The DMZ

CodesInChaos

4:05 PM

I'll probably ask a "keep keys secure" question as well soon :)

AviD

@CodesInChaos the direct answer is "Yes, you should".

Terry Chia

@AviD hahahaha good one.

David

morning

Terry Chia

4:25 PM

I vote this the best answer on scifi.SE.

4

A: How did Sauron survive before the ring was created?

It's really a very simple answer: Sauron is made up of a life force, which before the ring was made, put him at 100% life force. He then decided "Hey, I can put some of this life force into a ring, and then twist it so that I have awesome super powers." So he did. Before you know it, he's going ...

AviD

@TerryChia Really? Haaaaaaave ya met @Thomas?

oh sorry, I read that as "... on SE."

my bad, ignore me, I'll go back to my diagrams now.

Terry Chia

@AviD hehe. Of course The Bear reigns supreme wherever he chooses to grace with his presence.

0

Q: Can double encryption with different key increase the security?

Encrypting the file using same encryption algorithm using different Keys can increase the security or not?

AviD

I believe you have appeased The Bear.

Terry Chia

It's probably a dupe of something somewhere. What a bunch of crappy questions we are getting recently.

AviD

@TerryChia I was gonna say...

Antony Vennard

4:30 PM

@TerryChia So tempted to youtube.com/watch?v=u8qgehH3kEQ

Terry Chia

@AntonyVennard hahaha.

AviD

@AntonyVennard but wouldnt it be cool if 2 people could work at the same keyboard at the same time?

Would make a lot agilistas happy...

@TerryChia that was a poke at Agile's XP, if you didnt catch it.

Antony Vennard

@AviD Actually this is one of the big problems with multi touch displays. Y'know like in the movies where an entire wall commands an army? Well current (as of 2009, when I last knew about these things) multi-touch displays can't tell whose fingers are making the instructions.

Terry Chia

@AviD I got that. ;)

Antony Vennard

So me, an imposter, would have all the same authentication as General Avi.

Terry Chia

4:34 PM

@AntonyVennard What?! It's 2013 and they haven't implemented fingerprint authentication into touch screen technology?!?!?!?!?!

AviD

@AntonyVennard shouldnt be too tricky to push fingerprint authentication to every multitouch operation....

Antony Vennard

@TerryChia Correct. Disgusting isn't it?

AviD

Dammit, @Terry!!

Antony Vennard

This was my realisation playing with a Microsoft Surface and realising I could win all the games by interfering with the other players' moves.

Cause the surface couldn't tell it wasn't supposed to be me.

AviD

@AntonyVennard yeah, my 7-year old discovered this on my phone. Joyful.

'course all tablets currently have the same issue.

but you're right, it shouldnt be a problem, it should be simple-ish to solve.

Antony Vennard

4:39 PM

Yep, zigactly. So whilst double hacking may be not quite so serious, multi user on the same input device is.

Iszi

@TerryChia It's not really a duplicate. At least, not of the one that's been proposed. But the answer to the proposed duplicate and this one are essentially the same. Does that make them technically duplicate?

Terry Chia

@Iszi I don't know about that. Ask a mod. @AviD. :P

Antony Vennard

@Iszi I'd go with no. Can I travel to pluto to live? and Can I travel backwards in time? Are different questions with essentially the same answer (no).

Although of course, questions which are simply variations of each other, e.g. "Is 2+3 5?" and "Is 2+4 6" eventually beg for the canonical Q&A "Is 2+x y?"

jrg

@TerryChia ohrly.

Iszi

@AntonyVennard Not the greatest analogy there, though. The questions we're looking at here could both be merged to "Does layering encryption enhance security?" and therefore encompass layering of different algorithms with the same key, same algorithm with different keys, or different algorithms with different keys, all in a single question.

And the answer is the same as it would be for any of those questions asked individually: It may make the likelihood of exploitation significantly lower, but it also greatly increases the complexity of implementation which in itself can become its own security weakness.

Antony Vennard

4:53 PM

@Iszi True. What I was trying to get at is "are they just formulaic reiterations of the same thing" or "are these two different ways of asking the same thing?" If the latter, then although it's kinda a duplicate, as I understood it we left these alone (at least, that's what done on SO) since actually, it's better for others looking for the same answer.

Iszi

@AntonyVennard I thought the whole close as duplicate function was specifically for others looking for the same answer - so why would it make sense to leave them separated under that premise?

Antony Vennard

Blog - Stack Exchange: Dr. Strangedupe: Or, How I Learned to Stop Worrying And Love Duplication

Jeff Atwood on November 15, 2010

As Stack Overflow grows — or any other Q&A site in the Stack Exchange network, really — there’s a natural pressure to discover and link duplicate questions. The more questions you have, the higher the possibility a given new question isn’t in fact a new question, but a duplicate of an older existing question. Because of this, we’ve continually enhanced the tools for finding, linking, and merging duplicate questions:

Handling Duplicate Questions Linking Duplicate Questions Improved Question Merging …

AviD

@Iszi how is it not the same?

Antony Vennard

It's really a question of whether these are beneficial duplicates in the sense Jeff describes, or not.

AviD

"I encrypted with X, should I now encrypt with X||Y".

Antony Vennard

4:57 PM

Remember, as an answerer with a full understanding of the material you can look and see "oh yes, same thing" but an asker might not have that knowledge.

AviD

I dont think it matters if the 2nd algorithm is the same as the first, or a different one.

Antony Vennard

But I've not really looked at the questions all that hard, so, I can't say for sure either way.

AviD

And I am quite pleased when questions like that get closed pretty quickly without mod interference.

Antony Vennard

And now, HOME TIME!

AviD

to paraphrase:
"Should I encrypt twice, using the same algorithm?"
"Should I encrypt twice, using any algorithm?"

Antony Vennard

5:00 PM

@AviD formulaic looking, then.

AviD

the first (newer) one is a direct, complete, clear and obvious subset of the second (original) .

Scott Pack

I prefer to encrypt all of my files 3 times. If it was good enough for DES then it's good enough for me.

Antony Vennard

@AviD Yep, dupe-close I vote for.

Now, really home time.

AviD

@AntonyVennard too late, I missed it too.

@ScottPack if you wanted to be pedantic, and I know you always do, Triple-DES usually encrypts twice, with a decrypt in the middle.

Though that is not always the case, I've learned that it is the preferred way.

Scott Pack

Keep your truth out of my jokes. Bitch.

Iszi

5:02 PM

Like I said, the *answer* is the same but the questions are not. We have:

"Should I encrypt twice, with different algorithms?"
vs.
"Should I encrypt twice, with the same algorithm but different keys?"

AviD

"You got truth in my jokes!"
You got jokes in my truth!"

"MMMMMM"

Scott Pack

wot?

Iszi

Neither is a subset of the other - in fact, they're mutually exclusive.

AviD

@Iszi the original did not emphasize different algorithms, though it did allow for it.

►

Iszi

@AviD Actually, it did.

Scott Pack

5:03 PM

That looks terrible.

Iszi

> I've occasionally read the suggestion to enhance security by either doubling up on encryption algorithms (encrypt a message once with one algorithm, then encrypt the ciphertext again with a different encryption algorithm) or by periodically cycling through a list of encryption algorithms.

At no point did it ask for anything regarding double encryption with the same algorithm, or even make a request that would bring that in-scope.

AviD

@Iszi hmm. I think I misread the "or" option there about cycling.

at this point I might not have mod-closed it, but seeing as I did not and the community did, I dont feel strongly enough about it for a modveto. Feel free to make your reopening case, though.

Iszi

@AviD Yeah, he's talking about cycling algorithms, not keys.

@AviD Since there would be no appreciable difference in the answer, I'm not sure I'm motivated enough to give it a reopen vote. I've already stated my case in comments.

AviD

It is possible to misunderstand, and think that one is about protecting against a broken algorithm, and the other is about stronger keys / against brute forcing.

I'm not even sure the answers are strictly the same.

Iszi

@AviD Either way, you're still getting protection at a much higher risk of screwing up implementation.

AviD

5:08 PM

double encrypting with the same algorithm and 2 keys is basically just having a longer key.

@Iszi that part is true, but the cryptobits may be different.

Iszi

@AviD I'm not sure I understand. It seems sort-of right, but not quite, to say "Encrypting with one 128-bit key gives exactly the same protection as two rounds of encryption with different 64-bit keys." Could you clarify?

AviD

@Iszi I meant, from a brute-force perspective, which is really the only reason to do this (I think).

Thomas Pornin

@AviD Actually it does not live up to this premise

AviD

@ThomasPornin yeah, I was about to say.

3DES keys being a perfect example of the problem.

ala meet-in-the-middle.

Thomas Pornin

If you do double-DES with two 56-bit keys, you do not get 112-bit protection, but something like 57-bit protection.

Iszi

5:11 PM

@AviD There would be one other reason to do it, but it's more against insider threats. Think of a nuclear missile sub, where the Captain and XO each have a key and both are required to launch a nuke.

AviD

so it IS strictly longer, just not as longer as you might expect.

@Iszi ah, this is split knowledge / dual control you speak of.

Iszi

@ThomasPornin Is that due to the algorithm specifically though, or is it the same across all?

AviD

you dont strictly need 2 keys for that, but it would make it easier - though not as secure.

Iszi

@AviD How not as secure?

AviD

@Iszi as I understand it, any algorithm doubling is subject to meet in the middle.

Iszi

5:12 PM

(And secure against what?)

AviD

@Iszi because as @ThomasPornin said, 2 keys are not twice as strong as one key. Which means, if I have one of the keys, the other key is not as strong protection against me as you would expect.

@Iszi malicious insider, of course.

Thomas Pornin

@Iszi Actually it is not algorithm specific. If you encrypt with algorithm 1 and key 1 of size n1, then algorithm 2 and key 2 of size n2, then, meet-in-the-middle attack has effort 2^n1+2^n2 in CPU, and about n1*2^n1 in space

AviD

the whole point of SK/DC.

@ThomasPornin n1*2^n1 ? How come n2 isnt relevant?

Thomas Pornin

@AviD I implicitly supposed that n1 <= n2

otherwise, switch

i.e. n2*2^n2 if n2 < n1

AviD

@ThomasPornin ah. You know what they say about when you implicitly suppose.

Thomas Pornin

5:16 PM

@AviD Yes. I blame @Scott.

2

Iszi

@AviD I'm not sure that's quite right. Just because you only have 1 bit of difference in protection between insiders vs. outsiders doesn't mean that there's only 1 bit that an insider needs to attack. Or does it?

AviD

@Iszi of course (I think). but it does mean there is only that one key worth of protection, not two.

Iszi

@AviD Yes, but if that one key is only one bit shorter than the effective protection against outsider threats is the difference really that big of an issue?

Thomas Pornin

@Iszi No, indeed. Bits don't always add up that way.

@Iszi Let's say it otherwise: if you cascade two algorithms with distinct keys, then encryption is at least as strong as the stronger of the two -- but not necessarily much stronger.

You can use double-encryption if you fear that one key could be compromised, but not both.

Of course, double-encryption means double-cost, so that can prove expensive.

Cases of partial compromise may make sense in dual-control situations, but that's not a really common scenario.

Iszi

@ThomasPornin We're primarily discussing double-encrypting with the same algorithm but different keys. And, in the case of what @AviD calls "split knowledge / dual control" you not only fear that one key could be compromised, you "implicitly suppose" it is.

AviD

5:22 PM

@ThomasPornin actually, it has become much more common as of late - there are regulations that explicitly require it, in some situations.

e.g. PCI-DSS.

not so much the compromise, but the requirement to support and administer dual keys.

Thomas Pornin

@Iszi When I say "two algorithms" I do not say "two distinct algorithms". Whether they are the same or not is not important (unless it is a weak algorithm, in which case you should not use it at all).

AviD

@ThomasPornin @Iszi HA! see? That's what I was saying originally.

CodesInChaos

Double encryption is somewhat like increasing the number of rounds

so it probably makes cryptoanalysis harder

AviD

@CodesInChaos and the key length.

@CodesInChaos but not as harder as you would expect. I.e. not twice as hard.

Iszi

So I think what this all is saying is that double encryption really isn't that worthwhile if it is solely for protection from outsider threats - or at least it is not as valuable as one might naturally assume. Its only real and practical use is in "split knowledge / dual control" scenarios.

Thomas Pornin

5:25 PM

@AviD "twice" in the logarithmic sense, of course. So "not squared as hard" (if that was English)

CodesInChaos

I don't care about the increase in key size. I'd derive the individual keys from a single 256 bit master key anyways

AviD

@ThomasPornin heh, yeah.

Iszi

@CodesInChaos The problem is the protection wouldn't be equal to the whole master key.

AviD

one bit IS twice as hard, but not twice the difficulty. WHAA?

Thomas Pornin

8

A: Will double encryption increase the security of cipher vs bruteforce?

First point: there is a practical security increase only if both encryption algorithms, taken alone, would be independently vulnerable to exhaustive search, i.e. by using too small a key. That is the main issue, and it is better to fix that. Exhaustive search works only up to the key sizes such t...

everything is there

CodesInChaos

5:26 PM

@Iszi Assuming the individual keys are 256 bit as well, the combination still has 256 bit security, but higher resistance to cryptoanalysis

AviD

@ThomasPornin huh. @Iszi that is arguably a much more complete dupe than what it was closed as.

CodesInChaos

Traditionally I recommended salsa xor AES-CTR

but recently I've considered first encrypting with salsa, and then with AES-ECB (yeah really)

AviD

love this:

Doubling (or tripling) algorithms is like a pegleg: it helps you keep upright if you had the misfortune of losing a leg; but, if possible, it is better to keep your two biological legs.

Iszi

@AviD I don't disagree.

@CodesInChaos Wait, so you're saying you'd use the whole master key for the individual keys and just fiddle around with the sequence?

CodesInChaos

I'd plug the master key into HKDF and derive 2 keys

which I'd use for the individual ciphers

with a 256 bit master key, and 256 bit derived keys

Iszi

5:32 PM

So, the point still becomes that two rounds of encryption with 256 bit keys are not as strong as a single round with a 512 bit key - so why not just do the latter, unless you have special requirements (i.e.: split knowledge/dual control)?

CodesInChaos

Larger keys are inconvenient, and brute-force is already meaningless for 256 bit keys

Iszi

@CodesInChaos How inconvenient? If we're talking about 256 bit keys already, we're not expecting any human to read or enter it.

CodesInChaos

this kind of double encryption is against advances in cryptoanalysis

TildalWave

Morning all! :) I have two questions: 1) is the link to DMZ removed from the main Sec.SE page (list of questions), or do I have problems with my browser again (for which I've tested somewhat by disabling plug-ins), and 2) why is there a bounty on a question that was answered so good by @ThomasPornin before and also accepted? Am I missing something or is that just an up-voting strategy?

Iszi

@TildalWave Chat should be right next to review, which is right next to your badges, which are right next to your username. On the other side of chat are, in order: meta, faq, search.

TildalWave

5:36 PM

OK... question 1 solved, it's now back LOL

Jeff Ferland

@TildalWave I still see it on the right side of the front page

Iszi

@JeffFerland Oh, and there's that too.

TildalWave

@Iszi I know, but I meant the direct link to DMZ... it wasn't there a moment ago, now it's back... sorry to bother with that

Jeff Ferland

@TildalWave 2) For whatever reason the asker wanted more. shrug

Iszi

@JeffFerland Actually, based on the bounty description, it seems the asker wanted to give more. Not that @ThomasPornin needs it.

TildalWave

5:38 PM

@JeffFerland OK, humor me, what would these be? :)

Jeff Ferland

@TildalWave I have no idea why they posted it. None at all.

@Iszi Yeah, here, let me pour more votes down the full pipe.

Thomas Pornin

@TildalWave I did not ask for it and there is no proof (yet) that the bounty is meant for me.

Rory McCune

@TildalWave weirdly for me today the box on the right is sometimes present and sometimes not.. I was about to raise it as missing but then a page refresh brought it back...

TildalWave

@RoryMcCune yup someone is fiddling with the layout

Rory McCune

@TildalWave indeed is gone for me at the moment.. hope they don't ditch it altogether, the link on the top bar isn't really obvious enough on it's own..

TildalWave

5:42 PM

@ThomasPornin well nice of OP to offer it either way he decides to distribute it, I just find it rather odd as neither you nor Anthony Vennard seem to be missing any rep, especially given how much of it OP has LOL

@RoryMcCune well I'm old and I don't like changes, that means I have no advantageous experience any more which I find rather disrespectful to say the least

Iszi

@ThomasPornin Did you deliberately exclude cold-boot attacks from your write-up on passwords in memory? I found that odd.

Adnan

@TildalWave Morning

@RoryMcCune Yup, same here

TildalWave

6:01 PM

i.e. "you don't fiddle with the core" :)

Thomas Pornin

@Iszi That's because I don't find these attacks very serious.

To be able to run these attacks, the attacker must have a lot of control on the physical machine, at which point he has already won.

Jeff Ferland

First order of business in the new job: Hire 100+ top-tier security consultants. If you like & are good at problem solving, reply ASAP.

Tweeted by Wh1t3Rabbit on March 14, 2013 at 3:45 PM

Rory McCune

6:26 PM

@JeffFerland heh I'm getting old and cynical. Looking at his timeline they want top talent business focused but people who aren't primarily motivated by money....

large corporates (who are motivated by money) who want staff who aren't motivated by money...

4

Jeff Ferland

@RoryMcCune Yeah, I read that. But I've talked with him in the past and until I know otherwise one way or the other about it, I'll assume he's just filtering out people who go, "There's money in security!" Of course there's money in our field. We want you to be good at it, though.

I've got a friend who expressed interest in that, so I'll see if I can track how the process goes for him.

Rory McCune

@JeffFerland yeah interesting to see how large co's approach sec consulting compared to the boutiques. In testing in the UK the people who seem to attract the best testers are smaller dedicated testing co's..

Jeff Ferland

@RoryMcCune That will probably play out to be the case here, too. I am curious, though.

Rory McCune

what would put me off ever working for a large co. again is the bureaucracy . meetings and paperwork always seem to proliferate in big co's

Scott Pack

6:48 PM

And public employment!!

Rory McCune

@ScottPack yeah any large organisation.. only decent company I worked for in that regard was a pen testing co. As long as you did your tests on time and the customers were happy they never bothered you :)

Scott Pack

How can you possibly know if they value you unless they require you fill out a paper form to report your vaca time in hourly increments and 5 forms, hand delivered, an hour training, and a quiz in order to receive a company spending card with a $500 limit?

Rory McCune

7:06 PM

@ScottPack <shudder> takes me back to doing performance reviews at the bank where we both knew the outcome 'cause there was no money for raises but we had to do the process anyway

or being told that I only "met expectations" 'cause they had high expectations of me

Scott Pack

coughs

Rory McCune

hey what happened there I missed it!

Stack Exchange

Scott Pack has added Rory McCune to the list of this room's owners.

Scott Pack

II wonder if you can now, per chance, see deleted posts?

Rory McCune

lol I can and did, see now :)

Jeff Ferland

7:19 PM

@RoryMcCune Sounds like you're not considering that you might be paid less.

Rory McCune

@JeffFerland well I've never had that happen to me, in the banks a pay cut would be unlikely except when they do the delightful "it's a re-org and everyone has to apply for their own jobs again" thing

Scott Pack

I would find that process rather stressful, I'm sure.

From where I'm sitting that is sure fire proof that they want to clean house.

TildalWave

You three realize there's easier ways of conveying secret messages between each other, right? I mean... you're supposed to be experts on that! :P

Rory McCune

ou'reyay ightray owhay ouldcay Iway avehay orgottenfay ethay
ecuritysay ersonspay ecretsay odecay..

@ScottPack yeah I avoided it at the banks, but some of my friends had to apply for their own jobs 3 times!

it was brutal

Scott Pack

Funk that.

Rory McCune

7:29 PM

indeed

Scott Pack

That's true. There is google talk.

But I'm already typing in this window

I wonder when they'll cancel GTalk for being too under utilized.

Rory McCune

@ScottPack probably, I mean you can just use Google plus instead

Scott Pack

I have to say, I'm not sold on the new compose format.

Xander

@RoryMcCune Or Orkut. They haven't canned that yet.

Rory McCune

@Xander really wow, I've not heard of that in years!

Jeff Ferland

7:31 PM

@Xander I guess that's successful in Brazil.

Xander

@RoryMcCune LOL! I know! @JeffFerland Yeah, and I think India as well, IIRC.

Maybe it is just Brazil.

Scott Pack

Same diff.

TildalWave

@RoryMcCune histay siay tandardsay odecay erehay ¿ eemssay ddoay otay ebay singuay bscurityoay nlyoay henway tiay siay osay rownedfay pponuay ollay ¿

i.e. the only good thing about it is that it makes me stfu for a bit longer while :)

Rory McCune

@TildalWave aitWay youyay'eray ayingsay isthay isnyay'tay ecuresay ..... Ohyay Shay*tay ... ;opyay

ahh you need online translation <ahem> encryption services

TildalWave

@RoryMcCune no i got it lol, problem is i'm already slightly ciscelsid and letter-shift comes natural as it is

your code is basically how i write things before spell-checking kicks in :)

*should be "cixelsyd" sry

AviD

7:52 PM

@RoryMcCune and dont forget the politics.

Rory McCune

@AviD yeah that too, although I've seen nasty politics in really small co's two.. freelancing FTW on that score anyway...

AviD

@RoryMcCune oh yeah baby!

Rory McCune

@AviD reminds me I need to go send out some invoices...

AviD

But I dont just mean nasty dysfunctional politics, I mean in the strictest sense, of group sociology.

@RoryMcCune yeah...umm.. best part of freelancing... NOT

@RoryMcCune damn scottish accent

sorry, I should say "brogue"

Rory McCune

@AviD what's shoes got to do with it ;op

AviD

7:57 PM

Brogue

The term brogue ( ) generally refers to an Irish accent. Less commonly it may also refer to certain other regional forms of English, in particular those of Scotland or the English West Country. The word was first recorded in 1689. Multiple etymologies have been proposed: it may derive from the Irish bróg ("rough or stout shoe"), the type of shoe traditionally worn by the people of Ireland and the Scottish Highlands, and hence possibly originally meant "the speech of those who call a shoe a 'brogue'". It is also possible that the term comes from the Irish word barróg, meaning "a hold (on ...

o_O

Rory McCune

Brogue shoe

The Brogue (derived from the Gaelic "bróg") is a style of low-heeled shoe or boot traditionally characterized by multiple-piece, sturdy leather uppers with decorative perforations (or "broguing") and serration along the pieces' visible edges. Modern brogues trace their roots to a rudimentary shoe originating in Scotland and Ireland that was constructed using untanned hide with perforations, allowing water to drain when crossing wet terrain such as a bog. Brogues were traditionally considered to be outdoor or country footwear not otherwise appropriate for casual or business occasions, but...

see it's great how weird english is as a language

AviD

those are actually related, apparently.

Scott Pack

I've never heard those called brogue. How strange.

Iszi

8:30 PM

It's a shame you can't have an ISO 8601 Pi Day.

Well, I guess technically you could but none of us are going to be around to see it. For that matter, I wonder if anyone will...

AviD

@Iszi you can, and you can eat it too.

@ThomasPornin your awesomeness has been requested. I agreed to loan you out, temporarily.

0

Q: Theory about software communications mixing up with other software causing an Apocalypse?

I can remember a very Very long time ago (pre Y2K) , reading an article by some "expert" that theorized that software communicating over the internet, especially video games could get mixed up with Military communications meaning that a user could inadvertently mobilize a B52 nuclear bomber with ...

communication theory networking games

@Iszi what date would that be?

Iszi

ISO 8601 Pi Day will be on...

314,159,265,358,979,323,846,264,338,327,950,288,419,716,939,937,510,582,097,494,459,23,078,164-06-28

Seems like that might be beyond the heat death of the universe, or something.

Scott Pack

Clearly you need a new calendar

Iszi

Ack. There's a typo there.

(Just a mis-placed comma)

AviD

why not on (20)31-4-15 ?

Iszi

8:36 PM

@AviD Because you can't omit higher-significant digits.

And it has a 4-digit minimum for the year.

Ok, the proper notation with commas would be...

31,415,926,535,897,932,384,626,433,832,795,028,841,971,693,993,751,058,209,749,445,923,078,164-06-28

Thomas Pornin

@AviD On it.

Iszi

Of course, ISO 8601 doesn't allow for commas in the year - I just put them there for readability, even though the number is well over the scale of a Vigintillion.

AviD

@Iszi of course you can. Never heard of Y2K??

Iszi

@AviD And that's why ISO 8601 forbids it.

AviD

Damn them!

Iszi

8:50 PM

So, it looks like the next ISO 8601 Pi Day would contain probably well over 100 digits of pi.

AviD

@ScottPack and any other coffee enthusiasts (or anyone with an opinion or scientific knowledge) - what type of coffee maker is the "best"? Auto-Drip / Pour-over Drip / French Press / AeroPress / Instant (I'm kidding on that one)

Scott Pack

@AviD It depends on what you want.

AviD

@ScottPack Coffee. Excellent coffee.

Scott Pack

I use auto-drip because it generally produces good enough coffee and is a helluvalot easier.

French Press, is generally accepted, to provide the best output.

It also gives you the most fine-tuning for water temperature and such.

AviD

Just found a coffee boutique just up the block, some exotic-ish coffees. Figure its time to upgrade my coffee routine, not sure what type to get.

Scott Pack

8:52 PM

You need to be very conscious of your grind, though.

AviD

@ScottPack French press is better than drip?

Scott Pack

French Press requires a courser grind, and you will still end up with some sludge in your cup.

AviD

@ScottPack sure.

Scott Pack

You can also buy a higher priced drip machine and still get pretty good coffee.

AviD

how much noticable difference is there between grinding immediately before brewing, as opposed to buying it freshly pre-ground once a week?

Scott Pack

8:54 PM

Good coffee really comes down to water temperature and appropriate grind/steep times.

That will depend heavily on your palate.

AviD

and the bean, of course.

Scott Pack

As long as you store the grounds properly, I don't really notice much of a difference over the course of a week.

AviD

hmm, sure makes it easier. Less geek cred, though ;-)

coffee geek, obviously.

thanks! now I get to experiment and taste coffees from all over the world.

:P

Xander

@Avid LOL! The real coffee geek cred comes from roasting it yourself. (I know someone who does that.)

AviD

So this boutique, my neighbor and a few friends just really love their coffee. So they started importing all kinds of fresh beans and doing the roasting themselves... and then turned it into a nice little business.

Scott Pack

8:57 PM

So about a 3rd of the coffee bean is water soluble. Of that the different components extract at different rates.

AviD

Helps that a lot of my neighborhood is a bit on the yuppie-side.

Iszi

Wow. The year for the second ISO 8601 Pi Day would be over twice as long as the first.

Scott Pack

For ease of conversation let's divide those dissolved solids into 3rds.

The first 3rd to dissolve out is rather bitter and not all that tasty. The last 3rd is also rather bitter and not that tasty. The middle 3rd, however, is fantastic. That is the stuff you want.

Iszi

But there's only 13 digits more 'till the next.

Scott Pack

So when you brew you want to make sure that you extract out as much of the first 2/3rds of water soluble materials as possible. That's why the grind/time relationship is so important.

Xander

8:59 PM

@Avid That's great to have a nice boutique. It's really fun to try out new coffees and find tasty new varieties and roasts.

AviD

@Iszi sshhh, coffee talk now.

Scott Pack

A fine grind has gobs of surface area and will extract like nobody's business. A course grind much less so.

AviD

@Xander yeah, I wasnt going to - I enjoy a good cup of coffee, but I'm not really a coffee snob - but his site just makes everything look and sound so enticing.

@ScottPack yeah, reading up on all that now.

Scott Pack

So if you put a super course grind in an espresso machine the water that comes out will be slightly tinged with brown, and will taste pretty dodgy. You didn't get all the good stuff.

AviD

hmm. Perhaps I should go for the espresso machine.

Scott Pack

9:01 PM

Similarly, take espresso grind and put it in a french press? You'll end up extracting every possible solid from that bean, 2/3rd of which is really bad tasting.

AviD

Add in milkwhipper for cappuccinno...

Scott Pack

So you'll have a pungently strong cup that will taste exceptionally bitter.

Xander

@Avid Espresso is a really dark roast, which isn't what you want for enjoying the flavor of the beans.

AviD

heh, I knew you'd be the bloke to ask :-) Thanks!

Scott Pack

Espresso machines are also hard.

AviD

9:03 PM

@Xander it depends, some beans are better dark roasted.

Or so they say.

Scott Pack

You have to put just the right amount of grounds in, then pack it down using a tamper. Just like a pipe the pack has to be just right or else it'll suck.

Xander

@Avid - I'm not a coffee snob either. I don't drink a lot and I tend to make instant because I'm too lazy to make anything else these days, but I really enjoy good coffee when I get it.

Scott Pack

Then crank that pot down on the machine. Those things actually have pumps inside to force the water through the grounds.

Then you have to dispose of the puck, which can make a huge mess.

AviD

@Xander exactly me.

Scott Pack

We have a little single serving espresso machine at home. My wife used to manage a coffee shop and has a good feel for all this stuff.

We use pods

AviD

9:05 PM

@ScottPack hmm, yeah, I guess if I were to go espresso, I would have to get one of those slick auto-makers .

Scott Pack

amazon.com/Lavazza-Gran-Crema-Espresso-Single/dp/B000SDO5YQ

AviD

yeah, with pods.

but I dont want that.

Scott Pack

French Presses are nice, though. They're stupid easy, small, and it has a very nice ritual associated with it.

AviD

I guess I'll be going with french press...

Scott Pack

They're also the cheapest of all the options.

A respectable auto-drip will run you in the neighborhood of ~100. Same with the lowest scale espresso machines.

A French Press? 30 max.

AviD

9:07 PM

they have a variation they call AeroPress. seems similar to the french press, just a bit more controlled, less work. Might go with that.

this: aeropress.com

Scott Pack

I'm not familiar with it

Oh shit. Gotta run

AviD

it looks pretty cool, comparable with the French.

@ScottPack later then. thanks.

Xander

@Avid Yeah, that looks like a French Press but with less hassle.

2

A: Theory about software communications mixing up with other software causing an Apocalypse?

This scenario of "nuclear apocalypse by inadvertence" would require some inordinate incompetence at some point. Namely, we can imagine a buggy router which mixes some packets together, and sends the wrong packet to the wrong destination. And then, inexplicably, the military system which receives ...

I particularly like this analogy: "it's like being crushed at StarCraft, when your opponent is a cat who decided to take a nap on the keyboard; it is very embarrassing"

3

AviD

@Xander yeah, seen it. Not disappointed.

Xander

@AviD LOL! The Bear never disappoints.

Antony Vennard

9:27 PM

@Xander Even if that question were possible and the attacker got into the PC controlling the nukes, they clearly haven't thought of the inevitable:

And damn, good luck if you can find 64-bit drivers.

AviD

hehe, you should add that to @ThomasPornin's answer.

so @ScottPack do you have a preferred bean?

Or regional...

Antony Vennard

@Thomas feel free to use the above image. I took a hasty screenshot from a running windows vm.

Xander

@AviD I know you didn't ask me, and I've been trying to resist, but I simply can help offering my opinion. It's a personal failing. My all-around favorite is Sumatran. I also like Kona when I'm in the mood for something milder, and Kenyan, when I'm in the mood for something really big and bold.

@Avid and I typically like a light-city to city roast. I feel like that gives me the most bean flavor with just a bit of roasty bitterness.

AviD

9:43 PM

@Xander Please! I just didnt think you were enough of a coffee snob to have a favorite. Sorry, ddint mean to exclude you...

hmm, they have a kenyan, I'll try that - I like it bold.

Also a sumatran. I might try that next.

Xander

@Avid Yeah, if you like bold, Kenyan is a good choice, and you might want to roast it a bit darker...A French Roast maybe.

AviD

I dunno, I'm torn - I typically like the roastiness, but I also like the liveliness of lighter roasts.

Xander

Sumatrans are not quite as bold but they've got a ton of richness, and a bit of earthiness which appeals to me, both in coffee and wine.

AviD

hmm, guess I'll have to get one of each! woot!

Xander

@AviD LOL! Excellent solution. :-)

AviD

9:48 PM

Gotta talk the boutique guy into doing a coffee evening again.

Every once in a while they have neighborhood coffee tasting fests... missed the last one, before I moved in.

I would REALLY enjoy that. And not sleep for 6 days.

Xander

@Avid, Yeah, definitely. Those sorts of events are awesome.

LOL!

AviD

@Xander (btw, if you click on the little arrow on the right of the message, it replies to that. Easier to follow the convo flow... )

Xander

@AviD Yeah, sorry..I know that. I only tend to use it to reply to old messages for some reason.

I'll learn.

AviD

@Xander hehe, as you wish. Wasnt sure if you knew about it.

Also I know on phones it is difficult.

Xander

@AviD I only figured out how to embed posts today, so I'm sure there's plenty I don't know yet. As to phones, haven't used mine for chat yet. My Nexus 7 is a bit flaky in chat though. Sometimes it works OK, sometimes, not so much.

AviD

9:54 PM

@Xander yeah, seen that before.

But there is a bunch of hidden functionality in the chat room, its fun.

chat.stackexchange.com/faq

Xander

@AviD Ha! Guess I'll have to read that.

AviD

not everything is documented there, though - like the oneboxing, you have to go look that up on meta.so.

Xander

Donw beyond the "Be nice" bit, anyway, which I've already read to. :-)

TildalWave

@ThomasPornin what do you mean with "instead, quite smoking, drink less alcohol, and eat more vegetables and less fat."? That sounds like a horrible way to die :)))

Xander

@TildalWave LOL! Agreed.

AviD

10:11 PM

@TildalWave I don't get this part: "drink less alcohol" -> Coming from a Frenchman!

TildalWave

@AviD French Canadian ... so yeah, double odd :)

of course, double odd makes it even...

AviD

@TildalWave as he often tells us, He is not canadien, he is a Frenchman living in Canada.

Which would explain his "stress out less, eh" attitude.

TildalWave

@AviD oh, pardonne-moi didn't know that

Rory Alsop

10:32 PM

Evenin all - despite a couple of good answers, I think this needs to be closed as a crap question. Anyone think it can be edited to be a good question (I'm too lazy)

0

Q: What's most efficient techniques to detetct backdoors?

I use mac OSX and i suspected to some running backdoors in my system. to get a sure answer i have to bring my computer to security labs but for privacy reasons i don't wanna do that because they need full access to my computer for their analysis. what's most efficient technique to check if my sys...

malware risk-analysis backdoor

Xander

@RoryAlsop I'll give it a go.

@RoryAlsop it might be unrecognizable now. Crush the edit with the ModHammer if you don't think it's worth it.

@RoryAlsop Ok, now it's really submitted. Note to self - Check for submission errors before claiming edits are submitted.

Scott Pack

@AviD I'm not quite enough of a purist to have one particularly. I do, however, usually prefer a medium/medium-dark roast.

Rory Alsop

11:09 PM

@xander - looks alright to me. Cheers

Transcript for