The Comms Room

Mark Henderson

00:01

@MatthewIfe That was nice

I wonder if that really was his personal diary

kce

What my nerd-izzles.

Anonymous

00:17

@MarkHenderson I've got a motherfucking complaint

Anonymous

> your account has been automatically suspended for posting inappropriate content and cannot chat for 30 minutes.

Anonymous

chat.stackexchange.com/messages/14210199/history

Mark Henderson

@PatoSáinz You posted about babies getting cut in half

It got flagged

I'm not surprised

Falcon Momot

what room was that in? :P

Anonymous

I just mentioned the fact such thing existed, I didn't know you could offend people by mentioning something

Falcon Momot

00:18

(obviously not here)

Anonymous

@FalconMomot here

Falcon Momot

:(

Anonymous

@FalconMomot yes indeed

Mark Henderson

@FalconMomot Here

@PatoSáinz Well now you do :)

Falcon Momot

and here I had all this faith in sysadmins and stuff

Anonymous

00:19

@MarkHenderson But seriously wtf

Mark Henderson

fwiw when someone in here flags a comment in here it probably has crossed their line

I only take flags seriously when they're from and in this room

Anonymous

It wasn't like I described the whole shit, just told it

Mark Henderson

@PatoSáinz Don't take it personally

Anonymous

@MarkHenderson lol I never take anything OTI personally

Anonymous

But it's just... surprising

Anonymous

00:20

Apparently I'm more cold hearted than what I thought

Mark Henderson

@PatoSáinz shrug

It doesn't happen often

And usually it's @wesley

Anonymous

Death is part of life. Some of them die horribly like the two cases mentioned before and those things happen. I dare to say, weekly, in India. It's not like I oneboxed the video, what else, a flag for saying "people die from starvation in Africa"?

Anonymous

But meh ok

Mark Henderson

@PatoSáinz Sounds like you're taking it pretty personally to me

Anonymous

@MarkHenderson You seem right, maybe

Mark Henderson

00:23

I don't control what people do or don't find offensive

Matthew Ife

@PatoSáinz (he does, we're all bots)

Anonymous

@MarkHenderson neither do I, but now I know what to expect

ewwhite

So I missed my flight. @joel where are you!?!

Anonymous

@MatthewIfe proof?

Mark Henderson

All I know is that if someone in here flags it (and I know who flagged it; it wasn't a non-room member on a driveby) then it's probably over whatever line there is

Magellan

00:24

@MarkHenderson For starters, that statement here in the US is sufficient proof that you're a part of the oppressor class and should be hounded out of any gainful employment and ostracized.

Joel E Salas

@ewwhite in the middle of a deployment

mossy

How did I end up here in life. Why me. Why is LEMP / Wordpress paying my bills. What have I done

Magellan

@JoelESalas That's a much nicer way of saying Fsck Off. =)

ewwhite

Oh, can I come help? I know how to use the command line!

Matthew Ife

@PatoSáinz well, clearly someone found it offensive and it was his fault. Duh.

Joel E Salas

00:25

@ewwhite You're more than welcome to visit!

Mark Henderson

@Magellan I will change my name to Osama Ack Bin So Houdini

Anonymous

@MarkHenderson oh ok

Magellan

@MarkHenderson that'll get you sent to Gitmo

Anonymous

@MarkHenderson at least it's more legit than a random suspension because a joke about consultants and sluts...

ewwhite

I'm at the sausage place right now. But how is the deployment going? @joel?

Anonymous

00:26

@Magellan can't tell if irony or not

Joel E Salas

@ewwhite orly

Magellan

@PatoSáinz It's sarcasm if it not true. Irony when it's true.

Joel E Salas

I'm going to the Down and Out with a friend in a bit ... yelp.com/biz/the-down-and-out-los-angeles

Anonymous

@Magellan then is it true or false

Magellan

@PatoSáinz depends

Anonymous

00:27

@Magellan oh god you are confusing me

Magellan

@PatoSáinz you're welcome

ewwhite

@joel cool. I'm staying downtown again. Dive bar?

Joel E Salas

@ewwhite very divey

don't bring a backpack

ewwhite

Hah

Joel E Salas

@ewwhite They won't let you in

I didn't know you were in town! or I wouldn't have agreed to meet my friend

ewwhite

00:29

Can I wear my Google glass?

Joel E Salas

@ewwhite rofl yes

ewwhite

I didn't plan to be here. Total customer fail

Joel E Salas

@ewwhite Was that the people disconnecting the printer?

You should just throw in the towel and move to LA.

Andrew

@Magellan anyone who uses the phrase "check your privilege" should be slapped for attempting to derail.

2

ewwhite

10am- "Oh, the phone vendor is here,Ed. He needs a few things..."

Magellan

00:31

@ewwhite ya sure, you betcha. $250/hour.

Joel E Salas

@PatoSáinz This isn't #reddit on freenode, this is a chat for (alleged) professionals

Anonymous

I'd pay to see a movie of a BOFH starred by Nicholas Cage

ewwhite

A few things == a windows server vlan definitions, TFTP setup, routing changes, ACLs, cabling...

Anonymous

@JoelESalas that's why

ewwhite

You know how long it takes to update a windows 2008r2 server from a fresh install?

Anonymous

00:33

@ewwhite 2 hours?

Magellan

@JoelESalas though I'm firmly of the opinion that some of the non-general audience business chat in here should be done in a hipchat room or something.

ewwhite

@magellan you are right

Magellan

free for < 5 users too

i use it for non-emergency notifications

ewwhite

@pato yes. 2 hours. Hours that I didn't plan for.

I like hip chat. Last job had it. Wish I could use it as a general chat client

Anonymous

@ewwhite can't they be unattended?

ewwhite

00:38

Good question...

I don't know..

Michael Hampton

Hi. Did I miss something?

Anonymous

@MichaelHampton maybe

Magellan

@ewwhite same here. game company rocked hipchat and google hangouts. didn't feel at all like we were geographically dispersed.

Joel E Salas

@ewwhite Are you remotely interested in a seamy dive?

ewwhite

00:53

I'm enjoying my sausage fest!

2

FEAST

First meal of the day

Then back to hotel to put all the brokenness I saw this weekend into Trello

Joel E Salas

dolla dolla billz

ewwhite

Customer gave me a check for the hardware today..

So I'm feeling all special... But then I realized I can't cash $45k at a currency exchange

So no Spearmint Rhino for me tonight..

HopelessN00b

01:08

@Basil TN Visa is a free trade work Visa... get one for up to 3 years, renewable basically indefinitely, open to citizens of Canada and Mexico (NAFTA free trade zone) with certain technical specialties to work in the US.

Falcon Momot

01:18

ARGH

remember how I am transferring to the US from Canada?

and how the exchange rate has tanked in the past year by like 10%?

they want to change my pay over at 90 cents on the dollar, instead of the near-parity I negotiated it at

Matt Bear

@FalconMomot you get paid what... 16 beaver skins and 1 moose a week?

how does that exchange?

Joel E Salas

@MattBear One moose a week! Mr. Millionaire over here

HopelessN00b

@FalconMomot "Uh, no."

Oh wait, better one... "That means I only work 90% as many hours for you, right?"

Falcon Momot

pretty much

I couldn't be less enthusiastic

have a meeting to chat about it tomorrow morning

before my flight

last-minute, rushed, as usual

The $94000-a-year offer I have from google (contrast $85500 from the current place) looks a lot better in that circumstance

HopelessN00b

Yet another reminder that I got into the wrong career. Oh well.

Magellan

01:39

@FalconMomot that's it? cheap bastards.

HopelessN00b

@Magellan Hey, I'd kill like... 8 people to pull down that salary at a good workplace, doing what I do. Unfortunately, it's looking like that's what it's going to take. Find one of those rare openings, interview, and kill all the other candidates to clinch the position.

Magellan

@HopelessN00b uh, unless there's some serious perks, that's cheap for here. imho

HopelessN00b

@Magellan Guess that's pretty area dependent. It's pretty big-ballin' for where I am, and unless you're willing to suffer through working for a bank, you probably won't see that salary as an SA or SE.

Magellan

windows work here is much cheaper unless you're a Dev. Do some serious linuxing and work hard on moving up to companies with more enterprise-grade deployments, you could easily be pulling 6 figures in a few years.

Mark Henderson

@Magellan Screw you all. I've been working hard for 7 years now and I've only just hit 80k package (salary+perks)

And that's good for this area

ewwhite

01:47

@HopelessN00b Crush-kill-destroy-MAIM!

Magellan

very low tech unemployment here.

HopelessN00b

@Magellan Seems like it would get in the way of being lazy and coasting through life on my... well, however I'm doing it. Killing 8 people is clearly the easier, and therefore, better option.

Magellan

finding good people is VERY difficult

HopelessN00b

@MarkHenderson Dude... you need to move. That's... that's... I mean. Ouch. Now I feel all guilty and shit.

ewwhite

:(

Bob

01:49

@MarkHenderson Would you mind sharing which area?

Mark Henderson

@Bob Sydney

North west

Bob

:\

Mark Henderson

I don't work for a big company though, and I refuse to, which limits my oppertunities

Bob

Ah, that might do it.

ewwhite

@MarkHenderson what's your top skill?

Bob

01:52

How far NW? Say, relative to Hornsby - further N? Further W?

Matt Bear

so... I finally am understanding the need for a decent bike haha

Mark Henderson

@Bob Well I work in Norwest business park

So more blacktown than hornsby

@ewwhite Good question. Perhaps one that I struggle with

Bob

Ah, so further off to the west.

Mark Henderson

I'm very good at delivering the projects that people actually need versus the one that they think that they want

jscott

Neutral Bay? That's a thing, TIL.

Mark Henderson

01:53

@jscott Yep. Where junior lawyers live.

Bob

I honestly have no idea how pay there compares to other areas.

Mark Henderson

@Bob Depends on the company more than anything else

And I do work for a cheapskate

jscott

@MarkHenderson I suppose it's as appropriate an arbitrary combination of words as any then.

Ethan

is there a chat room for cryptography

Mark Henderson

@Ethan How about you go to crypto.se and click the "chat" link

That'll tell you pretty quickly

HopelessN00b

01:55

@Ethan Yeah, but it's encrypted.

2

Ethan

@HopelessN00b lol

jscott

I've not verified their certs, but @HopelessN00b is correct, and there is a crypto chat.

Bob

@MarkHenderson :(

HopelessN00b

@Ethan Cryptography, last message 4 days ago or Security.SE, which is actually used on a semi-regular basis

Mark Henderson

@Bob Yeah but I like working here

Ethan

01:58

when talking about an "n bit RSA key" does that refer to the number of bits in the in the encryption modulus

e.g the product of the two primes being used would be n bits?

Mark Henderson

And that counts for a lot

Bob

True, a good environment makes a world of difference.

HopelessN00b

@MarkHenderson Yeah, something you forgot to mention while making me feel sorry for you. I'd happily trade my job in for one that doesn't suck. And, unless I'm even more unemployable than I think I am, I will, fairly soon.

@Ethan That's talking about key size.

Mark Henderson

@HopelessN00b My apologies

Ethan

@HopelessN00b How big of a relationship is there between the two, given the key size could you give bounds on the size of the modulus being used?

In a typical scenario, I mean I imagine you could intentionally make it bigger

or somthing

HopelessN00b

02:04

@Ethan That... would be a question you don't want me to answer, as I'm not confident I'd get it right. Not much of a math geek, since a string of horrible math teachers in the latter half of high school and the early part of college.

Mark Henderson

@Ethan Neeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeerd

(sorry, I've always wanted to do that)

Andrew

> n is used as the modulus for both the public and private keys. Its length, usually expressed in bits, is the key length.

RSA (cryptosystem)

RSA is a cryptosystem, which is known as one of the first practicable public-key cryptosystems and is widely used for secure data transmission. In such a cryptosystem, the encryption key is public and differs from the decryption key which is kept secret. In RSA, this asymmetry is based on the practical difficulty of factoring the product of two large prime numbers, the factoring problem. RSA stands for Ron Rivest, Adi Shamir and Leonard Adleman, who first publicly described the algorithm in 1977. Clifford Cocks, an English mathematician, had developed an equivalent system in 1973, but it...

Ethan

@HopelessN00b Alright, but you know how people typically add a salt of some kind to hash the plain text even before encrypting it, does that salt act as the substitution cipher. Or is that done even before the hashing? broadly speaking with most protocols

sorry kinda vague

Matthew Ife

@Ethan the salt is used as a 'mixing' source. Because none-salted values are usually already known.

Andrew

@Ethan what context?

I don't know of any cases where you salt + hash + encrypt

Mark Henderson

02:11

@Andrew I do

HopelessN00b

@Ethan Salt is used as an additinoal input. As in, combined with the original value (in some way), and then the combined value is hashed.

Matthew Ife

@Ethan it also ensures hashes differ between two plaintexts when the original plaintexts are similar.

Andrew

@MarkHenderson examples?

HMAC?

Mark Henderson

@Andrew crackstation.net/hashing-security.htm

Ethan

@HopelessN00b yes but wouldn't the hashing, be the actual encryption scheme

and the salt would just be done before to pad it?

Mark Henderson

02:13

Section titled Impossible-to-crack Hashes: Keyed Hashes and Password Hashing Hardware

Andrew

@MarkHenderson if you're not using bcrypt you're doing it wrong

Mark Henderson

We've been AESing our hashes for a long time

Bob

@Andrew Wait, what's salt got to do with encryption?

Matthew Ife

@Ethan, hashing is importantly meant to be a lossy operation.

Andrew

@Bob exactly!

Matthew Ife

02:13

There is a big difference. Encryption is reversible. Hashing is not.

(or at least not meant to be ;))

One should never be able to deduce the original input from a hash.

Bob

@MatthewIfe It isn't - as long as you're losing data, you can't reverse it.

Mark Henderson

@standaloneSA Thanks for the lunchtime read. Also: VINDICATION! I have been AESing hashes for YEARS and have been told it was a waste.

Tweeted by thefarseeker on February 24, 2014 at 1:30 AM in reply to standaloneSA

Bob

You can sometimes find a (possibly different) input that hashes to the same result. But that's not reversing it.

And as long as you're losing data you'll have multiple possible input for the same result.

Matthew Ife

@Bob I didnt say hashes were reversible.

Bob

@MatthewIfe You said it's not meant to be, implying that there's cases where they are... which would be so terribly broken :P

HopelessN00b

02:16

@Ethan Yeah, you seem to be misunderstanding the difference between hashing and encryption. Encryption is reversible. (You can decrypt to get the original values.) Hashing is purely one-way. Not reversible. And typically, salts are only used with hashing algorithms, not encryption.

Matthew Ife

Actually I am implying that to our current knowledge they are not meant to be.

strugee

Bob

Hm. Any hashes with variable-length output?

Ethan

@HopelessN00b im talking about asymmetric encryption

sorry if i didn't make it more clear

Matthew Ife

@Ethan re p=np no it wouldn't, thats a totally different mathematical problem to do with proving whether or not any known hard problem has a unknown easy solution.

Ryan Ries

02:17

@Bob What hash algorithm are you talking about when you say you've found collisions?

Ethan

@MatthewIfe mathworld.wolfram.com/One-WayFunction.html

Bob

@RyanRies I'm saying that as long as the output space is smaller than the input, collisions must exist. Finding them is an entirely different exercise.

Ethan

The existence of one-way functions is not proven. If true, it would imply P\neNP

Ryan Ries

@Bob Yes you're right -- my mistake for not following the whole conversation

HopelessN00b

@Ethan Still the same answer. Encryption is reversible, hashes aren't. And salts aren't generally used with encryption, symmetrical or asymmetrical.

Matthew Ife

02:19

@Ethan p=np is the mathematical question as to finding proof as to whether any known currently hard problem will always have a easier (non-polynomial) solution.

@Ethan well I dont think it would purely mathematically. It would prove it for a certain case of mathematical problems, it merely deducts a problem set.

Bob

@MarkHenderson That's an interesting one. Defense-in-depth and all, but the salt still doesn't have a direct affect on the encryption (and vice versa)

Matthew Ife

Perhaps (im not a maths guru) that would be enough.

Mark Henderson

@Bob No. Not at all

Andrew

@MarkHenderson ok, so you encrypt(hash(salt+data)) but what separates the key from the hashes?

Matthew Ife

@Ethan I have a feeling that hashing (being a lossy process in terms of information systems) is not considered a polynomial problem.

Mark Henderson

02:22

@Andrew The same way you always do

Matthew Ife

@Ethan I'm happy to be totally wrong there ;)

Bob

@Andrew More like encrypt(hash(salt+data), key)

Mark Henderson

Keep it on disk, unreadable by all but a single user

Andrew

@Bob notation :P

Ethan

@MatthewIfe I don't know much about it lol

Mark Henderson

02:23

It's not foolproof, but it certainly makes things more difficult for a remote attack

Bob

@Andrew Well, generally with encryption the key has to be known independently of the cleartext.

Ethan

yea you have to give them the key for the hash

Andrew

> This could increase security if an attacker would only have access to the database and not to the place where the key is actually stored. The problem is that often in data compromises an attacker will at least have access to the hard disk and in some cases even the memory. If the attacker can obtain the key, then the pepper does not add any security to the hashing algorithm.

Bob

You're never adding security to the hashing algorithm by encrypting the output. You're adding some security to the entire scheme, but not the hashing algorithm itself.

Yes, I love nitpicking.

Mark Henderson

We do it because we provide the customer with their own database, should they request it. This way, if they manage to lose their database, whoever finds it can't even begin to brute force the passwords

Andrew

02:26

> This is not as easy as it sounds. The key has to be kept secret from an attacker even in the event of a breach. If an attacker gains full access to the system, they'll be able to steal the key no matter where it is stored. The key must be stored in an external system, such as a physically separate server dedicated to password validation, or a special hardware device attached to the server such as the YubiHSM.

HopelessN00b

@MarkHenderson Sounds like that could be inconvenient, if they're the one who find their lost database, though. :o

Mark Henderson

@Andrew We encrypt them in case the database is stolen from wherever it is off-premesis

@HopelessN00b Well, even so the lost database would still be useless unless they want to brute force all the hashes

Matthew Ife

@MarkHenderson unless said database contained names, addresses, telephone numbers, credit card details..

Mark Henderson

Mind you, if they have a copy of the database they don't need a password. They can look at anything they want anyway

@MatthewIfe No credit card details

But it will stop them from taking the stolen database and getting onto the live database in order to change things

We have some large clients where if you had the right access, could benefit from it greatly.

Matthew Ife

Hope you dont store session cookies in that database in plain-text then :)

HopelessN00b

02:33

Oh, gawd.

Mark Henderson

@MatthewIfe Session cookies rotate. You have a database from 2 weeks ago? Good for you. Those cookies are all useless.

HopelessN00b

Well, we've looked over the xml you are sending and everything looks fine.  The only thing we can see is that when we copy the xml from the e-mail and paste it into Word it underlines the e-mail address as a hyperlink.  It looks like that's the problem, you need to send us the xml with no hyperlinks.

Mark Henderson

@HopelessN00b Is that from thedailywtf?

It must be

HopelessN00b

@MarkHenderson Yup.

I received an email like that today, from one of our suppliers. Our dumbass business parners sure do get around.

Andrew

@HopelessN00b yup, I remember reading that one

@MarkHenderson snow! 101 F.

Bob

02:38

@Andrew ...why would you use Fahrenheit? D:

Andrew

@Bob because the majority of thedailywtf readers are USian...

Bob

Ah. TDWTF submission.

I almost thought there was a Canberra in the US for a min. (wait, is there?)

HopelessN00b

@Bob Must be. I mean there's a London and a Rome and a Paris.

Andrew

lol @ en.wikipedia.org/wiki/Canberra#Etymology

Anonymous

Bob

02:42

@HopelessN00b Trying to find one right now..

Andrew

@Bob unlikely given the etymology

Bob

@Andrew Wouldn't be the first time one place was named after another :P

Andrew

@Bob have you read the meaning of the word yet?

Bob

@Andrew Yea. I meant, say, a town or city in another country named after Canberra, Australia.

Andrew

@Bob Strangely there is a Melbourne, Florida.

Bob

02:44

And Sydney:

Andrew

amongst others....

Bob

> *Populated Places*
Sydney, NSW, Australia
Sydney, FL, U.S.
Sydney, ND, U.S.
Sydney, NS, Canada
Sydney, South Africa
Sydney Vanuatu

Hampden Sydney, VA, U.S.
Poilcourt-Sydney, France
Sydney on Vaal, South Africa

Andrew

> Antarctica

Mount Melbourne

Canada

Melbourne, Nova Scotia
Melbourne, Quebec

England

Melbourne, Derbyshire
Melbourne, East Riding of Yorkshire
Melbourn, Cambridgeshire

United States

Melbourne, Arkansas
Melbourne, California
Melburn Hill, California
Melbourne, Florida
Melbourne, Iowa
Melbourne, Kentucky
Melbern, Ohio

Bob

Hm, looks like Canberra might be Au only!

Andrew

let's not get started on Perth

Bob

02:45

geonames.org/…

Mark Henderson

@Bob Lidcombe

Because it's a contraction of two peoples names

Andrew

Ah ha ha ha ha ha. delimiter.com.au/2014/03/11/…

Ooh this is good too: delimiter.com.au/2014/03/10/…

@MarkHenderson speaking of hardware for passwords etc.: arstechnica.com/security/2014/03/…

HMAC hardware token

Mark Henderson

@Andrew This is my favourite part

> it may be that the Abbott government will appear as nothing more than a thin, greasy layer in the core sample of future political scientists drilling back into the early years of the 21st century.”

He is greasy

Transcript for