@vignesh - as @Jeff said, it is important to realise that all here are users or moderators, and not employees. This is a community site, managed by the community and moderated by volunteers who were voted into position by the community. There are a few employees who come and visit, but by and large their role is to provide the infrastructure and support us in growing our own community.

This does mean that some things are just not able to be answered by us, and others might need to wait until someone has time in their day to assist.

Looks like @AviD spent an awfully long time talking about his barrel.

@ScottPack He mentioned that he had to lift it up to get it down hills, too.

@Polynomial Typical Avi.

I need a gold bagde

It's missing to my collection

@M'vy fanatic ;)

@M'vy so does my barrel.

I'm working on my 3rd.

@Iszi but unfortunately it forces encryption on you

XD

I managed to get one on SO, so this is possible

@Gilles not necessarily, there is such a thing as NULL ciphers...

(it's unsung hero badge, but still a gold one)

I'm half way to Fanatic

52/100

Which one is that one?

@Polynomial I just got my third yesterday, I think

^_^

@AviD how do I tell my browser to use one?

@Gilles I'm not sure I'd call that "unfortunate".

@RoryAlsop Remind me to log in whilst we're at 44con

if I miss a day imma be pissed.

@Polynomial definitely - that and the daily blog

@RoryAlsop Indeed.

@Gilles can I assume that you're asking pejoratively?

@Gilles The best way is to set up your server as only supporting that cipher suite.

oh, and remember that timezones often catch people out - Checking morning and evening is best

@ScottPack and assume your client supports that too.

I'm at 79 consecutive. Can't believe I haven't done 100 in a row yet.

@AviD Since when have clients been important?

@Iszi the upside is that if it didn't force encryption, you'd have many different options to make sure you've set right. The downside is that you can't, in practice, use SSL without encryption

@AviD pejoratively? I don't think this word means what you think it means

@ScottPack as I am in Professional Services, I would have to say: never.

@RoryAlsop Stack TZ is UTC if I remember Correctly

@ScottPack it's not my server

@Gilles yes, that one is one that I know.

@M'vy Fanatic is the one where you visit the site at least once a day for 100 consecutive days.

@Gilles Then it's not really your choice.

BTW it may be easy to make a bot doing this.

@M'vy but that would be cheating

@Iszi there should be one for a whole consecutive year.

@Rory indeed

@M'vy there are protections against this (you can't just wget the home page) but of course they aren't perfect

I think there is one individual SE network wide - who has 101 rep on every site as well as fanatic on every site

or nearly every site

@Gilles I meant, I assume you know, but you're making me answer to prove a point?

@AviD Agreed, but having worked on the 100-day one as I have lately I'm starting to wonder if that's even possible.

It would have to be a platinum-level badge.

(And we could use some of those.)

@AviD then that should be “rhetorically”

@Iszi ha! been there, done that.

rhetorical question = not expecting an answer

@Gilles but with an evil twist.

362 consecutive

and no, I don't know how to configure chrome or firefox or w3m to use a null cipher for certain sites

not for all sites obviously, sometimes I do want encryption

The web server also has to support NULL ciphers, which you're unlikely to find.

Why is anybody wanting to use a NULL cipher?

and does the null cipher even provide authenticity?

@JeffFerland I want authenticity without encryption

I think mod_ssl on Apache, by default, only supports Medium and higher.

@Gilles s/What/Why/

@Gilles Is this a theoretical, or do you actually have a use case where stripping encryption is worthwhile?

@Gilles oh. just assumed you knew everything about that stuff. :)

but yeah, what @Scott said.

encryption → no caching

Are Windows Update downloads encrypted?

to have caching with authenticity, you need to take precautions too, since caching is by definition a replay, so you won't be getting fresh data

yes, it does provide authentication - the ssl handshake is still the same, via certificate checking and such. However, depending on what hash youre using (can also be NULL), you might not get integrity, which means you dont have authenticity even after the authentication.

@ScottPack Why would they?

@M'vy For integrity purposes. I think they are, but I don't actually know for sure. I do, however, know that they are distributed via CDNs, so they are cached.

@ScottPack I assume so, simply because it is over SSL, and I doubt they would go for the NULL ciphers.

it means the server (not the HTTP server but the machinery behind it) has to be configured carefully to return good expiration dates, and the client and the proxy have to understand when data is stale (in practice, this doesn't happen)

No need for encryption to get integrity or authentication.

@AviD eeep, yes, authenticity is what I meant

@M'vy No, but it's easy.

And what do we know about developers?

@M'vy true, but talking NULL ciphers you might be including NULL hash cipher too.

They're lazy.

@ScottPack and stupid.

most of 'em are ugly, too.

@AviD I know there are some in here, so I wasn't going to be that brutally honest.

I would only make a signature of the updates. The decryption is too much of a overhead for the client

That's why I am so different - I'm only lazy and stupid.

@M'vy ah, but over what protocol...?

HTTP

@M'vy that's what I advocated (and considering the crowd here I was surprised not to be downvoted into oblivion)

There is no interest to crypt it, since you can verify the integrity and source.

dont forget, SSL givers you authentication, besides the integrity and encryption.

And the update is basically a public thing

These days, when you're talking about downloads across the Internet, the network is the bottleneck with SSL encrypted traffic.

HTTP and sign the files with PGP.

So the content is not something to hide

@M'vy encrypting can give privacy. Sometimes (an eavesdropper still knows how much you downloaded and when)

I'm not disagreeing with you, in principle - but that would be too much work, to reimplement it all without SSL.

@JeffFerland yup, that's how Debian and Ubuntu (and many other Linux distributions) do it

@Gilles They can also monitor which site you access

@M'vy "windowsupdate.com" is not really giving anything away.

which updates you download, is. Sorta.

@M'vy You're right. Er, didn't I say this? Oh, no, I didn't: I meant “how much and where from and when”

Hm

@AviD It can, however, give you passive information about what OS you're running, which patch level, etc. Which is pretty stinking good information for passive collection.

@AviD if I get my updates from skype.com, though...

anyway, even if you only need a "secure" protocol, with authentication and integrity, SSL is still the easiest. And they happen to throw in encryption, so who cares?

@AviD no, SSL doesn't provide what we really want in a package distribution system

@AviD Back to caching.

"Sorta."

not in the Linux model anyway, which has no central authority that both makes and distributes the software

true that.

but so what?

there are other specialized caching mechanisms for windows update.

Do people really monitor the updates you're getting? They have no way to be sure you applied it, so they still want to try known vulnerabilities, don't they?

like WSUS (or whatever its called these days).

in the Windows model (which is eroding), each vendor handles the distribution of its own applications, so SSL can work

Too much on-topic chatter in here.

@M'vy "Electorate" is easiest. Just vote for 40 distinct questions every day. In a fortnight you'll have the shiny yellow smudge.

@ThomasPornin Oh, that reminds me...

@HackToHell hello

@vignesh Hi

@vignesh Do I know you ?

@HackToHell i guess no

Umm ok

well already discussed but like to discuss more

can we trace one's ip through chat?

Yeah if you get the guy to click a link

@HackToHell you meaned like phishing mails

No need to fake anything, just run a local server, get the guy to connect to it and ta da you have the ip address

but suppose while chatting in gtalk & similar sites its possible?if yes how can i prevent it from it?

the only way to protect from it is to not give out your IP address to the server, e.g. via Tor.

but why would you care? it's only an IP address.

see: security.stackexchange.com/questions/19018/…

Have any of you guys read Zero Day? I've got a copy, but haven't gotten around to it.

@vignesh Most modern routers have a default firewall, you cannot do anything. How ever to get into someone else's computer, there is always metasploit ;)

@Iszi Nope. I used to really like Mark Russinovich, but I'm starting not to. He's become really greedy and pushy.

I liked Windows Internals, but that's a reference book. I can't imagine I'd enjoy his fiction much.

@Polynomial but google says like this productforums.google.com/forum/#!topic/talk/ThKMKPMkmOc

@Polynomial It still boggles my mind just a bit that someone who writes books such as Zero Day and Trojan Horse, and therefore is presumably security-minded, would write tools like the PsTools which send authenticators in the clear.

@Iszi He's not really a security guy. I think his books come from his fantasy to be a security researcher.

@vignesh It's not google and the guy there says the same.

@vignesh That answer says exactly the same thing that I did.

@Iszi Is it any good, like does it involve guns,planes and computers ?

an IP address is just an address. it's used to route network traffic to you, just like a real mail address is used to route letters and packages to your house.

@HackToHell Like I said, I haven't gotten around to reading it. From what I know of it though: Planes and computers yes, guns maybe.

someone knowing it isn't a security problem. it's nice to keep it reasonably private for privacy reasons, but beyond that there's no reason to be worried about people knowing your IP.

anybody aware/remember about iloveyou virus?

@HackToHell Wouldn't rely on the router's firewall. Keep a good host-based firewall up as well. That also will help protect you on public networks when you roam.

yes, I remember iloveyou.

vbscript malware.

pretty nasty, just due to the destructive nature of it.

So's your face.

it replaced all your documents, music, etc. with itself.

@Polynomial you too got infected?

@vignesh No. I just know what it does.

ILY was only around for a short while back in the early 2000s, but it's one of the most costly to have ever existed.

did they found whom written it?

yep

apparently the dude that wrote it only released it accidently.

^^ love it

Mister 477K rep

yeah, the SE systems catch those downvoters quite quickly.

@M'vy you don't get 477k rep by being downvoted constantly! :P

indeed

How do downvotes interact with the cap? Skeet doesn't lose any rep for a downvote, right?

@Polynomial atpresent any malware.virus similar to it?

You can actually exceed the cap I guess

if you get downvoted, then hit the cap, then refunded

I think

@vignesh no. ILOVEYOU was dangerous because it was a vbscript attachment, which most email clients didn't block at that time.

@M'vy The rep cap is 200. If you earn -10 from downvotes and +250 from upvotes, you get 200.

so jon doesn't feel downvotes anyways

if you earn +205 and -10, you get 195

but accepts aren't covered by the cap

so if you earn +200 and -10, and an accept, you get 205.

I think you still lose rep for downvotes you give, but not for those you receive

@CodesInChaos nope. they're under rep cap.

otherwise you'd only be able to get 198 if you downvote someone.

@Polynomial what about flames?

only things that don't count to rep cap are accepts and bounties

@vignesh Flame? that's completely different.

is it malware?

@vignesh Flame is only interesting because it's thought to be by the same people who made Stuxnet.

I think half my answer downvotes are for bad hashing

yes.

@CodesInChaos Oh god yes. Same here.

if I added up every downvote I've given for bad hashing methods, I'd hit a negative rep cap

@CodesInChaos The other half are for you know who and his tinfoil hattery.

I was mainly talking about my SO downvotes

I don't have that many downvotes on sec.SE

@CodesInChaos Oh, yeah, that too. Actually on SO most of mine are for mysql_query.

HERP DERP PARAMETERS PLZ

I don't downvote for that. I only comment that parameterized queries might be a good idea

I only downvote if they manage an actual sql injection vulnerability

(In part because I don't how to do a parameterized query in php myself)

That's what I mean - bad use of mysql_query.

at the time I wrote php, we wrote our own wrapper

it's so incredibly easy to use PDO / MySQLi these days.

that combined format string with escaping

but W3Fools continue to screw us all by pushing the mysql_* functions, which are actually advised against by the PHP devs, and are to be deprecated in PHP6.

So you'd write query("select... where x='%s'", param) and it worked correctly

because the wrapper automatically sent the param through mysql_real_escape for non-numbers

these days it's $stmt = $pdo->prepare("select ... where x = ?"); then $stmt->bind('s', array($x));

where s implies string

so it's context-sensitive

if you included an int, you might do: $stmt->bind('si', array($x, $y));

nowadays I'd use something like that too, if I were in the unfortunate situation to write php

where $x is your string, and $y is your integer.

I actually like PHP.

once you get past its quirks and the HORRENDOUS tutorials, it's easy, scalable and maintainable.

compare that to ASP.NET, which has a learning curve steeper than ancient Egyptian algebra these days.

hm? Didn't find the learning curve of ASP.NET that bad

but I didn't do much with it yet

I'm a seasoned C# WinForms dev. I tried ASP.NET. My brain went "WHAT THE SPORK IS GOING ON?" and I got a headache.

Webforms or MVC?

that's my point.

Webforms is an abomination.

MVC is relatively simple and decent

Not really great, but getting working knowledge of ASP.net isn't that hard

I can't even remember which I tried.

I think I tried both. One wanted me to set up a bunch of database connections and configure a XAML repository or some shit.

If you ever try it again, remember to try MVC, and not WebForms

so I said "PASS!" and moved onto option #2.

and option 2 was like... "what the hell am I doing?" :s

I was just kinda expecting to get a Main method, and go go go, output some HTML and shit!

that'd be nice.

I don't do that even in php

Even in php I prefer a clean separation between view and logic, typically using something like smarty for the view

see, that's where I'm not so clear on.

I hate PHP frameworks. They're dumb, and overly abstract a language already designed to output content.

however, I do see the need to have logic and content separated

With MVC you write one method per page that returns an object that contains everything you need to render

And then a .cshtml page which is mostly html with a bit of mixed in C#

so I just write a bunch of classes to represent objects, then utilise them in the content pages.

I should probably get an ASP.NET C# MVC book.

an up-to-date one.

@Iszi From reddit huh ?

sadly, I bet it'll spend 300 pages explaining ints and strings and structs.

@Polynomial I can't agree with this more.

Add to the fact that many frameworks are horribly documented.

And you got an incredible headache to work with.

tbh, if you're working on something super-enterprisey, you don't want PHP in the first place.

once the term "MVC" crosses your lips, PHP is out.

Well clean php code, even without any framework is pretty similar to MVC

PHP is for sites that want to do something, and don't want to be a pussy about it. It's like Russia: the programming language.

Our php code was pretty much MVC, long before we ever heard the word

I usually have a class for each object, like User.class.php, SomeObject.class.php, etc.

then write pages that utilise the objects.

And if you split the pages in two

in cases where there's a lot of bullshit, I have separated out the pages a bit.

first one half working with the objects

and then an output page doing the rendering

You have your controller and view

I hate how Zend Framework automatically links the files together with barely any explanation on how they do it.

I very much prefer writing clean php code.

Much neater imo.

one day I'm gonna be sewper-hardc0re, and write a whole website in x86 asm.

winsock APIs for serving pages

@Polynomial There are quirks. E.g., yesterday, I hit the cap but remained at +190 (+15 for an accept). Explanation: someone upvoted me, then cancelled his upvote. The +10 for upvote was forgotten because I was already at +200, but the -10 for unupvote got through, and I was capped at +190. Subsequent upvotes did not change it...

@ThomasPornin Odd. I'd guess that's a bug rather than intention though.

So, next time you hit +200, I can upvote/unupvote you a few times and destroy your rep...

Did you only get 190, or was it just a display bug?

good point.

@CodesInChaos I did get only 190...

did you try triggering a recalc?

@CodesInChaos Yes. First thing I tried.

Not sure how much that button does nowadays

@HackToHell HowToGeek.

So you figured that one out :/

@LucasKauffman Going after the competition votes for the mobile stuff now, eh?

@Polynomial trying to

you got a +1 from me, anyway. that article on android encryption was interesting

but 5 questions with some level of depth are hard to find

let alone getting 5 votes on each :<

indeed

So far no one has won anything good right?

nothing above level 1

The interest seemed to have died out after week 1.

shell scripting got 0 attention

Just got Vox Populi. 132 question votes to go 'till Electorate.

So... about 4 days if I just spam question votes.

@Iszi you can always spam my mobile questions :3

In other news, we're only 62 questions away from having 5k.

w00t

make that 61

@Polynomial Aww, and I can't vote on it for another 9 hours...

@Polynomial +1

might be 60 actually, since I posted 2 questions.

depends when you ran the stats

I forget half of my questions before I get around to asking them