« first day (293 days earlier)      last day (2970 days later) » 

12:20 AM
/me sighs
Nothing makes an evening better like a judicious mixture of bourbon, vermouth, and bitters.
 
here's an interesting, irrelevant set of facts: lincolnportrait.com/physical_man.asp
Turns out Abe Lincoln was incredibly strong.
 
12:39 AM
@thisjosh I see that you did there.
@AviD How else do you think he killed all those vampires?
 
@ScottPack Saw did you blind man?
 
@thisjosh One eyed men and kings and all that.
 
@ScottPack Kings who live in glass houses shouldn't stow thrones.
 
Now you've just being silly.
@AviD As someone who had spent a fair amount of time with an axe in my youth...wow. That is one hell of a work out. It's an entire core and shoulder exercise.
 
12:59 AM
I'm sure
okay, this has just become my own personal tag line
 
 
3 hours later…
4:12 AM
 
5:07 AM
@StackExchange Wow. Never did notice that...
 
 
2 hours later…
7:11 AM
What? The baseball fielder? XD
 
 
3 hours later…
9:53 AM
morning (+/- random offset 0:12)
@AviD I have found it very useful both when I was freelancing, and in big consultancies, both for finding opportunities, and for recruiting (I'm not a recruiter, before you get worried - I just had a large team requirement and it was an easy way to stay in touch with good folks over the years)
@AviD Yeah - it was slashdotted (schneiered?) when I tried last night
 
10:23 AM
@RoryAlsop ah, that explains the incredibly slow site.
and merry diurnalphism to you
@Iszi really? I still cant figure it out. pointer?
 
10:42 AM
@Iszi ahhhh, see it now! interesting...
funny, I only got it when I accidentally realized the xkcd / guy fawkes / willie mays was a modified logo. yeah, didnt notice it spelled fedex till I glanced in the right way... :$
 
Hey !
 
11:33 AM
Wasn't Willie Mays the character that Snipes played in Major League?
 
@ScottPack mayes hayes:-)
 
@RoryAlsop Near enough :)
In related news. The speed at which you issued that correction made me properly smile.
 
heh
@ScottPack just happened to be looking at the screen as it popped up
 
12:13 PM
So to speak.
 
Willie Mays Hayes. I hit like Mays, and I run like Hayes.
@ScottPack funny, that was the reference that popped into my head too.
thats how I know that willie mays is a good hitter....
 
12:36 PM
The battery died on my watch while I was trying to sync the time. :-|
 
12:47 PM
And the XKCD tooltip text is absolutely right.
Could someone clarify/correct the second comment here?
7
A: When are HTTP session cookies at risk over Wi-Fi?

Iszi If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties? No. Outsiders can crack WEP networks almost as if they weren't encrypted at all, these days. Insiders have even more ease of access. Even on WPA/...

 
@Iszi I think it is the piece around "ultimately" - if the session is only negotiated at the start, under http, then an attacker may be able to use it
 
@RoryAlsop I don't follow. You're saying in a case where the site uses HTTP for login but HTTPS for the rest of the session? Talk about senseless.
 
sorry - if the session identifier is negotiated while in http and reused, then there is a risk (I wasn't meaning session cookies - blame me for not really reading the headline but thinking of the general case)
a serverside session token might be a better phrase for what I was meaning
 
1:20 PM
@Iszi does that make sense?
interesting:
security basics in 140 chars or less
 
1:41 PM
Oh yeah, this is Information Security Awareness Month. ISC is going to have something every day related to that.
Usually some good stuff comes out of them during October.
 
I'm planning a big blog post after the Scottish Financial Crime Group Conference on the 27th as well - they do a lot of good stuff
I drafted some stuff about the OWASP AppSecEU conf but others did it way better than me, so I gave up
on the blog post side of things, we have one scheduled for the 18th, but nothing else...a good time for people to draft up any topics they like for the fortnightly ones, and it looks like we have 2 possibles for the QOTW - if someone fancies drafting one for this week:
1
Q: Vote for your QOTW #12

Rory AlsopFor QOTW #12, scheduled for publishing to the Security Stack Exchange Blog on 7 Oct, please post your topics as Answers, and vote for your favorite question from the whole Security Stackexchange site. Please post any question that you feel is worthy and your reasons. Try not to promote your own ...

And I think we need more bears on stackexchange.com/leagues @ThomasPornin
He's go the same on crypto - impressive bear-ness!
 
1:59 PM
@RoryAlsop Makes sense to me, I think. Mind adding a comment on the thread there?
 
@Iszi done - how does that look
 
@RoryAlsop Okay, except I think the "fix" is not applicable to the audience in this question. Question was from an end-user perspective, and the fix looks like it's on the server/development side.
 
2:15 PM
I'm really enjoying thinking of @Thomas as a bear. :)
 
I am pleading Not Guilty !
 
I'm going to blame my theatre background, but my first thought upon hearing someone called a "bear" is something a bit different.
 
@RoryAlsop Wow. I'm surprised physical security was so low on the list.
 
@Iszi yeah - surprised me a wee bit too. Odd call
@Iszi yes - valid point
 
I liked the "WEP = Unencrypted Wi-Fi" note.
We need to get a picture of Smokey The Bear saying this... or, maybe just @ThomasPornin: "Dear User: Millions of $$ of software won't keep you from clicking that link. Only YOU can prevent link clicking."
Oh, I like this one for a future QoTW...
1
Q: How to deal with tunnel applications such as TeamViewer on the corporate network

SilverViperOur IT department uses TeamViewer to provide support to users at remote locations. More recently we've noticed that users are using TeamViewer to get support for their lab equipment from vendors. Though I support the idea, it does bug me a little bit that someone could either accidentally or ma...

 
 
2 hours later…
4:40 PM
@Iszi why? "P" comes after "O" , its more than halfway through the alphabet. You did realize the list is alphebetical, right? ;)
 
 
1 hour later…
6:02 PM
hey, any you guys use digsby?
was getting ready to use it, when I read their Commitment to Security:
> When your IM, email, and social network account passwords are sent to our servers they are encrypted using the plain text version of your Digsby password, which is not stored anywhere on our servers.
 
@AviD Never heard of it.
 
great, but WTH are they sent to your servers in the first place??
 
@AviD Synchronization between devices?
 
@Iszi actually pretty cool multi-client, for IM / email / social networking / etc
 
I think Trillian behaves similarly.
 
6:05 PM
@Iszi hmm... okay, maaaaybe.
 
> You send the hash of your password and that is compared to what we have stored in order to authenticate you.
 
yeah, that reminds me of a certain question here....
 
I'm having a horrendously bad day after an epic fight with apt-get, so I think I'm just going to sit here and weep at that.
 
OTH, that still doesnt help get at your encrpted IM pwds.
except for bruteforcing those hashes....
 
Is anyone else ever tempted, when you know someone calling you is a "wrong number" caller, to answer the phone as "911, what's your emergency?"?
 
6:09 PM
hehe
 
@AviD no, but if you send a hash, the hash is the password. If you acquire the hash database, to log in, just send the hash to the server.
 
@Ninefingers obviously.
thats the question i was referring to....
 
ah ok, sorry, bad day.
 
authentication with them doesnt really give you much, other than access to your profile there.
hmm, perhaps also the encrypted IM pwds... but you need the original pwd to decrypt that.
that is, thats what I'm guessing - trying to verify that the client logs into the services, and not proxied via the server.
didnt see any traffic heading there.... but then I was only looking at http.
 
@AviD You do not want your data to be exposed publicly, if it is "only" password-encrypted.
So it makes sense for a server storing your password-encrypted data to serve it only to authenticated clients.
In the context of password-based encryption, you cannot prevent the storage server from having enough data to "try passwords", but that does not mean that you want to give the same power to, say, the whole population of Russia.
 
6:16 PM
@ThomasPornin of course.... ?
think I'm missing your point.
 
@AviD Possibly I missed yours, too. Deuce.
 
hehe
okay, I'll clarify:
I know there are certain insecurities there, just from that page. In general, most of that doesn't bother me, if the rest is solid.
specifically, I dont care about e.g. my digsby profile, but i care about my IM/email/etc pwds and data.
so hypothetically, I'm not too worried about the whole "hash is your password" thing; as long as that doesnt grant access to my other pwds.
 
@AviD Ok, I understand better now.
Based on your quote, they do not store your Digsby password; but that does not mean they they never get it.
Possibly, they store:
1. your IM/email/etc data, encrypted with a key derived from your Digsby password;
2. a hash of your Digsby password.
this would imply that there is a point during authentication where the server has your encrypted data and the password simultaneously, which is "suboptimal".
Things are better if they use a challenge-response based password verification scheme, in which case they would never have a copy of your Digsby password even transiently
or if, even better, they use PAKE (e.g. SRP)
Now that I have looked at the page, what they do seems clearer.
You have a Digsby password P
and some data D
E_P(D) (encryption of D with a key derived from P) and h(P) are stored on the server
to authenticate you send h(P)
so they never store or even see P itself
they can do an offline dictionary search on P (that's theoretically unavoidable, since they store your secrets in a way which can be unraveled with knowledge of P)
by sending h(P) you actually show that you already know enough to perform an offline dictionary search on P, so there is no harm in giving you E_P(D)
Of course, this is reasonably secure only as long as the key-derivation from P and the password hash h(P) use proper salt/iterations/bcrypt. The documentation does not give enough information on that.
 
6:40 PM
@ThomasPornin yeah, thats kind of what I was thinking.
@ThomasPornin reading between the lines, its pretty clear that they're not using bcrypt, and probably not iterations.
furthermore, it looks like the IM pwds are not stored on the client at all, meaning that they are retrieved encrypted from the server on logging in, and decrypted clientside with the remembered digsby password
 
@AviD That's cloud computing. Very fashionable.
Mind you, it is convenient. I recently switched my main machine, and my StarCraft II saved games followed automatically.
 
of course.
and, if thats the case, I think id be okay with it.
flaws and all....
18 hours ago, by AviD
user image
 
@AviD Image not found
 
was more worried that the digsby server acts as a proxy to the im, performs a login for me.
pretty sure thats not the case
@Iszi aww.... @rory said they got /. - traffic load pretty heavy
Its hard to maintain a standard when everything you see is nowhere near it.
4
 
@Iszi It is there, just very slow.
 
6:50 PM
You know how medical staff can, over time, lose their sensitivity to unspeakble trauma?
in that context, I can accept that their not using PAKE / bcrypt / other things beyond the bare minimum....
 
heh
that onefte actually has a lot of priceless items....
 
@AviD INF again.
 
awww maaaan
 
Shopping recommendation &// too localized...
0
Q: pyhisical laptop lock for dell n4030

ShadowPressI brought this really great laptop, but i cannot find something that i can lock the laptop physical to the desk or avoid thief's from grab this laptop There is no "universal" hole there that 99% of the laptops... not that ive noticed at... (I mean thing like that: http://www1.dealextreme.com/pro...

 
7:00 PM
think it should be generalized....
 
@AviD Nah, I think flat-out closed.
 
@AviD If you edit, do not forget the typo in the title; it makes my eyes bleed.
 
@ThomasPornin Yeah, what is that? "Pie-high-sickle"?
"Puh-high-sickle"?
 
hows it look now?
 
Still gonna result in a product recommendation(s), which is not what SE is for.
And FFS... why did he initially tag it as ?
 
7:05 PM
@Iszi umm.... poor random generator?
I find that non-regulars usually use very random tags, even when there are some obvious ones.
on the other hand, his laptop does HAVE wifi, right...?
@Iszi wanna have a try and be more explicit?
 
@AviD These days, that's generally presumed. Unless N4030 is some twenty-year-old product.
@AviD I don't see any way this question could not result in "product recommendation" answers. Though, now that it's more generalized, it may still be something worthwhile here.
 
@Iszi ah, so thats why it has that tag. Can someone please create a tag for ? I'll go ahead and add to the q.
@Iszi thats my hope.
 
@AviD You're not serious, are you?
 
I meant the 2nd half, duh
 
Posted by Alex Miller on October 5th, 2011

This week, Jeff & Joel are joined (in studio, no less) by David Fullerton, head of the NY Dev Department, and Jason Punyon, a developer here in the office.  Its a fast moving discussion covering all kinds of topics, like:

Stack Exchange 1.0 (which gave users wanting their own Q&A site the Stack Exchange software, without being official Stack sites) is touched on. Jeff discusses the clones that exist and their reason for existing.

Trello’s launch caused some kerfuffle on Web Apps.SE when general (and off-topic) help questions started being asked. In the larger sense, they discuss the necessity of applications and products to have their own unique help service. …

 
7:11 PM
"something worthwhile"
 
Back!
 
Front!
 
:P
 
7:40 PM
Y'know, it'd be nice if that "Firefox is already running..." dialog would have a "Kill Firefox" option.
 
8:00 PM
sure
 
@Iszi Would it count as murder or suicide ?
 
@Iszi Disagree here. Laptop theft is a serious problem, and OP is asking for a solution.
Oh it's been edited thats why it looks ok. Sorry, catching up
 
@thisjosh However, Google says that the Dell n4030 has a Kensington hole, so the OP has not only failed to do some basic research on Google, but also on the laptop that he has under his eyes.
Can a question be closed for OP laziness ?
 
@ThomasPornin Unless he bought a grey market knockoff in which case he may not have a Kensington hole.
boy my editing sucks.
Actually the picture is of insufficient resolution to determine visually and the technical spec don't list Kensington hole.
Yep, it's intended market is Malaysia.
 
8:21 PM
@thisjosh <quote>This product is unavailable. Below we have suggested a like or better computer to satisfy your immediate needs</quote>
Damn, how do you typeset a quoted block in chat ?
 
I think you use single quotes
 
anyway, when I follow the link I have the spec and photos of an Inspiron 14, not the same computer type.
 
Oh oops, poor fact checking on my part.
Yes its the 4020 instead of the 4030
You know it dings me every time you edit that post :P
 
@thisjosh Of course I know it. I am perverse that way.
2
Serves you right for giving me faulty syntax advice.
 
Somewhere there is a test chatroom intended to let you experiment, but I forgot where it is.
 
8:41 PM
@thisjosh Ah, I got it. You begin the line with a '>'. It is not compatible with linking the message to a previous message
 
Maybe you could request a chat improvement.
 
9:13 PM
@ThomasPornin Y'know, I was trying to find that, and didn't. Linky?
 
@ThomasPornin remember you can edit (and therefore view the source) of any chat message as a mod! Yes I can ! Awesome !
 
> This product is unavailable. Below we have suggested a like or better computer to satisfy your immediate needs
@ThomasPornin Like that?
Use a greater-than with a space after it at the start of the line.
 
@Iszi Yes, that's what I found by trying in the sandbox.
 
9:47 PM
ey up +/- etc
 
@RoryAlsop Hello visitor.
 
:-)
 
You should get a new bronze badge in a few hours
 
ooh - which one?
and how can you tell?
 
9:49 PM
I tried to monitor that sort of thing ages back and failed so I gave up:-)
I'm assuming that one of the data.se things will tell you?
 
I saw that you had 21 responses for a total of 99 upvotes
so I upvoted one of your answers for that tag
apparently, such tags are awarded once per day (per night)
 
Yay :-) cheers - (Occam's Razor should have suggested that would be how you knew:-)
 
Anyone feel positive about cloud + security?
 
@thisjosh Hahahahahahahahaahahahahahaaaaa
 
@thisjosh Yeah, I am positive : I know "job security" when I see it.
 
9:56 PM
@RoryAlsop Thats my general feeling, the article "Being Smart about Cloud Security" in the Technology review (published by MIT) seems too optimistic to me.
So I have to ask "Then what's your worst-case scenario for organizations that shift to the cloud?"
 
@thisjosh I have written an article which may end up in the ISACA journal early 2012 on just a few of the issues which most organisations will come up against -
lack of location control for data
lack of control over copies of data
lack of control over jurisdictions
lack of segregation of duties
lack of control over dynamic/volatile asset registers - leading to licencing issues
resilience
increased attack surface
...
etc
 
Human sacrifice, dogs and cats living together... mass hysteria!
 
LOL
 
And thats just the SysAdmins!
 
likely case: not realising beforehand that what was easy before suddenly becomes impossible, leading to fines or sanctions for data protection or other regulatory failures
 
10:02 PM
Who knows what will go on in marketing?!
Where'd my cloud go? Whose responsible for the cloud, Frank, Jim?
poor visibility into responsible parties
 
zigackly
 
fingerpointing
 
Hey @RoryAlsop!
 
you saw the news about some company that monitored elderly care patients through 'the cloud' and lost all connectivity for an extended period of time? They had NO backup solution!
@Mvy evenin'
Bon nuit - izzat right?
 
How are you?
Bonne nuit (Good night)
 
10:05 PM
None? Not even some paper?
 
@Mvy not so bad - had a charity day today so got to play Guitar Hero at lunch time:-)
 
But usually not to greet someone, but say goodbye :P
 
@thisjosh nothing accessible within 24 hours, which was longer than their BC/DR plan could cope with
@Mvy ahh
 
@RoryAlsop I heard a wonderful (thus probably fake) anecdote about an automatic defibrillation system in an hospital
 
I'm may visit your country soon @rory
 
10:06 PM
According to the story, there are those patients in successive beds,
 
@ThomasPornin at least this incident wasn't quite that bad:-)
 
Their DR plan could not cope with over 24 hours? Who wrote it?
 
@Mvy Yay - whereabouts? and when?
 
Nottingham
 
@thisjosh yup - that bad:-)
 
10:07 PM
probably end of next week
 
@Mvy Nottingham is unfortunately far away in a different country:-)
 
Yeah, I though so too :P
 
if you were coming to Scotland, particularly to Edinburgh - I'd offer you a drink:-P
 
@RoryAlsop splutters different country eh??!!
 
when one has a failing heart, the system automatically sends electric shocks. But one of the programmers was using Fortran and the other assembly, so when patient 11 got a heart issue, that's patient number 10 who got the shocks -> in a few minutes, 11 dead people.
 
10:08 PM
@Ninefingers :-)
@Ninefingers Oh flower of Scotland - oh, sorry - you guys beat us in the rugby:-)
Good match though
 
@ThomasPornin Sounds false, no hospital would buy a machine for each patient, too expensive.
 
@ThomasPornin LOL :P
Sounds indeed false.
 
@RoryAlsop I'm not sure we can necessarily say we played all that great tbh - you had us on the ropes for almost the entire game. In some ways after that effort I almost feel sorry for the Scottish team. They played a great match.
 
Kind of a geeky joke. (Hope it's false... cause 11 deads would be bad)
 
@Ninefingers I did think we had it in the bag :-(
 
10:11 PM
And the nurses union would have a fit if they were replacing nurses with machines
 
And that would imply the system are connected to some central monitoring?
 
@thisjosh aye
 
"Oh sorry, we could not have revived you, there was no service. Please accept our apologises for the incovenient"
 
@thisjosh In France they replace nurses with Spanish nurses and the unions do have a fit.
 
@RoryAlsop I didn't actually watch the first half, but I could tell that was the case from the language coming from those actually watching it...!
 
10:13 PM
Wonder who the replacees are in Spain...
 
@thisjosh All down that path lies Somalia. Where people just die.
 
Thats was my guess, somewhere in Africa.
I call it employment turger pressure. National boundaries and laws act as a semipermeable barrier against a pressure from the difference in wages and conditions in different countries.
 
@thisjosh Osmosis of Human Capital
 
@ThomasPornin Exactly, but I don't like to refer to people as human capital.
reusable skill containers is however acceptable
3
 
10:40 PM
0
Q: Securing data by physical isolation

Eric Di BariI was having a conversation recently discussing security approaches. It had to do with the idea that data placed on a networked device can never be completely secure. In the age of the Internet and on-demand data availability, are there situations where data security and integrity is so importa...

It's an old question in the tag on SO, but might be more on topic here?
 
10:58 PM
@Ninefingers It certainly has little value where it is. However the question is asked in a more argumentative way, it may require some cleanup.
 
11:18 PM
@thisjosh back to that, are we?
@ThomasPornin aren't French Nurses one of France's main exports?
 
@AviD Capital day isn't it!
 
it was
 

« first day (293 days earlier)      last day (2970 days later) »