« first day (2596 days earlier)      last day (2720 days later) » 

13:00
Looks like the only people who make M.2 2242 SSDs is Transcend, and they're pricey
@FleetCommand also when someone admits that they are stupid its kind of an room in-joke that it will get starred to remind them to be humble in future
"A long time ago a car magazine pundit said that the best way to ensure safe and defensive driving was to put a spike in the center of the steering wheel, aimed at the driver"
I don't get it.
@Boris_yo you crash, you DIE
@Boris_yo Jeremy clarkson said it
Was meant to sound like the guy from Cranked
'You stop? YOU DIE!'
13:01
@djsmiley2k Ah...
So you are constantly stressed...
sure
you make the best decisions when you need a wee.
And if you're not stressed when moving a 1.5Tonne lump of metal, you shouldn't be driving.
i drew a diagram to illustrate the principle
@Burgi Looks like wizard holding his magic hat after conjuring his double but a dead one...
i challenge you to do better
13:06
Visual explanation is best. It sinks in faster.
@Burgi If I had Apple Pen I would.
man up dude, just use paint
##headdesk
Steering wheel with spike... Gives association with Death Race...
@CircusCat As of time you posted that GIF my CPU usage got higher and fan started working harder.
SFW I guess but not SFPC...
@Boris_yo Your browser is crap
I believe we've had this conversation before in here... a decent browser will display 100 of those GIFs while using less than 20% CPU.
Also tested it to use less than 40% CPU on my mobile phone while displaying at least 20+ such GIFs
On my laptop my browser is using 2% CPU with overall CPU usage of 5%, while encrypting a drive in the background.
Arf. I want to buy. But hard to justify cost when I have no money.
13:14
@CircusCat Chrome is crap. Gotcha.
lol seems fine here :O
0.4% cpu
Jun 14 at 0:18, by Not Dog
user image
Jun 14 at 0:18, by Not Dog
@Avery I put SEVENTY GIFs on my screen at the same time, my fan isn't even close to starting
@CircusCat well you DO have a high end cpu
also, try browsing tags on tumblr
especially those with a high number of gifs
or twitter threads with a ton of gifs
Tumblr still exists?
those tend to cause unfun stuff too
@CircusCat considering I got my profile picture done there, I assume yes
13:25
Tumblr... What's it for? And Tweeter? How do people have time to tweet? Businesses and celebrities are okay, but people?
tumblr is for finding fanfic and fanart
you have the time to talk here, you have the time to tweet.
Well I actually don't have time to tweet.
@djsmiley2k I hardly tweet
ALSO AAAAAAAAAAA
why is @aveao taken
13:33
0_0
oh. on the twitters
@JourneymanGeek me neither
@djsmiley2k Suppose I have time. What am I to tweet about? Who will I tweet to?
Like I thought, Tweeter is only if you have audience to tweet to. Businesses and celebrities have that.
lol ok
And self-made celebrities too like YouTubers etc.
it's self indulgence, all it's ever been
13:36
@djsmiley2k Tweet is ego feeder. I would agree.
If you have no audience to feed your ego, feed it on Tweeter.
twitter is nice to have internet arguments
like, are kittens or doggos better
vim or emacs
@Avery Ahhh trolls breeding ground?
windows or linux
Or trolls calling ground...
@Boris_yo no that's 4chan
is <person> a traitor or not
is <company a> evil or not
which political candidate is better
etc etc, it's fun for arguments
13:41
@CircusCat for porn, apparently it does
@Avery Trump must be popular there...
the site is very split
like
there are people who are left and those that are right and centrists and far left and alt-right and everything
@Burgi @CircusCat Not just porn
Several communities
Usually about art and writing and stuff
yeah
but also yeah, tumblr does have an adult side
It does... I guess
13:42
but how would I or @rahuldottech know
So does the Windows 10 Creators Update break much? Mine's nagging me to install it now
It caused problems with one LOB application for a company I work with
@CircusCat Didn't for me, but I'm on LTSB, so it's different
Guess who got to write a patch for some other company's ancient software
(specifically, some window manager internals changed)
Other than that, I don't remember any notable issues
Oh, it breaks some video drivers too
@BenN Cool I'm doing nothing important productivity wise on this thing anyway
Oh. Gaming/video is what I use it for the most :-/
13:45
@CircusCat for home use, seems ok
The video driver it broke was pretty old though
I have no issues with a modern NVidia card
Ah OK. Thanks.
Mine's about as modern and NVidia as it gets.
@CircusCat you should take up residence in the nVidia factory
@Burgi Speaking of factory, do you know where nVidia cards are made and where are assembled?
i assume either china or north america?
Bob
Bob
13:58
hm
I can't get channel4 videos to work and I have no idea why :P
or taiwan
@Bob are you in the UK?
RUSSIAN COMPONENTS! AMERICAN COMPONENTS! ALL. MADE. IN. TAIWAN!
Bob
Bob
@Burgi no. do I need to be?
@Burgi he is not.
Bob
Bob
13:59
it doesn't say anything... it says they're all playable but the play button is greyed out
are we talking about the UK channel 4?
Bob
Bob
yup :P
brb pretending to be british
yeah get a UK based VPN
Bob
Bob
oh that gets me a sign in popup
@JourneymanGeek If true then these should be Taiwanese components.
Bob
Bob
14:01
@CircusCat updated three days ago. smooth update for me.
You see this small field of grass sir? I request you vacate it at once.
@JourneymanGeek is that so you can widdle on it?
i've decided that i don't like our frontend dev
@Burgi er.. other doody duty.
@Bob who you get your vpn from? :/
But that's besides the point
14:06
@Burgi Does he not like Tea?
Bob
Bob
@djsmiley2k those skyrim guys *cough*
:P
I can probably read that
@JourneymanGeek Go right ahead :P
14:08
@djsmiley2k he keeps uploading unapproved stuff to live, not doing pull requests (just merging to random branches) and not checking our ticket system for outstanding work
they really did confuse them
> Nelson Mandela, who famously played "God" in the Bruce Almighty movie series, also won a Nobel Peace prize...
@rahuldottech basically says "Nelson mandela joined Gandhi, Mother Therasa and Martin Luther King Jr on 05/12/2013. We share the same time with them and in their memory, we should show love, pacifism and charity"
@JourneymanGeek ooh, thanks
i prefer my translation
14:14
which script is that?
Tamil
I could read it ;p
why is Morgan Freeman on that poster
he is playing Nelson Mandela in a new movie
That's Nelson Mandela. Duh.
he teams up with Gandhi, Mother Therasa and Martin Luther King Jr to fight crime and defend the galaxy
14:17
The obvious solution is to kill Morgan Freeman
Bob
Bob
he looks surprisingly lively
@rahuldottech i reckon morgan freeman is a badass, it'll be really hard to assassinate him
you might have to drop rocks on him from orbit
14:39
@Burgi classic, hard or progressive?
@Burgi lolololol
@ThatBrazilianPony hard, obviously
ok this might sound like a silly question... but do you hash the salt used in password hashing?
@Burgi Dunno, going into orbit and sending nukes by sheer guitar power sounds like someting those over-the-top metal bands would do
@Burgi yes
the idea is you append the salt, then hash the entire thing
some hashing functions take the salt seperately
i mean when storing it
14:47
you store it seperately...
well, firstly no you don't hash it
| salt | password |
hash(salt|password) = unique value for that salt + password
thanks, i knew it was a silly question
diff salt for every user = even users with same password end up with different hashes
(use username as salt?)
the silliest question is the unasked one
i was just going to chuck a random string into the password
373
Q: How to store salt?

GeorgeNowadays, if we expect to store user password securely, we need at least do the following thing $pwd=hash(hash($password) + salt) then store $pwd in your system instead of the real password. I have seen some cases where $pwd contains the salt itself. So the question is how to store the salt, ...

the username is going to be unique every time, no?
brb, head of sales is here and i need to grab him about a migration
14:51
Why bother coming up with more randomness.
it doesn't need to be random.
Bob
Bob
@Burgi This all sounds like a terrible idea.
Use a library that does it all for you. Don't roll your own hashing algo.
password_hash if you're using PHP
they'll typically output a string that also encodes the algorithm, work factor and salt
you should treat that as an opaque string, both to store and compare (password_verify)
i wasn't going to, i was just thinking about retro-fitting a legacy site
nuke it from space, it's the only way to be sure!
i've asked, they won't let me :(
@rahuldottech O_O
14:54
something about the customer not wanting to pay for a new site
the current passwords are stored plaintext :|
Bob
Bob
blech
@Burgi PHP version?
there's no reason you can't use password_hash or its older cousin crypt, really
VB.net
Bob
Bob
14:57
neither of which requires manual salting
...huh, that's new :P
@Burgi aaaarrrrrrrughghghghg
Bob
Bob
IIRC PBKDF2 is the easier one to access in .NET
@Bob no, it is old ;p
Bob
Bob
@JourneymanGeek it's actually pretty new
now if @Burgi had said VB6...
@Burgi The de facto standard method (in .NET) is to use the built-in PBKDF2 algorithm. It takes three params: password, salt and rounds (work factor). So you need to store the salt and rounds.
There's also bcrypt libraries/implementations but AFAIK it's not built-in yet.
(also part of it is picking a nice large number of rounds. and this is expected to change as machines get more powerful, so should be stored per hash)
I wanna try it! -----^
Not only convenient and cool, but sounds like a geeky challenge :D
Quick question
Why $pwd=hash(hash($password) + salt) and not simply $pwd=hash($password + salt)?
@Bob
Someone I know on gentoo has been doing this @ThatBrazilianPony
Bob
Bob
@rahuldottech don't use either. both are fundamentally broken.
youtu.be/bvim4rsNHkQ?t=17 << what my car might do
@Bob Ow, how so?
Bob
Bob
15:11
@rahuldottech because any joker with a few thousand dollars and access to AWS can brute-force most common passwords in a couple hours/days
@Bob Huh... so I should use pepper, right?
Bob
Bob
when we talk PBKDF2, we're talking in the region of over 10000 rounds of the hashing primitive (usually SHA1/SHA256)
when we talk bcrypt, we're talking a work factor that pushes the time per 'hash' to at least 0.5s, longer if you can
@Bob i've just been told, literally just now, that the customer has been sold to someone else and they are "reviewing" if the brand is to continue
Bob
Bob
@rahuldottech PBKDF2, bcrypt and scrypt either take salt as a separate parameter or generate one randomly internally.
You should not be doing manual string concatenation.
@Bob I really should look into this more, but I haven't yet worked on anything that stores passwords, so eh
Bob
Bob
15:17
If you are doing so, you're either misusing one of those algorithms, or not using one at all.
Got it, thanks
Bob
Bob
@rahuldottech If you use raw SHA or MD5 to store a password, that's wrong
It can be useful to understand the primitives.
It's dangerous to actually use them in practice.
Should we consider: superuser.com/questions/1250288/… to be spam for EaseUS? They have really shady practices
Bob
Bob
@rahuldottech But if we're going to try to generalise, the first one is possibly better. Because the second one might truncate or do other funny things depending on the (untrusted, user input) password. In theory. But hash() could also be an extremely poor algorithm that's broken if you double-hash the same text, which could make the first one more dangerous.
@Bob if it generates one internally, does it output it as an array so you can save the salt somewhere?
Bob
Bob
15:21
@Burgi bcrypt outputs a crypt-formatted string that you should treat as opaque.
@Burgi example (from wikipedia): $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
> 2a
err
Bob
Bob
2a means bcrypt, 10 is the work factor, the first 128 bits of the rest is the salt, the rest is the hash
@Burgi But in practice, you should just store the whole string and pass it back into the corresponding bcrypt verify function
k @bob wins.
Bob
Bob
PBKDF2 is a bit different in that you have to generate the salt yourself and pass it in. You're responsible for storing it separately.
But some libraries will wrap it up in a crypt-like function anyway.
@rahuldottechYou should read up on password hashing, it's a broad and interesting topic :P But if you ever do implement, keep in mind that you should be slooooooooooooow because if you're fast then your attackers are fast too. That's what the whole thing with work factors is about.
And rule #1 of cryptography: don't roll your own algorithms. Don't even try to combine existing algorithms unless you have a very good understanding of what's going on, cause combining them in the wrong way could make things worse.
@djsmiley2k It might be unfeasible on my laptop as it has "two" logical graphic cards (integrated intel + GeForce GT 740M) that are physically just one chip. The guide says I need a separate dedicated card.
Besides, I have only 6 GB RAM.
I wonder if I can easily upgrade the RAM on my Dell Inspiron 15R.
It doesn't help that there are a lot of different "Dell Inspiron 15R".
15:34
there is?
> physically just one chip
oh, there's diff numbers
so what number is yours?
@tha They're usually different chips on the same board
Hm. Ping works on partial usernames.
@ThatBrazilianPony You didn't know? :P
Three letters+ pings the person if they've been in the room in the past two days. Full username pings if they've been online in a week
@jou I'm correct, right?
15:36
oh I didn't know the 2 day thing
cool
@rahuldottech No. I knew about username autocompletion, though
12
A: What are the rules for when chat messages appear in a user's inbox?

balphaTo use you as an example: @TonyMeyer, i.e. an exact match will cause a notification if you've been in the room in the past seven days. @Tony, i.e. a first name match (to be precise, a word boundary match) will cause a notification if you've been in the room in the past two days. @Ton will notif...

odd issue just now class-wp-rest-revisions-controller.php in a WP install refused to upload and it kept deleting itself from the server
anyone ever come across that?
What do you mean by "refused to upload"?
How are you installing it?
Aren't... aren't you using FTP, right? Right?
via FTP, yes
15:40
aaaaaaaaaaaaaaaaaa
deleting itself is clever
because legacy system
also we only have a two stage deployment infrastructure
LOCAL -> STAGING/UAT -> PROD/LIVE
Oh look at Burgi and his fancy "staging" server.
ideally i'd want: LOCAL -> DEV -> STAGING/UAT -> PROD/LIVE
15:53
Here we have our local machines and production. With totally different environments. Obviously.
and i thought we were doing things wrong
There's nothing so wrong that we can't make wronger!
lol
you wanted to see the last place I worked out
5 diff envs' and nothing was the same accross any of them
was terrible
15 mins ago, by That Brazilian Pony
user image
Bob
Bob
@Burgi dev only makes sense if you do CI and have a large-ish team, imo
otherwise local is dev :P
staging/uat should be a clone of prod
I only wish we used docker (or some similar container technology) to [1] standardize environment configurations, and [2] have clearly defined (and VCs'ed) env specs
15:57
@Bob that does mean we sometimes have different branches deployed to staging for testing
I've been trying for two days to start on my machine a local copy of a live site.
So I can start looking for a solution for a bug.
It is live on prod. It starts on my local machine, but there are regions missing.
Why? Who knows!
The logs say nothing.
@ThatBrazilianPony have you got ALL the databases?
Yeah. I had the same issue two months ago, found the cause, it was something really stupid I can't remember.
@ThatBrazilianPony is it not tracked in your bug DB?
Which bug DB?
16:01
check 'em all
There's none.
We don't have a central development team. We have multiple dozens of small teams working against each other separately.
Bob
Bob
@Burgi ach. yea, our dev is a bit ad hoc
would your agency not save taxpayers money by rationalizing the dev teams?
Bob
Bob
like, we have the servers, but what's actually deployed can be a bit random or out of date
anything that goes to uat should be final testing for prod though
There's no code reuse on the organization level. Once my previous team spent nearly a year developing a system. It was used once. Then the next year a similar the exact same functionality was needed again. Other team started developing it again at other branch.
16:05
David Robinson on September 14, 2017

We recently showed that, based on Stack Overflow question visits, Python has a claim to being the fastest-growing major programming language, and that it has become the most visited tag on Stack Overflow within high-income countries.

Why is Python growing so fast? Python is used in a variety of purposes, ranging from web development to data science to DevOps, and it’s worth understanding what particular applications of Python have recently become more common. I’m a data scientist who uses R, so I’m certainly interested in how much of Python’s growth has been within my ow …

@Burgi internal politics, internal politics, internal politics, internal politics, internal politics, internal politics, internal politics, internal politics, internal politics, and internal politics.
And by politics I don't mean rules and guidelines, I mean playing power games.
python? :lenny_face:
we built a site for our big customer and in 12 months they've only ever had one enquiry from it
@Burgi Low visits, or people visit and leave? Because those are symptoms of different problems.
all of the above
16:24
To solve the first you have to invest in advertising, discoverability and SEO. For the latter, copywriting and design / usability improvements.
But I'm probably preaching to the priests, as you work at an agency and know it much better than me :P
if you could convince our senior management to invest in those things
O_o
You work at a marketing agency or at a web dev agency? I ask without any sarcasm.
You can have an amazing web dev with bad marketing, and vice-versa.
Ideally you need both, but not everyone (specially up high) realizes that.
And then blame the **devs** for problems out of their range.
marketing
pretty much
@Burgi Oh lord. I thought we were crazy here but turns out people are crazy everywhere.
@ThatBrazilianPony at least you have the jungle heat to explain your madness
16:30
If it makes you feel less sad, we build sites without knowing who's the target audience, or even what's the purpose of the site.
We build then because it's either mandated by law, or by a department's head ego.
Then it sometimes sits without any content for months.
Sometimes the content can contradict the very nature of the site.
16:47
tbh sounds like most goverment sites
Jesus that windows update was over 30GB
@CircusCat nice
@CircusCat 30 GB 0.o
@ThatBrazilianPony Creators update or some shite
I literally can not imagine software that large that isn't like, five complete operating systems conjoined at the hip
16:52
One game I'm downloading is 50GB
@Avery 20 DVDs!
yeah but that game is likely to contain a lot of image data that doesn't compress well, the actual compiled binary shouldn't be hardly any of that size.
beep
@ThatBrazilianPony I think that nuked it?
@ThomasWard Thanks! :)
17:06
lurks in the corner with the laser cannons
I was the one who flagged it.
yup
waves at @Mokubai
roar
Just trying to be helpful :)
@ThatBrazilianPony Is on removal spree!
17:08
cautiously waves at @ThomasWard
:P
@Mokubai hope you don't mind me helping out with that flag :)
disappears again, this time to actually go do his job xD
@ThomasWard which flag?
what'd I miss?
ah you probably missed it, user requested deletion of their own messages
look for the block of six or seven (removed) lines from @ThatBrazilianPony
PII / NDA protected info
"Hey man! What do you do for living?"
"I am SEO..."
"I hate you!"
Ah, probably fired up browser but wandered off
17:10
@ThomasWard Nah, not NDA, just marginally PII... But better safe than sorry :P
goes to viciously destroy rage-mode-glare look at this Exchange server and determine why it's not DKIM-signing messages going outbound
why is it i always miss the stuff flagged
2
@ThomasWard we're all on the same team so no worries
well regarding the chat moderation, yes.
regarding this evil Exchange server...
... not so much. grabs the sledgehammer
17:13
I don't know how SEO can be exciting. I felt bored being SEO. Promoting casino and gaming industries was a job that made me feel empty. I felt purposeless.
meh i need a break this server's angered me for four hours today. drifts back into chat
SEO is a dark art
SEO is not tangible. You don't feel like you are serving the people. More like harming.
@Burgi Which SEO degree are you?
I heard 33 is the highest...
It's like a pyramid. Lower level degree SEOs don't know what higher degree SEOs know.
I have never done SEO, but they way I see it, there's white-hat and black-hat SEO. White-hat SEO, if it even exists, is deeply tied to things that end up helping all users, such as optimizing the loading speed of the site, either by a more performant server or a better written front-end; also copywriting, ensuring the content is on-topic, relevant, properly presented, easily navigable...
I was a gray SEO...
17:17
Hm. Wait. Is white-hat SEO just making sure the devs, sysadmins, content writers, designers and UX/UI teams are doing their jobs? 0.o
Sounds like its project manager's job...
Anyways, lunch time (has passed an hour ago) and there's this delicious fish waiting for me
SEOs do work with content writers (content optimization for discoverability) and designers (valid and optimized code)
I prefer CEO than SEO.
SEO project manager gets to enjoy the fruits of labor his team did to finally see what works and what does not.
17:54
hey didn't know that jmg made movies
@Avery "Journeyman downloads", "Journeyman documents", "Journeyman pictures"
nice
(also cc @JourneymanGeek)
why do you have a documentary] about ashley madison hacks on your pictures tho

« first day (2596 days earlier)      last day (2720 days later) »