The DMZ

6:00 PM

@tylerl And @ThomisPornin is a deity. We know this.

So then I end up with statements like this:

THIS IS NOT ABOUT HASHING PASSWORDS. When you see a hash function used, do not assume it's about hashing passwords. Multiple iterations of a hash function is not appropriate in the context of this question or this answer. — tylerl 27 mins ago

Scott Pack

Fuck you too memegenerator.

TildalWave

@tylerl I can't even pronounce PBKDF2 without swearing

Oh, apologies, I didn't notice. What do you mean use enough rounds? I don't remember any function that lets you directly modify the number of rounds, at least not in PHP. Otherwise I agree @LucasKauffman — rath Jul 30 '13 at 10:18

... or PHP without spitting

Glen The Udderboat

How many TSA Baggage Lock master keys are there in circulation among the 'general' public?

Scott Pack

@GlenTheUdderboat Enough.

Iszi

6:06 PM

@tylerl Umm... I thought that question was about hashing passwords?

tylerl

@TildalWave My point was that in no part of either the question or the answer was hashing a password even discussed. But because SHA-1 was mentioned in the answer, I got 6 comments about how SHA-1 isn't appropriate for hashing passwords. WHY??

Glen The Udderboat

@ScottPack Can you use that for closing a bag as well, as if it was never opened?

tylerl

@Iszi The question is about generating salts, not hashing passwords.

Scott Pack

@GlenTheUdderboat That requirement is a bit trickier.

Iszi

> Assumed I have to following code in order to generate a random blowfish salt for saving a new password:

TildalWave

6:07 PM

@ScottPack and a pair of tube nunchuks to provide additional torque for those difficult to cut through ones ;)

Iszi

@tylerl Also, it's tagged passwords

Glen The Udderboat

@ScottPack Perhaps replace it with another lock from the store. :)

Scott Pack

@GlenTheUdderboat There you go!

@TildalWave You could use the 24" ones. They don't fit as easily in a back pocket though.

TildalWave

@tylerl I've seen that yes, that's why I went on a comment upvote rampage

tylerl

@TildalWave :)

TildalWave

6:09 PM

also, your answer is far superior to the accepted one, but that's down to OP ...

Glen The Udderboat

Does anybody hash their salt?

tylerl

@GlenTheUdderboat you can.

Iszi

I still don't see how the question isn't about passwords. Sure, the title doesn't mention passwords and a large portion of the question has nothing to do with passwords specifically. But the very first line says that the function is intended to be used for saving passwords and the OP even included the password tag.

David Freitag

@GlenTheUdderboat I usually salt my hash, but that's only because the cook doesn't use enough.

tylerl

@Iszi The question is about whether mt_rand() is appropriate for generating salts. The password hashing bit is assumed to be already answered about 15 times elsewhere.

But people can't resist throwing in that little tidbit they've picked up about how to properly hash a password

cause god knows you wanted to hear it

And just in case you haven't heard, MD5 is also inappropriate for hashing passwords.

I realize that wasn't what we were talking about, but I want everyone to know that I KNOW.

Scott Pack

6:14 PM

Man, I haven't had corned beef hash in a long time.

tylerl

@ScottPack I'm not sure I ever have

Glen The Udderboat

@tylerl Is it consistent for me to know that you know but not know myself?

TildalWave

I did use hash of a GUID a few times for my salt, I thought it worked pretty well ... it's kinda what @tylerl described there

Rоry McCune

@ScottPack mm corned beef hash :)

Scott Pack

@RоryMcCune With some nice cabbage. Yyyeeeeesssss

Rоry McCune

6:15 PM

@ScottPack cabbage could work or sprouts

tylerl

@TildalWave I've got another answer somewhere clarifying that random GUIDs are not designed as a substitute for /dev/random. It strikes me that I shouldn't even have to say it, and yet it comes up.

Scott Pack

@RоryMcCune Or some sauted cauliflower.

tylerl

Several actually. Hm.

Scott Pack

@RоryMcCune I've still got a few glasses of a proper stout in my fridge too. Actually black in color with a slightly smoky flavor.

Glen The Udderboat

I hear great things about Dead Sea salt (for your mash).

tylerl

6:21 PM

Himalayan salt

Himalayan salt is a term for halite (commonly known as rock salt) from Pakistan, which began being sold by various companies in Europe, North America, and Australia in the early 21st century. It is mined in the Khewra Salt Mines, the second largest salt mine in the world, located in Khewra, Jhelum District, Punjab, Pakistan, about 300 km from the Himalayas, about 160 kilometres from Islamabad, and 260 kilometres from Lahore, and in the foothills of the Salt Range. The salt sometimes comes out in a reddish or pink color, with some crystals having an off-white to transparent color. ...

Glen The Udderboat

@tylerl Excellent salt-generator. I like the pink stuff.

TildalWave

@tylerl Oh I know that, but I wasn't too bothered in those cases with how random GUID is or isn't, mostly because those datasets were never meant to grow much anyway so it worked fine like that.

tylerl

For 6 days in a row I've been rep-capped at 200 when I woke up in the morning. It kinda saps my motivation for answering SE questions at work. But on the other hand, once 5pm rolls around I've got to put in a bunch of really good answers so that I keep the streak alive.

Thomas Pornin

6:46 PM

@strugee Bitcoin is as good (and as bad) a currency as paper.

The protocol is alright.

But a currency has any value only insofar as people believe that it has value.

Traditionally, that belief is bootstrapped by some institution (say, an edict from the King, or a big central bank).

Bitcoin tries to bootstrap out of thin air, so it is like a bubble which floats around and may burst at any time.

Scott Pack

So...it's like the US dollar but with less history to convince people it's worth something?

Thomas Pornin

A successful bootstrap is what we get with the US dollar, or the Euro: since Bretton Woods agreements, currencies exist "by themselves" and what prevents them from exploding in mid-air is that they are too big to fail; they are backed by being used widely.

Bitcoin has not yet reached the critical mass (by far).

People still have the option not to believe in the Bitcoin.

Lucas Kauffman

@AviD I wasn't here earlier, but now I am

Rоry McCune

@LucasKauffman very zen

Glen The Udderboat

@ThomasPornin As I understand it, Bitcoin does not at all have mathematically unique properties. This implies that it needs traction by convention even more.

Scott Pack

6:53 PM

I think my favorite koan is "The rug really ties the room together."

3

Glen The Udderboat

@ScottPack Lebowski, right?

Scott Pack

Natch.

matt wilkie

well, I'm all washed up now. I am no longer a human being. I just tried to post a new question on Security SE and failed the captcha 10 times in row.

Glen The Udderboat

@mattwilkie You do sound a bit bot-like to me.

matt wilkie

:)

A few times a year I am greeted by security.stackexchange.com/questions/14890/… on the varies servers I connect to, mostly shared web hosts. Up to now my practice has been to just say "yeah, okay, just update the key and let me get on with it".

Thomas Pornin

6:57 PM

@mattwilkie That's kind of neat. If you are not a human being then you cannot be held responsible for your actions.

matt wilkie

In part this is because I'm in the middle of a task and don't want to get sidetracked, but it's also because I don't know the correct response. How does one verify the fingerprint being returned is in fact for the correct computer?

I'm mystified why this isn't covered in the thousands of FAQs about ssh and rsa keys. Clearly there must be some fundamental concept I'm missing. Please enlighten me.

@ThomasPornin oooh, I hadn't thought of that

Glen The Udderboat

It's your salt.

Thomas Pornin

@mattwilkie This is done "out of band". You are supposed to phone the sysadmin of the server, and he will spell out the fingerprint that you are supposed to see.

Another similar method is that when you reach your desk for your first day on the job, you are provided with some "startup documents" (on paper), one of them containing the key fingerprints for the servers that you are supposed to use in your daily tasks.

Needless to say, it never happens that way. That's just the theory.

matt wilkie

@ThomasPornin so in the case of a web hosting provider, they should have published list of fingerprints and IP addresses somewhere? perhaps behind a service desk issue request or something?

Thomas Pornin

@mattwilkie Theoretically, yes.

Scott Pack

7:00 PM

It also doesn't help that some systems would regenerate a new key on every reboot or software update.

So that list of fingerprints in your onboarding pamphlet will become obsolete during next week's patch cycle.

matt wilkie

so in practice most people just do what I have been doing, because there isn't an accessible/feasible out of band channel.

yes?

Scott Pack

Generally yes.

Thomas Pornin

@mattwilkie Yes. In practice people do things which are weak.

Because the alternative is not getting things done at all, which is not tolerable.

Scott Pack

I've noticed the same with PGP. Some people have lots of fun with key signing parties and building out their web-o-trust.

Most people just accept the keys blindly and don't care.

Thomas Pornin

@ScottPack Ah, I once used PGP with a customer and we did verify the fingerprint by spelling it out over the phone.

Scott Pack

7:04 PM

@ThomasPornin I'm going to assume "once" was emphasized.

Thomas Pornin

@ScottPack The point is that PGP is OK and using the fingerprint is fine; using the Web of Trust is not fine.

matt wilkie

Ok. thanks for the explanations. Now, what should a moderately securely minded non-sysadmin shell user do? make themselves a pain in the ass with tech support by opening a ticket on every fingerprint change, asking for out of band confirmation?

Scott Pack

Glen The Udderboat

What's your favourite "security" movie?

TildalWave

The Bear is here

Thomas Pornin

7:11 PM

@GlenTheUdderboat Star Wars IV

TildalWave

DMZ is complete :)

Scott Pack

@ThomasPornin My daughter and I finished that last night. She thoroughly enjoyed it.

Thomas Pornin

@ScottPack Well, yes, these late-70s haircuts are just downright hilarious.

TildalWave

we can finally say wrong stuff and be corrected before it hurts

Scott Pack

She kept asking me about The Force.

@ThomasPornin Also a pretty intense reminder how poorly Hamill and Fisher have aged.

TildalWave

7:13 PM

@ThomasPornin what's so security about it? The One Time Hologram?

Thomas Pornin

@TildalWave The whole plot is about an information security incident (the stolen plans) later exploited by attackers to find a hole in the defence system.

Darth Vader is the CISO and he spends the complete movie trying to manage the consequences of the breach (and ultimately failing).

Scott Pack

I'm really enjoying this analysis.

Would that make Tarkin the CIO?

TildalWave

ah that's the one, I always confuse the episodes

Glen The Udderboat

@ThomasPornin I haven't seen that one, but is it conceivable that you see a "security" angle in every movie?

Scott Pack

Considering that The ~~Pope~~ Emperor never appears in that movie he's clearly the CEO/President.

2

Thomas Pornin

7:17 PM

@ScottPack This analysis is the main point of a nice presentation I saw at BSidesQuebec last year.

Scott Pack

@ThomasPornin Do you know if it was recorded?

And in English?

Thomas Pornin

@ScottPack It was in English, and it was recorded (maybe not at that one time) and I saw the recording, too.

@ScottPack 2012.video.sector.ca/video/51119497

2

Scott Pack

Salud!

Chrome failed to translate the BSidesQuebec page for me so I was rather struggling through.

David Freitag

Chrome has failed to translate for me quite a lot recently. I think something might be up

Scott Pack

FYI: Content begins at 2 minutes 15 seconds.

Lamia

7:22 PM

Guys, I'm gonna start building an OS as a replacement for Windows and make it the default OS in all PCs :) who is in?

Thomas Pornin

@ScottPack Yup, the first few minutes are rather superfluous.

Scott Pack

@ThomasPornin That's a rather kind descriptor.

Thomas Pornin

@ScottPack Contrary to what is usually believed, I am not unkind (on a general basis).

@Lamia Are you gonna call it MacOS X, ChromeOS or Android ?

Lamia

@ThomasPornin I will call it FUCKYOUWINDOWS

David Freitag

@Lamia I have been working on one for a while now

It's not much more than a simple command interpreter and it's x86 only

Lamia

7:31 PM

@DavidFreitag well if you need any help

Someone need to do something about it! I just bought a laptop for my college hws with windows 8, and when I updated that stupid shit to 8.1 my laptop fans were damaged! Can anybody explain why :)

David Freitag

@Lamia It's more of a hobby that i expand on as my knowledge on the subject expands.

Lamia

@DavidFreitag That's an interesting one! I can work for you as marketing manager :P

Just to replace all windows systems

I mean, I don't know from where I should start and there is a lot to be learned, but I might be serious

David Freitag

@Lamia Heh, it's probably best just to sit on my computer at home. It really is stupid simple. The only reason it's running in 32-bit protected mode is because GRUB leaves the computer in that state when it calls my loader. There are no drivers other than keyboard and certainly no filesystem drivers

@Lamia wiki.osdev.org/Main_Page is where i started

Lamia

@DavidFreitag Awesome, I got to work on that!

David Freitag

@Lamia You should start by firing up an ubuntu (i use lubuntu because it's lighter) VM and do this first: wiki.osdev.org/GCC_Cross-Compiler

Gilles

7:38 PM

Microsoft has a majority market share

See Mark's closure comment here: https://bugs.launchpad.net/ubuntu/+bug/1/comments/1834 ------ Microsoft has a majority market share in the new desktop PC marketplace. This is a bug which Ubuntu and other projects are meant to fix. As the philosophy of the Ubuntu Project states, "Our work is driven by a belief that software should be free and accessible to all." "Ubuntu software is free. Always was, always will be. Free software gives everyone the freedom to use it however they want and share with whoever they like. This freedom has huge benefits. At one end of the spectrum it enables the Ubuntu community to grow and share its collective experience and expertise to continually improve all things Ubuntu. At the other, we are able to give access to essential software for those who couldn’t otherwise afford it – an advantage that’s keenly felt by individuals and organisations all over the world." * http://www.ubuntu.com/project/about-ubuntu/our-philosophy Non-free software leav…

Ubuntu

Critical / Fix Released

David Freitag

Then do either the C or C++ barebones tutorial. That will leave you with a bootable iso image that you can create another VM to test.

@Lamia if you decide you're serious let me know - I would be very interested in an OS project

Lamia

@DavidFreitag Actually, I have an old laptop I don't use, maybe I can directly work on that by replacing the whole OS

David Freitag

@Lamia The easiest way to do that is use floppies. I can't remember if GRUB will be okay with loading a small elf binary from USB without some poking and prodding

Half the problem with GRUB is getting the right multiboot compliant header. Most of the documentation out there is for Grub Legacy

Lamia

@DavidFreitag I'm going to practice now with what you just gave me, maybe one day I'll be serious and I'll let you know.

Building an OS is one of my old dream :p

David Freitag

@Lamia Don't get caught up in how much sheer work there is to be done, that's the one thing that has always killed my motivation

Lamia

7:45 PM

@DavidFreitag What if I used DVD for the iso image

David Freitag

@Lamia That should work, but i recommend a VM. If you are going to run linux as the host Qemu works perfectly.

I use Windows 8.1 with Virtualbox. I have a Lubuntu VM and a VM for my kernel to run in. The bidirectional clipboard in Virtualbox lets me pluck the iso out of the Lubuntu VM.

Lamia

@DavidFreitag I'm excited right now, I hope nothing will change when I get to know more about the thing :p

@DavidFreitag Will do that then

David Freitag

@Lamia Once you get the Lubuntu VM up and installed, install the virtualbox guest addons and switch to seamless mode. It integrates your VM's windows into the host OS so you get a linux shell inside of windows 8. It's freaky at first ;]

Guest addons also allows the bidirectional clipboard to work FWI

Lamia

@DavidFreitag Can I just skip Windows 8.1 and go with Lubuntu and a VM for the kernel?

David Freitag

@Lamia Yeah

There is information on how to boot a kernel using Qemu (a VM host for Linux) somewhere on Osdev

Lamia

7:51 PM

@DavidFreitag I will look for it

@DavidFreitag Thank you so much btw

tylerl

8:12 PM

@DavidFreitag you use Lubuntu?

David Freitag

@tylerl yes, why?

tylerl

@DavidFreitag does it use primarily gnome tools? Like gnome-terminal, etc.?

David Freitag

Nope it uses lxde. So you get lx-terminal and leafpad instead of gedit

tylerl

@DavidFreitag but those are still GTK tools.

hm.

David Freitag

@tylerl I use it because it's more lightweight than regular Ubuntu. Most of my Linux installs are inside of VMs so the less heavy the install the better

Thomas Pornin

8:24 PM

@tylerl I am using Lubuntu and I use xterm as my terminal (so no GTK there)

tylerl

@DavidFreitag So why install a GUI if it's in a VM?

David Freitag

@tylerl Laziness

jalopnik.com/…

Ridiculously sexy car.

Thomas Pornin

8:46 PM

@DavidFreitag It looks like a brick with wheels and a couple of LED.

Rory Alsop

it's a volvo - boxy, but good

Not a sexy car

(although my car is a brick with wheels, but no LED's)

Bah - radio mice running out of batteries. I'm using a Wacom tablet to navigate online - mildly annoyinh

Scott Pack

I like Volvos but the fact that it's a Volvo precludes it from being sexy.

Well..pre-Ford Volvos.

Are they still shitty?

Rory Alsop

was it the Volvo P1800 that was gorgeous

yes

Rоry McCune

9:06 PM

@RoryAlsop me too but I was very happy again today to have something with good load capacity, being able to fit a double mattress in the boot comes in handy some times...

Scott Pack

Oh my.

Rory Alsop

@RоryMcCune TWSS

@ScottPack TWSS

:-)

Scott Pack

Well done.

Rory Alsop

thankyeow

Scott Pack

I have on the Rifftrax of Battlefield Earth. It's only slightly better.

Rоry McCune

9:14 PM

@RoryAlsop heh, unfortunately no "interesting" connotations, just a picky charity shop then when they offer "house clearance" services, mean "only stuff we want" and they leave you with the stuff they don't want..

Rory Alsop

Wow - 351 questions with no upvoted answers

security.stackexchange.com/unanswered

anyone fancy a little bit of a trawl through those

Rоry McCune

@RoryAlsop sounds like a job for ..... @kalina :)

Rory Alsop

@RоryMcCune I almost wrote that :-)

Rоry McCune

@RoryAlsop lol snyc'ed thinking. BTW I was in Livi today, I notice it really does rain less over that side of the country.

Rory Alsop

9:31 PM

@RоryMcCune oh yes. But slightly colder.

Rоry McCune

@RoryAlsop and less land-slidy

we had another one this week

Rory Alsop

very true - no landslides here

So did you get rid of all your excess stuff?

Rоry McCune

@RoryAlsop yeah was all furniture, the charity peeps took most of it, and the rest got to the recycling site. <fingers crossed> all is well for completion on Friday and I go back to only owning one house (Yay!)

Rory Alsop

yay!

Are you likely to be in Livi 8th March - Beer tasting at the cricket club. Alechemy are hosting

could stay over

Rоry McCune

@RoryAlsop hmm not sure of plans for then as yet, but yeah that could be a possibility.. I'll keep and eye on the date and see what works out :)

testing is being it's usual "loads of stuff busy busy busy".... "less stuff quiet"... "loads of stuff busy"... rinse repeat

Rory Alsop

9:36 PM

yarr - unlikely to ever change, really

Rоry McCune

@RoryAlsop true. well until everyone gets their software security sorted, then I'll be out of a job

and also a pile of dust decomposing somewhere

Rory Alsop

10:19 PM

That reminds me - I'm reading Abe Lincoln, vampire hunter

Rory Alsop

11:21 PM

Oh here we go again

user3171796

8 2

Rory Alsop

11:37 PM

Hey @M'vy

How's tricks

M'vy

@RoryAlsop Hiya Rory

I'm fine and you?

feeling alone?

Rory Alsop

almost never :-)

tylerl

@RoryAlsop Whatdaya mean? That guy's AWESOME.

Mind-control radar waves, man.

Rory Alsop

@tylerl ... for certain versions of awesome, sure

I had to tone down my answer to his meta post

my comment amout needing a psychologist was a bit rude

tylerl

@RoryAlsop now you're just getting soft.

A few minutes with the microwave stalker gang should harden you up

Rory Alsop

11:45 PM

@tylerl hahahaha - they can't get me- I have an 8 layer tinfoil hat

tylerl

@RoryAlsop Ooh. That's pretty leet. Never met an 8-layer wearer before. I just do the ol' foldover.

Client asked me to update the prices on his website for a single item. It took 2 hours to track down all the places (including 3 different locations in the static HTML) where the price was coded.

Rory Alsop

@tylerl nooooooo.

tylerl

There's a reason why I don't do UI crap. And terrible custom CMSes is a good part of that reason.

It's a bullshit CMS/shopping cart written (at great expense) by the marketing agency's own in-house programmers.

Rory Alsop

(that's like me and my amateur web pages for Metaltech and the local TaeKwonDo club - I'll make time to learn proper web design sometime. Until then, notepad is my web design framework most days

Transcript for