they coined to describe the color of dark shadows on Mars

could also be a cool name for your new album

9:59 AM

@TildalWave Erik would mis-spell it

:-)

<googling now>

I prolly did too

Bill Nye mentioned it when he was describing those sundials on the rovers

hmmm - can't find it

must try other spellings

possibly, wait let me try and find that video where he mentions it

I think it's "orangedescence" he mentions it 1 hour 8 minutes into this video: ustream.tv/recorded/42795898/theater

That is probably correct:

makeupalley.com/product/showreview.asp/ItemId=80637/…

user image

that is orangedescence apparently

oh god no, they think it's a shade of orange

it's a shadow of orange glow

he says it's meant to replace "cerulescent" here on Earth with blue skies

10:12 AM

ahhh

I need to watch that - bookmarked

10:48 AM

do any of you have decent amounts of mso rep (3k+)?

11:06 AM

a new source of images to spice up our answers

icanhazdigitalsecurity.tumblr.com

11:23 AM

@kalina I'm under impression that most of us here avoid MSO like the plague, well at least I am. @ManishEarth has way too much rep there tho, and probably Undo from those I can think of that are active there.

why would you avoid the site responsible for making decisions about the direction the network is going in?

@kalina 1) exactly because of it 2) that might not be true

i.e. I have no idea what it's meant to serve

3) they don't serve beer

@kalina The decisions about the direction are SO-centric and are barely influenced by MSO questions, I'm afraid.

until it gets split out into MSE

aye that's my sentiment too

11:26 AM

the choices that happen on there affect all of us though

Even then. Any network-wide change is primarily made with SO in mind.

@kalina it still won't make any difference ... just browse for stuff that SE itself agreed to do, then run stats on how many they actually did

MSO is good for bug reporting and the like, but if I want feature requests to succeed, I'm certainly not bothering with MSO.

@TildalWave stuff ends up on lists to be actioned eventually, though

"6-8 weeks"

11:30 AM

after it has been scheduled, sure

If you believe so ... I don't. I'm a dev myself and I know better than to ask of devs to implement new features. If I'd really want something, I'd make sure I push buttons where checks are signed.

there's no guarantee on how long that will take though

@kalina You haven't kept track of the MSO/MSE split, have you?

That was supposed to happen in "6-8 weeks" for over a year.

and I'm sure it's not the easiest thing to do

and it still didn't happen, yet the most work would actually be when it would be done, not the split itself

@kalina c'mon, everything becomes incredibly hard when you ask the one that would have to do it

11:32 AM

@jbferland interested in helping out with a tricky nginx/varnish issue over video chat and screen share? $260/hour, http://www.airpair.com/review/52f275115d478b0200000009

Tweeted by airpair on February 6, 2014 at 1:01 AM

^.^

that doesn't necessarily mean that it is

Greetings from Italy

@JeffFerland ahoy there you're close then

which part?

@TildalWave Yeeeeeep.

@JeffFerland I'd accept it, but dough up front

11:40 AM

so pessimistic

@kalina just realistic... a pessimist is an optimist with experience :P

12:27 PM

Hey, @LucasKauffman. I completed my python AES GCM wrapper. You said you were interested previously. github.com/Ayrx/py-aes-gcm

I only tested it on Linux, so you might have some problems on an OS X or Windows host.

But I doubt it.

Is there any way to boost Flash priority in Chrome? Or at least run two separate instances of its sandbox without complicating with VMs? I get short breaks in sound with tube videos if I'm navigating in other tabs / windows.

oh PolarSSL is a GPL lib. That could explain why I never looked at it

@CodesInChaos It's dual licensed if you need to use it in commercial software.

It's great to work with compared to OpenSSL.

I'm using it to teach myself to wrap C libraries with Python.

12:45 PM

@TildalWave and the physicist ducks.

for those that are interested: WAVSEP Web Application Scanner Benchmark 2014

@AviD I really dislike websites with black backgrounds. :P

@TerryChia cant say I disagree with you.

But it goes with his hacker aura.

Of which he has plenty.

You know... I think the director of the second Thor movie must really love Star Wars.

The movie has plenty of blasters and flying ships.

@AviD lol I was just about to post that...

phenomenal amount of work again, but could use a good graphic designer for presentation stuff.

@RоryMcCune I think he likes it that way :-)

12:55 PM

@AviD You totally should have become a Space mod. You missed your chance to live a Mel Brooks movie.

I have barely read any of it yet, it is a huge amount of information. Will have to wait and be processed in parcels.

@ScottPack with a little dubbing this could be their theme tune

@AviD well he could keep the hacker asthetic and still make it easier to consume :)

that said I'm not likely to complain, v.useful info. for free is never bad

@RоryMcCune again, I dont disagree.

@RoryMcCune I was more thinking this.

Have @LucasKauffman tell him. If he's not scared.

12:58 PM

@ScottPack or what about

@ScottPack ahhh now I get what you meant. Funny. Should have been obvious.

@AviD heh they must be making @LucasKauffman work these days, he's not around as much...

@RоryMcCune Maybe he's still having too much fun in Singapore.

Or maybe @TerryChia has him tied up in his basement.

@AviD so a diabolical plan to take his spot in the leader list...

@AviD I live in Singapore. I don't have a basement.

« first day (1148 days earlier) ← previous day next day → last day (3744 days later) »

Transcript for

Feb '146

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile