The DMZ

Terry Chia

2:30 AM

@Gilles Nice, one of the funnier amazon reviews.

Terry Chia

4:09 AM

@Polynomial Any recommendations on guides to kickstart learning c#?

Stack Exchange

4:34 AM

I've been sneaking out at night and installing lamps on the underside of every photovoltaic panel I can find. Sure, there are upwards of 80% losses, but I prefer to think of them as nearly 20% gains.

Polynomial

5:48 AM

@TerryChia Dunno really, I learnt VB.NET after coding in VB6 for a number of years, then realised "wow, C-style syntax is much nicer!" and moved over.

Jeff Ferland

7:09 AM

@TerryChia Thanks for the comment template

Terry Chia

@Polynomial ahh ok. i'll try to code something fun to pick it up.

@JeffFerland it is from the new review page. pretty cool.

Jeff Ferland

@TerryChia Niiice

Not nice: support.google.com/chrome_webstore/bin/…

Urgh... back to Firefox. Way to fail, Chrome.

Terry Chia

@JeffFerland eh, i do support the change to a certain extent. it does make it slightly more secure for the average user.

i always use FF for any fancy plugins that i need anyway.

Jeff Ferland

@TerryChia Yes, but I can't find a way around it without some seriously heavy work.

Terry Chia

@JeffFerland let's face it. their primary concern isn't us power users. it's the average user who knows nothing about security.

Jeff Ferland

7:16 AM

I just hope that Firefox figured out the memory leaks in the past few years

Terry Chia

Memory leak has gotten better i think. doesn't really impact my usage anymore. Or maybe it's the 16gb ram that is helping.

Polynomial

7:47 AM

0

Q: how to program my own TOKEN using atmega64

I'm trying to create a sample security token with Atmega64, And now i'm a little confused about how to program that. As it mentioned in PKCS11 Document token hardware should support about 70 function. But my question is how should i write those function for my Atmega64 and i use AVR Studio 6 - AV...

migrate to SO

Andrey Botalov

Had SEI sent t-shirts for participation in anniversary contest? At September,28 I received email asking about my t-shirt size and address but I haven't received anything thereafter

Rory Alsop

@Polynomial done

Polynomial

ty

Rory Alsop

@AndreyBotalov they send from the US, so expect a few weeks

I think last time I got one it was about the 3 week mark

@JeffFerland your hours really are crazy aren't they? You still up as I get to work

Jeff Ferland

8:02 AM

@RoryAlsop No reason for it. I've been playing with IPv6.

Rory Alsop

ahh - so it isn't work then. Playing with IT is totally understandable

Andrey Botalov

@RoryAlsop I thought they will send confirmation message before actual sending

Rory Alsop

8:23 AM

@AndreyBotalov I don't recall that previously...

think they just batch them up and send 'em out

Jeff Ferland

f = open("wordlist","w")
start = int(1e10)
while start < 1e11:
 f.write("%s\n" % start)
 start+=1
#Don't make all your routers have 10 digit passwords

Damn, I thought I'd be iobound. Should have written it in C.

AviD

9:17 AM

@Aarthi Yay! but that's not saying much... after all, I'm everybody's favoritest Avi...

Rory Alsop

@AviD :-)

AviD

@Gilles did you set it up for her?

Rory Alsop

The wonderful thing about Avi's is Avi's are wonderful things.

AviD

@Polynomial strangely, I felt more comfortable moving to C# from VB3-thru-6, rather than VB.NET.

@RoryAlsop dat's true!

Polynomial

@AviD Yeah, I just kinda figured VB.NET was the obvious move at the time.

after putting it off for a while, having that whole attitude of "It's not real VB!"

AviD

9:23 AM

it's really not.

Polynomial

then promptly realised "what the smeg was I thinking?" when I tried it.

.NET is vastly superior

AviD

absolutely - but still carries over the good parts.

on the rare occasion that I get tasked with a client's VB.NET codebase - and cannot convince them to switch - I find it to be such a chore.

@Polynomial @RoryAlsop really? I read it as "are there any security problem with this", which should be here.

Polynomial

@AviD There wasn't anything in his code that was even vaguely related to security.

he was asking "how I do write the functions for PKCS11?"

which is off-topic. the answer is "you don't, unless you're a cryptographer", but it's still a programming problem.

AviD

@Polynomial heh. well, the first part of the answer should come from here. on a re-read, I see the question is more about any function for atmega, rather than specific to pkcs11, so you would be correct.

@Gilles how do you get that it's about privacy? or accountability, for that matter?

I see nothing about either, even after the edit (other than the final question, which seems disconnected from the rest of the post).

as I read it, he's worried about either no-longer-valid credentials being cached (e.g. a user that was fired), or about a misguided notion that it would be easier to crack the password on a stolen machine.

Polynomial

9:43 AM

@AviD The question is pretty ill-defined anyway.

he changed his mind and turned it into an electronics question after it got migrated

AviD

@Polynomial lol

Polynomial

an electronics shopping question.

so it was off-topic at Sec.SE, off-topic at SO, then not constructive at EE

herpderp

AviD

I think the user should be autobanned after a stunt like that.

Thomas Pornin

@TerryChia You could learn Java first. C# syntax began as a clone of Java, then they added extra tricks (operator overloading, delegates, inferred types, LINQ...).

Polynomial

not really. the problem was that he was asking about what he thought was the correct means to an ill-defined end, so when I pointed out the whole "ur doin it rong" aspect of it, he had to change his question.

@ThomasPornin He could, if he was smoking a whole bunch of crack ;) </java_hate>

2

Thomas Pornin

9:48 AM

@Polynomial Prejudice kills productivity.

Polynomial

@ThomasPornin It's not prejudice as much as "I <3 C#"

and the whole OH DEAR $DEITY, ORACLE, WHAT DID YOU DO!?

AviD

@Polynomial shoulda closed it, and asked a different one.

Polynomial

@AviD nods

Thomas Pornin

The only situation prejudice is fine is against VB -- because VB kills productivity even more than just mindlessly hating VB.

Polynomial

@ThomasPornin haha

AviD

9:50 AM

@ThomasPornin Java kills productivity.

Thomas Pornin

@AviD I have been pretty productive in Java, but maybe that's just me.

Polynomial

@AviD Oracle kills everything.

AviD

@ThomasPornin well, relative to C or C++, sure.

Terry Chia

@Polynomial Don't worry, i have strong java hate as well.

Polynomial

heh

Thomas Pornin

9:51 AM

@TerryChia Hate leads to suffering.

Polynomial

I don't mind Java, I just think it's a bit "ye olde" these days.

Terry Chia

@ThomasPornin Come to the dark side, we have cookies.

3

AviD

with you on the hearting and C# combo, btw. It is truly an awesome language / environment to develop in.

Terry Chia

@Polynomial Eh, Vbox is still doing ok.

Thomas Pornin

@Polynomial So is C#, when you think about it. It is very old-school.

AviD

9:52 AM

@TerryChia waaaiiit for iiiiit.....

Polynomial

Java's been patched and forked and re-patched and re-forked and Oracle'd for so long it's just a bastardised monolith of its original simplicity.

AviD

@ThomasPornin it may not be as ~~new~~ juvenile as some scripting packs, sure.

Terry Chia

Python fan first and foremost. I just want to learn a new language.

Polynomial

@ThomasPornin Not really. If we consider .NET 3.5, it's only 5 years old.

Thomas Pornin

I mean, just look at it: structured blocks, as Algol ? Check. Unextensible syntax ? Check. Modular integers as the basic type ? Check.

AviD

9:54 AM

@ThomasPornin "unextensible"? Why would you say that?

Polynomial

the reason I chose .NET 3.5 as an example is that it's what basically kickstarted the popularity of it.

AviD

@ThomasPornin Object is the basic type. Integers are a specific Value Type

Polynomial

if you want to go back to the real original (.NET 2.0) it's 2006, which is still only 6 years old.

AviD

@Polynomial it was popular before, but it was not as great.

Thomas Pornin

@AviD I cannot define in C# some piece of code which defines a new arbitrary syntax that I can use right away. With 40-years old Forth, I can.

Polynomial

9:55 AM

@AviD Yeah, hence my point about .NET 2.0

AviD

@ThomasPornin right away, maybe not. but you can create a new domain language.

Polynomial

@ThomasPornin Actually, you can, sort of. Expression trees and such.

Thomas Pornin

@AviD That I can do with any language.

Polynomial

and extension methods

AviD

the syntax wont be arbitrary, but it is extensible, on the same syntax.

@Poly was gonna get to those.

but wait, @ThomasPornin what do you mean, arbitrary syntax?

Polynomial

9:57 AM

but why would you want arbitrary syntax? seems kinda counter-productive if you've got more than one person reading it.

Thomas Pornin

@Polynomial Arbitrary syntax is a powerful tool which, as all powerful tools and nuclear weapons alike, is best used with cautious restraint.

Yet it is sometimes very convenient.

Polynomial

@ThomasPornin Which is why expressions and dynamic are available.

it's not strictly arbitrary, but it allows for some crazy stuff like logic and dynamic expressions based on conditions or even types.

Thomas Pornin

@Polynomial Well, let's say I am not overly impressed.

Polynomial

and when integrated with LINQ it's incredibly powerful

Thomas Pornin

Although I can imagine that people coming from a bare world of C would like it.

Polynomial

10:00 AM

in fact, I'd argue that LINQ has done more for data integration than any other language has.

Thomas Pornin

I think that the more languages you know, the more limited they all appear.

When I see a language, I cannot help thinking: too bad it does not have feature X that language Y has.

Polynomial

var orderItems = from OrderItem oi in db.OrderItemsTable where oi.OrderId == orderId select oi;

instantly readable, makes complete sense, and 100% integrated into the database

even PHP, whose main job is to do exactly that doesn't have such integration

AviD

10:23 AM

@Polynomial I think Ruby has something similar, with its ActiveRecord. @RoryMcCune?

@Polynomial I dont disagree (and compiler implementation challenges, aside). @ThomasPornin what would be the benefit or usecase where this is useful?

Thomas Pornin

@AviD I usually need that a lot when implementing cryptographic algorithms

AviD

@ThomasPornin go on?

Polynomial

@ThomasPornin Can you give a solid example, though?

Thomas Pornin

@Polynomial saphir2.com/sphlib

I use C macros a lot, because C macros are the only tool I have in C for that

And also code generators

AviD

@ThomasPornin Is this like that old lawyer trick from the shows, malicious compliance? flooding us with reading material?

Thomas Pornin

10:27 AM

And even macros for a code generator

Polynomial

@ThomasPornin C macros aren't really arbitrary syntax, they're a preprocessor trick to convert x to xyz.

Thomas Pornin

@Polynomial Oh yes, I never said that C allowed for arbitrary syntax as I would like

Polynomial

you can do almost exactly the same in C#, via generics and expressions.

AviD

@ThomasPornin you shouldnt implement your own cryptographic algorithms, you should always use ones implemented by cryptographers

hehehehehe

Thomas Pornin

@Polynomial Except the part where the code runs fast, or runs at all on a 75 MHz ARM CPU with 32 kB of RAM.

Polynomial

10:28 AM

@AviD He is a cryptographer ;)

@ThomasPornin You wouldn't have .NET on an ARM CPU anyway, so it's a moot point ;)

AviD

@Polynomial I know, hence the chuckles, but it made me larf

@Polynomial waaiiit for SurfaceRT...

Thomas Pornin

"larf" ? Is that a word ?

Like the offspring of "laugh" and "barf" ?

Polynomial

@ThomasPornin It's a phonetic spelling of how a stereotypical Brit would say "laugh".

AviD

well, it's the typical automatic response to anyone saying anything about crypto algorithms (hell, Poly said this about a different question just an hour ago), some people might forget that there ARE those who DO have to implement them.

@Polynomial I'm sorry, is that offensive? ;-)

Thomas Pornin

@AviD No, "LOL" would be offensive.

AviD

10:32 AM

I still havent quite understood how sphlib requires arbitrary syntax.

Thomas Pornin

@AviD I had to use code generators -- which are arbitrary syntax: I am writing some code which is to be executed at compile-time.

If you want a non-cryptographic example, lookup lex & yacc

AviD

is that functionally equivalent to code being compiled at execution time?

Thomas Pornin

@AviD That's what the .NET and Java designers say, but that's only because they totally disdain any notion of startup time or limited RAM.

AviD

@ThomasPornin in .NET that's not true.

at least the concept of startup time and limited ram.

it's not the default, or necessarily common, but it does exist.

AviD

10:58 AM

anyway, I'm still not getting it. What benefit do you get from it, that would be difficult to express in "regular" syntax?

I assume you're not just talking about "precompiler code" (which does exist), which is also not "arbitrary".

Scott Pack

11:41 AM

If it can't be done betternin Perl then it ain't worth doing.

</NECKBEARD>

AviD

well, if it's obfuscation you're looking for, brainf**k or whitespace could be better. Sometimes.

Scott Pack

Or LISP, if you're going to include the joke languages.

Polynomial

@ScottPack If we're including joke languages, VBScript is a must.

AviD

@ScottPack lol, you did that better than I.

Scott Pack

@AviD Yeah....

@AviD For the record you are also my favorite Avi, if not necessarily my favorite avi.

AviD

11:55 AM

@ScottPack I would expect that you recode your favorite avis to mpeg.

Scott Pack

I don't much care for reencoding. Results are iffy.

AviD

did have to reread that a couple of times, to be able to parse it.

Scott Pack

For the record. My phone kept attempting to autocorrect you to 'David'.

AviD

Ah, why don't you just go autocorrect yourself!

Scott Pack

Why so mean?

AviD

12:38 PM

Why do vendors insist on stating "The world's only <some generic X>", when I just looked at 4 other sites that stated the same damn thing?

rather, I guess I should say "vendors' marketing teams".

Don't their product managers survey the market occasionally? Like, maybe look at the first page of results on a simple Google search for the terms you claim you're the only one to provide?

well, this makes it easier: when looking for candidates for anything identity- or SSO- related, if they prominently display a login box with no SSL, a quick CLOSE TAB is a no-brainer.

should have been... but I kept reading one more page. Now my head hurts.

Scott Pack

So, maybe it's just too early for me to be reading, but this seems a bit bogus. Anyone care to comment?

> The Classless Inter Domain Routing (CIDR) notation 135.8.55.8/24 is incorrect because it contains an incorrect network mask (/24). A CIDR notation of 135.8.55.8/29 would be correct.

I have a feeling one of us is being pedantic here and I'm wondering which one.

AviD

12:58 PM

I dont think pedantic is the word you're looking for.

I'm no networks guy, but why on earth would he claim /24 is incorrect?

or is that in context.

Scott Pack

That's what I'm wondering.

AviD

in general, I'm pretty sure you can mask however many bits you like.

well, up to the maximum, of course.

/92 would be senseless.

Scott Pack

At least in v4, yeah.

AviD

(assuming IPv4, of course)

Scott Pack

So with the /29 then 135.8.55.8 is the address of the network, and with /24 then 135.8.55.0 would be. However, 135.8.55.8/24 and 135.8.55.0/24 are functionally equivalent (albeit with 0/24 being the preferred).

Which is why I'm suspecting pedantry on someone's part.

This is from SANS, so, you know, probably them.

AviD

1:01 PM

this is curious: Intel now has a SSO service. Aren't they a chip company? At least stay in the realm of hardware.

Scott Pack

@AviD Intel does own Foundstone, or have you forgotten?

AviD

@ScottPack as a matter of fact, I did. but this isnt them.

Then again, I did also forget that they also own Mcafee. Which it is them.

so yeah, guess that makes sense. -ish.

Scott Pack

@AviD No, but the whole Intel owns McAfee thing is the first one I thought of when you referred to them as a chip company.

AviD

@ScottPack you heard how that came about, right?

Scott Pack

Which?

AviD

1:04 PM

Intel CEO: "hmm... I have a new computer..." To his assistant: "Get me Mcafee!"

Scott Pack

heh

Iszi

1:34 PM

Funny thing, here. This just became a "Popular Question". Weren't we talking about a similar question yesterday?

4

Q: How can I clear cached domain credentials?

Related: How can I enable domain authentication over wireless in Windows 7/2k8? To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an account that hasn't had its domain credentials cached on the local system. Unfortunately, there's only...

windows-server-2008 active-directory windows-7 authentication

AviD

1:47 PM

@Iszi heh. almost identical, just better.

Iszi

@AviD Difference being my question doesn't have a requirement for automation/scripting, or avoiding usage of Admin rights or the Registry.

AviD

@Iszi ah. but everything (almost) in windows is automatable, and one or the other you'll need admin rights.

but I guess that was the base of the question...

AviD

2:05 PM

Hey, anybody ever hear of Okta? e.g. how it compares to things like Ping, Symplified, etc.

@RoryAlsop see ^ (you're probably the most likely to have run into it)

seems to be the closest to what I would have liked to see for the Cloud SSO thingie...

in fact, seems they even implemented it in a similar architecture to what I was beginning to think of...

Rory Alsop

2:19 PM

@AviD I haven't seen it implemented in any of my clients yet, so can't comment unfortunately

AviD

@RoryAlsop thanks. Have you heard of it at all?

dont want to deal with anonymous identity services...

Rory Alsop

@AviD I have heard about it, but only a little bit of info - it's on my list to research more

haven't heard anything bad about them, though :-)

AviD

was more worried about providing service credentials to any random website :)

@RoryAlsop my first impression was that it was a clueless also-ran. The more I looked into it, the more they're leading my list of initial candidates.

Symplified just barely edged past them, based more on reputation and reputableness.

when I couldnt find anything decent for a while (took some googlefu, believe it or not), was shocked at the lack, then started thinking about a new idea for a startup...

both relieved and disappointed that there ARE some good solutions out there.

Polynomial

3:57 PM

Bad Programming Sign #481: When your code produces a 2.4GB Excel spreadsheet.

come to think of it...

Bad Programming Sign #482: When your code produces an Excel spreadsheet.

3

Terry Chia

@Polynomial Is there a list for the first 480?

Polynomial

not yet ;)

Terry Chia

@Polynomial time to get writing! ;)

Rory Alsop

@Poly - I see your blog post is well underway. I keep thinking I should properly populate the trello each time, and end up mostly running out of time

Scott Pack

4:20 PM

Worst part of setting up a new PC: Installing Office.

Install...update...update....update...update...update...

Rory Alsop

@ScottPack aaaaarrrrgh - just roll em up into one already

Scott Pack

No kidding

The boss and I talked about this the other day.

We both appreciate the linux model.

All update are cumulative.

Rory McCune

@AviD @Polynomial yeah Ruby has a couple of good ORMs for this kind of thing, ActiveRecord is probably the best known. Very handy for exposing databases to code but does introduce some security issues with default automatic mapping of all columns to the objects

AviD

@Polynomial while I dont disagree, there times where "Export to Excel" is a user requirement.

@RoryMcCune right, I know about that.

also the security issues... though supposedly the previous update solved that, sorta somehow.

but actually was asking about syntax, things like LINQ that @Polynomial was talking about.

Iszi

4:45 PM

@AviD Or CSV at least.

Rory McCune

4:57 PM

@AviD yeah the syntax is similar, to that :) the security stuff they fixed by defaulting it to no access rather than all access...

Iszi

5:31 PM

Wow. There is apparently no way to ultimately force a tie-breaker in the presidential election with these numbers: 538 members of the electoral college, 50 states represented in the House, and 100 members in the Senate. In the case of the ultimate uber-tie, the Speaker of the House gets the presidency until the House and/or Senate can make up their mind.

►

Yet another way (again, explained beautifully by C.G.P. Grey) our election system is totally screwed up.

Scott Pack

I miss the good ole days when the VP was just the second place candidate

You know what would also be awesome? If the electoral college was reformed into something meaningful.

Iszi

@ScottPack Seen that video yet? Apparently, in cases of a presidential election tie at the electoral college, the VP gets chosen by the Senate - it may or may not necessarily be the same VP that ran with the chosen presidential candidate.

Scott Pack

Some states give all their votes to the winner, some states divide up their votes according to the results, some states require their votes to vote according to the wishes of the state, some don't.

Iszi

@ScottPack There's a whole 'nother vid already done on that.

Scott Pack

Busted I think is the best word.

Iszi

5:35 PM

Actually, two videos on that.

►

Scott Pack

It's amazing how much of our current system is such a clusterfuck of amendments and convention.

Iszi

A great point in the last video there, at about 4:19 - "How you can become President with only twenty-two percent of the popular vote by taking advantage of the Electoral College today!".

Scott Pack

5:52 PM

yeah

Iszi

6:06 PM

Here we go. Made a playlist of all of C.G.P. Grey's videos on elections. youtube.com/playlist?list=PLEcHCTVM79BMISVn4AV5EXSglGDzRgwgG Total duration of all videos is a bit over 48 minutes.

Jeff Ferland

7:03 PM

@ScottPack You mean like most software?

Iszi

8:00 PM

Since when did Google get involved in politics? Try a Google Image search for the terms "completely wrong"

Gilles

8:11 PM

4

Q: How do I install userscripts in Chrome on Linux?

Help! The only way that Chrome allows userscripts to be installed now is by downloading the file to my local system then dragging and dropping it into the extension manager interface. However when I try to drag it over, nothing happens! I've tried using the file managers in both Gnome and KDE en...

google-chrome file-manager drag-and-drop

Jeff Ferland

@Gilles Thanks!

Gilles

@JeffFerland It's gotten better. Chrome, on the other hand, seems to be getting worse

I stopped using Chrome a couple of days ago (I posted my woes here)

Jeff Ferland

I love competition. It lets me walk away from stupid.

2

Gilles

even before I pulled the plug, it was leaking memory, I had to reboot it every couple of weeks, then twice a week in the last days

they seem to leak differently: Chrome dislikes opening and closing a lot of tabs, Firefox dislikes following a lot of links in the same tab

with Iceweasel 10, I noticed a leak when reading webcomics (lots of clicking “next” in the same tab): after hundreds of pages, switching between tabs would get slower, even if I closed the tab with a long history

I've switched to FF 15, haven't much experience with it yet

One annoying thing with FF is that you have to reboot it to install or upgrade most extensions

also, it is slower than FF for most rendering

and it crashes on the occasional website

so does chrome but at least only the tab goes snap

ObSecurity: niap-ccevs.org hard-freezes my Firefox 14 under Windows at work

With FF 15 under Linux with a blank profile, it freezes for a bit, then I get a message about a runaway script

Jeff Ferland

Cool, you can prefill the question title field. security.stackexchange.com/questions/…

Gilles

8:22 PM

@AviD I think she installed it on her own on at least one computer. Which would make it strictly more than she's ever installed Windows on her own. I know she's done several version upgrades on her own

@JeffFerland and the tags

Jeff Ferland

I tried the message body too, but it doesn't transfer the info to the load there.

Gilles

@JeffFerland AFAIK there's no way to prefill the body

Jeff Ferland

@Gilles Seems that way.

Gilles

@AviD I don't claim that Linux is always easy to use or install

I do claim that it's easier than Windows

Digital Fire

Posted up: security.stackexchange.com/questions/21413/… Hope there isn't a dup floating around.

Gilles

8:25 PM

(if you compare comparable things. Not if you set a preinstalled Windows against a Linux that you have to install on your own on unsupported hardware.)

Digital Fire

Yay my Fuzzy wuzzy question is almost to 20 upvotes =]

Gilles

0

Q: WHM server hacked, lost root access

I have a huge problem. In a nut shell, 2 days ago I noted a strange process going on with httpd, something I never saw before. That then led to me googling it, and OVH came up top with "Examples of a hacked server" So I freaked out, but didn't do anything as the rest of cpanel forums said it wasn...

centos

not sure about this one (other than upvoting the comment): duplicate? off-topic?

Digital Fire

@JeffFerland I looked through the site to find a dup. couldn't find any that were close to the question. I posted the bullets to "hopefully" craft the best possible answer.

Gilles

15

Malware

Proposed Q&A site for proposed Q&A site for humans seeking help with removing malicious software, anti-virus support, and other malware/infection-related help. Malware.SE is not confined to computer-related-only malware/infection help.

Currently in definition.

1

Q: Isn't this a subset of security.SE?

Proposal: Malware Discussions on malwares are not off-topic on security.SE. The malware tag has a 100+ questions. I feel this proposal's topics would be happily covered in that site, and a new proposal would just divert traffic from it.

technology merge-request

Digital Fire

9:03 PM

meta.security.stackexchange.com/questions/1030/… Let me know if this question is appropriate to post.

Gilles

1

Q: Is this is a duplicate of Computer Security Hacking?

We have a proposal, Computer Security Hacking, that passed the definition phase and is now in the committment phase. It has 26% of the required committment needed in only 30 days. If we stay focused on building a community, we could have a site in beta by 2013, give or take a few months dependin...

technology

Digital Fire

@Gilles My stance has been that it is different because that can focus more on skiddish/blackhat topics. After some time thou, I've come to believe it is a dup.

David

Anyone tested/used this successfully (gets windows passwords from fingerprint readers built-into laptops) github.com/brandonlw/upek-ps-pass-decrypt ?

Gilles

@DigitalFire blackhat isn't a topic, it's a hat color

blackhats and whitehats have the same questions

they might ask it in different ways, but “how can I make this attack work” and “how can I prevent this attack from working” are fundamentally the same question

Digital Fire

@Gilles The "How Can I" version of that thou usually gets shot down around here if it isn't asked correctly from a 'white' perspective.

Gilles

9:12 PM

@DigitalFire not really, and the downshooters get shot down too

we had discussions on meta about this a month or two back

it turned out that while there used to be some vague anti-black-hat language in the FAQ, that had never been supported by any popular opinion on meta

questions from a black hat perspective get the occasional antagonistic comment and assorted close votes, but the community predominantly accepts these questions. There's no policy against them, and any vote to close as off-topic based merely on blackhatness would be invalid

Digital Fire

Hmmm... Well i guess sometime later this week ill test that theory out. I have a few "black" questions that i've written down but never posted due to this very discussion.

Gilles

I'm a firm proponent of not discriminating against black hat, because I'm a white hat and getting answers from black hats is very interesting to me

As there was some debate looming, I was getting ready to go all huffy about lobbying for black hat

and it turned out that there was no lobbying needed, the community (or at least the part that goes to meta) was largely in agreement

Digital Fire

@Gilles If that is the case, then the need for that 'other' hacking site is merely a dup.

Gilles

@DigitalFire indeed

Digital Fire

Again, I will test this theory out as I have a few interesting questions to purpose. Hopefully my 100% question acceptance wont be tainted by them. lol

Thomas Pornin

10:26 PM

@ScottPack That's Evolution at work. The system which works kills off systems which are merely good or elegant.

Digital Fire

10:45 PM

Really want to get this question meta.security.stackexchange.com/questions/1030/… 'answerable', not overly broad or become a dup. Any suggestions on improvement?

I believe i might need to break it down into parts =/

Transcript for