The DMZ

Terry Chia

01:42

This is interesting: torrentfreak.com/…

Stack Exchange

05:03

It sounds like a great way to make friends! Is it near that Friend Zone you keep talking about? I wanna go!

Rory Alsop

11:33

A busy monday in the dmz, eh

I'm giving a talk to the Scottish Informatics & Computer Science Alliance in half an hour. Will be interesting giving corporate/enterprise view of the future of security to room of academics

Terry Chia

@RoryAlsop morning. well, evening over here.

@RoryAlsop That should be interesting.

AviD

11:52

Well, yesterday was the Jewish holiday of Purim. Consider it the combined equivalent of Easter, Thanksgiving, and St. Patrick's Day. So I was stuffed, buzzed, and hopped up on sugar, but it was okay cuz nobody could recognize me.

AviD

14:09

►

Terry Chia

@AviD Hahaha that is hilarious!

Adnan

14:29

@AviD So much CSI memories..

AviD

@Adnan Quick! I'll whip up a GUI in Visual Basic, maybe we can track their IP address!

Adnan

Oh lord.. laughing so much

Adnan

14:57

@RoryMcCune, you have a couple of personal "thank you"s from my workmates for this answer

Rory McCune

@Adnan coolio glad it was helpful. I guess there has to be some benefit to having written as many reports as I have :)

Terry Chia

Ahh, dunno how i missed that question. Might be a good idea to add it into the QOTW queue. I can see it being useful.

And Rook's answer really shows that he really isn't much good at the presentation side of stuff...

Adnan

15:15

@TerryChia But I was annoyed because he completely ignored my comment

I did my best to actually show that I appreciated his effort and read the whole answer

It was a genuine constructive criticism

Terry Chia

@Adnan He is usually a jerk.

Adnan

We are all jerks from time to time.

Polynomial

15:55

Long time no see y'all :)

Adnan

@Polynomial, I believe on Thursday we were saying that we hadn't seen you in a while

Terry Chia

@Polynomial hey! it's been awhile.

Polynomial

hehe

I quit my job, and have spent the last few weeks doing nothing but getting drunk, playing SC2 and writing code

because I'm a bawss like that.

oh and I also got a new job as a pentester :D

Terry Chia

@Polynomial Nice! Where you headed to?

Polynomial

not started yet, but I'm moving to London

Portcullis Computer Security: portcullis-security.com

same place FreakyClown works.

Terry Chia

15:58

Badass paycheck? I seem to recall you refusing to work in london a while back.

Polynomial

badass paycheck indeed.

double what I was earning before, plus a bonuses system.

Thomas Pornin

@Polynomial Welcome back.

Polynomial

ty :]

Terry Chia

@Polynomial sweeet!

Adnan

@Polynomial What coincidence I was just reading some of my old bookmarked questions and I stumbled upon an answer of yours, with this comment

Polynomial

15:59

@Adnan "Client-side data can be edited by the client? Who knew!?" ;)

Jeff Ferland

Good morning from BSidesSF

Polynomial

hey Jeff, how's the con so far?

Adnan

@Polynomial Jesus! They must be big! I heard about them in a client meeting a couple of weeks ago

A big ship engine manufacturer was deciding who will do their security audit and Portcullis was on the list.

Congrats!

Jeff Ferland

@Polynomial I can't believe how well things worked overall. Not flawless, but we have a conference :)

Also, Dan Kaminsky was Kanye Wested. That was amusing.

Polynomial

haha

Not sure what happened there. Browser fail.

@Adnan Not that big - about ~35 or so pentesters.

@Adnan they just happen to know their stuff :)

Adnan

16:05

@Polynomial Well then they reputation is big

Polynomial

:)

it's an awesome place too. Got two '50s Wurlitzer juke boxes, no dress code, everything's nice and chilled out

they clearly know how to run a pentesting business

Adnan

@Polynomial No dress code.. my #2 question in an interview

Polynomial

:P

Adnan

Are you drunk/high? :D

Polynomial

me? haha, no?

Adnan

16:07

We should have a special event in the DMZ to congratulate you properly

Polynomial

I didn't need to ask about dress code. I went in a suit and the guy interviewing me was wearing baggy jeans, sketchers and a black t-shirt with a unix joke written on it.

Adnan

probably in the ass

That one was starred for you

Polynomial

In the ass indeed.

Adnan

@Polynomial what was the joke what was the joke?

Polynomial

I can't remember. It was something to do with sed and awk

I was too busy defeating their "you have 10 minutes to do this" interview challenge in 4 seconds flat.

basically a PHP script with some command injection bug, and the goal was to get /etc/passwd. so I put in one URL and it worked straight off.

Was pretty awesome to get to hack shit in an interview though. Most places don't bother.

Adnan

16:11

@Polynomial Jesus! You can't come to the DMZ and talk about that.. I'm super jelly now!

What else were you asked in the interview?

Terry Chia

@Polynomial They must have been impressed.

Polynomial

I had to explain the full chain of what happens from plugging an ethernet cable into your laptop, up to logging into your bank via SSL

we only got to the TCP handshake section of that before he got bored and we moved on :P

I thought I did badly at that bit - turns out the point of it was to weed out people who have no idea because they give short answers

and I spent 25 minutes going through the details

Adnan

25 minutes until the TCP handshake!! Well, consider me weeded out then

Terry Chia

@Polynomial Heh, the long ass answers you write here paid off.

Polynomial

and in the middle of it we got sidetracked and started talking about the Raspberry Pi's ethernet magnet defect.

I mentioned a few of my StackExchange answers in the interview actually.

Adnan

16:14

Please tell me it's the robot SQL injection!

Polynomial

that came up briefly

I mentioned I held the record for highest upvoted answer on the site

Adnan

How was their impression of StackExchange?

Terry Chia

@Polynomial Yeah... @ThomasPornin has to get to work on that.

Can't have a non-Bear holding records over here now can we!

Polynomial

hehe

if he was a Roman they'd name him Maximus Ursidius Meridius.

Jeff Ferland

You killed my record. Prepare to die.

3

Polynomial

16:16

haha

Commander of the Bear Armies of the North, General of the Infosec Legions, loyal servant to the true emperor of StackExchange.

2

Terry Chia

@Polynomial I think we established that @ThomasPornin is the Bear God.

Thomas Pornin

@Polynomial I understand "Ursidius" instead of the correct "Ursus"; it is needed in order to look like "Darth Sidious". But why "Meridius" ? "The Great Bear of the middle of the day" ?

Polynomial

@ThomasPornin Yep. You're only great at midday. Otherwise you're drained from catching salmon or lack of coffee.

Thomas Pornin

@Polynomial I'll wager that the salmon is much more drained than the bear.

Polynomial

;)

but if you get to be Maximus Usridus Meridius, I get to be Tony Stark.

because I always kinda wanted to be a billionaire genius philanthropist.

Terry Chia

16:20

@Polynomial You forgot playboy.

Thomas Pornin

@Polynomial A drunken playboy with too much time on his hands and Daddy issues ?

Polynomial

@TerryChia Bitch please, I'm already a playboy.

Terry Chia

@ThomasPornin Why not? You get to fly around in a suit.

Polynomial

@ThomasPornin He has a mechanical suit, a near undrainable source of cash, and gets to bang Pepper Potts.

What's not to like?

Thomas Pornin

The suit is red. It is very tasteless.

Polynomial

16:22

I'd paint it black.

For maximum ninja-goth stealthiness.

@allquixotic Is that mine-turtle?

allquixotic

@Polynomial Yes, but funnily enough I am trying to get the SU cache of Gravatar to expel mine turtle and bring back my "oh don piano" gravatar.

Terry Chia

@ThomasPornin Not if you are a drunken billionaire genius playboy philanthropist with daddy issues.

allquixotic

I used the oh don piano cat for the longest time, switched to mine turtle, got TONS of comments about mine turtle and am now switching back. :P

Polynomial

haha

the flop one is the best part of asdfmovie6

that and the cats

allquixotic

the "bear nomming the girl for 10 hours" youtube video disagrees

just search "bear nom asdfmovie"

Polynomial

16:26

allquixotic

I bet the guys who did the "I like trains" and "mine turtle" videos are going to come out with a Flop music video

it's tomska and a few of his buddies

Polynomial

:P

Rory McCune

@Polynomial w000000000000000 Portcullis

nice one

Polynomial

@RoryMcCune cheers :)

Rory McCune

They're (in my exp) one of the good ones

allquixotic

16:29

one of the joys of staff reduction is that the same amount of work has to get done; lately I'm being tossed on both the functional validation and web app security testing teams for the same app, whereas before we had so many people that I often just did security testing, or ended up validating one app and security testing another

Polynomial

FreakyClown got me to send them a CV, got an interview within a day or so :)

Rory McCune

definitely in my days in industry we thought of them as good

Polynomial

awesome

Rory McCune

say hello to Tony Romanis and tim brown for me :)

@Polynomial so are you working out of the barn then?

Polynomial

@RoryMcCune will be, yeah

start date TBC.

Rory McCune

16:31

@Polynomial yeah it's a funny old office that I was there once to do an audit on them

Polynomial

@RoryMcCune First thing I thought when I got the tour was "this is my kinda place".

brb, gotta do some cleanup here before heading out

Rory McCune

@Polynomial yeah I think you'd like it there, research heavy quite old-school testers they've been around for a looong time (well for a testing co.)

allquixotic

He's a magical pony flying through the sky, on a magical journey for you and I

Polynomial

SHOOT IT DOWN

@RoryMcCune yeah, they look like they're churning out some good research.

only irritating thing is that I'm likely to start on the 4th, and I've gotta be back in Nottingham on the 8th for a gig :P

Rory McCune

16:52

@Polynomial bummer :(

Polynomial

s'all good, I'll just book train tickets asap ;)

I already let them know I'd need the time off for it

and there's no way I'm missing it. DevilDriver and Cannibal Corpse are playing a double headliner, with Winds of Plague and Black Dahlia Murder supporting. s'gonna be epic.

Rory McCune

@Polynomial good grief why I'm I guessing there's a metal theme to this gig with names like those!

Polynomial

haha

indeed.

their names are more intimidating than their music.

btw, I came up with a new industry-standard certification for ethicalness

eafc.org.uk

[NSFW]

borne out of a conversation on IRC about how we can measure ethicalness.

Rory McCune

lol

Thomas Pornin

@Polynomial A cannibal corpse, is that the body of someone who was formerly involved into eating members of the same species, or is that a corpse which happens to still be able to eat, and elects to eat other corpses (as we, technically, all do -- except vegetarians) ?

Polynomial

17:00

I guess it'd be a zombie that eats other zombies.

an omnyomnombie.

tbh, Cannibal Corpse is the band I'm least interested in seeing, but I imagine they're pretty brutal live.

I'm mainly there for DevilDriver and Winds of Plague

Rory Alsop

17:30

Afternoon all
And congratulations @poly - as @rorym said: they are one of the good ones!

Academia was fun - found myself as one of the judges marking 11 infosec phd presentations

Some good ideas that are very relevant in industry

Oh, and devildriver rule!

Polynomial

:)

well I figured if FreakyClown has stayed there that long then it must be pretty decent. he has a low tolerance for bullshit.

Thomas Pornin

19:50

Can there be a non-snark response to that ?

0

Q: How to test a proxy for tcp and udp traffic?

Is there a simple way to test a proxy to determine if it is correctly forwarding TCP and UDP traffic? An ideal method would be script-able.

proxy

TildalWave

@ThomasPornin IMO not on IT.sec

Scott Pack

Use netcat. Bitches love netcat.

Rory McCune

@ScottPack and refer to it as "the swiss army knife of network tools" 'cause that's not been done before ..

TildalWave

tell him to hit my webserver with his proxy requests, i've had a day long headache and feel like abusing someone

Scott Pack

@RoryMcCune Don't hate the netcat. Hate the Rory.

Rory McCune

19:53

@ScottPack Oy! although in actuality ncat is a better option these days

Thomas Pornin

@RoryMcCune Wasn't that socat ?

Rory McCune

@ThomasPornin well it's a swiss army knife + SSL and complex syntax

Scott Pack

@RoryMcCune You people.

CodesInChaos

20:05

@ThomasPornin Since you seem to be collection rep in the [hash] tag, how about writing a canonical answer about password hashing?

I can only find bits and pieces distributed among several questions.

Stack Exchange

Blog - Stack Exchange: Max, Oded, Wendy, Val, Shefali, and Mike: Welcome to the Family!

Joe Humphries on February 25, 2013

We’ve been busy hiring more of the most talented people on the planet! Three cheers for the newest employees at Stack Exchange:

Max Horstmann, Web Developer (Careers 2.0)

New York

Max joins Stack Exchange as a developer on the Careers team. Originally from Denzlingen, Germany, he previously worked on the Windows team at Microsoft. On a recent one-year career break, he and his wife had a chance to travel to glaciers in South America, deserts in the Middle East, and jungles in Southeast Asia. His mission for the next five years is to sort all the pictures taken on this trip, write a few more mobile apps, and find out which German bar in New York City plays the best Blasmusik. …

Thomas Pornin

@CodesInChaos A canonical answer requires a question to attach it on.

I could do that, after all

reminds me I have a QotW blog post to write

@StackExchange Oh, SE is now developed by an elephant. This is awesome !

Rory Alsop

you sure it's not a bear in a 'phant suit?

Thomas Pornin

@RoryAlsop Elephants are actually better developers because they have square fingers. They are born to type on keyboards !

TildalWave

20:27

Some of the best admins I've met were all Elephants

notice I did say 'some were all'

Ah shoot now I find out there's an edit option

is there a wiki for chat options?

Rory Alsop

@TildalWave there is something on meta.so - lemme see if I can find the link

Is it this one:

meta.stackoverflow.com/editing-help

TildalWave

@RoryAlsop Cheers appreciated!

Rory Alsop

and

chat.stackexchange.com/faq

CodesInChaos

78

Q: How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database, and not any other type of attack, such as bruteforcing the login page of the application, keylo...

appsec cryptography passwords hash

TildalWave

I still can't find anything on editing last submitted post as it appears to work here when I hit the up-arrow key. I gather that's only valid for last comment and probably time limited as well?

Thomas Pornin

20:39

@TildalWave I remember having edited a comment which was not the very last; but there is a time limit, for sure.

Except if you are a mod, in which case you can edit everything whenever you want.

Gilles

@TildalWave chat.stackexchange.com/faq#talk

the time limit is 2 minutes

Thomas Pornin

@CodesInChaos Ok, that one is a good candidate for a canonical answer. I'll see what I can do.

TildalWave

@Gilles seems reasonable enough cheers

AviD

@ThomasPornin I already accepted your answer. No need to actually write one.

or, you could save me the trouble and just edit the accepted answer to add your details.

Thomas Pornin

Ah, but where would be the fun in that ?

AviD

20:56

@Polynomial grats! I will second the rories in our strong opinion of Portcullis

they are indeed good with the pentesting :-)

Gilles

@AviD spam

Adnan

Woooah! This is the first I stay this long in the DMZ

TildalWave

@ThomasPornin could you please check that I'm not talking out of my behind to the guy with possible infestation? :)

Adnan

Is this when the naughty things happen?

In the ass

(damn.. I won't get tired of saying that)

Gilles

@Adnan that's what SHE said

Adnan

21:06

@Gilles She probably didn't say "with a cactus"

AviD

@Gilles yes it was

thank

Adnan

@AviD oh finally.. someone I know

AviD

@Adnan heh, "know"

Adnan

Well you know what I mean

AviD

yeah, I "know" what you "mean"

I'm not sure what " means... ;-)

Adnan

21:10

Jesus!

CodesInChaos

I get into arguments about password hashing far too often

Thomas Pornin

@TildalWave About the presumed PDFCreator ? Your comments look fine to me. His machine was probably infested.

Adnan

It's 23:10.. I'm still at work.

CodesInChaos

by claiming that the difference between SHA-2 and MD5 doesn't matter much

Adnan

@AviD, so go easy on me!

CodesInChaos

21:11

1

Q: PasswordDeriveBytes function

I am using AES (Rijndael) symmetric-key algorithm to encrypt-decrypt data. I am using the System.Security.Cryptography. PasswordDeriveBytes function; PasswordDeriveBytes password = new PasswordDeriveBytes( passPhrase, ...

c# .net encryption

AviD

@Adnan shameful. I'm in my office too, but i have an extremely short commute.

Adnan

@CodesInChaos who makes the claim?

AviD

also. How are we in the same timezone?

CodesInChaos

@Adnan me

Adnan

@CodesInChaos :) you make us proud

@AviD Check the map.. you guys are on the far right side of it, and we're on the far left

AviD

21:12

@Adnan far right of the map?? We're dead center.

Adnan

of the time zone

the GMT+2

TildalWave

@ThomasPornin Yes that's the one. Cheers for checking, it's not really my area of expertise it's been a long while since we've been writing viruses for fun of tracing them in College LOL :)

AviD

@Adnan ahh. hmm, so you're not in the same TZ as most of EU?

Adnan

@AviD Nope! Fuck the system!

Gilles

@AviD Finland is in eastern Europe, like Israel

TildalWave

21:14

@AviD What time zone is the most of Europe in? :P

Adnan

@Gilles Nice way to start a fight

@TildalWave GMT +1

TildalWave

@Adnan Correct, let's see if Avi knows that

AviD

@Adnan interesting. I notice now that Kiev is also in the same TZ, will come in handy if I wind up going there next month...

Adnan

Here.. my brothers

AviD

@TildalWave heh, yes I do... been there often enough.

Adnan

21:15

AviD

'course the @Rory's will say its GMT+0 in the only area that matters....

Gilles

@AviD only half the year though

Adnan

@Gilles What?!

TildalWave

OK here's a tough one: what continent spans the most time zones?

Adnan

@Gilles Oh okay.. I get it now

@TildalWave Come on.. there's the map

AviD

21:17

@TildalWave ha! Trick Question. It is Antarctica.

TildalWave

@AviD +1

@Adnan not on map, sorry :P

Adnan

@AviD okay.. I'm officially dead

Rory McCune

@AviD well there's an easy to spot hint that we are in the one true timezone... it's the G in GMT

Adnan

@TildalWave true.

Gilles

@Adnan whoa, this map is old

AviD

21:19

@RoryMcCune or the U in UTC.

Gilles

it's from the last millenium

TildalWave

@RoryMcCune I've seen an interesting discussion on what 'Mean' means in GMT on English language SE

Adnan

@Gilles Elaborate..

AviD

@Gilles distributed on parchment.

Rory McCune

@TildalWave ah you've got to watch when assigning meaning to mean it would be mean to try and confuse someone about that

AviD

21:20

@RoryMcCune that's mean.

Rory McCune

@AviD but lexical ambiguity is fun :)

like ... James while John had had had had had had had had had had had a better effect on the teacher

TildalWave

@RoryMcCune yeah a bit like mitchell & webb on 'watergategate' :)

Gilles

8

A: Which place(s) are the first to cross into New Year?

You can see this in the Wikipedia list or on any map with the International Date Line. The first place to see a new day is the Line Islands, more precisely the part that belongs to Kiribati (formerly known as the Gilbert Islands). The Line Islands are in the UTC+14 timezone, and the rest of the c...

TildalWave

►

Rory McCune

@TildalWave nice, I'd not seen that one before..

Adnan

21:23

@Gilles Ahaa.. I see. Thank you

TildalWave

anyway, that discussion on 'mean' in GMT is here

Adnan

@RoryMcCune How many concurrency sketches have you seen on TV?

Because they have an extra one that is only on Youtube, I didn't see it in the DVD or on TV

Diana, Aliens, Moonlanding

Rory McCune

@Adnan heh

Adnan

@RoryMcCune Shit! I'm starting to saying things that don't make any sense

I must go home. See you all

Rory McCune

@Adnan sleep is a good thing...

Rory Alsop

21:31

@RoryMcCune apparently so

amusingly, one of Hamish's classmates said to him "Is your dad doing a talk on Thursday evening - my dad's going to it"

Scott Pack

My dad could out infosec your dad.

Rory Alsop

@ScottPack lol

@RoryMcCune I had forgotten this one:

►

Hate Self Why Patril not burn?

TildalWave

@RoryMcCune 'but lexical ambiguity is fun' English can be rather confusing sometimes, which of course makes it so much more fun

ah the Cheesoid sketch!!! a bit morbid at the end me think

Rory McCune

@roryalsop probably my fave was youtube.com/watch?v=IVEIlObp22s&sns=em

TildalWave

Could some1 please explain why Brits hate ginger people so much? I never got that

AviD

21:44

@TildalWave cuz they look Irish.

TildalWave

@RoryMcCune here's a better rip: youtube.com/watch?v=F5sw-RQotrk

Rory McCune

@tidalwave ta but not available in my country :( looks like a copyright type has been blocking stuff....

TildalWave

@AviD OK, but if they had no Irish or Polish people, who'd build their houses? :D

Rory Alsop

@AviD because they attract radar, smell of wee and can't swim?

(I'm sure that was the punchline on one ginger joke)

TildalWave

@RoryMcCune it's the beginning of the season 1 episode 1 of that mitchell and webb look, try with a search and see if you get a better version

Scott Pack

21:46

@RoryAlsop As I get older I am getting redder.

Jerkface.

Rory Alsop

@ScottPack heh - also, check out my lead singer:

TildalWave

In what program were those 'Suffered gingery at work?' sketches? Was that Monkey Trousers?

Rory Alsop

natural ginger - possibly accentuated a little...

@TildalWave could be, yes

Scott Pack

@RoryAlsop Possibly.

AviD

btw @TerryChia re the unlocked i7 - doesnt help to get the locked one for VT-d, as of now Hyper-V doesn't support it.

allquixotic

21:56

@AviD I bought the 3770K not realizing that it didn't support VT-d, because I wanted to dual boot using Xen... Linux in dom0 with graphics output to the HD4000, Windows 8 in domU with graphics output to (VT-d passthrough) Radeon HD7970. Too bad.

if I had a choice I'd toss the 3770K for an ordinary 3770 but it was way past the date of return on the CPU when I realized my fatal error

TildalWave

Yey found those ninjury/gingery/... sketches. They're indeed in Monkey Trousers, the "Ablett Associates" sketches. youtube.com/watch?v=Y9DyDHDjE_o Even funnier, I found a listing for Simon Ablett Associates Ltd Computer Services in Sheffield while Googling :D Does anyone know how to check in what countries are YouTube videos available save for inspecting their XML? Is there a web tool that would determine that for me?

AviD

@allquixotic yeah, I just happened to notice this, and was strongly considering forgoing the overclock for VT-d. Now I realize it doesnt matter, since I will be virtualizing using Hyper-V - and it doesnt use VT-d anyway.

all else being equal, I would hav e liked to have it anyway - yknow, for futureproofing - but if I have to choose between the massive overclock the K provides, and VT-d that I do not plan to use in the near future, I'm probably going with the K.

now I just have to source it locally, which often makes things more complicated. (arbitrary differences in prices...)

allquixotic

@AviD water cooling? or just relying on a fan to keep the CPU cool during your overclock?

i let my 3770K do turbo mode based on the automatic settings but i haven't actually set its max clock above the factory default for fear of breaking it

AviD

@allquixotic heh, actually looking at watercooling right now.

@allquixotic apparently, its dead simple, depending on your motherboard. Dont even need massive cooling for some pretty impressive OC gains...

supposedly, you can clock it from 3.5 up to 4.8 or 4.9, with a regular sink/fan.

(not stock)

allquixotic

my overengineered PSU can handle pumping more current/wattage no problem; my PSU is designed for quad SLI but I only have a single HD7970 :P power isn't a problem for me and I have great air cooling in the case which keeps everything very cool at stock speeds but I haven't done water yet

I can't think of a situation where CPU is the bottleneck on any of my current workloads except perhaps make -j8 but compiles are insanely fast anyway

if there's one thing I oughta be investing money in, it's a terabyte SSD... or two of them in RAID-0 to plug into the hardware RAID controller I already have

TildalWave

22:12

Not wanting to spam but I thought to give you heads up Hexus is running a competition to win one of Plextor's M5 Pro Xtreme SSDs. It's available to all readers the world over. I wouldn't mind one of those puppies myself either :)

Tinned_Tuna

@AviD the thing in the side bar says there's a CTF on the 1st of march. Where's it at?

AviD

@allquixotic oh I agree about that. But its free cycle goodness, just waiting to be configured... how can I say no?

allquixotic

@TildalWave I put my name in the bucket, but I'm sure there are people creating millions of email accounts to give themselves a greater chance of winning, and I never win those things anyway

AviD

like I said, I was willing to forgo it in favor of VT-d. but since thats out, its worth the extra 30$...

@Tinned_Tuna ask @Lucas. I'm really not on the in on that.

allquixotic

@AviD heh... my CPU will already, straight out of the factory, run at 4200 MHz when it's extremely pegged by kicking in the "Turbo Boost", and can do so with the stock heatsink/fan at a sustained, reasonable temp.

AviD

22:15

@allquixotic I thought the turbo only pops up to 3.7?

TildalWave

@allquixotic Yeah it's a long shot, I realize that ;) Still, it costs nothing to enter and they don't spam with follow-ups if you opt out

AviD

sorry no, 3.9.

allquixotic

@AviD ah yeah it's 3.9

basically it'll run at the normal stock speed for fairly intensive but not really pegged workloads, and if it is totally occupied it'll kick in up to the turbo speed all on its own, no overclocking needed

AviD

@allquixotic 4.9 > 3.9 :)

allquixotic

I guess OCing the CPU can lead to pretty good performance gains but I wouldn't bet on a 4.9 GHz 3770K beating out an overclocked 3930K from Sandy Bridge-E

more cores, bigger die size, bigger TDP

presumably (hopefully) we're less than a year out from Ivy-E, which should be pretty awesome

Ivy-E will set the new standard for single-processor total performance (when busying all cores/threads) in the desktop/workstation form factor

Tinned_Tuna

22:18

@AviD thanks :-)

@LucasKauffman the thing in the side bar says there's a CTF on the 1st of march. Where's it at?

I am verry surprised

AviD

@allquixotic yeah, the TDP is the downside... another point for Ivy.

Tinned_Tuna

I grabbed the latest OpenSSL from the repo, went into the makefile, changed gcc to clang and rebuilt

it passed it's tests.

what sorcery is this?

AviD

@allquixotic yes, and 6 months from Hansel or whatever, and 8 months after that till the next... :)

allquixotic

@AviD I did take a risk and try overclocking the iGPU on my 3770k by quite a lot, but it didn't help; an OCed HD4000 is like trying to win a race against automobiles with a horse and buggy by having an Olympic runner get out and push the cart from behind

@AviD Haswell. but judging from Intel's predictions of Haswell's performance, it's not really going to be anything above Ivy performance-wise. They're going for the near-SoC architecture, pushing more stuff into the CPU, probably make the die size a little bigger, improve power management algorithms, a modest CPU throughput gain (maybe 8 - 10%), and a much faster/beefier graphics core on CPUs with an iGPU

Ivy-E is definitely going to make chopped liver out of Haswell on the CPU side, no doubt about it

and it's coming out in Q3 2013, which is way sooner than we'll see Haswell-E or Skylake, the only microarchitectures that might compete with or beat Ivy-E

I might actually take the leap up from mainstream and go to the Ivy-E platform on my desktop when it releases

depends on how much spare money I have laying around :P

AviD

@allquixotic might consider that for next year, not gonna wait around for that...

also, not really interested in the igpu, gonna get a real card for that.

and not just for gaming, bigass highres monitors really strain the igpu.

but youre right about the HD too. SSD is definitely going in there.

although...

since I plan on doing a lot of my computing in VMs, which would likely be stored on the larger HDD (at least some of them), I'm not 100% its worth putting SSD as system disk.

perhaps as a system cache, might be more effective.

allquixotic

22:39

@AviD the point of the enthusiast performance line such as Ivy-E is that it doesn't have an iGPU.

AviD

@allquixotic ohh, dint know that part.

makes more sense. didnt understand why there is one on the OC model either.

allquixotic

ever since Sandy, it goes like this: time T, release new mainstream microarchitecture with built-in iGPU and modest scale (quad core, low TDP). time T+8 to 12 months, release new enthusiast line based on the same microarchitecture, but eliminate the iGPU, scale up the CPU, add at least 2 cores, increase L3 cache, increase die size, increase TDP, and run on a separate mobo chipset

Sandy-E was out before Ivy, but now it seems like the -E lines are lagging so far behind (due to design or validation or fab issues, not sure) that the next mainstream generation is out before the enthusiast line of the previous gen.

not that the next mainstream is necessarily faster; indeed it seems like they won't be

AviD

Tick Tock.

allquixotic

the mainstreams offer a nice cost/performance ratio, affordable system boards, the latest CPU microarchitecture right away, and a GPU that's good enough for triple monitor desktop applications

no, the enthusiast line isn't even part of the tick tock

the tick tock is between new feature size (reducing the size of the transistor / going to a new fab process) while holding the microarchitecture constant, and coming out with a new microarchitecture while holding the feature size constant.

Sandy was a new microarchitecture on the old fab; Ivy is a new fab on the old microarchitecture; Haswell will be a new microarchitecture on the old fab; etc.

so with the enthusiast lines it's more like "tick-a, tock-a" (four beats)

AviD

they calling it Tock +.

allquixotic

22:46

that's marketing slogan for "we want people to think we're not complacent"

wonder if AMD will ever catch them on the CPU side, or if Intel will ever catch AMD on the GPU side

my understanding is, they're getting mighty close to the limit of how many transistors they can pack into a square millimeter due to limits of physics, and availability of rare elements needed for the increasingly extreme environments -- we're already using the rare Hafnium for the HKMG since Core 2

AviD

@allquixotic eh, people have been saying that for years.

if that was true, it would be called Moore's Suggestion. But it's a goddamn LAW, isn't it.

Transcript for