The DMZ

Scott Pack

00:20

I didn't know bukake was a type of noodle.

Holy shit. I typed that before looking at the picture.

Scott Pack

01:20

@polynomial I felt like it had run its course last year. :)

AviD

@ScottPack so how did you know what we were talking about....?

or was that just the type of random nonsense @scott tends to write here....

Polynomial

@ScottPack It had kinda gone a little downhill in terms of quality, but it was still a good show.

Scott Pack

Gentile Magic.

@poly I felt like they were trying to cram 1 hours of content into 5.

Polynomial

@ScottPack they could've done with making the first half high-density content and the second half just random chatting.

that way they could cover the daily news, then do as much or as little as they want for the rest of it

Scott Pack

I actually got excited when they went weekly.

it only lasted 2 days

Polynomial

01:25

weekly would've made more sense. or bi-weekly.

Scott Pack

Agreed.

I also was really put off by most of their accents.

I come from not far from Louisville (home of DerbyCon). I don't like hearing that.

Time to go put the kid to bed. Bbl jiggas

Polynomial

kk

@ScottPack I find Boris a little difficult to follow sometimes when he talks slowly but disjointedly - he seems to lose his train of thought.

jrg

01:44

socialsecurity.gov does two-factor auth. Not bad for a government agency.

(well, it's an option. You have to enable it.)

but still.

Scott Pack

02:09

@Polynomial For me it's primarily the southern and Indian guys. One reminds me too much of home, and the other speaks too slowly and doesn't seem to add any content.

makerofthings7

04:58

@jrg I just enrolled in SS.GOV just to see what the process was like....

@jrg The Social Security "knows" the last eight digits to my credit card numbers. I thought that all they care about is that I have an account.

Surprised they actually know the number. Wonder if it's updated if my card is lost or stolen.

ATM debit cards don't work though

Stack Exchange

05:33

And it says a lot about you that when your friends jump off a bridge en masse, your first thought is apparently 'my friends are all foolish and I won't be like them' and not 'are my friends ok?'.

Lucas Kauffman

07:31

morning

AviD

@LucasKauffman yes it is.

Rory Alsop

07:46

heh

Rory McCune

08:08

@AviD I take it your one of these people who doesn't need a lot of sleep then? last message 1:20 am first message ~7:30am?

AviD

@RoryMcCune heh. you forget the time difference.

first message at 9:30am my time, though I have been up since 7:30.

you forget - I have kids.

Rory McCune

@AviD yeah but that makes your last one 3:30 doesn't it?

ahh kids

yeah I forget about that and the sleep disrupting effect thereof

AviD

so, not so much "doesn't need", but rather - "needs a hella more sleep than he can get with kids around"

actually, they're not so bad anymore, I just like to whinge about it.

I just happen to be a night person. I like naps during the day.

home office FTW!

Rory McCune

we just have cats coming in during the night going wow wow wow

@AviD I know best commute time EVAR

AviD

@RoryMcCune "wow"? your cats say "wow"?

what are your cats so excited about in the middle of the night that they say "wow wow"??

Rory McCune

08:13

@AviD yeah a kind of "hound of the baskervilles" noise

@AviD generally coming in from catting about and wanting food/attention at 3am

I would never have thought a cat could make that kind of noise but one of ours manages it

AviD

@RoryMcCune ah, so like teenagers ;-)

Rory McCune

sounds about right!

Rory Alsop

08:50

@RoryMcCune did you read this?

codinghorror.com/blog/2012/05/…

Rory McCune

@RoryAlsop I hadn't, interesting one. Wouldn't work for our two as we mainly feed them on wet food (not sure an automated dispenser would work here....)

Lucas Kauffman

@RoryMcCune you can take two robots, one dropping dry food and one dropping water

kitty cornflakes!

Rory McCune

09:05

@LucasKauffman heh yeah that doesn't apply to our two too much, they pretty much run the place. (currently one of them is sitting right next to my keyboard watching me type, he'd developed a bit of a fascination for computer screens recently)

flickr.com/photos/raesene/8450346528

Lucas Kauffman

@RoryMcCune he has the evil eye

Rory McCune

@AviD BTW see the Surface Pro reviews are out

@LucasKauffman yeah Tora kind of looks perpetually grumpy

Lucas Kauffman

:p

AviD

@RoryMcCune no, I didnt. Anything surprising there?

@LucasKauffman no, he looks dead inside. deep, unimaginably deep dark pools of evil.

2

Rory Alsop

@AviD lol

Rory McCune

09:16

@AviD largely as expected. Compared to tablets it's heavy and has a bad battery life but compared to laptops it's light and has a decent battery life

Generally the anandtech review quite liked it I thought

AviD

@RoryMcCune so basically a little more laptoppy than the surface RT.

Rory Alsop

Oh, for those who like challenges - free tickets to B-Sides are up for grabs:

Rory McCune

@AviD oy! you'd best hope my missus doesn't see that comment, she's very fond of Tora

Rory Alsop

securitybsides.org.uk/challenge1.html

4

Rory McCune

@AviD yeah with backwards compatibility

AviD

09:17

heh

I would still go for the RT.

now, if the pro had 3g/4g - that would be a killer.

Rory McCune

the missus is (predictably) doing both. She knows someone at Microsoft who can get her one of the US ones

AviD

I still dont get how they dont even offer that.

Rory McCune

@AviD It'll be in SurfaceRT2 I'll bet

AviD

@RoryMcCune ooo... can she get another extra one for me??

I'll take my catcomment back

@RoryMcCune heh, yeah I guess.

hmm, maybe I should wait then?

Rory McCune

@AviD heh unfortunately it ain't free just she's getting it early

AviD

09:19

or look around for a usb modem...

Rory McCune

@AviD it's an interesting point, I think that a lot of the win8 tablets look a bit like version 1.0 I think that the 2nd gen (with haswell) will be better

@AviD or phone tethering

which is what the missus does, just tethers to her WP8

AviD

@RoryMcCune and kill my phone battery? no thanks.

I mean, sure I'd do it in a pinch, but I dont want to plan for that.

Rory McCune

@AviD ahh USB connect the phone to the tablet for charging

then it uses the bigger battery of the tablet effectively

AviD

@RoryMcCune heh, waat? that is too circular.

Polynomial

11:35

Ok, this is epic

I've got one of those "there are errors on your computer" scammers on hold

with Erection Day by Turbonegro on repeat as hold music

he's been holding for 10 minutes now and he's still not hung up

Rory Alsop

@Polynomial hahahahahaha - lovely

Polynomial

I took him off hold now, about to start trolling

Rory Alsop

@Polynomial let us know how it goes then mate :-)

Polynomial

he's getting me to load up event viewer already :P

hehehe

"Ok sir, first, I need you to click your Start button." "My start button? On my dishwasher?" "No, sir, go on your computer, it is at the bottom left of the screen."

I think I'll eventually just start shouting at him in faux-German

Rory Alsop

@Polynomial lol

Polynomial

11:40

I might dig up Hitler's Nuremberg speech on YouTube

what, now he's talking about Jesus

I think he's annoyed at me

Rory Alsop

@Polynomial wonder if he knows the wonder of worshipping cthulhu

Polynomial

I just told him I believe in the Norse religion.

hahaha he just said "JESUS IS HATE YOU" and hung up.

Rory Alsop

result - how much time did he waste today?

Polynomial

about 15 minutes

haha, have you heard the latest Southern Fried Podcast?

going on about this hilarious bullshit new AV called Manvirtex?

so funny. they read out the sales crap from the site like an infomercial, then do one of those monotone super-high-speed disclaimers at the end to the effect of "Side effects may include not actually catching any malware, getting hacked, false sense of security .... consult your cyber insurance contractor for more details."

Terry Chia

12:21

WTF: digitaltrends.com/lifestyle/can-bangwithfriends-work

AviD

@TerryChia let's be honest, isn't that really all Facebook is used for anyway?

Polynomial

I think this is the most citation-laden answer I've ever written...

0

A: Is XSS possible here? Challenge

My immediate reaction to this was not positive, for a few reasons. Trying to use regex to parse complex language constructs is a bad idea. Regular expressions just aren't suitable for such constructs. Security through blacklisting is a bad idea because you will always be, by definition, one ste...

AviD

As someone very wise once said:

Polynomial

also some fun links in there. including OH NO NO NO cat :P

AviD

> A man works hard every day, just so that at the end of the day he will have a warm home, full belly, and empty balls.

3

Polynomial

12:35

hahahaha

Rory Alsop

@Polynomial no no no no cat rawks

Terry Chia

12:50

theverge.com/2013/2/6/3958300/…

Polynomial

@RoryAlsop he makes me smile :P

Terry Chia

Cool, the close button popup got a makeover.

Polynomial

-2

Q: How to Unblock?

How to Unblock Websites and Surf Anonymously using your Android phone How to Unblock Instant Messengers and Anonymously Chat with your Friends using your Android Phone How to Unblock Tor if it is Blocked How to Unblock Websites on your iPad or iPhone How to Watch American TV Shows Streaming f...

tools

spamhammer plx?

also, I just hit 26k rep :)

Terry Chia

Have you guys read the details of the new iOS jailbreak? Pretty sweet work: blog.accuvantlabs.com/blog/bthomas/…

@Polynomial Congrats repwhore. :)

Polynomial

@TerryChia yeah. spotted it on /r/netsec yesterday. was an interesting read.

Rory Alsop

13:02

@Polynomial So I am going to just beat you to 30k - after that I'll be relegated pretty quickly

@TerryChia that is clever!

Rory Alsop

13:16

Yay - got my Apptivate.ms t-shirt!

Terry Chia

Blah, I guess I can't submit a decent piece of work for the Syscan coding competition. :( Too busy with school recently.

Lucas Kauffman

13:30

@TerryChia Who needs school when you've got Swag?

Terry Chia

@LucasKauffman #YOLO

AviD

@TerryChia collegehumor.com/video/6786228/new-yolo-slang-words

Terry Chia

@AviD That cracked me up.

Lucas Kauffman

Asked to go to the bathroom and i didnt even have to go #yolo

Tweeted by Sixth_Grader on February 6, 2013 at 12:09 AM

Colin Cassidy

@LucasKauffman There goes my faith in humanity

Terry Chia

13:39

@ColinCassidy What faith?

Colin Cassidy

@TerryChia well, seeing as you put it like that...

Rory McCune

@TerryChia You're way to young to have lost your faith in humanity yet!

you need to be at least @RoryAlsop - 10 to have done that.

Lucas Kauffman

@RoryMcCune 67?

Rory McCune

@LucasKauffman harsh

Terry Chia

@LucasKauffman Wait, is 67 before or after the - 10?

Lucas Kauffman

14:04

@TerryChia I can't really tell... :/

Thomas Pornin

@RoryAlsop Enjoy your first row status while you can.

Scott Pack

Ok, so I have to know. What the fuck is up with all this #yolo #swag stuff? I doubt they're talking about conference goodies.

Thomas Pornin

@TerryChia The article gets it wrong; it is not the largest known prime. It is the largest prime which has been proven to be prime with a non-probabilistic algorithm (but which was nonetheless executed on a physical computer which cannot be assumed to be 100.0% reliable).

@ScottPack It's a fad; it will pass in due time.

Lucas Kauffman

@TerryChia btw I just noticed that girls from Singapore are rather pretty

Scott Pack

@ThomasPornin The yolo thing I comprehend, but what's the swag thing?

Thomas Pornin

14:15

@ScottPack The Great Internet tells me that it is an expletive to designate things which are generically agreeable to.

In France, highschoolers use the term "swag" for the "medium cool" people: those which are not "the top" but with which you can accept to be seen in public.

lynks

@ScottPack I always assumed it was referring to stolen goods, kids nowadays...

Scott Pack

That sounds ridiculous.

Lucas Kauffman

@ScottPack It's something that people exclaim who will work at McDonalds in the near future

Thomas Pornin

@ScottPack Well, it is.

That's mankind for you.

Scott Pack

Every time I think I've hit rock botton on faith in humanity....

Thomas Pornin

14:20

When you hit rock bottom, well, the rock is deeper in it than you.

Scott Pack

heh

Iszi

14:37

@ThomasPornin So... are you contesting that it is the largest known prime, or that it is actually known to be prime?

CodesInChaos

He said that we know a large prime, but only tested it with a probabilistic algorithm

and that the difference between a probabilistic and deterministic algorithm is rather academic, since real hardware can make mistakes while running a deterministic algo

Iszi

Always wondered how they figured out whether a number was prime in the first place - do they just use brute force to try dividing it by smaller numbers or something, until they reach its half?

Terry Chia

Primality test

A primality test is an algorithm for determining whether an input number is prime. Amongst other fields of mathematics, it is used for cryptography. Unlike integer factorization, primality tests do not generally give prime factors, only stating whether the input number is prime or not. Factorization is thought to be a computationally difficult problem, whereas primality testing is comparatively easy (its running time is polynomial in the size of the input). Some primality tests prove that a number is prime, while others like Miller–Rabin prove that a number is composite. Therefore we might ...

CodesInChaos

There are "fast" deterministic tests

Iszi

@TerryChia Of course, Wiki has it. Why did I bother asking anywhere else?

Terry Chia

14:43

@Iszi heh

I only tried the Miller-rabin algorithm before. Which is what is used in RSA IIRC?

CodesInChaos

AKS is fast and deterministic. In practice we mostly use probabilistic algos, like 2^p = 2 mod p

followed by miller-rabin

Iszi

Okay, I don't get this...

CodesInChaos

Most RSA implementations start with sieving or trial division

Iszi

> The simplest primality test is as follows: Given an input number n, check whether any integer m from 2 to n − 1 evenly divides n (the division leaves no remainder). If n is divisible by any m then n is composite, otherwise it is prime

Why go to n-1? Shouldn't you just stop at n/2?

CodesInChaos

you could even stop at sqrt(n)

but that's an example of the simplest algo

so they simply try every possible factor

Iszi

14:46

@CodesInChaos I don't follow that logic.

CodesInChaos

the smallest prime factor of a number is always <=sqrt(n) if the number isn't prime

consider having a prime factor p with sqrt(n)<p<n

then n/p is smaller than sqrt(n) and a factor of n

Iszi

Nevermind. I read a bit further into the wiki and it got explained.

Thomas Pornin

@Iszi Both !

Iszi

@ThomasPornin Well, I suppose by challenging the latter you're naturally challenging the former - but that wasn't my question.

Thomas Pornin

@CodesInChaos AKS is NOT fast -- it is polynomial and deterministic, but in practice it sucks big time.

CodesInChaos

14:52

that's why I put "fast" in quotation marks. Theorist's "fast"=polynomial time

Thomas Pornin

@Iszi It is not the largest known prime, because "konwing" a prime means choosing a big random integer and testing it for primality, which is not free, but can be done in practice for larger integers than that.

Lucas Kauffman

I just downloaded the excel from that securitybsides.org challenge

and my AV went beserk

Thomas Pornin

Here they deliberately use a "primality proving" algorithm which is not probabilistic (that is, when it says "prime" it has a mathematical proof), which makes the endeavour more difficult (and explains why they stick to Mersenne numbers, which have a special format which makes their algorithm a bit faster).

Iszi

@ThomasPornin So, it's a matter of semantics. Presuming the test to be accurate, the proper expression would be "largest number known to be prime".

Thomas Pornin

But since they run on a physical machine, they do not achieve mathematical proofiness in practice. It is still "proven prime up to a very small probability of very bad luck".

Iszi

14:56

Of course, your contention is also that the test is not guaranteed to be accurate so the point is moot.

CodesInChaos

It's something like: largest number for which a determinisitic test return "prime"

It doesn't matter is your hardware has some error chance or your algo has some error chance

Thomas Pornin

On the bright side, it keeps some mathematicians busy, preventing them from doing something stupid like trying to apply mathematics to sociology or politics (at which point they would be called economists).

CodesInChaos

and of course there is also the chance of a flaw in the algorithm/its proof itself

Terry Chia

Is there actually a practical use for such huge primes? Or is it one of those "academic" stuff?

CodesInChaos

You could implement diffie-hellman with a 27Mbit key

super secure11!1

Terry Chia

14:59

@CodesInChaos heh

Thomas Pornin

No practical use whatsoever. But the techniques developed to compute algorithms on that big integers can be reused elsewhere.

Rory Alsop

@LucasKauffman interesting...what does it come up with?

Thomas Pornin

@CodesInChaos For that matter, a Mersenne prime as modulus will allow a faster discrete-log break (a SNFS variant is applicable -- I had asked the same question to Lenstra, a few years ago).

Iszi

Being that this new prime is a Mersenne Prime, then I presume its discovery has also resulted in the discovery of a new Perfect Number?

CodesInChaos

oh well, then we'll use ECC with an underlying 27Mbit field

Then that algo probably won't be applicable.

ECC is cooler anyways

Thomas Pornin

15:03

@Iszi Necessarily, yes: if 2^p-1 is prime, then 2^(p-1)(2^p-1) is a "perfect number", which is even more useless than knowing a 27Mbit prime.

Iszi

So, there's a quarter-million dollar prize for a billion digit prime number. I wonder how many numbers need to actually be tested, out of the full set of billion-digit numbers. i.e.: What percentage of billion-digit numbers do not end in: 0, 2, 4, 5, 6, 8?

Lucas Kauffman

@RoryAlsop securityresponse.symantec.com/security_response/…

anyone here familar with Qualys?

CodesInChaos

decimal digit?

Iszi

Oh. I'm an idiot.

7

Of course, it would be ~40%.

Thomas Pornin

@Iszi When expressed in decimal, there are precisely 9*10^999999999 "billion-digit" numbers, out of which 9*6*10^999999998 do not end in 0, 2, 4, 5, 6 or 8

@Iszi It is exactly 40%

Iszi

15:16

@ThomasPornin Thanks, Sheldon.

lynks

@Iszi you only need to try dividing by other known primes, and only up to the square root of the number you are testing. trial division has lots of optimisations.

CodesInChaos

you'd probably sieve a bit, and then run 2^p mod p and a few other probabilistic tests

Iszi

@lynks That presumes that you already know all the primes up to sqrt(n).

CodesInChaos

I'd guess you need to only test less than a billion numbers of those that survive a basic sieve

Thomas Pornin

@Iszi You are allowed to try to divide with non-primes, too. It will just take more time but it won't break the test.

Iszi

15:23

@ThomasPornin Of course. What I'm saying is that you can only limit your divisor search to prime numbers, up until the point you run out of... I'll say "consecutive" primes, but I'm sure that's not the right term.

(e.g.: 5 and 7 would be "consecutive" but 11 and 17 would not be)

So, if in your search for divisors you reach primes x and y, where not all numbers between x and y have been tested for primality, you also need to check all the numbers between x and y.

lynks

@Iszi correct, but you save yourself a whole bunch of work, given that we have consecutive primes way up into the millions, and they account for a tiny fraction of natural numbers.

also stopping at sqrt(n) is rather helpful :P

Thomas Pornin

@Iszi If you generate the divisors "successively" then it is a rather simple matter to skip multiples of 2, 3, 5, 7, 11... by using Erathostene's sieve. It would be easy to avoid, say, 99% of the trial divisions with non-primes.

Of course, trial division is just slow anyway.

lynks

@ThomasPornin slow but correct, unlike probablistic methods

Rory Alsop

@LucasKauffman hmmmm - wonder whether they need an email to tell them...

CodesInChaos

@lynks How are deterministic methods running on indeterministic hardware any better than probabilistic algorithms?

You've a chance of error either way. But typically the algorithm error chance can be made really small, like 2^{-256}

Thomas Pornin

15:36

@LucasKauffman A few weeks ago, I got a call from the security people, they had detected that one of their precious servers had been scanned from Qualys, and they wanted to know if that was me. I fear that I have built up a "reputation".

@CodesInChaos That's the kind of probability where I usually conjure up an analogy involving cosmic rays and gorillas.

lynks

arg, whats the key combination to toggle shell echo, my remote shell has gone all non-responsive

Thomas Pornin

@lynks Try Ctrl-Q

Ctrl-S is the "xoff" command to stop the flow

Ctrl-Q is the "xon" which enables it again

lynks

@ThomasPornin thats the one, thanks :)

Thomas Pornin

@lynks That's the "software control flow" which you would use with a serial terminal (a VT220) when you were too lazy to solder more than the minimum 3 wires in the serial cable.

That xon/xoff are still honoured over a SSH connection where there is no serial cable involved is just the habitual symptom of Unix-like systems being radical conservatives who never throw away anything.

Sometimes there is a comment from a user, and I cannot fathom all the layers of confusion which could result in such a comment: security.stackexchange.com/questions/30382/…

lynks

@ThomasPornin you know too much

@ThomasPornin looks like he is responding to the part of the question that states that printers can be 'hacked' by malicious pdfs.

Rory McCune

16:06

@LucasKauffman running it through virustotal, it's getting 2 detections out of 46 virustotal.com/file/…

Adnan

@ThomasPornin Should I feel bad that I have absolutely no idea what that comment is about?

Thomas Pornin

@Adnan On the contrary. Understanding that comment would be a bad sign for your mental health.

2

Tinned_Tuna

16:32

Is this a reasonable assessment of the situation: coderinaworldofcode.blogspot.co.uk/2013/02/…

(i.e. any changes that should be made?)

Thomas Pornin

@Tinned_Tuna I would argue against the entropy-worship

32 bits of entropy are more than enough if offline dictionary attacks are not feasible

After all, a credit card with a 4-digit PIN uses a much lower entropy (less than 13 bits)

Allowing offline dictionary attacks from the outside would be a sever protocol flaw

And even against attackers who gained illegal read-only access to the server database can be somewhat thwarted by using salted slow hashing (bcrypt and its ilk)

lynks

@Tinned_Tuna i totally second the no copy-paste rule. i was pretty angry typing out my 20 character random string from keepass

Thomas Pornin

When users choose good enough passwords to actually achieve 32 bits of entropy, then the password situation is mostly solved and it is reason to rejoice and have a grand feast.

lynks

@ThomasPornin credit cards only allow 3 attempts though, then the card locks itself

Tinned_Tuna

@ThomasPornin wow, that's a sad state of affairs :-(

Thomas Pornin

16:40

@lynks Ex-act-ly. That demonstrates while online dictionary attacks are less of an issue.

My own passwords have 32 bits of entropy and I am happy with that.

lynks

@ThomasPornin I disagree slightly, surely defense-in-depth is always better. always assume that the hashes will be downloaded by someone, at some point in the future. having passwords that are secure against a slow, online dictionary attack, and no more, is a little short sighted.

Thomas Pornin

@lynks 32 bits are secure against an offline dictionary attack too, IF the password hashing process is done properly.

Tinned_Tuna

I agree with @lynks -- you're assuming that they are using best practices on the backend.

lynks

@ThomasPornin again, always prepare for the worst.

Lucas Kauffman

“G’Day mate, Fosters Help Line. What’s the problem dude?”.

“I’m in Australia with the girlfriend and she’s been stung on the vagina by a hornet, and now her minge has completely closed up”

“Bummer dude”

“Thanks mate , bye”

Tinned_Tuna

16:43

blink

lynks

@LucasKauffman xD

CodesInChaos

17:01

32 bits is a bit on the low side for offline attacks

might be OK with exceptionally good stretching

but for example Truecrypt only uses PBKDF2 with 1000 iterations

lynks

17:17

i don't usually swear, but when i do, it's to say how much i fucking hate ruby.

2

CodesInChaos

what's the problem with ruby?

lynks

@CodesInChaos it is the most non-orthogonal language of all time

@CodesInChaos there are language constructs that people say to 'never use', this alone is a very bad sign.

@CodesInChaos it is completely unnecessary, does not cover new ground that other languages didn't already. it exists solely so that hipster CEOs can torture developers into using yet another terrible web technology.

Rory McCune

@lynks small point but ruby != rails..

I find ruby pretty useful rails is nice but has its problems

lynks

@RoryMcCune absolutely, but I hate both. I just hate rails more.

CodesInChaos

I'm mostly a C# coder, but I'm planning to learn some dynamically typed scripting language

Rory McCune

17:21

well each to their own, personally ruby is my language of choice ..

Tinned_Tuna

Lol, I write Java, and occasionally Groovy.

lynks

@RoryMcCune I mostly disagree with the vast amount of variable declaration methods, each with its own weird ruleset that is exclusive to ruby. like why allow static fields, then discourage their use, and instead advocate using a reflection-oriented approach of 'class-instance fields'...

Tinned_Tuna

I think I've gotten away with it.

lynks

its an instance variable...but it's declared in the class, rather than any instance of that class...what now?

Rory McCune

@lynks yeah for some types of coding I can see why ruby is not a good idea. I mostly write short'ish scripts and I find it lets me get things working quickly and I find the syntax easier than alternatives

The extremly dynamic side of things and monkey patching is, to my mind, not too nice

lynks

17:26

@RoryMcCune yeah, I've hit that a few times in answers on SO, I shouldn't have to change libraries to work for me, I should be able to extend their functionality to work for me. I've never felt the need to recompile my own version of a standard Java class.

@RoryMcCune the worst thing, is that I'm running out of web-languages that are acceptable to me. Guess I'll move to python.

Rory McCune

<shudder> white space is significant

lynks

@RoryMcCune it scares me too, but lots of people I respect advocate it...

CodesInChaos

And their upgrade culture competes with TLS

lynks

@CodesInChaos hmm?

Rory McCune

@lynks yeah for my line of work (pen testing) it's really either ruby or python for most stuff. Python does have some libs that look nice...

CodesInChaos

17:30

Python 3 is 4 years old, and most still use python 2

Tinned_Tuna

Groovy is a very interesting language for pen testing. If you're trying to do any sort of timing analysis, you basically have to throw away your first few requests, as the JIT on the JVM can really mess with things.

Rory McCune

yeah the lack of uptake there is weird.. ruby 1.9 seems to be taking over from 1.8 quite easily.

CodesInChaos

Just like TLS 1.2 is 4 years old and people still use TLS 1.0

Rory McCune

BTW if people've not seen it I thought this checklist on auditing high value apps was interesting github.com/iSECPartners/LibTech-Auditing-Cheatsheet

lynks

@CodesInChaos ahh I understand, I thought you might have typo'd LTS and got confused

Thomas Pornin

17:49

@Tinned_Tuna The same tends to apply with any VM with JIT.

If you know Java, you are actually close to knowing C#/.NET, and vice versa

Lucas Kauffman

@lynks I advocate it too! I even have a basic example of webpy on my blog :)

lynks

@LucasKauffman it is certainly my next language to learn, I have a great big pile of literature to get through for a job application, but after that I'll be all over the python.

lynks

18:12

@RoryMcCune how do i access a @@variable from a different class? I have tried OtherClass::variable and OtherClass::@@variable, both fail, the second with syntax error :(

p.s. I hate ruby

CodesInChaos

In German we call Norton Anti Virus (or whatever it's official name is nowadays) "Gelbe Pest" (yellow plague). Does it have a similar nick name in the English speaking world?

Rory McCune

@lynks if you have access to the class you need to define an accessor method on it to get access to the class variable AFAIK

def access_class_var

@@class_var

end

lynks

@RoryMcCune thanks, but I've changed to try to use a class constant, but that is still failing, fml.

p.s. I hate ruby

Iszi

Does anyone else harbor a certain dread for the arrival of new tech in the house that is not to be your own? When it's yours, it's a great new toy. When it's not, it's just more work.

Polynomial

18:28

@Iszi Pretty much. I'm on tech support duty right now with my Dad's laptop.

Iszi

Wife is due to be receiving a new laptop any minute now.

Polynomial

worst one is new laptops that've been bought from places like PC World.

so much junk pre-installed.

e.g. "Some Bullshit AV 10.5 Free Trial"

Iszi

@Polynomial I think you mean new laptops, period. Everyone, even OEMs, puts a fair amount of junk on them.

Tip: If you don't like crapware, stay away from VAIO.

Polynomial

HP are bad for it too.

Iszi

@Polynomial I haven't had that bad an experience with HP.

Polynomial

18:30

worst thing is that places like Pissy Werld get the hardware from OEMs, then put their own junk on top of it

Iszi

@Polynomial Ah, true.

Polynomial

with HP it's not so much junk, but needless bloatware

HP Power Manager, HP Disk Health Check, HP Security Manager, etc.

Rory McCune

@Polynomial god I hate HP. Installed a printer driver to fix my Mother in laws printer. 228MB download!! Then I can't uninstall it, as it trashes win8 when I do

luckily windows 8 rollback feature is awesome and saved it

Iszi

@RoryMcCune Sounds like you picked the wrong installer. A bare-necessities driver download shouldn't be near that large.

lynks

@Iszi I run debian on my vaio, that was not easy to get working. sony love to make things weird.

Scott Pack

18:36

@RoryMcCune Does the rollback re-install Windows 7?

Rory McCune

@Iszi ahh couldn't use the bare one. Needed to re-configure the wireless on the printer (basic model that didn't let me do it via the panel) and that needed the full driver

Iszi

Ah, right. There's another thing. Damn new LT is coming with Win8 - and she actually wants to give it a shot, so there's no "cheating" for me.

@RoryMcCune No web interface via ethernet on that model?

Rory McCune

@ScottPack LOL. Actually once you get past the start screen/metro thing, win8 is cool, many improvements over 7 and pretty stable

@Iszi don't think so it's a pretty dinky one

Scott Pack

@RoryMcCune I do find it amusing that I'm starting to notice screens, even on 7, that say "Click or Tap".

Iszi

@RoryMcCune Gotta give MS some credit for finally starting to make stable OS's since XP.

CodesInChaos

18:38

Win2k was pretty stable

Scott Pack

I've found 7 to be pretty spot on.

Iszi

@CodesInChaos Talking about consumer OS's.

Rory McCune

@Iszi yep the base OS is getting nicer as time goes by, powershell is a good scripting language and the backward compatibility is good.

CodesInChaos

I used win2k as a consumer

Iszi

@CodesInChaos That wasn't their primary market, though.

Scott Pack

18:39

I took my win2k desktop to lan parties.

Rory McCune

@CodesInChaos Me 2 'cause ME was god-awful and NT4 had bad hardware detection..

Iszi

@RoryMcCune Funny thing about ME. I never had any more problems with it than I did 98SE, despite hearing everyone else constantly gripe about it.

Scott Pack

Hey, who's that kid that started hanging out here from Abertay?

I was supposed to get him something but now I can't remember his handle, yo.

Rory McCune

@ScottPack Adam McKissock IIRC

Scott Pack

That sounds about right

Hopefully I'll remember that long enough for him to come back.

Rory McCune

18:41

@Iszi yeah I wasn't a fan but then probably didn't use it all, I had just got into IT around then so was running more of the NT line 'cause it was what I was using at work..

Polynomial

@RoryMcCune I've had that experience with HP's server stuff. Downloaded an update for the iLO management card, was a few hundred megs. Then it wanted me to burn the update to a floppy and reboot... so I downloaded ~300MB for a 1.44MB image, and had to dig out a floppy disk from somewhere.

total waste.

Thomas Pornin

@Polynomial Had some trouble with a new HP PC recently. Bought it, removed the hard disk, put in the two disks with a Windows 7 installation (from a machine where motherboard fried), and... no boot.

Rory McCune

@Polynomial I'm just glad that floppy based stuff has mostly died a death for BIOS updates. I used to have to keep a drive around just for that..

Thomas Pornin

After some murking with BIOS settings, boot works and I can update drivers, but no video driver

Because HP used a specific Radeon card with a modified PCI identifier so that only the HP driver can handle it

and the HP driver is for Windows 8 only

CodesInChaos

mobile graphics cards+drivers always sucked

Thomas Pornin

18:49

It turned out that when you remove the card, the motherboard remembers that it has some integrated graphics; I just had to remove the plastic caches which covered the plug.

And that's one less fan in the case, too

Polynomial

@RoryMcCune Dell's BIOS update for laptops is hilarious. You click update and it just halts the OS immediately with no warnng, lets the BIOS chip take over the screen, flashes stuff across, and hard reboots.

not exactly ceremonious.

Rory McCune

@Polynomial youch. The lenovo one is ok. Does some stuff asks you to reboot. reboots does the update reboots again.

Scott Pack

@RoryMcCune I had to make a DOS boot flash drive to update a Dell bios a year or two ago. That brought back terrible memories.

Rory McCune

@ScottPack last time I had to do a floppy BIOS flash I found the one last disk I had (a firewall license disk from around 2000) and pulled a drive out of an old desktop to make it work.

this is amusing, things MySQL does unexpectedly in comparisons phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails

Thomas Pornin

@Polynomial That kind of no-nonsense programming is kind of refreshing.

Polynomial

18:56

Samsung's latest one is nice. It advises you to only do an update if you know what you're doing, and lets you know that it's done a full check of the backup BIOS to make sure it's working. When you click run it explains what it's about to do, offers to save the existing BIOS image and settings to a USB stick in case you need to restore it, shows you that it's done proper integrity checking on the BIOS image, then locks all user input shows a screen overlay to show the progress.

when it's done it just says "reboot in order to complete" and leaves it up to you.

@ThomasPornin downside is that it doesn't warn you it's going to reboot. so if you're not expecting it, then BOOM! it just reboots.

also it's not exactly good for the OS to just reset the system without properly shutting down

Thomas Pornin

@RoryMcCune Automatic type casts are evil. They are meant to allow programmers to remain unaware of what happens under the hood, and the unfortunate consequence is that programmers remain unaware of what may happen under the hood.

Transcript for