The DMZ

Happy [00-24] hour to you.

Stack Overflow Blog: Stack Exchange becomes an institutional member of the TeX Users Group

9:07 AM

Happy-- hour++ bye.

Stack Exchange

10:20 AM

Posted by Rebecca Chernoff on October 4th, 2011

We’re pleased to announce that Stack Exchange is now an institutional member of the TeX Users Group.

The TeX Users Group (TUG) is a non-profit organization supporting the the TeX typesetting system community — or anyone generally interested in furthering the fields of typography and font design. It’s popular within many academic disciplines, several of which are represented in the Stack Exchange network.

TeX was originally popular as a tag on Stack Overflow and eventually grew into its own TeX Stack Exchange site through the Area 51 process. This community has actively contributed new packages back to the TeX community, and maintains a community blog. …

Stack Exchange

12:09 PM

Stack Exchange Security Blog: Risk Assessments: Knowing What to Protect

Jeff Ferland on October 04, 2011

A company’s data is as much a risk as it is an asset. The way that customer data is stored in modern times requires it to be protected as a vulnerable asset and regarded as an unrealized liability even if not considered on the annual financial statement. In many jurisdictions this is enforced by legislation (eg Data Protection Act of 1998 in the UK)

One of the challenges of this as a modern concern lies in knowing where your data is.

To make a comparable example, consider a company that owns its place of operation. That asset must be protected with an investment both for sound business sen …

2:40 PM

Morn'

Thomas Pornin

Hello

faceplant

@JeffFerland Yeah, I have that effect on some people.

@Mvy I'm guessing I'd get this joke a little better if I better knew the parameters of Linux commands?

@Iszi (kill process, no trapping of command possible; present limited view of the system to a process)

... so yes

Morning gents and Jeff

2:53 PM

@ScottPack Ouch

@JeffFerland Buy him a beer sometime.

M'vy

Hey

Q: Extract passphrase hash from pgp secret key

@JeffFerland Should we be closing this as dupe? And, is it me or is this guy just asking us to do his work for him?

0

I'm trying to break into a PGP secret key part of the FRA Challenge 2011 (stolen_priv_key.ascii). Is there any way to extract the hash for the passphrase so that it can be attacked with a wordlist/brute-force? I have tried pgpdump.com which yields a couple of hashes but i don't know which is whic...

I'm thinking answers are... Not quite, and yes.

@Iszi Agreed

3:23 PM

@JeffFerland So... close-worthy at this point, then? It's been answered, and we don't need anyone else trying to give "homework help".

I voted as "not constructive".

Why the frell does Communicator replace (s) with a moon? Did some moron never think people would actually use (s) to represent possible plural(s) in conversation?

3:46 PM

Netscape Communicator?

@ScottPack Office Communicator

Replacement for Windows Messenger in the newer Office suites.

But yeah... Wow, that takes me back.

@HendrikBrummermann did you get my email regarding the mod cards?

Holy Crap. McAfee announced today that they're buying Nitro, and IBM announced that they're buying Q1

I didn't understand that to start off with - but then I realised they're all security firms.

forbes.com/sites/ericsavitz/2011/10/04/ibm-to-buy-q1-labs

IBM have also brought other firms recently too: www-03.ibm.com/press/us/en/pressrelease/35255.wss

4:08 PM

@Iszi Voted as such

So from IBM's perspective to me it looks like they're trying to acquire quite specialist consulting outfits.

4:30 PM

IBM has been moving much more heavily into the security realm lately, and putting a lot of effort into the MSSP approach.

6:43 PM

hello hello hello - so, what did I miss?

Uh, 3 of us voted to close some lousy question about cracking PGP private key passwords and StackOverflow is telling me I don't know how to ask questions.

Oh, and the "iPhone 5" has been announced, but they're calling it the "iPhone 4S".

security validation playframework captcha recaptcha

@JeffFerland :-) me too

interesting -

0

Q: Is ReCaptcha too weak?

I recognized that during some time reCaptcha is used without the horizontal line. I do not like the changes. Referring to some articles, google's captcha service is getting weaker and weaker. Do you guys think reCaptcha is still the best captcha there is, or should i think about using another imp...

6:59 PM

Voted to close --> too localized (point-in-time).... though I guess your answer covers that too.

Afternoon, @Rory

evening @Scott

How are you this lovely day?

grand - had 5 days away in the highlands with the extended family (but it did rain almost the whole time, unlike the rest of the UK)

Was it still an enjoyable trip?

7:12 PM

It was lovely - the kids spent 80% of the time in kids club, and we spent a lot of time in the bar, in the jacuzzi, wandering the mountains, going bat spotting etc etc

really relaxing

I just got to clean house and think about how I'm going to turn NIST SP800-53 SI-4 into an enjoyable presentation.

I think it's pretty clear who had the better time.

7:30 PM

@ScottPack SI-04? Which one's that again? (Goes to look.) By the way, have you downloaded their controls database application? Pretty handy, but then again you'd have to be a Windows user.

Ah, monitoring.

Hmm....network analysis and integrity monitoring. Yummo.

7:45 PM

@ScottPack :-)

8:17 PM

most people have no integrity... monitoring :P

@thisjosh :%s/... / or /

There, I fixed that for you.

oww regex sexy :P

regexy! Evening @thisjosh

Evening +/- 12 Rory

I wonder what the point of lurking is when you can read the transcript.

Heh - I'm trawling the transcript for the last few days, but I'm sure I'm missing loads

8:27 PM

@Scott what is MSSP?

@Iszi Hey, I'm trying:-)

Managed Security Service Provider

@JeffFerland It's inevitable. Security is like being the canary in the mine, but the miners put a rubber band around your beak.

6

@Iszi like the Perplexcity Leitmarks?

@thisjosh Oh, it's not a security issue... it's a "other dev hasn't used version control in 18 months" + "client's CFO doesn't understand double-entry accounting"

8:34 PM

@ScottPack We could try for the milestone of all users on pages 1 and 2 being over 1k

... and other things, but those are the flagships.

@RoryAlsop If @Thomas create a different account every time he broke 1k, we'd be there? :)

@JeffFerland Oh so they're just incompetent, that rarely bothers me anymore. You must be under 30.

@thisjosh Problem A: two of us in the firm write code. I had to wade through the other guy's. Problem B: They've been my client for over a year.

@JeffFerland Ah and thus the escape plan was hatched. If you were black hat I would suggest random file corrupt on his directory structure to keep him out of the way until you finish the code.

@thisjosh So used to submit homework that way to buy myself extra time. "Oh, Word won't open it?"

dd if=/dev/urandom of=~/homework.doc bs=1k count=22

8:41 PM

Hah, thats clever! I never though of that, but I think most of my homework was either hard copy or electonically submidded source and binaries.

I wonder if anyone accepts hard copy any more.

M'vy

Well @JeffFerland I guess you could have changed a picture in a .doc and the teacher would not guessed :P

@JeffFerland Heh - very true. I was thinking more of just encouraging people to vote more:-)

but your way works too

What are we trying to reach?

I think I may have found an appropriate theme song: Communication Breakdown by Led Zeppelin. Rory can do a cover.

8:57 PM

@RoryAlsop Hadn't heard of those. Interesting.

@thisjosh +1

@Jin yes, sorry. I have answered now.

@HendrikBrummermann got it. thanks!

@thisjosh I used to play a lot of Zeppelin with my old covers band. Should be easy:-)

Thomas Pornin

@JeffFerland Hey, if I create many accounts they can begin upvoting each other madly; this is exponential.

@Iszi Was really good fun while it lasted, I still have a range of unused cards - wasn't quite as interested when the prize was found.

@ThomasPornin hahaha - just gotta watch that sock puppet algorithm:-)

9:03 PM

@RoryAlsop I don't think the sock pupet algorithm can keep up with exponential expansion.

there's only 1 way to find out (or should that be - there's only e ways to find out?)

i'm creating the security.se tshirt this week..

with a new design

@Jin is it just a front or a front and back?

@Jin new design - bears, with wings, and lasers as per @AviD's request?

2

:-)

How many downvotes would I get for answering a question "winged bears with frickin' laser beams attached to their heads"?

4

@RoryAlsop it's just the front. the logo will be more refined. but overall design will be simliar.

9:09 PM

@Jin logo small on left chest, or large and central?

@RoryAlsop I have been forcing myself to vote more frequently.

@ScottPack It does have a good response, especially on newer folks, or those under 200 or 500 rep. I read a meta.so piece on the encouragement it gives to them

Q: How do I use the sleuthkit to find files that don't match the hashes in a hash database (like the NSRL)?

Wrong venue:

0

I am trying to figure out how to go through a drive image (created by DD) and find files that aren't listed in the NSRL hash database. How would you go about this? I can't seem to find a tutorial online.

hash forensics

The answer is to loop mount the image as a filesystem and then compute hashes on the files.

yep - agreed. Do you want to pop an answer on before I migrate it over

No, but thanks.

9:12 PM

@RoryAlsop centered

@thisjosh if you flag it before I migrate, you'll get flag points

I'm going to assume that there's no chance to have the shirts by the end of next week,e h?

@ScottPack Even if we became eligible tomorrow, I'm doubtful they'd be shipped so quickly.

@Iszi That was my assumption as well

flagged

9:16 PM

I am wondering if that applies to me, too.

Would be nice if we could get the swag before November. I've got some security training it'd be cool to wear a shirt to.

I have a "vote to close" button in the flag -> offtopic dialog. So i better don't try it.

@HendrikBrummermann Yeah - that becomes instant

very hard to resist, sometimes:-) But it means you just wait longer to see what the community does

@RoryAlsop yes

I think that's the only real gotcha

9:19 PM

@RoryAlsop no more rep for tag edits.

aye - and going for the Deputy badge is not really likely any more:-)

right - gotta get to bed. Back to work tomorrow and it'll be a long day trawling through emails

night all

Thomas Pornin

Good night.

Night +/- 12

9:39 PM

I'm gonna GTFO. Catch y'all on the flip-side.

10:05 PM

in SE Podcast Live Chat, 2 hours ago, by Jeff Ferland

Signal-to-Noise ratio.... ouch

@JeffFerland I didn't bother with the chat this week.

Did I miss anything...??!!

@Ninefingers no

Ah. Thought that might be the case. I had some more interesting stuff I needed to do; thought about the podcast but there's little difference listening live to listening to the edited version in a day or so.

only bonus i knew of was an invite to careers.so

@JeffFerland ah - I have got one as I was a careers 1.0 member

@Ninefingers I figured from your rep you would

10:15 PM

@Jeff I was actually hired through careers too, which is pretty awesome really.

I've never had any luck with recruiters; not having a degree I don't get a look in at most places.

Ditto, ditto

@Ninefingers Got a typo fix for you... "learnt" is in your resume.

@JeffFerland aaah thanks. I've found the more I write online (blogs, code, documentation) the more these things slip in.

Hey wait - urch.com/forums/english/9214-learned-vs-learnt.html

That's valid British English? TIL....

Yep, apparently. I didn't know that either but I read it and my brain said "no that sounds right" so I talked to my good friend google and...

@Ninefingers TAOCP -- how often do you reference that? I think that's one that would be fun to have on my bookshelf and that I'd actually pick random sections to read.

10:24 PM

@JeffFerland seminumerical algorithms I read, and as I say learnt humility! I was going to contribute to a project called MPIR (a GMP fork) but licensing issues kicked off, so a few of us started a brand new project which is currently going nowhere, but was fun.

I wanted to learn how to do arbitrary precision arithmetic and TAOCP vol II covers it, amongst other things, although there are other references too.

So doing that project, a lot; day to day, not very much.

My biggest thing is that I never aspired to be a programmer. People keep roping me into it... so while I've done a fantastic job on my feet and architected a few full systems, I've never been part of a programming team. Seems that programming jobs are easier to come by than good sysadmin jobs.

I think programmers have a tendency to say "if you've never read X, you can never be a good programmer" and it simply isn't true. Nor did I, ironically. I wanted to do Maths and started off in a stats job. It just so happened that I knew how to solve a rather key problem holding everyone up.

@Ninefingers Look at LibTomMath. The book is excelent

@this.josh I've heard of libtom; also there's modern computer arithmetic, and one of the guys I sort of didn't help very much writing bsdnt wrote a blog describing each part: wbhart.blogspot.com

@Ninefingers Yes, but you can actually compile LibTomMath and enable or disable various optimizations. Just studying exponentiation can be enlightening. The source is often used comercially because it is public domain: no open source encumberment.

10:33 PM

g'evening folks

@Iszi so do you usually go to these things in the buff, or just pants then?

'evenin +/- 12

@thisjosh luvvit, you'd be getting upvotes from me and @Jin, regardless of the question...

+/-

@thisjosh I might have to look at that more seriously.

@thisjosh once again, you've caused me a flurry of poststarring. I think you're beating @ScottPack's ratio of starred / total comments.

@Ninefingers really? thats awesome.

I was on careers1.0 too, but then I havent pushed it, mostly because I'm not really looking for a programming job.

@Ninefingers The source comes with a draft edition of the book in pdf form. libtom.org/?page=changes&newsitems=5&whatfile=ltm

10:38 PM

have gotten a load of offers via linkedin, though.

@AviD yep. I found a post, emailed the guy, had an interview and here I am.

@AviD I detest linkedin. Oh hey Avid, would you like to connect and keep in touch about job opportunities?

excellent

@Ninefingers sure, why not

wait, were you being facetious....?

@AviD yep, sorry. I'm not a recruiter :)

@JeffFerland usually you can claim any typo is valid british english, and most americans will believe you.

hehe, no I got that

actually, I've gotten quite a few gigs via LI, and not recruiters. though they do tend to pester...

10:43 PM

@AviD I suspect it works for higher level jobs which are all about networking. I keep getting adverts saying "do you know Django as well as (Django) Reinhart could play?"

@thisjosh excellent

@Ninefingers oh goodness

yeah, I guess so. plus, its especially helpful for freelancing

Wachu talkin bout, @Avi?

though I have had a few very good real FTE job offers from it too (though I didnt take any of them)

@ScottPack linkedin

heya @scott

Hiddidly-o

Be back in a bit. Time to do something about the little one.

wait till it grows?

10:46 PM

speaking of FTE - @RoryAlsop ran into a great new wecomic today (well, new for me anyway). think you'd like it...

onefte.com/2011/10/01/we-are-not-bad-people-2

@thisjosh I'm looking forward to that.

reminds me of that xkcd with time travel....

This looks like bad news

My FTE is becoming more tenuous by the day. Time to take a peek outside.

@ScottPack why?

10:49 PM

@AviD They're listing 1316 new tweets in 2 hours.

@ScottPack okay.....?

@thisjosh what is it you do?

Something has everyone a buzz, likely something bad

eh, its just the ~~iphone 5~~ iphone 4S coming out....

bbc.co.uk/news/business-15176947

The EU is in a bit of a crisis. Could be that.

or, its the other way around....

"Steve Jobs sneezed! EU economy collapses!"

2

10:52 PM

@AviD Formally I'm a software engineer.

and informally?

Could be the Android security issues...

What I actually do depends on the project I'm working: some systems, requirements, security review, implementation, etc.

@thisjosh okay, so overall software development and engineering...

whats the market for developers like there now?

its been up and down as of late....

Not so hot, depends on the specific segment. Looks like a good market for web developers, but that's not my background.

Sign me up here "The ****** mission is to create enterprise value through de-risking and re-balancing the customer's workforce"

@thisjosh say what?

11:03 PM

acsicorp.com/workforce-management/hiregenics

so, selling employees by the pound of flesh?

@thisjosh thats.... not real, is it?

check the link

seems generated by dilbert's buzzword generator....

did

the whole site is bozoish

another one "We share our knowledge with customers to help them manage their Human Capital more effectively."

gorammit, I am not "Human Capital", I am not a resource.

stop treating people like horses!

also, I hate - with a passion - those stupid, generic pictures of stupid generic people sitting around a generic laptop with stupid generic grins on their faces

11:08 PM

@AviD excuse me. You totally are. Now, how long will this project take, cause I need to fill in this very important gantt chart!

nothing whatsoever to do with the company or product

(i tried squeezing insipid in there, but got carried away)

I've actually seen some of those generic people on more than one site. Of course, as Human Capital, they've probably just been traded for twinkies, to work for more than one company.

Any problem with this statement? "Contractors give you the benefit of testing an employee’s skills and compatibility and allow you to hire for the duration of a specific project."

@Ninefingers I am not. Probably why I can't work for big or even medium sized companies anymore....

@thisjosh how many you want?

I was looking for three.

@Ninefingers btw, Gantt charts suck. Gantt charts are completely unsuited for planning software projects.

@thisjosh beyond the inconsistent grammar?

11:11 PM

Yes, just logical errors.

hmm, only found two.

besides, of course, the assumption that the HR managers reading that would have a an ice cream cone's chance in hell of having a clue wrt the employee's skill.

@AviD outrageous! My favourite ever line from a PM: "it's just a plugin architecture, so write your bit and we'll plug it in". Yes, but it's a bit different to an actual plug, this software thing...

OTH, I love this quote: Being not unproductive is a highly underrated skill.

onefte.com/2011/09/23/im-not-doing-anything-wrong

Thats why you need workforce management, they can tell you if the skill level is appropriate or not.

@Ninefingers yeah, exactly

so what were the 3?

LOL, wrt "Human Capital" - y'all seen todays dilbert?

11:18 PM

Why would you employ them if their skills are untested?

If they are not compatible why would the agency offer them?

those first two, I'm not too sure about - you can interview and test all you want, but until you work with them, its not the same.

like seraph said to neo: You never really know someone, until you fight them.

The duration of the project implies that its end is well defined.

@thisjosh ah, good one!

Yes but the contracting agency is supposed to be expert at those things otherwise you would have your own HR department do it.

I had:
You can't really test compatibility, if you treat him as an external Resource. It's just a different type of interaction.
And
Screw the employees, we'll take the resources as we need them, and dump them out as soon as we're done.

kind of the feeling that you get the cardboard box on your first day....

besides the inconsistent reference to "Contractor" != "Employee"

11:23 PM

Oh those are good too!

@thisjosh wait, what?

how on earth would the HR department have a clue?

@thisjosh Which brings us at last to the moment of truth, wherein the fundamental flaw is ultimately expressed...

2