« first day (1494 days earlier)      last day (3407 days later) » 

5:18 AM
> CGI programs could be anything. You could write them in a shell script on an HP-UX or Irix box. You could write them in C. Netscape tried to make money selling server software where you could write them in JavaScript (and oh how everyone laughed).
 
6:02 AM
Hey @tylerl.
 
@TerryChia sup
 
@tylerl Do you know anyone on the GAE team? :)
 
6:28 AM
@TerryChia google apps for enterprise, you mean?
yeah, quite a few.
thats who I spend my day-to-day with.
or you mean app engine?
(I know fewer of those)
 
@tylerl App engine. :)
 
but I know how to get in touch with them.
 
Was wondering if I can get github.com/pyca/cryptography on the approved modules list.
They have PyCrypto but that's a mostly dead project now.
 
does it use native code?
 
@tylerl Yes. OpenSSL.
 
6:31 AM
does appengine have openssl?
cause that's just a shared lib
you just gotta declare that you're using it and its available
 
@tylerl I thought the only Python modules you can use are the ones listed here? cloud.google.com/appengine/docs/python/tools/libraries27
 
you can bring your own modules
thats just the list of modules they provide.
but there's nothing stopping you from installing modules as if they were part of your own code inside your directory tree
the only catch is that you can't use native code.
afaik
 
@tylerl Hmm, that may be a problem then.
Because pyca/cryptography uses CFFI, which dynamically builds a C extension against the OpenSSL shared lib at install time.
 
so it's not using pyopenssl to link to openssl
 
@tylerl Oh no, in fact pyopenssl is the downstream of the pyca/cryptography project.
 
6:41 AM
whats the use case where having it is important?
 
@tylerl For me basically having an actively developed crypto library available.
 
I could put in a feature request, but they take the security of the appengine platform pretty seriously, so stuff has to be properly reviewed and vetted and stuff, so you gotta have a good enough reason to convince someone to put in on their priority list.
 
@tylerl Well, PyCrypto (which they have available currently) hasn't been in active development for a long time now and the maintainer has been in discussions with us to merge the projects.
A lot of the Python ecosystem is now starting to use pyca/cryptography so it will be nice to have it available on GAE as well.
 
@TerryChia If that happens, then adding support for your project would essentially be rolled in to updating the pycrypto project?
 
@tylerl The idea currently is for PyCrypto to use us for their backend instead of their custom C code so projects relying on PyCrypto's API can still continue using it. Meanwhile we have our own (much nicer imo) API that many newer projects are using. The talks are still very early-stage but it looks like it's gonna happen since the current maintainer appears to be very tired of updating the project.
I'm not sure how the GAE team works; as an end user I just want to use my library on GAE. :P
Not a big deal but hey, since you are a Googler I thought I'd ask. :)
 
 
6 hours later…
12:44 PM
139
Q: Is this new flat theme mandatory or is there an option to change it back?

RomokuI noticed today that Stack Overflow has changed to a more flat UI. I have nothing against flat UIs, but I am used to the old theme and it is more visually appealing to me. Is there an option to switch between the old design and the new one?

I see that SE users are not exempt from complaining about any design changes to their favorite website.
 
 
2 hours later…
2:33 PM
I don't get the issue. I generally don't notice updates to themes on websites, because to me it is like advertising: Irrelevant. All I'm interested in is content.
Mostly
 
 
1 hour later…
3:41 PM
Face the nation is on. Everyone is blathering on about surveillance and I'm just sitting here wondering if I'll have a career
 
4:33 PM
@TerryChia I don't visit SO very often, so when I saw it was different a couple of days ago, I just thought there was something broken about the browser/cache/display driver, or something.
The new theme looks like the page had been printed out and scanned back in on poor-quality equipment.
 
@kalina I'm here now and then. Just not quite so much as I used to be. Work's been killer lately.
 
@TerryChia I don't like the new font (or more precisely, how it's rendered on windows). The kerning is bad, there is often no space at all between characters.
I don't care too much about the design itself, but readability matters.
 
5:15 PM
-1
Q: How to do Rijndael MixColumns step ? Plz Help?

Mahmood Al Ȝnezyam trying to go through all of the the steps in the Rijndael Encryption Algorithm ... when i multiply of a value by (02) , what if the leftmost bit of the original value (before the shift) is 0 not 1 ??

0
Q: AES MixColumns step ? pleas help

Mahmood Al Ȝnezy{d4}.{02} = 1101 0100 << 1 (<< is left shift, 1 is the number of shift done, pad on with 0's) = 1010 1000 XOR 0001 1011 (because the leftmost is a 1 before shift) ans = 1011 0011 now what about : {5d}.{02} witch 5d=01011101 here the lift most is not (1) .. how it's done ??

and
I'm not gonna comment on how great dane tag would be
 
Hello
 
6:23 PM
@TildalWave I don't think we need tags for different nationalities, not even Danes.
 
7:02 PM
I thought he was talking about dogs...
 
@CodesInChaos there's flags for that :)
@RoryAlsop Did you get to see the comet? Also the Venus and Mercury are pretty close and Mars and Neptune
 
7:48 PM
Last night was brilliant. Temperature dropped right down, clear night, best stargazing for agrees. Thought I was going to have to show the kids by navigating from Rigel and Aldebaran, but it was clear enough that the Pleiades were bright to the baked eye
Naked, even
 
@RoryAlsop nice typo :op
 
Typos! s/agrees/ages ... @RoryAlsop did you lie in your auto-correct settings how old you are?? :)))
 
8:03 PM
@TerryChia @RoryAlsop this isnt just a silly design change. This absolutely BREAKS the site. It's completely useless now, and 12 million other users are all agreeing with me.
 
@AviD yeah but it makes beta sites look awesome in comparison
 
@TildalWave @CodesInChaos I agree with @TildalWave. Until we see mutiple questions on that subject, there really is not a reason for the tag.
@RoryAlsop curious how difficult they would be to find considering how baked you were.
 
@AviD apparently, it was a brilliant night :)))
 
heh.
 
we call those days here
 
8:09 PM
speaking of readability, I've gotten insistent comments that one of my classic rules needs to be grammarized.
so, which is better:
> AviD's Rule of Usability: "Security at the expense of usability - comes at the expense of security."
> AviD's Rule of Usability: "Security at the expense of usability... comes at the expense of security."
> AviD's Rule of Usability: "Security, at the expense of usability, comes at the expense of security."
the comment....:
@AviD: A note on your (awesome) AviD's Rule of Usability: either there should additionally be a comma after the first word or, as I prefer it, there should be no commas in it at all. I think you intended the comma to indicate a pause, which is grammatically incorrect. In this case, try an en dash (with spaces), an em dash (without spaces), or an ellipsis (with or without spaces). Also, if you want attribution, you should probably put in this answer. Thanks! — Adam Katz yesterday
the issue is the comma. which I put in for clarity.
 
I shouldn't bother using the DMZ on mobile, should I.
 
@RoryAlsop nah, just stick to TMZ.
 
Regarding the theme change, I honestly do not know what the problem is... Or indeed what the difference is.
It looks like an SE site, and works just the same as ever
 
@RoryAlsop you probably dont even get it on mobile.
 
@AviD you realise of course the consequence of your rule which is that security will invitably suck until the Internet is completely unusuable without improved security :)
 
8:12 PM
Admittedly I'm only a 1K user over there so it's not one of my main sites
 
@RoryAlsop you should definitely do that more often
 
@RоryMcCune I do not accept that.
 
@AviD ah so you believe in the unicorn of usuability + security at the same time :)
 
usability is an inherent part of good security, just as security is inherent to good usability.
 
Maybe I should save used sparkly and clear rather than brilliant... But the stars were brilliant
 
8:13 PM
@AviD developer signing of code libraries
 
the fact that (almost) everyone sucks at it, just proves the strength of my rule.
 
improves security makes usuability (from the devs standpoint) worse
 
Unicorns are great. That's why they are our national animal
 
@RоryMcCune heh. nice counter example.
 
@AviD ungrammatical. If you use — (dash) instead of - (hyphen), still ungrammatical. A dash is like a parenthesis except that the matching parenthesis can be the start or end of the sentence, it doesn't work here.
 
8:13 PM
On that note, did we find any other countries who had an imaginary animal as their mascot?
 
@AviD grammatical but weird: the ellipsis isn't doing anything useful here
 
@AviD I've been looking into it recently for my next talk... loads of initiatives in communities to start it (usually after an incident) they never go anywhere
 
@Gilles I agree, it is too dramatic of a stoppage.
@Gilles concur.
 
Comma is fine
 
@AviD kids, don't try to take the meaning of this too literally
 
8:14 PM
@AviD grammatical but not what you meant: it means that security is always at the expense of usability in the first place
 
@Gilles I still think the single comma is best, but if its sooo ungrammaterical that its harming clarity, then I'm screwed.
 
Either put no comma at all, which is a bit hard to parse, or do what you did, which is grammatical
 
@Gilles right. It's a subtle, semi-confusing sentence (as all the best rules are) - therefore clarity is important.
 
Alternatively, make the sentence more verbose: “Security, when it comes at the expense of usability, comes at the expense of security”
 
8:16 PM
@AviD doesn't your rule fail the cyclic redundancy check?
 
See - mobile DMZ sucks
Chatsey is much better but won't let me upload stuff
 
@RoryAlsop sucks on iOS too
 
Like screenshots
 
@RoryAlsop android sux!
@Gilles blech
 
I vote @AviD keeps the phrase exactly as it originally was
 
8:17 PM
@TildalWave not at all!
 
me too
keep it as it was @AviD
 
On another note, snow!
 
heh. thanks all.
 
Yeah - very nice
 
@AviD my sentiment exactly
(and I hope T not WSS)
 
8:18 PM
@Gilles thanks. btw can you explain you said the single comma IS properly grammatical?
 
@AviD I'm sure that one of these threads explains it
 
dammit!
oo I should just ask there
 
english.stackexchange.com/questions/208248/… says it's incorrect but I don't think it's exactly the same case
english.stackexchange.com/questions/76850/… says it's incorrect in modern English but perfectly fine for 18th century English
 
Sorry, we only have 18th century Scottish here
 
@TildalWave - Modernist!
 
8:31 PM
Seriously though, why does an infosec meme have to be grammatically correct? Can't grammatiarists get their own memes?
 
^bit of a different rory (well Ruairi) accent for you
 
hahaha
@TildalWave I think its more a question of the overlap. Grammaitical infosecer having trouble grokking the meme because OCD :-)
@Gilles actually this one is much closer.
> Never separate the subject from its verb with a comma.
^ seems to be a repeated grammar meme, and is applicable here
dammit, its like kerning - once you see the problem, you can't unsee it.
 
Implications for us
We may need to revisit our thoughts on black hat white Hart
I still haven't fully thought this through, but it has some worrying points
@RоryMcCune - that is a very weird accent
 
8:47 PM
@RoryAlsop very N.Ireland that one
 
@RoryAlsop With all the attention they're putting on permuting the design to stackoverflow, you'd think they could put just a few minutes into fixing the design of the chat system on mobile.
 
Is it bad to literally leave a guide on how to find password for user as here: unix.stackexchange.com/q/179538/98945 - as he asked I found it better to show and tell then say nothing.
 
0
Q: Illegal Comma to Enhance Clarity

AviDA while back, I coined a well-known InfoSec rule: AviD's Rule of Usability: "Security at the expense of usability, comes at the expense of security." Recently I received a comment pointing out that usage of that single comma in this case is grammatically incorrect: [...] either th...

:-)
@RoryAlsop we're not all US-centric, yaknow
 
@AviD meh, I think it's just as good (possibly even better) without the comma
it's more poetic
 
hmm. Perhaps I should rephrase it as a haiku.
where's @LucasKauffman? he's our resident songwriter.
 
9:02 PM
"Security at the expense of usability comes at the expense of security."
yeah, without the comma it's pretty readable still
 
> Usability in a rule /
Security at the expense of usability /
At the expense of security it comes.
dammit I broke the haiku format too
 
Security at the expense of usability comes, at the expense of security.
 
I cant help it, this rule breaks all other rules
crap now I'm starting to sound like Taylor Swift
I need to go eat a gallon of ice cream and cry about losing my boyfriend. Oh and also the coming apocalypse.
Speaking of which, weather was nice enough to justify going out to the ice cream shoppe today. Delicious.
 
To combine the two topics of discussion, here's the Benjamin Franklin phrasing of AviD's law:
Those who would give up essential Usability, to purchase a little temporary Security, attain neither Uasbility nor Security.
 
and the short short version:
> Unusable security isn't.
 
9:11 PM
@RoryAlsop I don't know the extent of that law, but if it's that big of a change, it might mean that Security.SE can't be hosted in the US and would have to be moved to a jurisdiction with freer speech
 
@Gilles that is a saaaaad statement.
 
sec.se without questions about attacks, pentesting, etc. wouldn't be a useful site
 
@AviD oo a downvote. unexpected.
okay it wasnt at all unexpected, but VtC was.
 
> Security, when attained by the sacrifice of usability, itself is it own undoing.
--Ancient Chinese Proverb
5
 
heh. I sense a meta.sec.se meme post coming on.
All the different forms of this statement.
 
9:17 PM
> Be thou not secured but through an increase in ease-of-use.
Securitus 5:19
2
 
okay Imma starring them all
well, except for mine of course
 
Security blooms / But if not made usable / Security wilts
2
 
@Gilles nice! thats a valid haiku, and you even made it sound romantic.
Typical Frenchman.
 
@AviD What do you want haikued my striped friend?
 
@LucasKauffman Too late. Frenchie over here nailed it. Just like your mom.
@LucasKauffman We're talking about AviD's Rule of Usability.
 
9:23 PM
@AviD :o
 
There was a young lady named Swift
Who liked her security makeshift
But when she made it less usable
The outcome was quite terrible
And all her security went adrift
2
I probably got the meter all wrong, I can never figure that out
 
@Gilles pretty decent, though usable / terrible is a pretty terrible rhyme, though still usable.
 
@Gilles A haiku is a 7 5 7, three line poem, this is more a limeric
except you used AABCA instead of AABBA
 
@LucasKauffman usable rhymes with terrible. Sort of. That's kind of by design.
The rhyme is right, the meter's what I got wrong
 
@LucasKauffman yes, he did the haiku before.
like, literally 3 lines before you walked in.
 
9:29 PM
aaah now I see it
 
8 mins ago, by Gilles
Security blooms / But if not made usable / Security wilts
now he moved on to limerics.
 
sorry my bad
 
the point is to rephrase the Rule in all applicable structures.
@LucasKauffman go for the rap version
 
if (!usability(security)) fflush(security);
 
@user367890 nice! but that should be !usability...
 
9:34 PM
Should perhaps be a mmap variant.
Ah, yes.
 
FTFY
 
Sécurité sans utilisabilité
Compromet à coup sûr toute sécurité
That sucks. Alexandrins aren't made for 7-syllable words.
 
try some paracetamol instead.
 
Yo yo yo, this one is for my circumsized tiger man A to V to the ID.
Security is important you say, but without usability it will just be dissaray
Being a hacker OG from the block, I understand people will be in shock!
When they learn about my new scheme, to implement usable security, it will be as sweet as neapolitan ice cream!

You must know I don't rap about, drugs, bitches and sex, all I do is explore security specs
Implementing them into a nice website, it's what I do to provide people with insight.
3
 
LOL
you should try to get @Taylor to use those lyrics
okay now we just need @Iszi, as the official Scribe of the DMZ, to collect all these versions into a meta post.
 
ya lost me.
 
@AviD he's hacker/rapper
presented at Brucon and defcon
 
so I gathered
 
we should ask him
he should be better than me
 
oh jeez. I just got it.
@RoryAlsop I find it very symbolic that @WhiteHouse is officially going to start persecuting "black hats" tomorrow - on MLK Day.
Thats Martin Luther King, Jr., for those not aware of the significance.
 
10:01 PM
> or rewrite it, maybe starting it with usability
 
@TildalWave :-(
 
what, like "Usability at the expense of security, comes at the expense of usability"?
 
ignoring the fact that I explicitly stated that I prefer to not forgo the succintness, how would one rephrase that??
 
you don't
you kicked in the hornet's nest and expect succintness?
succinctness even
 

« first day (1494 days earlier)      last day (3407 days later) »