« first day (776 days earlier)      last day (4402 days later) » 
00:00 - 15:0015:00 - 00:00

00:21
Eh, it works.
Bear #2 upvoted a question, got his "supporter" badge, then cancelled his upvote to get back to his nominal "zero vote" status -- and he still has the badge.
@ThomasPornin badges are never taken away except in cases of fraud
except tag badges, you do lose them if you stop being eligible
you can easily get Disciplined that way (you might have more trouble with Peer pressure)
of course, Real Men consider this cheating
00:40
@Gilles ....but he's a bear....
@ScottPack are you implying that bears are inferior to humans? That's speciest!
@Gilles I'm simply pointing out the inaccuracy of comparing him to men.
Does anyone still say "World Wide Web" anymore? The trainer said it just after 0:30. I'm not sure how much more of this I can take asp.net/mvc/videos/mvc-2/aspnet-mvc-for-the-rest-of-us/…
@Gilles that does sound vaguely fraudulent.
@makerofthings7 I've heard some Italians say it in some webvids too.
Is that racist?
or speciest?
@makerofthings7 I've been learning up on ASP.NET MVC WebAPI. Very cool stuff.
Nationalist, maybe ?
00:54
albeit 2 thirds of it's name are apparently virtual.
@AviD I've been toying with that too... only have WCF Services knowledge that's 2 years old.
@AviD I'd be shocked / think it's funny if Vittorio Bertocci (MSFT) said it... smart guy heavy accent & entertaining
@makerofthings7 I actually think it might have been. very thick accent.
their names all sound alike to me.
Mr. Pasta Pizza Bagguette.
haha. A friend of mine refers to herself as a Pizza Bagel. An italian jewish girl in NYC
Hmm what am I: Polish / Scottish + some French
Kelbasa in a kilt?
2
@makerofthings7 hahaha, that actually sounds delicious.
don't want to say that on the mean streets of NYC... would likely be misinterpreted
01:01
@makerofthings7 better than San Francisco. ;-)
@makerofthings7 Funny thing, Bagels are considered jewish food only in US. Here they are considered American food.
@makerofthings7 Unpronounceable haggis -- with garlic.
@AviD Crazy!?! wow
@makerofthings7 DAFUQ? Sounds like "pigs in a blanket" but with Polish sausage and bagels, or something.
@Iszi That's racist.
D'ya know that all those Polish jokes Americans like to tell, Brits tell about the Irish?
Right, @Rory @Rory @Poly?
@ThomasPornin Aaah this is why I've never seen or heard of haggis: "Since 1971, it has been illegal to import haggis into the US from the UK due to a ban on food containing sheep lung, which constitutes 10 to 15% of the traditional recipe"
01:06
@makerofthings7 yup. Well, in the US I'm considered Israeli, here I'm considered American. So it is what it is.
@makerofthings7 whaaa???
@makerofthings7 Americans are madmen.
4
@ThomasPornin "Americans"??!!? It's the Scots that eat that stuff!!
We were actually amused, in the movie Armageddon one of the guys is explaining what haggis is. And we already knew!
@ThomasPornin I believe the canonical translation is “These Americans are crazy”
California has banned foie gras, too.
Israel did it too !
01:10
But this craziness comes with its own punishment (wiz. not eating foie gras).
around 1:35
@ThomasPornin Is it because of "animal cruelty", in force feeding and fattening?
that would make sense here.
@AviD That's what Wikipedia says
@Iszi heh, I forgot, that was a funny movie. Should watch it again.
Fastforward through the "drama" parts.
01:13
But by the same reasoning, California should ban the 50% of its own citizens who inflict the same treatment on themselves.
hehe
but noone wants to eat their livers.
well, almost noone. I hope.
@ThomasPornin Force feeding and fattening? That has to be the states in the midwest, and Chicago
@AviD This is America. Of course it has a substantial proportion of wannabe cannibals.
@ThomasPornin Speaking of which, there is a dating site to meet policemen/women
(did you hear about the canabalistic policeman?)
 
1 hour later…
02:20
@ThomasPornin While grammatically more accurate, that carries along with it some slightly different baggage.
@AviD Can human be kosher?
 
3 hours later…
 
3 hours later…
08:39
@AviD but Haggis is good :) you just don't think too much about what's in it!
09:01
@RoryMcCune oh I'm sure it is. It does sound delicious!
@ScottPack Well, let's look at the facts: Assuming a human is not a bird, and not a fish, it would need two (or was it three?) attributes to be kosher: split hooves and regurgitation.
While some humans are regurgitory (especially depending on how much they had to drink), I think you would be hard pressed to find many with split hooves.
@AviD does a camel-toe count... :)
So it seems they would not be kosher. (Ignoring the explicit commandments against eating humans, and even drinking blood, medieval pogroms notwithstanding.)
Centaurs, now, that's a different story. Centaurs would probably be kosher, but I cannot say for sure.
@ColinCassidy oooh, good point.
So, it would be okay to eat a drunk coed with a camel-toe?
@AviD not sure, let me google that. I'll be back in a couple of hours
@ColinCassidy LOL. nsfw...
the best conversations are when we get to combine two of the room topics - in this case we got 3!
 
1 hour later…
10:11
Afk, ritualistically drinking centaur blood.
om nom nom
@AviD Yea, the fuzzy notepad rant is fantastic. Someone actually went out of their way to make a double-claw hammer, and mark it with the PHP logo.
@Tinned_Tuna haha, excellent.
@Tinned_Tuna ahhh, right - thats why the analogy seemed familiar.
Being in SE means that you get to read a lot of rants on SE. It's a rather hilariously under-researched field, resulting in a lot of comical hubris.
Stack Exchange is a hilariously under-researched field....? I'm confused.
10:23
Software Engineering :-p
Sorry :-)
heh. Dont usually hear it that way.
I'm part of an engineering research group. I want to do some software engineering research, but I'm only a research associate at the moment. I'm not important enough to have my own projects :-p
"I'm not... " WHAAT?? Be your own man! Or woman! You're damn well important enough to research whatever the hell you want.
Academia be damned!
But really, in this day and age, there are many other options, some better, than academia for doing research.
@Tinned_Tuna Actually, there is quite a bit of solid research in the field (though clearly nowhere near enough). The problem though is that most of the "professionals" in the field ignore all the scientific and empiric research.
Oh, there's a fair bit of research. Just it seems like far too little. I like the idea of tool support making certain errors impossible, personally.
Take PHP for example. By the time it was created, there was plenty of research and knowledge available about designing programming languages. They ignored it all.
10:29
haha, yea. Poor PHP. It's the butt of all the language design jokes.
It's more of a joke than brainfuck -- a language whose entire existence is a joke.
@Tinned_Tuna Agreed on that. Though tool support is not necessarily research, its development, and some tools do that already. (depending on the certain errors)...
Well, yes, but what tools are needed? Are they feasible? Why do we use Java and run FindBugs once a month but our (by god I hope deterministic) unit tests every build?
Why is Java lagging behind in the region of property based testing in terms of uptake?
Does property based testing really help, or is writing the properties overly difficult? Why are some problems/APIs significantly harder to apply property-based testing?
etc.
I see. Interesting.
Though the answers to a lot of those questions lay more in the realm of (group) psychology, not CS/SE.
I have a question I'm not sure if it should belong on the main site so I'm gonna ask here first. Does a processor architecture(x86 vs ARM) significantly affect password hashing?
@TerryChia in what sense?
10:36
@Tinned_Tuna Speed-wise.
@TerryChia because, GPUs are much faster at computing a hash than a general-purpose CPU
I don't know about the differences between architectures though.
Reason I'm asking is I have a chance to work with some Raspberry Pi units for my project work as part of my diploma. Thought it would be interesting to do a distributed password cracker with it.
@Tinned_Tuna I have in mind the hashing functions that don't work well on GPUs, mainly bcrypt and scrypt.
@TerryChia that would be a good idea
scrypt with the right settings can max out (RAM & CPU) a Raspberry Pi
@TerryChia I think your best bet is to do some measurements on similarl-spec/price CPUs and see what happens
I suspect that it won't make a major difference, but that x86 will come out on top (but will consume more power whilst doing so)
Heh. I just want to see if there is any obvious things I should note before proposing it to my supervisor.
I'm not familiar enough with the architectural differences to really make a call on it, to be honest.
10:41
@AviD Do you think it would be a good fit on the site? It isn't specifically about security, but about a hashing function on different architectures.
why do you think a raspberry is a good device for password cracking?
If you have access to similar spec tablets, one intel one arm, both running droid would be a good testbed
@CodesInChaos I think he basically wants to make a low cost supercomputer
well, cluster.
@CodesInChaos Mainly because each unit has a good amount of RAM.
I'm just brainstorming for ideas right now.
@CodesInChaos regardless of the rPi's actual abilities, however meager, when you multiply it up, it could be quite formidable.
For bcrypt you need a fast CPU cache of a few kilobytes, not much RAM
10:42
@CodesInChaos but scrypt is a different beast again :-/
@Tinned_Tuna Yeah I mainly have scrypt in mind.
fast CPUs benefit scrypt, since you can keep the RAM for each attempt around for a shorter time
I'll have access to a cluster containing around 60+ Pis, so I was wondering if the idea is feasible.
how many cores does a PI have?
@CodesInChaos it's an ARM11, I think it's just the one core.
10:45
> The SoC is a Broadcom BCM2835. This contains an ARM1176JZFS, with floating point, running at 700Mhz, and a Videocore 4 GPU.
I wonder if you could delegate bcrypt to the GPU? I think the rPi's GPU is not FOSS-friendly though, so it may be difficult.
so a single intel CPU would probably as fast as two or three dozen PIs or so
(unless scrypt becomes memory bandwidth bound on such a CPU)
@CodesInChaos 24*25 ~= £600 for a cluster that size,
benefit, if correctly designed, is that you should just be able to add rPis to increase the effect.
4 cores vs. 1. 3.5 GHz vs. 700MHz, twice as fast per cycle
Hmm alright. The numbers doesn't look really feasible.
I'll have to do more consideration.
10:50
@TerryChia I would encourage researching it either way -- It's better to know for definite one way or the other. And besides which, I like rPi clusters. They're cool.
:-p
and depending on the parameters, GPUs can be quite fast at scrypt
Even if you just benchmark hashing speeds on an rPi
@CodesInChaos isn't that the point of scrypt parameters -- to put it out of reach of most GPUs?
for example for the small parameters litecoin chose for mining, GPUs are more efficient than CPUs
@Tinned_Tuna Heh. Pretty excited I'll get to play with a decent sized cluster soon.
@CodesInChaos why does litecoin use scrypt?
10:51
it wanted to be CPU mining friendly
I don't follow. Why does it matter if you mine using CPUs or GPUs?
I didn't follow litecoin, they don't seem very useful to me
but CPUs are beginner friendly
@TerryChia I think its a good question, but I'm torn between here and crypto.
ask @ThomasPornin.
@TerryChia I think you should do some benchmarks and publish them (not like, in a journal, but definitely a blog post or two would be interesting)
Though from I what gleaned, GPUs are better for bruteforcing because of the parallelism, not anything specifically crypto-ish.
10:56
@AviD iirc, that's correct.
@Tinned_Tuna I'll see how it goes. But it will be a few months at least before I start work on it and I might have limitations on how much I can say on my own. It's a school project with collaboration with a company(doubt I can say which :P) after all.
I'm going to harass a friend for some rPi time :-)
do some of my own benchmarking
11:24
Yey, my friend is going to let me benchmark hashing on an rPi ^.^
11:39
@Tinned_Tuna Cool. I'll be very interested in the results. :)
12:12
@TerryChia @Tinned_Tuna: ARM is a 32-bit arch, it is rather bad at 64-bit arithmetic, so it will be slow on SHA-512; but competitive on SHA-256
For bcrypt, you need about 4 kB of fast-access RAM, which fits in L1 cache for both ARM and x86 -- but it is rather unfriendly to GPU
scrypt needs much more RAM (configurable) and works on latency of the external memory bus, which then depends on the motherboard
For that matter, many rPi might be better than a single big x86 because memory latency does not scale up like core frequency
I mean that 1000$ worth of rPi might hash more passwords with scrypt than 1000$ worth of x86 PC
/me schedules some time on an rPi for benchmarking... :-)
and goes for lunch, see you laters.
For continuous effort, you would have to factor energy costs in
In the long term, energy costs more than hardware.
But in winter time, in houses which are heated with electricity, energy is "free".
@ThomasPornin I see. So besides the aforementioned 32-bit vs 64-bit, the architecture itself(I'm thinking of the underlying assembly code) doesn't play a huge role?
@TerryChia Not really. Architectures tend to offer the same kind of elementary operations.
The Thumb instruction set of ARM is usually a bit slower
@ThomasPornin Alright. I think i'll write up a question on that so the information doesn't get lost in the chat logs. Mind popping your answer in later? :)
12:18
You'd better use the "standard" (older) ARM instruction set, if that's still allowed (some newer ARM cores deactivated it)
@TerryChia It shall be done.
so my bios has an 'enable nx/dep' option. which i have turned on. i don't understand, I thought DEP was a software thing? I mean the kernel keeps track of what pages have what flags for each virtual memory space. why is this setting in my motherboard?
15
Q: How do ASLR and DEP work?

PolynomialHow do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?

:)
@TerryChia thanks :)
i guess i should probably get into the habit of actually using sec.se once in a while :P
Two excellent answers from our two biggest repwhores around. :P
Hey, you actually commented on @Polynomial's answer quite awhile ago.
@TerryChia hehe
i think that was one of my first posts here
12:27
Still can't get over the fact that the two excellent answers only got 40+ votes between them. While this less well written answer managed 500.
539
A: How can I explain SQL injection without technical jargon?

PolynomialThe way I demonstrate it to complete non-techies is with a simple analogy. Imagine you're a robot in a warehouse full of boxes. Your job is to fetch a box from somewhere in the warehouse, and put it on the conveyor belt. Robots need to be told what to do, so your programmer has given you a set o...

STACKEXCHANGE IS UNFAIR
and my book quote got over 200
212
A: Why not use larger cipher keys?

lynksI dug out my copy of Applied Cryptography to answer this concerning symmetric crypto, 256 is plenty and probably will be for a long long time. Schneier explains; Longer key lengths are better, but only up to a point. AES will have 128-bit, 192-bit, and 256-bit key lengths. This is far longer ...

@AviD Feel free to migrate to crypto if you feel it is more appropriate there.
12:41
@TerryChia I think the beauty of that answer is that anyone can understand it - developers, managers, QA, support, sales, etc. That's why it made the rounds on Twitter so quickly.
I originally wrote up a more in-depth slightly-technical analogy and didn't like it.
12:54
@Rory if you were interested in kickstarters for great watches - you'd be better off with this smartwatch. Very cool.
Already in production, and check out the kickstarted funding ratio there.
@AviD Have you read the review on that watch? It seems functionality is still quite beta-like for the time being. Mostly owing to poor OS support.
@TerryChia read a review, it was glowing...
@TerryChia OS on phone? thought they had apps for that.
I'll see if I can dig up the review I read.
@AviD I meant poor OS support for the app.
eh. I'm not buying, just thought it was really cool.
Yeah, I love the concept.
The review is mostly positive. But it does mention some flaws.
13:00
so we can hack peoples watches now?
i approve of this
@lynks Meh, not that big a deal.
@lynks change the time remotely, make them late for that important meeting.
That app-controlled door lock was way stupider.
Ahh here it is: lockitron.com/preorder
@TerryChia a later model will probably have wireless connectivity, have it dial out to a C2 server for the purposes of spying
@lynks It's probably the first step in making hacker movies come true.
tap-tap-tap doors open
13:47
@AviD Oh, so in order for a mammal to be kosher it must have split hooves and be a ruminant?
@ScottPack ruminant! yes, that's the word, thanks!
@ScottPack yes, that is correct.
@AviD So horse is not kosher because it has neither non-split hooves nor is a ruminant?
correct again!
hmm, do centaurs have split hooves?
Which explains why squirrel is not kosher.
No, centaurs are horse-people.
I was actually making an assumption that, since a centaur has at least 2 stomachs (human and horse), it would need to be a ruminant. But I guess no hooves...
13:50
@ScottPack @AviD I'm lost. I'm not sure if I want to go back and read the chat logs for the sake of my sanity.
@ScottPack What would you call a cow-people?
@TerryChia hahaha, you should be used to that by now :D
@AviD Americans.
@ScottPack LOL!
Wait, I thought wildebeest was kosher because it was horse-cow.
@ScottPack its actually not a horse at all. It is a wild cow. Closer in family to bison, I think.
13:51
@AviD Oo, good point. Classically a centaur would have both a human and horse digestive tract.
Damn, only 23GB of usable space on the 64GB surface pro?.. arstechnica.com/information-technology/2013/01/…
That's gonna be a huge PR blunder for microsoft.
@TerryChia old news. plus the MMC slot.
@AviD MMC slot? I have not been keeping up with the surface pro news.
@TerryChia ehh, its not news. Other pads have the same issue. this is just news because its MS.
@AviD Taking up more than half the storage is a bit more than other tablets, though.
13:53
@AviD I dunno.... 40gb used up?
@ScottPack sure, I guess.
besides the slot (maybe its not MMC, some other tech? dont remember) you get a ton of cloud storage, FWIW.
If they really need that much space they should not offer a 64GB option even. It just doesn't sound reasonable to a non tech savvy user.
I am more bothered by no 3G/4G option.
@AviD Ok, so no blood, period. Has that been ruled to include all bodily fluids?
@ScottPack hahaha, noooo... that's still okay.
but do you really want to go milk that bull?
13:56
@AviD Good point. I suppose cow milk would be technically bodily fluids.
@ScottPack so would mother's milk. But I'm not going there.
@AviD Considering how frequently you've spawned, that surprises me.
hahaha
Yknow how kosher forbids mixing meat and milk?
@AviD I'm familiar with the concept.
Well there is a discussion (dont remember the conclusion) on whether or not it is okay to eat meat with human milk.
@ScottPack dafuk
@ScottPack I think this line sums it up: Human cheese is initially a pretty shocking concept to most people.
2
Well, unless you're French.
@TerryChia Lactose intolerance is becoming more of a thing. Those who are lactose intolerant seem to be able to take human milk product.
Hmm @LucasKauffman wanna go into cheese production? ;-)
@TerryChia It is, after all, the only milk product humans are biologically intended to consume.
14:02
@AviD hahaha, as a side job or a full time career?
@TerryChia hobby :P
maybe some community service?
I like the part where they said their freezer was full of breast milk and they didn't have anything to use it on. "Anyone who has ever pumped breast milk knows exactly what he's talking about."
I seem to recall having just enough milk stored for consumption.
@AviD This is interesting
@ScottPack during kosher research? ;-)
@AviD I'm a curious boy.
whoa, turns out wildebeest is a kind of antelope??
14:14
That surprised me as well.
One thing I can always count on, when joining this room, is that I'll look at the sidebar and have a whole new reason to say "DAFUQ?!".
2
> Australasia was His dumping ground for failed experiments.
14:42
@AviD A centaur has 6 limbs: it is an insect. Are insects kosher ?
@ThomasPornin A centaur also has an internal skeletal system, which disqualifies it from being an insect.
@ThomasPornin I dont think the nmber of limbs is what defines an insect.
It looks like most insects are forbidden, but there are 4 types of locust that are kosher.
Are siamese twins insects?
@ScottPack and, shockingly, grasshoppers.
@AviD Not all Siamese twins have the same number of limbs.
14:43
wait, how in hell do you know that??
@AviD That makes sense. Aren't grasshoppers and locusts related?
okay, passed my grossout limit.
Ah, ok, locust is a specific subspecies of grasshopper.
heheheheh
@ScottPack I did not need to know that.
Or, more specifically.
> Locusts are the swarming phase of certain species of short-horned grasshoppers in the family Acrididae.
14:46
but, I guess, its the type of general knowledge that does not hurt, other than being gross.
@AviD You don't need to be afraid of locusts anymore. That was a long time ago.
hahahaha
@ScottPack gimme a hand a second. I'm having trouble with my network masks.
@AviD I need to leave in about 2 minutes, so if I can do it in that time, or you can wait about 30 minutes.
if I have a network that was masked 255.255.255.0, and I have one machine there /.32 - I now have a new vlan, to seperate that .32 machine, but I cant change its IP (too complicated).
it would be 255.255.255.224, right?
So you want to split your /24 in such a that 10.10.10.32/24 doesn't have to be readdressed?
14:50
that is to say, everything with .32 and up would be split.
pretty much, yeah.
Can you modify the netmask on .32?
oh dang, right I would need to change the netmask on that anyway.
urggh.
and if I'm doing that I may as well change the IP...
just complicated to climb up to it physically.
VOIP box - management interface only local.
nice
Sorry, mate.
Gotta run, though. I'll be back in about 30.
k
thanks a lot, anyway
This is bad. Non-security tech bloggers should not be allowed to give security advice.
14:53
and for my edification, did I have the netmask right?
> Just like opening a text file or web page in your browser should be safe, opening an email message should also be safe.
@AviD if you only want one machine on a subnet, you can make it a /32 subnet -> 255.255.255.255
-facepalm-
@TerryChia The only saving grace in that statement are the words should be.
@lynks hmm, good point. but I dont really care, dont have that many machines here.
yet.
14:56
Curious though, is simply opening an email on a web interface risky? I haven't heard of any malware that uses just that as an attack vector. Can't say I read much on the subject though.
255.255.255.224 gives you 32 ips, and is correct.
@TerryChia Webmail is generally considered safer than an e-mail client. Still, I wouldn't consider it immune.
in otherwords it defines a /27 subnet
@Iszi Yeah, it's always a potential risk. But I'm just curious if there is any malware in the wild that can exploit it.
@lynks Wait, what? I think we've got a problem with 32, here. (Goes to double check.)
14:58
side note: it really bugs me that decimal is the defacto format for netmasks.
@lynks Really? I see the /24 format way more often now.
@Iszi 224 = 0xe0 = 1110 0000
5 bits, 32 ips, right?
@Iszi He is correct.
00:00 - 15:0015:00 - 00:00

« first day (776 days earlier)      last day (4402 days later) »