The DMZ

Polynomial

1:00 PM

the first four already make me want to jump around and punch people

Lucas Kauffman

@Polynomial more like if you include JQuery from the JQuery website rather than hosting it from your own domain

AviD

@Polynomial and that's really all you want out of your bands, right?

Polynomial

@LucasKauffman oh, yeah, that's different.

@AviD what the hell else would I want? :P

Adnan

I'm going probably only for Ensiferum!

AviD

@LucasKauffman thats not a vulnerability...

Polynomial

1:01 PM

@AviD It's more along the lines of something to keep in mind.

e.g. if you later switch to SSL.

AviD

true.

Lucas Kauffman

@AviD no but it remains a finding because it is against the policy

Polynomial

or if your content security policy changes.

AviD

@LucasKauffman really? thats odd.

I guess that also rules out all forms of CDN, too?

CodesInChaos

I'd love to see a way to embed external data where you specify a SHA-2 hash of the content

Rory McCune

1:02 PM

@AviD I'd say it's a weakness and possibly a vuln....

CodesInChaos

and it only loads if the hash matches

AviD

@CodesInChaos that would be cool.

Rory McCune

if the 3rd party domain gets compromised then it can compromise the site that your reviewing. So I flag it up to companies, as they usually don't consider it a risk

AviD

but it also means that you lose one of the big benefits - up to date versioning....

CodesInChaos

You could code it with javascript (Mega tried, but since they used CBC-MAC as hash, it didn't go so well)

Rory McCune

1:03 PM

it's also one that's been exploited in the wild with malvertisments

AviD

@RoryMcCune that would depend on your trust model.

Lucas Kauffman

@RoryMcCune it depends, it's more like if the server isn't under their own control, we recommend against it

Polynomial

@CodesInChaos That would rock if your browser had an internal implementation that did the job properly.l

AviD

@RoryMcCune that is true, but that is also different.

Rory McCune

@AviD yep but if you load javascript from a 3rd party domain you don't control they you're at their mercy

Adnan

1:04 PM

@RoryMcCune Gold! Very often missed.

Polynomial

@CodesInChaos I lol'd at their JS code. It was terrible.

CodesInChaos

I didn't look at their code.

Already didn't like their spec

Rory McCune

I'd love to say I don't see it a lot but I do. things like analytics scripts, tracking stuff advert stuff

Polynomial

It was quoted in one of the articles.

AviD

@RoryMcCune I agree, but it depends on who the 3rd party is.

arguably, you're already trusting them, as you use their code.

Rory McCune

1:05 PM

true if it's google then you're probably ok

Polynomial

oh shit, I didn't realise Winds of Plague have a new album I haven't heard yet

AviD

@RoryMcCune ehhh ;-)

Polynomial

in the meantime... RAISE THE DEAD \m/ (>_<) \m/

Rory McCune

@AviD ahh but you can audit the code once, if you ref it from their domain they can change it without you knowing

AviD

@RoryMcCune true, but do you?

Rory McCune

1:07 PM

@AviD well I'd recommend that people do it :) also the risk isn't just that the company you get the script off is malicious, it's that they get compromised

AviD

and everytime you take an updated version?

Rory McCune

If you think about it taking out someone hosting a javascript library could allow a compromise of thousands of sites at one

tempting target

AviD

@RoryMcCune potato, potato.

Rory McCune

@AviD ?

AviD

unless you're downloading new versions with SSL and hash checks, its irrelevant.

@RoryMcCune heh, I guess that doesnt carry when typed....

potAEtoe, poTAHtoe....

Rory McCune

1:09 PM

@AviD hmm not sure it's identical. If you update manually there's a chance that unless you do it on the day of release a compromised file will be noticed. the longer you leave updating the higher the chance that it will be noticed. If you hotlink you have zero time to notice...

AviD

@RoryMcCune thats a fair point.

while I say in most circumstances its enough to rely on crowd control and reputation, window of opportunity - or 0day equivalent - could trump that.

Rory McCune

not saying that people do enough checking. The way open source libraries is used these days is fairly scary, and if github ever gets compromised heaven help the ruby on rails crowd!

AviD

on the other hand, transferrence of risk is an acceptable risk management tactic.

Rory McCune

true

AviD

in most cases, I would tell them that the 3rd party code (assuming it is from a trusted source) should be reviewed and sandboxed, but at a much much lower priority than fixing their own damn code.

Rory McCune

1:14 PM

heh well yeah if they already suck it's just one more point, but sometimes (rarely) you'll see a good app that does it...

Adnan

Yaay! Now I know what Rory means!!

Polynomial

0

Q: Content hashes to help protect resources being fetched from a CDN

During a conversation in The DMZ, it was suggested that an SHA256 hash could be used to check that content being delivered from a CDN hasn't changed before being executed, similar to how Kim Dotcom's MEGA tried to do recently with CBC-MAC. The mechanism would be implemented at the browser level,...

Lucas Kauffman

dat moment when developers upload their bash history on github and it contains child porn...

Polynomial

@LucasKauffman wat.

Terry Chia

@LucasKauffman whaaaat...

Polynomial

1:19 PM

I swear The Bear must spend like 2 hours writing answers: security.stackexchange.com/questions/29686/…

@LucasKauffman srsly, wat.

Terry Chia

yeah, don't leave us hanging.

Lucas Kauffman

@Polynomial yea the new github search function revealed a lot more than planned

including mysql histories

and bash histories

Polynomial

:/

Lucas Kauffman

they found one developer with a bash history containing:

[–]Karlchen 65 points 13 hours ago
mplayer 6yo_Masturbate_Beach-watch-her-squirt\ kleuterkutje\ ptsc.avi
mplayer Pthc\ 9Yo\ Girl\ Orgasm\ 2\ Webcam\ (New\ 2011)(1).avi
mplayer Amber\ 7yo\ BJ\ and\ Butt\ plug\ Full.avi
and many more...
What the fuck? His full name and unique university log-on is in the log file too. How do you go about reporting that kind of stuff in the states?

It's on reddit

Polynomial

O_____o

Terry Chia

1:24 PM

@LucasKauffman link?

Polynomial

that's fucked.

Lucas Kauffman

reddit.com/r/netsec/comments/177g0c/…

2

Adnan

His repo was disabled

Polynomial

The. Actual. Fuck.

I can see that story making it into the security podcasts.

Terry Chia

Seriously, who pushes their home directories to git?

Polynomial

1:32 PM

actually, I'm gonna go submit it to a bunch of them for the lulz.

Lucas Kauffman

also beyond it being child porn

who watches porn using bash

Polynomial

haha

Terry Chia

@LucasKauffman hahaha right

Polynomial

lib-ncurses-mp4

ASCII rendering :D

Terry Chia

I need to get a good book on computer architecture. Any recommendations?

Well, doesn't have to be a book. Online resources will work fine.

Lucas Kauffman

1:35 PM

@TerryChia architecture hardware or software?

as in OS or Hardware

Terry Chia

@LucasKauffman Hardware - covering things like memory registers, CPU etc.

Lucas Kauffman

@TerryChia you want the technicalities behind from an engineering point of view?

@TerryChia I'm visiting Singapore somewhere in March btw

Terry Chia

@LucasKauffman Hmm. I'm not sure actually. I want to get in-depth into stuff like reverse engineering, shell codes and such. I want to start by learning the very low level stuff so I can wrap my head around the more difficult concepts.

Lucas Kauffman

@TerryChia Look at the books of Tanenbaum and Stallings

and the shellcoders handbook

Sadaluk

@TerryChia ftp.linux.org.ua/pub/docs/developer/general/cpumemory.pdf

Also, I'd go look at wiki.osdev.org

Once you start trying to explore how, for example, you'd load a process and manage its memory, everything else becomes pretty clear :)

If you need to know about Intel Opcodes, I think @poly has previously mentioned ref.x86asm.net/coder.html and the like - v useful.

Polynomial

1:46 PM

@Sadaluk yeah, that site rocks

Sadaluk

@Polynomial v useful :)

Polynomial

for buffer overflow stuff the CoreLAN exploit writing tutorials pretty much can't be beat

Sadaluk

@TerryChia Also, Agner Fog's stuff: agner.org/optimize

Polynomial

they cover everything from the basics to ASLR+DEP+SafeSEH bypass

Terry Chia

Thanks for the links guys, that will keep me occupied.

Polynomial

1:48 PM

oh, and I submitted that paedo story to ISD, LiquidMatrix and PaulDotCom

Sadaluk

As a side note, I own both "Hacking: the Art of Exploitation" and "Secrets of Reverse Engineering" - and I'm not sure I really benefited that much from them. They're well written, but for me a little too simple.

Polynomial

yeah, I found SoRE a bit simplistic.

Sadaluk

They're useful sometimes if I can't remember how to do something quite straightforward. I also imagine they'd be really really helpful for a beginner.

Polynomial

the Rev. Bill Blunden book about Windows Kernel and rootkits was great though.

Rootkit Arsenal

Sadaluk

@Polynomial Yeah. Actually the first part of that might be the best x86 introduction ever written in a book (that I've seen, anyway).

I'd buy it again for that section alone

Polynomial

1:52 PM

heh

it taught me more about winternals and rootkits than anything else ever has

a truly brilliant book

shame it's directly targeted at Vista rather than Win7

but other than that it rocks

Terry Chia

Anyone around here a full time middle school, high school or college student? :P

Adnan

2:07 PM

@TerryChia Here!

Terry Chia

@Adnan You might be interested in this: syscan.org/index.php/sg/securecoding/rules

Really attractive prizes.

Polynomial

some good talks at SyScan this year too

Adnan

Wow! Good money!

Polynomial

esp. the new XSS one from .mario (@0x6D6172696F on teh twitt0rs)

"The innerHTML Apocalypse - How mXSS attacks change everything we believed to know so far"

Iszi

Holy crap. 437 new lines since I left yesterday afternoon?! Y'all need to learn to STFU now and then.

Colin Cassidy

2:12 PM

@Iszi I know, people in the chat room, chatting, who-da-thunk-it

Terry Chia

I'm trying to round up a few friends to take part in it.

Tough though, too bad the timing coincides with a lot of my assignments.

Polynomial

@Iszi You start first ;)

Adnan

@TerryChia, very attractive. Sadly school + work.. too little time

Polynomial

@Iszi also, read the reddit link in the starred list on the right

Lucas Kauffman

2:24 PM

Have you tried adding Club Mate to the vending machine? See who is able to drink it. — Lucas Kauffman 38 secs ago

^ added that to the "how to lure a hacker" question

Polynomial

Club Mate is pretty disgusting.

Rory Alsop

@Polynomial @Iszi - but not at work

Lucas Kauffman

the only place I see people drink it is at cons

Polynomial

@RoryAlsop I read it at work. It's only vaguely NSFW text.

@LucasKauffman same.

it's more like SFWBNIYGACLAYS

Safe For Work But Not If You've Got A Client Looking At Your Screen

Rory Alsop

@Polynomial hahahaha - I'll need to wait until I get home. No reddit here

Iszi

2:29 PM

@RoryAlsop Well, crap. Thanks for the warning now.

Polynomial

here's a brief extract...

> Found that Pedobear while searching for "path:.zsh_history mplayer"

> feh 2011_vichatter_10y_chatting_naked_[redacted]_closeup_sound.mp4.jpg

> mplayer 6yo_[redacted]_Beach-watch-her-[redacted]\ kleuterkutje\ ptsc.avi

> What the fuck? His full name and unique university log-on is in the log file too. How do you go about reporting that kind of stuff in the states?

Lucas Kauffman

I bet it's for educational purposes...*not*

Iszi

@Polynomial Some of that "vaguely NSFW text" is NSFW enough that it might set off some web filters.

Lucas Kauffman

suddenly @Iszi was fired from his job

Polynomial

@LucasKauffman Yes, playing child pornography with mplayer is totally educational.

@Iszi good point.

Adnan

2:31 PM

Anybody here is into hunting? Sport shooting?

Polynomial

@Adnan I fire mah lazers.

that's about it.

Adnan

:D

Lucas Kauffman

@Polynomial Maybe he's studying to become a priest?

3

Polynomial

rofl

Scott Pack

Or performing investigations.

Polynomial

2:33 PM

@ScottPack with mplayer.

he's investigating what it'd be like to fap to cp.

Scott Pack

Fun Fact! In the State of New York it is illegal to view child pornography even as part of a child pornography investigation.

Polynomial

wait, what? how do they investigate?

Scott Pack

So what they have to do is rely on things like hashes of known files or non-visual analytics.

Lucas Kauffman

LOL

that's stupid

Polynomial

but at that point they can't even hash match it, because they can't know what hashes match real CP.

Scott Pack

2:34 PM

pretty much

Lucas Kauffman

@Polynomial as americans are americans, it's probably legal in another state, so they ask that other state to provide the hashes

Polynomial

so... all paedophiles move to New York now?

2

Rory Alsop

@Polynomial I'm assuming they rely on another state or the FBI

Lucas Kauffman

regardless it's a pretty retarded rule

Scott Pack

Presumably there exist agencies outside the State that either to do the validation or produce the comparison lists for the intra-State agencies to use for analytics.

@LucasKauffman NY has a bit of a reputation of legislation.

Remember, this is the same place that is trying to pass legislation regarding the size of soft drinks.

Polynomial

2:36 PM

ROFL... an email just went out at work that we're having a fire alarm test later, and someone just replied to the email with "PREPARE YOUR ANUS". I think he meant to send back a reply instead of a reply-all.

Scott Pack

@Polynomial So you guys went out for curry at lunch?

Polynomial

heh

Iszi

@TerryChia Reminds me of this: bash.org/?207373

Polynomial

@Iszi that was the first thing I thought when he said that :P

WORDS OF PRAISE FOR FISHFOOD

some guy on Twitter just complained that I didn't warn him about the link, and now he feels sick

Lucas Kauffman

@Polynomial tell him to quit crying like a baby

Polynomial

2:40 PM

my response: Your warning was two-fold: first, the URL started with "reddit.com". Second: I tweeted it.

5

@LucasKauffman Yeah, that'd probably be a good idea. Otherwise that GitHub guy might download videos of him naked.

Iszi

@Polynomial To be fair, the URL really started with t.co

Polynomial

@Iszi the human readable URL :P

Scott Pack

@Iszi Then you have a shitty client. Mine expands them out for display.

Polynomial

^

we have a Greg in our midst... I wonder if he's a Good Guy.

Iszi

@ScottPack Oh, no. I use the web interface. I was just commenting on Twitter's annoying habit of shortening every damn URL - even ones that are already shortened.

lynks

2:51 PM

have the securi-tay vids gone up yet?

Polynomial

not yet. I checked a couple hours back.

I'll bug Gordon later to see if he knows when they'll be up.

lynks

@Polynomial rgr

Terry Chia

3:08 PM

Ugh, can't decide if I should take part in the SyScan competition.

On one hand I already have a crapload of assignments to do, on the other hand it would be a great experience and the prizes the tempting as well.

lynks

@TerryChia a friend of mine has a team for the GitS 2013 CTF, the teaser round has ended, but the challenges are still online. I'm just looking at the "keming" challenge if you wanted something to do :P

Terry Chia

@lynks Heh. I already have a lot of stuff on my hands. Just trying to figure out which I should prioritize.

lynks

here: ghostintheshellcode.com/2013-teaser

MOAR CTFS!!!

CodesInChaos

nice name

Rory Alsop

Blog - Stack Exchange: 2012 Stack Overflow User Survey Results

Bethany Marzewski on January 25, 2013

In December, we launched our 3rd annual Stack Overflow Annual User Survey to learn more about our site demographics and user trends throughout 2012. Compared to last year, we received an even larger sample size this year with almost 10,000 respondents!

Here are a few larger trends we’ve observed over the past three years:

You like us…you really like us!

Since 2010, site traffic to Stack Overflow has grown by a whopping 261.7%! As if this weren’t enough, we’re also now the 86th largest global site, according to Alexa. Our crazy goal of breaking into the top 50 is looking less crazy! …

Terry Chia

3:16 PM

@RoryAlsop sql is a programming language?

Polynomial

@TerryChia It's a development language. Dunno about programming.

Rory Alsop

@TerryChia I didn't write it - I'm just the messenger

:-)

Polynomial

but the nomenclature is rather irrelevant to the point.

Rory McCune

@TerryChia weirder Jquery is a programming language as distinct from JavaScipt!

Terry Chia

@RoryMcCune Indeed!

Rory McCune

3:20 PM

and Given how easy it is to make a mess of things in JavaScript it has to be a bit concerning that that's the largest language...

Stack Exchange

Blog - Stack Exchange: 2012 Stack Overflow User Survey Results

Bethany Marzewski on January 25, 2013

In December, we launched our 3rd annual Stack Overflow Annual User Survey to learn more about our site demographics and user trends throughout 2012. Compared to last year, we received an even larger sample size this year with almost 10,000 respondents!

Here are a few larger trends we’ve observed over the past three years:

You like us…you really like us!

Since 2010, site traffic to Stack Overflow has grown by a whopping 261.7%! As if this weren’t enough, we’re also now the 86th largest global site, according to Alexa. Our crazy goal of breaking into the top 50 is looking less crazy! …

Terry Chia

@StackExchange ninja-ed by @RoryAlsop.

Thomas Pornin

3:42 PM

@Polynomial It took roughly 40 minutes, and I had breakfast simultaneously.

Lucas Kauffman

I just shat my pants seeing this

Terry Chia

@LucasKauffman You talk to your pants?

Lucas Kauffman

4:07 PM

@TerryChia I'm lonely sometimes :(

Polynomial

I have it on reasonably good authority that the ISD podcast guys will be mentioning the GitHub thing tonight.

CodesInChaos

ISD?

Lucas Kauffman

@Polynomial I have it on reasonably good authority that you are partially responsible for that.

Polynomial

ISD Podcast = InfoSec Daily Podcast

@LucasKauffman I have it on reasonably good authority that you are entirely correct.

Lucas Kauffman

is it a video or a radio cast?

Polynomial

4:15 PM

radio.

Lucas Kauffman

cause I still need something decent for in the car

Polynomial

isdpodcast.com

Lucas Kauffman

coolio going to download that for the morning and evening commute

Polynomial

ISD is a bit haphazard because they release EVERY DAY

so there's dead air and bad mixing and confusing rambling sometimes

but the content is generally pretty good

CodesInChaos

I'm not a big fan of audio/video to take in information. Information density is so low.

Polynomial

4:18 PM

I also listen to... PaulDotCom Security Podcast, Exotic Liability, The Southern Fried Security Podcast, LiquidMatrix Security Digest, Network Security Podcast, Risky Business, and the Social-Engineer.org podcast.

@CodesInChaos I listen to them to/from work mainly.

as you can tell, I have a reasonably long daily commute.

Lucas Kauffman

Polynomial

Exotic Liability and LiquidMatrix are my favourite two, I think.

Lucas Kauffman

@Polynomial how long are they?

Iszi

It's an interesting thing when an answer has as many up-votes as the question's negative score.

-6

Q: How is Shepard supposed to know how to make the final decision in Mass Effect 3?

Mass Effect 3 has, depending on certain conditions, up to three possible endings. However, when I reached the final decision point, I did not see anything that clearly indicated which actions would lead towards which ending. Certainly, I could have gone online and looked up a walkthrough to h...

mass-effect-3

Polynomial

@LucasKauffman it varies. some of them are pretty strict on timing - anywhere between 40m and 1h 15m depending on the cast. some of the others are highly variant, shifting from 30m to 2h 30m.

ISD podcast tends to be about 45 mins or so

LiquidMatrix is usually about 45m to an hour

Exotic Liability is infrequent but usually has super-long casts, up to 3 hours

Lucas Kauffman

4:21 PM

45 minutes is ideal

Polynomial

Social-Engineer.org casts tend to be about an hour or so

SFSP / NSP / Risky Business tend to be ~45 minutes

Lucas Kauffman

2

Polynomial

also, did I ramble too much in this answer? security.stackexchange.com/questions/29701/…

I feel like I might have repeated myself a bit. I dunno, I'm tired.

wanna give a decent response because it's a great question and I happen to be in a position to give first hand experience.

Lucas Kauffman

It's a good answer

Rory Alsop

@Iszi not sure why you got so many downvotes - maybe folks think it is obvious? Dunno - haven't played it, so just guessing

Iszi

4:25 PM

@RoryAlsop When you view it in light of the answer, it does seem a bit obvious. For me, playing it in-game the first time through, it wasn't quite so much.

Terry Chia

@Polynomial me likes black boxes with blinky lights :O

Polynomial

@LucasKauffman and don't bother listening to SecurityNow! by Steve Gibson. for obvious reasons.

unless you like "security" podcasts about hard disk defragging and endless SpinRite adverts.

and a presenter that has no idea about security.

(can you tell that I don't like GRC / Steve Gibson?)

Lucas Kauffman

@Polynomial Isn't steve gibson the guy who has as much understanding of security as my grandmother has?

Polynomial

pretty much.

he made a port scanner that doesn't actually scan ports

Rory Alsop

and it sounds like SpinRite doesn't really do what he claims as well :-)

Lucas Kauffman

4:34 PM

what is spinrite

Polynomial

yeah SpinRite is bullshit. its claims are bogus.

his disk recovery and repair software

Lucas Kauffman

gtg

car is fixed

Polynomial

which he pushes and advertises constantly

laters

he ranted and raved about raw sockets in WinXP too, claiming it'd cause a massive storm of DDoS traffic

which it didn't.

this one makes me laugh: radsoft.net/news/roundups/grc/20060123,00.shtml

Adam McKissock

Hey all

Polynomial

.o/~

epic typo in the 5th paragraph: radsoft.net/news/roundups/grc/20060121,01.shtml

Rory Alsop

4:43 PM

@AdamMcKissock afternoon

Polynomial

oh, wait, it wasn't a typo :|

heh, I was confused as to why they were talking about gay people in an article about AV stuff

Adam McKissock

Hey @RoryAlsop, whats up?

Rory Alsop

@AdamMcKissock the day is almost over - time to go catch a train in a mo, and head back out to the snow

@Poly - ouch, those radsoft articles don't really pull any punches do they

Polynomial

@RoryAlsop never.

they're good at being blunt.

Adam McKissock

@RoryAlsop Awesome, I'm just sitting in the uni hacking lab watching Equilibrium on the projector :P

Iszi

4:56 PM

@AdamMcKissock Awesome movie. Need to find a way to re-watch that sometime soon-ish.

Oh, sweet! It is on Netflix Instant!

(I've come to not expect that any great movies will be.)

Adam McKissock

@Iszi Yeah, I'm watching it on netflix with some of the other hackers :D.

Iszi

@RoryAlsop Damn. There's my irrational time zone jealousy kicking in again.

Adam McKissock

@Iszi timezone jealousy?

Iszi

@AdamMcKissock I live in EST. So, occasionally I get the feeling of "People who live in GMT are so lucky, they get off work right after lunch." or "Damn lucky people in PST get to sleep in until almost lunch time!". Of course, such jealousy is logically irrational because "lunchtime" (as well as any other time - time to go to work, quitting time, etc.) is relative to the time zone.

Adam McKissock

But then - you are asleep for another five hours after we get up...

Editing your post to make me look like an idiot!

Gaaaahhh!

Iszi

5:07 PM

@AdamMcKissock No. Just to further complete my thought.

Adam McKissock

hmmmm

suspicious

Iszi

@AdamMcKissock No, suspicious is if I abuse mod powers (not that I have any) to edit it after the timer would have run out.

Adam McKissock

The lack of mod powers would indeed make that suspicious

Iszi

@AdamMcKissock Nah, that would just make it extra-suspicious. Though it is still suspicious when a mod does it.

Adam McKissock

extra-suspicious? How many levels of suspicious-ness are there then?

lynks

5:14 PM

@AdamMcKissock 4

Adam McKissock

@lynks Define: suspicious

lynks

sus·pi·cious
/səˈspiSHəs/
Adjective

Having or showing a cautious distrust of someone or something.
Causing one to have the idea or impression that something or someone is of questionable, dishonest, or dangerous character or condition.

Synonyms
distrustful - doubtful - fishy - suspect - mistrustful

Iszi

@lynks No, 42 is the answer to ... everything. You should know this!

lynks

@Iszi please enumerate

Iszi

@lynks No. To understand the answer, you must first understand the question.

Adam McKissock

5:17 PM

@Iszi To understand the question, you must first understand the context.

lynks

@AdamMcKissock to understand the context you must first speak english.

Adam McKissock

@lynks Not if the question isn't being asked in english.

Lucas Kauffman

And to all of this I say boobies

3

lynks

combo breaker :(

Adam McKissock

lol

Iszi

5:35 PM

@LucasKauffman Hrm. I wonder...

Nope. 5318008 is not a multiple of 42.

Neither is 58008 or 8008.

lynks

@Iszi 0xb16b00b135 is though :P

Iszi

@lynks Wait... are you dividing that by 42(hex) or 42(dec)?

lynks

arg, no it isn't, my calculator just rounded it :(

@Iszi 42 dec

Iszi

@lynks What do you mean it just rounded? Looks right to me.

Oh, wow. You're right. Why would it do that and not tell you? CALC is an arse.

lynks

762 004 418 868 = 0xB16B00B134

Iszi

5:44 PM

That's it. We're now on a mission: Somehow, we must find a mathematical connection between 42 and boobs.

3

lynks

@Iszi rgr

Iszi

Okay, what the crap? I get the same rounding problem even in hex!

Adam McKissock

even in italics?!

Iszi

There's got to be a calculator that can handle larger numbers and decimals more gracefully than CALC. Anyone have suggestions?

Thomas Pornin

@Iszi dc

lynks

5:56 PM

@Iszi thought i had it, but rounded to 4 again. :(

Iszi

6:12 PM

@ThomasPornin ?

Thomas Pornin

@Iszi "dc" is a calculator software which is very common on Unix-like systems. It handles integers of arbitrary length and decimals up to an arbitrary precision. Also, it can convert between bases (hexadecimal is no problem for dc)

Iszi

@ThomasPornin ...and for Windows?

Thomas Pornin

@Iszi Cygwin

Iszi

@ThomasPornin That's cheating.

Thomas Pornin

It is possible that SfU comes with dc, too

Iszi

6:22 PM

Hrm. I wonder...

Ack. Excel sucks harder at math than Calc!

I tried to have it do a HEX2DEC conversion of B16B00B135 and it came up with a negative number.

lynks

@Iszi it probably truncated it to 32bits, 6b00b135 is negative :(

Scott Pack

@AviD I've had squirrel, but it's been a long time. Not much meat, but it tastes like chicken.

@AviD Do you know why it's not kosher?

lynks

wait, no it isnt

Iszi

@lynks ...and also very weird, unless you're some sort of alien or a quadruped.

lynks

@Iszi unless the default type in excel is 32bit signed, and it just tried to mash it in.

b16b00b1 is negative

Iszi

6:29 PM

@lynks I think you totally missed the fact I was humorously trying to call out your typo.

lynks

@Iszi its truncated little-endian :P

Iszi

@lynks What's that? A circumcised, native American dwarf?

Scott Pack

@Iszi Wow.

lynks

@Iszi :P

Iszi

I find it strange that it is so difficult to find a numerical representation of boobs which is also a multiple of 42.

Scott Pack

6:39 PM

Look for a picture with 21 women.

Iszi

@ScottPack I said multiple not factor.

Scott Pack

Does multiple require whole numbers?

Iszi

@ScottPack We're going with yes.

Scott Pack

> In mathematics, a multiple is the product of any quantity and an integer.

Iszi

@ScottPack An integer is a number that can be written without a fractional or decimal component.

Scott Pack

6:43 PM

@Iszi Right, so 42 is an integer.

Iszi

@ScottPack Aye

Scott Pack

The real question is whether .5 is a quantity.

Iszi

@ScottPack Oh. Well we're going with multiple as requiring two integers.

Otherwise, you can just about pick any number and say "yep, that works".

Scott Pack

Well sure, you can make any point you want if you arbitrarily redefine terms mid-discussion.

Iszi

Heck, even 13 would be a multiple of 42 then.

@ScottPack Read further in the article. It elaborates to show that when we say x is a multiple of y, then y is the quantity.

Scott Pack

6:45 PM

Ah, so it appears as though, for definitional purposes, the "quantity" is defined to be the reference number.

Iszi

Thereby whatever other number is multiplied by y to make the statement true must be an integer.

@ScottPack Yeah, I think you've got it.

I wonder what the conversion from base36 would be?

@ThomasPornin Can it convert between arbitrary bases?

We'd need at least base29.

Or we could use base20 if we were to say that A(base20) = 1(dec).

Thomas Pornin

@Iszi "dc" supports bases 2 to 16 natively. Since it is Turing-equivalent, it can ultimately support any base.

For Windowsers, if you have .NET 4.0, you could use PowerShell. PowerShell gives full access to the .NET classes, including the big integer support from .NET 4.0

Otherwise, try PARI/GP

PARI/GP

PARI/GP is a computer algebra system with the main aim of facilitating number theory computations. It is free software; versions 2.1.0 and higher are distributed under the GNU General Public License. It runs on most common operating systems. System overview The PARI/GP system is a package that is capable of doing formal computations on recursive types at high speed; it is primarily aimed at number theorists. Its three main strengths are its speed, the possibility of directly using data types that are familiar to mathematicians, and its extensive algebraic number theory module. The P...

Especially this: pari.math.u-bordeaux.fr/pub/pari/windows/gp-2-5-3.exe

Iszi

Y'know, if we brought pi into the picture, I think we could find some connection between 42 and cup sizes.

Ok, I've officially spent way too much time pondering this problem for the work day. Time to get back to actual work-like stuff.

Iszi

8:10 PM

Don't you love how games that simulate (to one degree or another) real-life conditions can generate some rather interesting question titles on Arqade?

Apparently Harvest Moon is particularly subject to this. Examples: Can I get pregnant? When should I go to bed? Do I need to eat to stay healthy?

My all-time favorite so far is from The Witcher 2: So I was out drinking last night... how do I remove a tattoo?

CodesInChaos

8:43 PM

@Iszi epic question

CodesInChaos

10:06 PM

WTF php is this supposed to be: openssl_public_decrypt

Jeff Ferland

10:23 PM

@CodesInChaos Looks like everything else in PHP I'm used to. mysql_real_escape_string (which is now deprecated...)

CodesInChaos

real_escape at least at a somewhat valid purpose

this one has the one and only purpose of shooting yourself into the head

you don't decrypt with public keys, and you don't encrypt with private keys. Unless you really know what you're doing, and you're doing something really weird

Jeff Ferland

@CodesInChaos > This function can be used e.g. to sign data (or its hash) to prove that it is not written by someone else.

So says the private_encrypt. Back to that old misleading statement.

Rory Alsop

10:55 PM

So @polynomial- tired to read the reedit thread but:reddit.com/r/netsec/comments/17a1ds/…

Transcript for