The DMZ

this.josh

00:25

securitybsides.com/w/page/35868077/BSidesSanFrancisco

Jeff Ferland

00:55

@this.josh Yup

this.josh

For whomever is interested.

Jeff Ferland

01:17

@this.josh Me! I'm (one of the people) organizing it! Get your asses there!

this.josh

Your web page has too many cookies on it :P

@JeffFerland Oh I missed "@jbferland"

Scott Pack

01:41

@Jeff I should start calling you Benedict

this.josh

You have something against Hollandaise sauce?

Scott Pack

Yes. It's too bloody Dutch.

this.josh

Isn't gin Dutch?

Iszi

03:47

@BobWatson One of the problems I have with your argument is that you're assuming it's going to take 30+ years before your heirs will need access to that information. It's not that hard to leave good instructions and hardware/software to enable them to access it in a timely manner after your passing. After that point, they can take the data in the clear and protect it in whatever way works best for them - they will then be the responsible custodians.

Bob Watson

Sure, but the question is how "I ensure that the encryption is future-proof, and that I will be able to access the data an arbitrary amount of time in the future"

The best way to ensure encryption is future proof is to not use any, and the best way to ensure access in the future is to reduce your requirements.

"Remember one key, and the location of one safe"

vs

Iszi

@BobWatson That's not quite the way the question was originally worded. But the answer is still to just properly maintain the system.

Bob Watson

"Remember my password for a computer I haven't used in ages, how to use the software, where I put the keys, etc."

That was copy/pasted from the question

4

Q: How to avoid to lose data encrypted because it was encrypted by no longer supported software?

How can I avoid losing data that is encrypted using methods that may become obsolete? I have valuable family records I wish to secure, so I plan to encrypt them before putting them in long-term storage. But how can I ensure that the encryption is future-proof, and that I will be able to access th...

Iszi

@BobWatson I don't see that in the current or original version of the question.

Bob Watson

Or more simply: "How to avoid to lose data encrypted because it was encrypted by no longer supported software?", "Don't use software, therefore no software to no longer be supported."

The last sentence: But how can I ensure that the encryption is future-proof, and that I will be able to access the data an arbitrary amount of time in the future?

Iszi

03:52

@BobWatson In any case, you're not answering the question - you're totally side-stepping it. Proper answers are to either maintain the system and data properly, and/or keep a failsafe system with good documentation for its use.

Terry Chia

Gonna have to agree with @Iszi here.

Bob Watson

@Iszi It is resolving the problem though. You have to consider just not encrypting as an option, and as a solution to the question.

Scott Pack

@this.josh I try not to think of that.

Bob Watson

And it's a pretty big issue in infosec - the fact that we often miss physec solutions.

Iszi

If I was to be keeping multiple generations of family data - PII possibly including full names, DOBs, addresses, parentage (read: Mother's maiden name, Father's middle name) and maybe even SSNs, I most definitely would not want anything less than encryption protecting it.

Terry Chia

03:53

What happens if your bank burns down/destroyed in an earthquake/got hit by a nuclear warhead?

Or got robbed...

Iszi

@TerryChia is going in a right direction as well. If you're keeping the data there, it's totally lost and perhaps even compromised. If all you're keeping is a backup of the keys, there's no significant consequence to you except that you need to make a new backup and re-key the data.

Bob Watson

It's not clear from the question if these are active documents, but if they're not - I worry that you won't be able to open whatever format they're stored in, let alone decrypt with the key

Iszi

@BobWatson Which is why the answer is: Maintain your system and data, and keep a failsafe.

Otherwise, you're settling for weaker protection.

Bob Watson

I don't think that's realistic over an 'arbitrary' time period.

Yeah, it's weaker protection, but requires a ton less resources

Terry Chia

Encrypted data in it's lowest form is still 1's and 0's. I don't see binary disappearing any time soon.

Bob Watson

03:58

My position is that it's probably not the best option for data you need access to in 30 or 40 years

It's different if it's data that's constantly changing, because then you're constantly updating, etc.

Iszi

@BobWatson I don't think an "arbitrary" time period is realistic to assume for the given data. At most, you're possibly looking at around the 30 or 40 years as you're suggesting. If you keep a good failsafe system and documentation, I'm sure your family can find someone with the proper vintage expertise to help them read the data.

Bob Watson

But if it's a one-off, print it out, put it in a locked box, put that box in a safety deposit box.

Terry Chia

@BobWatson You are assuming safety deposit boxes are infallible.

Bob Watson

To me, the question emphasises arbitrary

@TerryChia I'm not, I'm assuming that a safety deposit box outlasts current PCs

So don't use a deposit box, lock it up and keep it in your house

Terry Chia

I'd say there is a higher chance of a safety deposit box being robbed than computer architectures completely changing in 30 years with everyone that knows how to use the old architecture dying of mysterious causes no?

@BobWatson Like your house is perfectly secure...

Bob Watson

04:01

A bank is definitely more secure than my house

Architectures have changed a ton in 30 years.

Scott Pack

From an archivist perspective, encoding data in a single non-paper format and then putting it away for 30-40 years is already failure.

Bob Watson

Can you open stuff on a 5.25" floppy?

Scott Pack

All storage formats need to be revisited, and transferred if necessary, ever few years.

Terry Chia

@BobWatson That's where maintenance comes in. UPDATE your storage if mechanisms undergo a radical change.

Bob Watson

Ok, but paper in a safe requires less maintenance than anything in current computer tech

My point is only that in the case where you want access to your data over an undefined time period, you may be better off considering non-IT solutions.

Scott Pack

04:04

Honestly, if you lock any information away for that long in any format except archival quality paper+ink, then you're either committing a grievous error through ignorance or determining that the information isn't important enough to keep.

That's why you maintain your electronic records.

Terry Chia

brb lunch

Bob Watson

If you're looking at crypto options for keeping something safe in the very long term, I think you're building in a lot of assumptions about your current environment - that your word document or whatever will be openable after a number of years, that your archive format has modern parsers, etc. etc.

You build in fewer assumptions if you use a simpler solution

Scott Pack

This also takes a long time to figure out the standards. In the photographic field they haven't come up with a standard image storage format yet. Hell, some archivists (partially jokingly) even say that paper hasn't been fully tested yet.

Bob Watson

And we can argue about paper types, etc. - but I think this is a case where paper wins

Scott Pack

The only storage medium that's been proven for arbitrary long time frames is stone tablet.

@BobWatson What I'm saying is that your base assumption is faulty, from an archival standpoint.

Iszi

04:08

@ScottPack You sure about that? Maybe we should check with @RoryAlsop.

Scott Pack

@Iszi Papyrus degrades faster than stone.

Bob Watson

@ScottPack My base argument is "Consider if non-IT solutions are appropriate before inventing a complicated maintenance schedule and choosing to use encryption at all."

Scott Pack

@BobWatson You seem to be implying an encrypt and forget methodology, which is already assured to fail.

Iszi

@ScottPack I didn't suggest it wasn't better than paper - just that it might not be "proven for arbitrary long time frames".

Bob Watson

I didn't actually mention paper or anything in my original answer

It just came up as part of a point that unencrypted data is more accessible

So just protect that with stable tech and you're done

Scott Pack

04:10

Now, what you could do is 3DES the information, print that out in binary form on paper, then store it away. As long as it's marked as 3DES you'll be fine.

Iszi

@BobWatson Then you're still left with the same problems you're arguing against - the availability of compatible hardware/software to read the electronic data.

Bob Watson

@Iszi I'm trying to get away from the assumption that "This is electronic and needs to be secure, let's encrypt it!"

Scott Pack

@BobWatson If it's electronic then the long term viability of known encryption standards isn't the problem.

Bob Watson

An LTO tape in a lockbox is both more secure and more likely to be accessible than anything you want to store on a home pc

Scott Pack

That's not where your data loss is going to occur.

The storage medium is what's going to fail, not the cryptographic algorithm.

Bob Watson

04:12

I think the medium is likely to outlast the value of the data regardless

Maintenance of an encrypted document is not straightforward

You have to constantly keep it up to date, saved in new formats, etc

Scott Pack

I've seen long term tape storage facilities. They're pretty bad ass.

Bob Watson

And encrypt / decrypt it each time

I work in records - it's almost never the tape that's bad

It's the person saving a word doc with a password they forget 10 years on

Scott Pack

I can't tell you how many hours I've spent cleaning the tape leavings off heads.

Bob Watson

Or the guy who uses Macromedia Freehand

Iszi

@BobWatson Magnetic media, according to Wikipedia, is only good for around 20 years.

Scott Pack

04:13

@Iszi If stored well.

If not stored well, much less.

Bob Watson

Yeah ok, but 20 years is longer than I think you would manage to hang onto your encrypted data

And if it's stored in a safety deposit box, that doesn't prevent you from updating the media

Iszi

@BobWatson But your assertions in this argument are that the data should be available for 30+ years.

Bob Watson

Coming right back to it: "how can I ensure that the encryption is future-proof" - that's easy, use a well known algorithm; "and that I will be able to access the data an arbitrary amount of time in the future" - that's hard, and non-IT solutions are likely to serve you better over the long term

Look, over an arbitrary amount of time, quoting myself earlier "The best way to ensure encryption is future proof is to not use any, and the best way to ensure access in the future is to reduce your requirements."

Scott Pack

Honestly, I think anyone that really thinks they can answer the second question is fooling themselves. The answer simply cannot be answered without knowing what "arbitrary" means to the person in question.

Iszi

@BobWatson ...while being much less secure overall, and less accessible.

Bob Watson

04:16

Yes, that is the sacrifice

Though, much less secure is hard to quantify,

Secure from whom?

Iszi

@BobWatson Anyone with physical access to the storage medium. (Presuming they do not possess the key.)

It is several orders of magnitude more trivial to compromise data stored on paper in a bank vault, than it is to compromise electronic data encrypted with a robust algorithm and strong key.

Bob Watson

I just think that, overall, you're much more likely to be able to get at your data if you use less technology, and that the tech you use is well understood.

Scott Pack

Truth be told, I have no idea what you guys are actually arguing about. So is someone honestly asking how to make their files encrypted with the proprietary crypto from Adobe AwesomeProtection stored on floptical drives trivially readable in 100 years?

Bob Watson

4

Q: How to avoid to lose data encrypted because it was encrypted by no longer supported software?

How can I avoid losing data that is encrypted using methods that may become obsolete? I have valuable family records I wish to secure, so I plan to encrypt them before putting them in long-term storage. But how can I ensure that the encryption is future-proof, and that I will be able to access th...

encryption software

Long-term storage is also important here

I'm assuming 'arbitrary' that he mentions is 20+ years

And my answer was essentially "Get a securely lockable box, secure the keys and put it in a safety deposit box at your bank."

Iszi disagrees, " First, protection of this data is very important as it will likely contain PII and other sensitive information for several generations of one's family - at least two of which are likely to be currently living. Second, securely storing a "failsafe" copy of your encryption software and keys in a place other family members can get to is just as easy as storing the records themselves in a safety deposit as you suggest."

Scott Pack

Oh, to answer the question in the title? That's easy. Don't use proprietary crypto. Who cares what software you use to encrypt something with AES256. Any piece of software that implements the spec will be able to take care of it.

Or, worst case scenario, you throw $50 at some developer and have them mosey down to the library, look up the algorithm on microfiche, then code it up.

@BobWatson You know what happens when you start assuming. You make an ass out of you and Ming the Merciless. And don't nobody fuck with Emperor Ming.

4

Bob Watson

04:23

Yeah, but 'long-term' doesn't conjure up 3-5 years.

And yeah - there are ways to do it, certainly. I just question whether or not they're the best approach.

Scott Pack

To me? Not really. To @TerryChia? That's like half his life.

2

Iszi

Y'know, if we're talking about ASCII text, we could go a route that employs both strong cryptography and hardcopy storage.

OpenPGP.

Bob Watson

That's true, and really - without knowing the specifics around who's going to need access, if it's likely to be in a hurry (are they wills? Do you want to take the risk the person executing your will won't understand the principle behind the encryption?), and a host of other things

It's not really possible to get to any agreement

Scott Pack

@Iszi In the past that's exactly what I've done with passwords. I put them all in a keepass file. Placed it, a text file with instructions, and a copy of keepass portable, on a USB hard drive in my safe deposit box. I've let the relevant people know where they can separately retrieve the passphrase. Then a couple of times per year I spool up the drive, make sure it's up to date, and that the drive still works.

Iszi

@ScottPack No, I mean hardcopy storage.

Take your data, encrypt it with OpenPGP. Print out the PGP block and keep it in your own fire safe. Print out the private key and put it in a safety deposit box.

Scott Pack

04:27

@Iszi Oh sure, just print out the binary, or base64, of the encrypted file and reference the algorithm used. Find a way to distribute the key.

The original input doesn't have to be ASCII text either. The armored block could be a tarball containing all of the files necessary to do whatever.

You know, the directory tree of your documents that were typed up in StarOffice.

Terry Chia

@ScottPack That's fucking awesome. I'm gonna steal that line.

@ScottPack Hey.. I'm not 6...

Scott Pack

@TerryChia Now go watch Flash Gordon so you'll at least know what we're talking about.

So, after reading up on all the past bickering, I am going to disagree with @Iszi on something.

Iszi

@ScottPack Am I supposed to be surprised?

Scott Pack

Good freaking luck getting that laptop to even boot. Hard drives that sit for a long time tend not to spin up all that well.

Iszi

@ScottPack Yeah, we've just more recently gotten around to that. Thanks. But then we're back to the issue of the data itself even being good either.

Scott Pack

04:34

@Iszi If you leave a spinning platter drive sit for a long time you might end up with something like this.

►

Iszi

@ScottPack Do you have any data on solid state storage longevity, presuming the drive isn't read/written for the duration? I'm guessing it's shorter than magnetic media?

Bob Watson

I don't think SSDs have been around anywhere near long enough to have a good read on that

Scott Pack

@Iszi Making sure the data format is both encrypted and usable over some reasonable time frame (small numbers of decades) isn't really all that hard. The harder part is making sure that you can still get at the information.

Agreed. SSD is way too new.

Iszi

Was figuring someone would have some theories by now, at least.

Bob Watson

Well, we've got a 6tb array of 256gb SSDs, and we replace one about every 12 weeks.

Scott Pack

04:37

Assuming it is stored in a place with reasonable atmospheric qualities, I would guess that solid state would have better longevity than magnetic on tape.

Bob Watson

But those are under massive use - so they definitely don't last as long in motion.

But voltage 'leaks' over time in SSDs, and relies on having a power source to get it back in line

So leaving them unplugged is also not great for longevity

Scott Pack

The problems with tape is that the electronic storage media sloughs off the physical storage media both in storage and in use.

The physical failures from SSD, when in storage, will result from corrosion, which is easier to protect against.

But, yeah, how long the bits can be stored on the media itself? I don't really know anything about that.

I would love to read a study on it.

I read a study on the longevity of Compact Discs about 10ish years ago. That was pretty fascinating.

Iszi

@ScottPack Those hardly last a decade, right?

Scott Pack

@Iszi Keep going down.

Iszi

@ScottPack That's what she said!

Scott Pack

04:41

BAM!

Here's a hint, it was supposed to be a 10 year study. They started noticing statistically significant failure rates after 2-3.

Iszi

@ScottPack Was that on user-writeable media, or professionally made stuff?

Scott Pack

@Iszi It was burned not pressed.

Iszi

@ScottPack So, how'd the printed stuff hold up?

Bob Watson

Stamped CDs are really variable - they're all sorts of thickness / types of plastic / etc

Scott Pack

The purpose of the study was to determine it's failure rate as a long term storage medium, which pretty much disqualifies pressed since it's just too expensive to use for arbitrary data storage.

The problem with burned discs is that the ink that you burn in order to encode the data would degrade over time.

So all of a sudden you started having bits flip as different sections of the ink changed.

They do make archival quality discs, which do a lot better, but still has the fundamental problem of storing the data on an inherently volatile substrate.

On archival quality discs the plastics are better quality, generally thicker, less prone to spontaneous delamination, higher quality inks that don't react as quickly to light, etc.

Press are, of course, best because in that case you're dealing with embossed metal. In those cases the plastic is simply there to protect the metal. So as long as it doesn't get scratched or clouded to the point of disrupting the laser, or delaminate, you're pretty much good.

Ugh. I'm really starting to sound like a stuffy archival nerd aren't I? I'm feeling a sudden urge to go get a drink at the biker bar.

Bob Watson

04:50

You would probably pick better quality for archive, but I've had stamped CDs from the 90s just come apart putting them in a CD player.

Those were singles mostly - but cracked to the point of being unreadable inside 5 minutes in the player

Scott Pack

Oh sure, that's the delimitation problem. Whatever it is that holds the two layers of plastic together just wears out over time.

Compact discs are put into pretty high stress environments. They're spun up and down quickly, often have fast heat/cool cycles, get thrown around, scratched, bent, everything.

I think it's pretty amazing that they hold up so well for two pieces of plastic glued to some tin foil.

Bob Watson

hpstoragemedia.com/main/en/mdt/medialast_eee.pdf has some stats

Ultrium at 30 years

Optical at 50

They don't say what they use for optical though

Scott Pack

I can't imagine charred ink optical lasting that long under any circumstances.

A good quality pressed and stored correctly? Sure, I could buy that.

Bob Watson

Wonder how that translates to DVD/Blu-ray

DVD has dye in the mastering process for professional stuff

Scott Pack

I've still got CDs from around 91-92 that will play. They spent the '90s and '00s being totally abused too.

I dunno, still pretty new tech. Modern DVD is from the mid 90s?

Bob Watson

04:59

That's about right

Scott Pack

Oo! Point of Interest: My father still has functioning LaserDiscs that be bought in the early 80s.

The only one that we know has failed was because my brother smeared it with peanut butter. That was still in the early 80s, though.

The data densities of blu-ray, and to a lesser extent dvd, make me wonder how we'll they'll hold up long term. A CD will be much more tolerant to failure simply because the density is so much lower.

Bob Watson

A lot less error-check with CD, and the laser is a much lower wavelength too - so maybe npt

*not

Though I remember sitting in a seminar at national archives once when they told us to burn 640mb of data to a DVD because it'll 'spread it out'

Scott Pack

Bob Watson

Yeah

And it was that seminar they explained DVD error checking

So grain of salt.

Scott Pack

I don't actually know anything about what encoding mechanism they use for CDs. I don't even know that there is inherent error checking.

Bob Watson

05:06

There's parity checking at least

Cross-interleaved Reed–Solomon coding

In the compact disc system, cross-interleaved Reed–Solomon code (or CIRC) provides error detection and error correction. CIRC adds to every three data bytes one redundant parity byte. Overview Reed–Solomon codes are specifically useful in combating mixtures of random and burst errors. CIRC corrects error bursts up to 3,500 bits in sequence (2.4 mm in length as seen on CD surface) and compensates for error bursts up to 12,000 bits (8.5 mm) that may be caused by minor scratches. Characteristics * High random error correctability * Long burst error correctability * In case the burst correcti...

Scott Pack

That looks almost boring enough for @Thomas to be interested in.

Bob Watson

Well, I'm laid up sick at home at the moment, and my only internet access is via a work machine that blocks pretty much anything even slightly suss

Trawling the wiki is my only form of entertainment

Scott Pack

Sounds like @Iszi at work.

For the record, Thomas is our resident cryptographer. You know, all that boring crypto garbage.

Terry Chia

06:01

Shamless self promotion: link to my new blog: infosecstudent.com

Hopefully I will be able to keep it active with decent content. :P

Bob Watson

blog.whitehatsec.com/cracking-aes-256-dmgs-and-epic-self-pwnage was posted just a little while ago; kinda kicks up the 'should I encrypt?' argument again tho, forgive me for that :)

Terry Chia

06:32

@BobWatson Well, that really isn't a flaw with the encryption. It's a flaw with the password being used.

0

Q: How to bring little changes in DES algorithm

I thought of implementing DES modes of operation as a project...But my guide asked to change or to modify the DES algorithm in such a way to overcome drawbacks of DES...So is there any way to do changes?IF so how?and could you please give me idea on how to bring changes in any of 5 modes of DES.p...

encryption cryptography cipher des secure-coding

What now...

We really need a close option for don't do that, it's a fucking stupid idea.

Bob Watson

Sounds like a uni project someone wanted to do, and their instructor really didn't want them doing.

Lucas Kauffman

08:32

mornin

Rory Alsop

11:28

@Iszi I just tuned the output of my favourite pulsars. Why, what does everyone else do? :-)

Morning all!

Thomas Pornin

@ScottPack Beware, mortal: if you invoke the name of the Bear, He might intervene.

Audio data on a CD does not have any error-correcting code, but there is a checksum which tells the player whether a given sector is good or bad. When a sector is bad, players skip it, instead interpolating the audio from the previous sector.

Rory Alsop

INTERVENTION!

Terry Chia

@ThomasPornin Seriously. Is there anything you don't know?

Thomas Pornin

@TerryChia Cricket. I have difficulty remembering the rules of Cricket.

Rory Alsop

@ThomasPornin Well, in that case! Stop listenting to this man/bear - he doesn't know cricket!

:-)

How's the icy north, @Thomas?

Thomas Pornin

11:46

@RoryAlsop Refreshing

Not so called, only -14 this morning

But windy.

COLD, not called

If I am making this kind of mistake, then this means that I am thinking in English.

For CD with "computer data" sectors, there are error-correcting codes; 2048 bytes of "usable data" encoded over 2356 bytes on the medium. This helps surviving minor scratches.

On DVD, the process is more complex, with redundancy scattered on the disk so that a major but localized impact (say, a scratch) does not destroy data.

As for paper, it has been tested for long-term archival, and found wanting. Especially the paper they began mass-producing in the 19th century, based on wood. Lasts hardly a century on average. Paper made out of cloth (cotton or linen fibers) is more durable, which explains we still have readable books from the 16th century.

Stone is better, but it depends on the conditions. We have remarkably well preserved baked clay tablets from the pre-dynastic Sumerian sites, 5000 years ago: burial under extremely dry sand seems to work marvels. In wet conditions, even stone tends to erode.

Granite appears to be one of the best stones for long-term storage, but it is hard to engrave properly.

Rory Alsop

@ThomasPornin The oldest granite buildings in Aberdeen still look brand new - the carvings just don't erode, whereas buildings in Edinburgh tend to be a sandstone, which just looks ancient.

The level of detail you can get in granite is also good - resolution is high due to the strength of the stone

Terry Chia

@RoryAlsop Stone tablets. Now available with Retina Display.

Rory Alsop

12:02

@this.josh good keynotes. That Josh?

Thomas Pornin

For really long-term storage, you need to engrave on a platinum-iridium alloy

Rory Alsop

@TerryChia hahaha

@ThomasPornin what did they use on Voyager

(the NASA thing, not Star Trek...)

ahh - it was gold

Thomas Pornin

Yep. You can count on Americans for going to the most showy.

Durability in space is not the same as durability on Earth. For one, you do not have to fear corrosion.

For the very very very long term storage, iron (in crystalline phase) is the most stable element, but we do not know if the proton is stable. It has been computed that if the proton is stable and the Universe is not closed, then all matter in the Universe will become crystalline iron in a mere 10^(10^76) years.

Proton half-life is, experimentally, at least 10^33 years; predicted by some theories at 10^36 years; other theories consider it stable.

Ninefingers

13:30

@ThomasPornin I'm not sure. I imagine provided it doesn't violate their T&Cs it'd be okay. Maybe ask them?

Scott Pack

13:40

@RoryAlsop Do you ever get the feeling he just makes stuff up to maintain his reputation?

Rory Alsop

@ScottPack hahahaha

Scott Pack

I also just learned that he typically is translating from French to English when speaking to us.

Rory Alsop

@ScottPack That just makes me feel so.... inadequate

Scott Pack

During college I dated a native Spanish speaker. I always found it fascinating to find out about the linguistics interplay that occurred.

Each time she traveled back and forth between home and school it would take some time (usually a few days in Puerto Rico or a few weeks up here) for her brain to context switch between the languages.

So during that transition time she was thinking in one and translating to the other, hell even the language used in her dreams would switch.

Ninefingers

@ScottPack I speak French, and I have the same experience. If I'm suddenly asked to speak French it's hard, but after a bit I find it much easier. Then sudden switches into English confuse the French again. I'm by no means at the bilingual level, but I can hold a conversation if the french person is prepared to excuse some broken phrases!

Scott Pack

13:55

@Ninefingers I find myself a rather typical American in this respect unfortunately. I keep thinking to myself that I should at least make an attempt to learn another language, but it hasn't happened yet.

@Ninefingers This girl was properly fluent, speaking English with a Midwest accent.

It was always a surprise when we came across a word that she didn't know. It was a rather sudden and stark reminder that English was not her primary language.

Ninefingers

@ScottPack Yeah. That happens... mid sentence you think... dammit I don't know a word for that. Or worse, you're not sure how to form a specific phrase correctly.

Probably a lot more to me than your friend, though.

Scott Pack

More frequently someone used a word she didn't know.

Ninefingers

Aaahh I see.

Thomas Pornin

@ScottPack Reminds me of this movie: imdb.com/title/tt0083943

Scott Pack

@ThomasPornin That looks terrible in the best way possible.

Thomas Pornin

14:00

To activate the weaponry on his newly-acquired vehicle, Clint must "think in russian"

Scott Pack

Oh, wow. Here's the tag line.

> ...the most devastating killing machine ever built... his job... steal it!

Thomas Pornin

Eh. Action movies from the 1980s.

Ninefingers

I had a colleague who spoke fluent russian once. Apparently not only do they have the usual array of verb conjugations, but they have noun declensions that obey rules akin to the french subjunctive (i.e., no rules, it just is, so good luck remembering it!)

Thomas Pornin

@Ninefingers Encore eût-il fallu que je les mémorisasse.

Scott Pack

Google translate failed on "mémorisasse". I am disappointed.

Ninefingers

14:03

@ThomasPornin subjonctif imparfait? Très difficile pour un étranger!

@ScottPack My french isn't that great and I can break google translate, so I'm not surprised!

Terry Chia

@ScottPack Could you add the english tag to the room?

Ninefingers

Don't worry. I should be able to translate Thomas' french, but I actually can't. I fall apart on literary tenses and resort to the dictionary pretty quickly.

Scott Pack

@TerryChia Is English your native tongue?

Thomas Pornin

@Ninefingers "Subjonctif imparfait" is the linguistic equivalent of aged cheese: it is an elegant rhetoric weapon from a more civilized age; and Brits cannot stomach it.

Terry Chia

@ScottPack yeah it is.

Ninefingers

14:08

@ThomasPornin Haha yes, that's about right. Well, actually it's not that I can't stand it, it's just that I see it so infrequently it's always a grammatical shock.

Then my poor British brain goes into overdrive trying to work out which verb eût is (avoir) and how exactly that would translate back to British (roughly: so I had to learn them (all))

Interesting fact about linux: if I press altgr+' then u I get û. I'm not sure what this feature is called that lets me input all these characters, but it's damned useful!

Thomas Pornin

@Ninefingers It depends a lot on the configuration.

Ninefingers

@ThomasPornin Yeah. I'm using gnome. I thought it was related to scim, but I don't have that installed. I do have the standard UK keyboard layout, but then so does Windows and Windows won't do it.

Thomas Pornin

Old timers with (properly configured) xterm (or the console with setmetamode) can type Alt+letter to "set the high bit" so you get "é" if you type Alt+i

Ninefingers

@ThomasPornin Yeah, Windows does do that. But it can't do « ĉ » straight from the keyboard.

Thomas Pornin

In modern systems you can have a "compose key" which triggers combinations. E.g. Compose+C+= will give you a euro sign.

This opens a lot of combinations, which more or less work for both X11 input methods and applications which use Gtk

Ninefingers

14:16

Thomas Pornin

(Gtk uses hardcoded tables which you cannot tweak without recompiling, which is a shame)

I usually set the "Windows menu" key (on the right of the space bar) to be my compose key.

Right now, I am typing this on a Mac, which has totally different key combinations.

Option-i yields a ˆ (so Option-i-u makes it a û)

Ninefingers

@ThomasPornin So not only are you fluent in several human languages but you're also fluent in Mac Keyboards?!! Is there no end to the wisdom of the bear?!

Thomas Pornin

@Ninefingers I do not support OS/2

Ninefingers

@ThomasPornin Well I guess that's understandable.

@ThomasPornin Hmmm, I might change mine. The right windows key seems a good choice as it serves no other purpose on Linux.

Mind you, I'm not sure what purpose altgr really has, either.

Thomas Pornin

@Ninefingers On French keyboards, the AltGr key is needed to type some characters which are not accessible otherwise, such as '[', '{' or '\'

(French keyboards are an abomination for programmers and also for people who use LaTeX)

Ninefingers

14:29

@ThomasPornin I was about to say...! The last time I used a cyber cafe in france I was 15, so I wasn't really thinking about suitability for tex.

Thomas Pornin

For the last 18 years or so, I have systematically configured my French "azerty" keyboard as US "qwerty"

Scott Pack

@ThomasPornin %s/ for programmers and also for people who use LaTeX// There, I fixed that for you.

Thomas Pornin

The first Minitel prototypes actually add a keyboard in alphabetical order (first row went "a b c d e f ...")

This is the "could have been worse" reminder.

(zoom on the keyboard, you will see it)

Ninefingers

@ThomasPornin I love that the space bar is labelled as such! I don't ever remember seeing that anywhere! It's always just been the largest key on the keyboard/typewriter.

Scott Pack

@Ninefingers That's an intentional UI element. You see, the "space" key takes up the most "space" on the keyboard.

Thomas Pornin

14:36

@ScottPack Fun fact: French words have a gender. "Espace", the French word for "space", has two genders.

In typography, "espace" is female; while in astronautics, it is male.

Scott Pack

@ThomasPornin So French keyboards all ship with trannies?

Thomas Pornin

@ScottPack A keyboard is all about typography so I guess its space key is 100% female.

A worse case is for "gens", the generic word for "people"

It is female on the left

"Ces gens sont odieux / Ce sont d'odieuses gens."

Scott Pack

So is that female on the left and male or genderless on the right?

Thomas Pornin

They are male on the right.

The latin "neutral" case has almost disappeared in French

Ninefingers

@ThomasPornin I did not know that.

Thomas Pornin

14:41

Male takes over the role of neutral. For instance, there are two pronouns which correspond to the English "they": we have "elles" (when "they" are all female) and "ils" (when "they" are of mixed genders, or all male)

Which is why I always say "he" for "the attacker"; not that I imply that a no-life hacker running foul-looking scripts from his parents' basement is necessarily male; I just use "he" because it maps to the French male/neutral "il".

And "it" would be slightly too much derogatory.

Scott Pack

@ThomasPornin I just always assumed it was because you don't believe women are capable of understanding things like computers.

Thomas Pornin

@ScottPack We French have been made aware that French women are uncannily good at detecting rampant misogyny and sarcasm, so we need to be cautious.

Scott Pack

I suppose that makes sense.

So you still think of yourself as French, even though you have abandoned the Fatherland?

Thomas Pornin

security.stackexchange.com/review/suggested-edits/6090

Ninefingers

Confusingly for non native speakers, french also has the pronoun "on" which can sometimes be used to mean "we" but has the same (non-plural) form as "il".

Thomas Pornin

14:47

Can you see that edit suggestion ?

It is fun but I am not sure it can be accepted.

Kind of too meta.

@ScottPack I am still French. Frenchness cannot be removed, even with red hot pliers. (Some have tried.)

Terry Chia

@ThomasPornin heh. i accepted it.

They can roll it back if they don't like it.

You attempting to get Tom Leek to 20k?

Thomas Pornin

I am attempting to get Tom Leek to second place

Ninefingers

I declined the edit as "too funny".

Thomas Pornin

But he will first have to get to 20k

Scott Pack

@ThomasPornin I'm a bit cornfused as to the motivation behind the edit.

Terry Chia

14:51

@Ninefingers Implying that IT security professionals have no sense of humor?

Ninefingers

@TerryChia I think this room stands as testament against that!

Terry Chia

@Ninefingers Eh, I'm not sure I would label what goes on around here as humorous...

Thomas Pornin

We have a sense of humour. If only we remembered where we put it...

Scott Pack

@TerryChia We certainly seem to enjoy it.

Terry Chia

> Catherine Venusto, a secretary with the Northwestern Lehigh School District, was like most parents in that she wanted to see her children succeed in the classroom. Sure, she could help them with their homework, or hire a tutor. But why not cut out the middleman? So, using the superintendent's username and password, she sneaked into the school's database to alter her children's grades over 100 times.

cracked.com/…

Ninefingers

14:57

@TerryChia Haha, did you see the early days of Meta Stack Overflow? They were... well, see for yourself

Scott Pack

Oh yes, the Great Recalc.

Terry Chia

@Ninefingers hahaha brilliant! I did come across the conspiracy theory one.

-2

A: How to bring little changes in DES algorithm

Yes, there is definitely a way to do the changes. Loading the DES algorithm onto a whiteboard is the way to begin. Then use a marker and eraser to make changes to the algorithm.

Ahhh snark...

tylerl

15:55

Don't we have a canonical for this?

1

Q: My website has been hacked, what do i do next?

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask. My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in order to gain page ranks. The attacker (based on the language of the blog (Indonesian)) is presu...

penetration-test malware exploit incident-response

Ninefingers

@tylerl Hopefully. If not, we should make a canonical CW answer on this one.

Thomas Pornin

@tylerl security.stackexchange.com/search?q=nuke+orbit

Lucas Kauffman

17:13

serverfault down?

Ninefingers

@LucasKauffman Yellow screen of death here.

I think it's related to the move to NY with their datacenters.

Their recent podcast talked about the windows load balancer being... rubbish on versions prior to 2012.

Scott Pack

Right, ok. So lately I've noticed my podcast queueueueue has been getting dangerously short. Does anyone have any good ones they would like to recommend?

CodesInChaos

18:04

listened to all the 27C3 talks already?

Scott Pack

This?

events.ccc.de/congress/2010/wiki/Welcome

CodesInChaos

I'm not sure what the best overview is, but there are plenty of their talks on youtube

Scott Pack

Never heard of it. I see from that website that they have mp3 versions.

Which is better, because I only listen to this stuff as audio anyway.

CodesInChaos

chaos computer congress is a pretty big hacker/security meeting in Germany

Scott Pack

How much of it is in English?

CodesInChaos

18:13

More than half I'd guess

luckily it's mostly the interesting ones that are English

I'd look for interesting topics at: events.ccc.de/congress/2010/Fahrplan

and then dig out the matching recording

Scott Pack

I was looking at this page events.ccc.de/congress/2010/wiki/Conference_Recordings

Transcript for