The DMZ

Adam McKissock

02:59

@AviD Doesn't look like something that I would use

Scott Pack

@AdamMcKissock Jesus. What the fuck are you doing up so late?

Terry Chia

Cool, just hit 1k for the month.

TildalWave

05:11

@TerryChia G'day/morning! I'm curious, how serious ya think attacks on ADS-B/ACARS can actually be? Wouldn't any attempts be relatively easily recognized as such through the use of other on-board systems, and cross-checked with ground control? Is there any single action that a pilot would execute based on ADS-B/ACARS data alone? It seems a bit far-fetched to me :?

Terry Chia

@TildalWave No clue. I'm not a pilot so I'm not sure what they do in that little cockpit. I'm just basing my answer off the fact that there is no good reason for the communications not to be encrypted especially since it is wireless.

It's actually very similar to some remote SCADA systems where they use wireless and some obscure communications protocol. We all know how secure that is....

TildalWave

@TerryChia well I went through that presentation and it's so full of holes I doubt there's any substance to it whatsoever. It seems more of a FUD advertising scheme to me than an actual attack vector... sure, securing it better can only be considered a plus, but these systems aren't decision makers, they're just helpers

Terry Chia

@TildalWave heh. you might want to drop an answer in. i didn't actually read it. :$

TildalWave

@TerryChia I don't want to speculate on this, I'd rather if some experienced member calls it as such ;)

I'm just curious if there was ANY real-life threat even presented by this group/individual ... he claimed he's a pilot, but never shows any real threat, just how it could be done to affect certain readings, readings for which I find no proof they're even remotely thought as something a pilot or on-board computer would consider as essential information and act upon it without checking and re-checking other data

Terry Chia

06:34

@ScottPack Ahhh, Bronn wasn't the commander of the City Guard in the books? Interesting....

AviD

06:51

I WANT THIS:

Ladadadada

@AviD The opportunity to moon your CEO and get away with it?

AviD

@Ladadadada hehe, that too. Well, If I HAD a ceo...

I just think that couch would work really well in my lair.

Ladadadada

fishbowl.pastiche.org/2013/04/14/it_security_in_a_nutshell

4

AviD

@Ladadadada fantastic. and not surprising.

dammit, I hate being such a cynical git.

Terry Chia

@Ladadadada brilliant.

Ladadadada

07:13

It's so easy to get stuff wrong in security, especially when you're the defender and have to win 100% of the time.

I love this though:

Just Pineappled my wife. It was an accident, honest, she just walked in and WAMMO! It's all going into this post, coming out soon.

Tweeted by troyhunt on April 14, 2013 at 4:52 AM

Terry Chia

@Ladadadada Butbutbut, didn't you SEE this?!?!

41

Q: How is "hacking" even possible if I "defend" properly?

On a Linux-based server, I follow basic practices as below: Make the admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable time). Monitor all incoming network traffic to the administrative files. To extend the layer of prot...

webserver

Ladadadada

After reading just the tweets about Troy playing with his new Pineapple, I really, really want one.

Rory McCune

@AviD yeah I've always noticed that Israel has a larger number of successful tech start-ups than you might expect for the size of country..

AviD

@Ladadadada Pineappled his wife....? Is that anything like a Dirty Sanchez?

@RoryMcCune absolutely. Interestingly, its not just startups either, All the big tech companies have research / development centers in Israel. Even the ones who wont open one anywhere outside of U.S...

Not to say there aren't cultural incompatibilities, but some of the places are really awesome.

Rory McCune

yeah I've always thought it would be cool to work in research for one of the big tech companies just to see all the shiney toys they must have :)

TildalWave

07:22

0

A: Aviation security - Lessons to learn from PlaneSploit

I'm no pilot, or an aviation expert, but I'm going to stick my neck out on this one and call it a zero substance FUD and an attempt at using our general ignorance on avionic systems as a cheap way of advertising one's so called security expetise. I've read through the presentation (if reading is...

There, dropped my 5 cents in ;)

AviD

@TildalWave inflation? ;-)

TildalWave

@AviD neah, I'm just cheap :)))

Terry Chia

@TildalWave I'll read it later, but who downvoted that quickly woah?

AviD

@TildalWave the other way around... its usually 2 cents.

@TerryChia I didnt - tldr - but damn I want to upvote the legosnark!

maybe I'll find time to read this later.

TildalWave

@TerryChia LOL, well... someone that reads faster than his monitor is capable of displaying the text in it :))

@AviD Oh, then I'm carelessly spending... I'll take my 3 cents back, thank you very much! :))

AviD

07:26

@TildalWave no, too late, its already in the pot.

TildalWave

@AviD ok, then at least mention me in the list of supporters with your new venture :P

AviD

lol

TildalWave

3 virtual cents generously donated by TildalWave

whoever downvoted removed it now... maybe he/she didn't see my lego plane? :)

Ladadadada

@TerryChia When I saw the question pop up I was thinking I should jump in and write a mangling of Schneier's law. And then someone else did.

AviD

07:48

anybbody else finding the site to be a bit... quirky?

TildalWave

@AviD It's been acting up since last night, sometimes queries wouldn't even return any results. Somebody is working on it, I guess.

AviD

@TildalWave Hooray for continuous deployment. :-(

Lucas Kauffman

@TildalWave 1 upvote for you

and one for @TerryChia

TildalWave

08:04

@LucasKauffman wheey result! thanks :) btw I just realized I didn't really answer the question directly enough... but it'll have to wait for a few minutes, my dog needs walking :)

Tinned_Tuna

hello! I'm looking for academic sources on password salting

So far, the best I've got is rsa.com/rsalabs/node.asp?id=2127 which is heavy on advice, but low on reasoning

Terry Chia

@Tinned_Tuna Does a Bear Post count as an academic source? ;)

5

@LucasKauffman Cheers!

Lucas Kauffman

@TerryChia Bear posts are axiomas

Tinned_Tuna

@TerryChia unfortunately not :-p

Terry Chia

@Tinned_Tuna well then, you need to be spanked.

Tinned_Tuna

08:07

Even though the stack exchange model actually does approximate peer-review...

@TerryChia lol

I'll have to check Schneier's book when I get to work tomorrow. Unfortunately, most of my books at home amount to "Salts are good, they help prevent dictionary attacks, etc."

but they don't have much discussion on salt selection method or salt length.

/me heads back to JSTOR

Terry Chia

I'll just go ahead and ping @ThomasPornin for you. He might know of some.

CodesInChaos

08:35

Salt generation method doesn't matter much. Salts should be mostly unique so an attacker can't attack more than one hash at a time. Occasional collisions aren't a big issue, only effect those have is allowing an attacker to attack the colliding hashes together.

Tinned_Tuna

So far, the BCrypt paper has the best analysis of it.

CodesInChaos

I think the NIST publication on PBKDF2 recommends random salts of 64+ bits

Tinned_Tuna

@CodesInChaos I know the principles -- I need to find sources to back my assertions up

@CodesInChaos NIST recommends 128b salts

RSA 64b

bcrypt wants 128b

I'm looking for academic sources which explore the rational behind the recommendations -- which so far, only the bcrypt paper does (that I've found)

There's a few referring to the old UNIX 12b salts, which is funny

there's a lot of references to Schneier's '96 book... but I've left that in the office :-/

AviD

@TildalWave Is that another euphamism?

TildalWave

@AviD hehe no, my dog really needed walking... as in... I have a dog,... she woke up... she needed to go out and water the grass a bit :)

AviD

08:43

@TildalWave oh yeah, I bet she does :P

TildalWave

@AviD LOL

AviD

and no, there really is no way for you to get out of this with your dignity intact.

TildalWave

@AviD Oh that's OK... it's DMZ, I didn't expect to have any dignity left in me as soon as I hit the link for it :P

2

@AviD You're in a good mood today :)

AviD

Sunday, beautiful weather, coffee, OC not crashing... You bet I am!

TildalWave

@AviD Good! Can I have my 3 cents back now, please? :)

AviD

08:49

@TildalWave haha, no they paid for my coffee :-)

Terry Chia

Welp, I decided to apply for the Google Summer of Code program under OWASP. Fingers crossed. :D

AviD

@TerryChia cool, want me to approve that for you?

Tinned_Tuna

^.^ IEEE has some sources

Terry Chia

@AviD huh?

AviD

@TerryChia I approve!

nevermind, I dont have involvement with anything global. its just that I spent the morning doing OWASP Chapter work...

Terry Chia

08:53

@AviD Ahh. I can die happy now.

AviD

@Tinned_Tuna does anybody else always read that as "IIIEEEEEEEEE!!!", or am I the only one...?

Tinned_Tuna

it's "I Triple-E" to me :-p

Terry Chia

@AviD Heh.

I'll probably apply for a OWASP membership soon. I keep telling myself to do it but I keep forgetting.

AviD

@Tinned_Tuna Peanut style :D

Lucas Kauffman

been playing around with Python-flask for a few days now, really quite powerful for a microframework

Terry Chia

09:01

@LucasKauffman That's good news. Planning to use that for my rasppi project.

Lucas Kauffman

@TerryChia you have some basic plugins you can install additionally like Flask-wtf which takes care of CSRF and form validation

also you can define everything OO with SQLAlchemy, so that you don't even have to think about the database

Coming from webpy it's a really cool

Terry Chia

Yeah. I need something flexible. Django is too rigid and difficult to extend.

Tinned_Tuna

@LucasKauffman I've been using Pyramid. 'tis lovely, in my opinion :-p

Terry Chia

Huzzah for python! In your face @ScottPack.

Lucas Kauffman

@Tinned_Tuna The main reason I swapped to flask is because of documentation issues

I hate it when you look something up in the docs and there's a page that says: TODO

@TerryChia also have you tried pycharm?

Terry Chia

09:06

@LucasKauffman Try Zend. The only thing worse than missing documentation is documentation that makes no sense whatsoever.

Lucas Kauffman

best IDE I've used so far

AviD

@TerryChia "... too rigid and difficult to extend"?? You make it too easy.

Terry Chia

@LucasKauffman Been meaning to pick that up. @RoryMcCune gave me that recommendation a while back.

@AviD Gaaaah!

Lucas Kauffman

@TerryChia Zend is php, php is ewww

Terry Chia

But I'm actually quite happy with using sublime text. I don't really need a full fledged IDE for python.

@LucasKauffman I was actually ok with php before I encountered the monstrosity that is Zend framework. Now I'm staying as far away from it as humanly possible.

Lucas Kauffman

09:08

@TerryChia the thing is that it's really easy to make documentation, run your apps, automatically set your headers

My first php application was a perfect example of the owasp top 10

Terry Chia

Yeah, it's on my to-buy list.

Lucas Kauffman

@TerryChia there's a 30 day trial

you can see if you like it first

Terry Chia

I did give it a shot. It's a very nice IDE for python. I'm just not sure I need it enough to justify buying it.

Lucas Kauffman

true, I'm trying to get the job to pay for it

Terry Chia

I can get the education discount if I really need it - so it won't hurt my wallet that badly.

TildalWave

09:15

How long is actually Sublime Text's eval period?

Terry Chia

@TildalWave Unlimited.

TildalWave

@TerryChia Ah cool. How do I know when I'm done evaluating it then? :))

Terry Chia

@TildalWave Are you gonna take advantage of those poor developers?!?! :)

TildalWave

@TerryChia Neah, just joking. I was just curious what's the eval period because I didn't notice it mentioned anywhere

Terry Chia

@TildalWave Yeah, it's really awesome of them to offer an unlimited trial period. It's one of the reasons I'm supporting them with a purchase, besides the fact that it is an awesome editor.

TildalWave

09:23

@TerryChia I'm still discovering all its little tricks. I need to make a few templates till tomorrow and will be finishing them off first time in Sublime Text... can't wait to see what all it's got :)

Luc

@Ladadadada Brilliant. I like that blog fishbowl.pastiche.org/2012/10/08/on_the_internet_nobody_knows_y

AviD

@TildalWave or @TerryChia - what does it mean when the benchmarks return inconsistent scores?

sure, I know the benchmark scores dont really mean anything substantial to me, but it is a relative indicator. But if the range of consecutive runs is larger than the difference between different clock settings, then whats the point?

TildalWave

@AviD hmmm could be heat related throttling, at what frequency you're at and what temp readings?

AviD

@TildalWave I've actually been trying different combinations. right now, its at x44, Vcore 1.250, 87C at stress.

I've tried running it right after stress, I've tried letting it cool down, even rebooting, before benching, to try to either eliminate or equivelate the heat affect. still a pretty wide range.

I'm using (right now) PCMark 7. The differences at a single clock speed are larger than the differences between a lower clock speed. So sometimes x43 or x42 will ostensibly have a higher score than x44 sometimes has.

Or, perhaps, this is a sign that the perf differences between them are less noticable than cosmic jitter.

TildalWave

@AviD Dunno I wouldn't rely on PCMark, and the temps don't seem so high it would start throttling down because of it... you could try lowering your voltage to 1.2 anyway, as it should be stable at x44 and FSB locked at 100... use Prime95 for benchies that's utterly consistent

AviD

09:38

@TildalWave I use Prime95 for stress, it doesnt do benchmarks. (wait, does it? Did I miss that??). I heard that pcmark is considered pretty reliable...

TildalWave

Prime95

Prime95 is the freeware application written by George Woltman that is used by GIMPS, a distributed computing project dedicated to finding new Mersenne prime numbers. More specifically, Prime95 refers to the Windows and Mac OS X versions of the software. MPrime is the Linux command-line interface version of Prime95, to be run in a text terminal or in a terminal emulator window as a remote shell client. It is identical to Prime95 in functionality, except it lacks a graphical user interface. Although most of the GIMPS software's source code is publicly available, it is technically not free ...

"a large proportion of system overclockers and enthusiasts favor Prime95 over other benchmarking suites because Prime95 pushes the CPU's floating point units extremely hard, causing the CPU to become extremely hot. In addition, Prime95 stresses a computer far more than the majority of software based torture-suites..."

AviD

Huh. its just sitting right there in the menu. "Benchmark". Who woodathunkit.

On the other hand, a real benchmark should try to simulate real-world usage scenarios, not just high FPU stress. Prime95 doesnt do that so much.

TildalWave

@AviD Not a real-world test as far as benchmarking is concerned, no. But it's a pretty good stress-test (or torture-test LOL)... the point being that you can reliably estimate upper operational limits

Terry Chia

@AviD To be fair, there isn't any "real-word usage scenarios" that will constantly push your CPU to it's upper limits.

AviD

for a specific set of tasks, sure. but that doesnt really tell you which set of settings (or hardware, for that matter) is better for you.

@TerryChia exactly.

Terry Chia

09:46

I use Prime95 mainly for stability testing. I don't give a rats ass about benchmarks tbh.

TildalWave

@AviD You should define the upper limit where the CPU is ready to go, then you can of course always lower it and expect it to remain as stable if not more so (with time conditions will change to worse... dust and stuff... now your fans are probably all shiny, thermal paste is new,...)

AviD

well, as I said, its not like the number will mean anything to me. I'm just using it to figure out relative performance, to find the optimal set of settings for me.

for example, if I could tell that there is a small enough perf difference between x43 and x44, I would just leave it at the lower, and sacrifice a small bit of perf for much lower heat.

@TildalWave oddly, the x43 voltage anomaly is a problem for that... :-)

TildalWave

@AviD Plot a graph that takes frequency, temp, noise,... all that matters to you on X (multiply each input value with some preference factor) and benchmark results on Y, then draw the upper limits you're ready to live with and you'll have your sweet spot ;)

AviD

@TildalWave heehee, thats exactly what I'm doing :$

problem is the benchmark results are either unreliable, or not precise enough to matter.

TildalWave

@AviD Prime95 is both reliable and precise ;)

AviD

09:56

@TildalWave except that it doesnt actually give you a specific and relevant score to compare with.

or am I missing something?

Terry Chia

@AviD I think he means monitoring the relevant values yourself using something like CPU-Z.

TildalWave

@AviD With who do you want to compare? If you'll run same benchmark on same rig, then the results will be consistent, --- ah yes, also what @TerryChia just said

AviD

@TerryChia ah, yes I do that.

and its great for e.g. generating heat.

but it doesnt give you a (relative) performance score.

@TildalWave same rig, different settings.

Terry Chia

-3

Q: Trying to heat my room with my PC, what can I do to make it as hot as possible?

It's cold. I'm trying to make my room warmer by making my computer hotter. My computer is a desktop, 64 bit AMD athlon II processor 2.8 ghz with 4 GB ram, 3 SATA hardrives and a nvidia 8800 GT video card. I'm thinking that a long running bench marking program would get the job done. I'd appreci...

cooling overclocking benchmarking overheating

AviD

haha, that one makes me laugh.

TildalWave

10:02

@AviD you want it to keep benchmark history and compare relative to previous results? Or I don't get something?

AviD

@TildalWave that would be cool, but I've been doing this manually.

I just want it to give me a result I can use to compare to other runs, with the expectation that running it multiple times on the same settings would give me similar results, relative to other settings.

TildalWave

@AviD then there's also this: mersenne.ca/bench.php

@AviD Oh I get it. No no, it's a completely linear, so you should get consistent results. If they're not, then your CPU is throttling down which would indicate other problems. If you run same benchmark on same setup, it should give you more or less the same results (where more or less is a tiny insignificant margin of error)

AviD

@TildalWave right, thats my thinking. BUT I'm not sure that this tiny margin of error, might not be larger than the difference in perf between too settings with a tiny change between them. (e.g. x43 -> x44).

Btw does vcore voltage have any effect on performance, or just stability?

Those are another set of tests I'm trying to run, but again the margin of error might be larger than the margin of improvement.

TildalWave

@AviD Shouldn't have any effect on performance, unless it makes it more/less stable (or temp spikes making it throttle down) in which case yes it would affect performance too

AviD

@TildalWave well, yeah, indirectly via instability. I meant directly, without changes in stability.

TildalWave

10:11

@AviD then no

@AviD it's closing gates at some frequency... voltage only affects this frequency's success or failure (gate SNR)... at least I hope it's so, otherwise I need to re-read half of the books from college LOL

AviD

10:33

@TildalWave heh. I dont even remember what it was I forgot from college.

EE has been almost completely erased from my brain, I'm trying to learn it all over again.

awww, this was closed:

5

Overclocking

Proposed Q&A site for all Overclockers, Hard Core overclocking or moderate overclocking, anyone who wants to dig in and optimize their computers. Also UnderClocking, DownClocking, RightClocking, and other forms of rig optimization, whether for speed, heat, noise, power...

Closed before being launched.

and fast, too.

@TildalWave @TerryChia @D3C4FF you guys have a lot more experience in OC than I - do you agree with the closure? Do you think it should be bounced up for discussion?

I think there is some overlap, and also overlap with EE, and also some not so much. Also as a "community", @D3C4FF at least seems a different type than regular SUers...

Lucas Kauffman

@AviD I disagree that it overlaps with su

well maybe a little

AviD

I'm not on su enough to really know.

Terry Chia

Yeah, disagree that it's a dupe of SU.

Although I never really got the point of SU. It seems to be a dumping ground for random questions.

How did this get closed so fast while the Hacking one was left open for so long...

AviD

10:53

@TerryChia doncha know, the original trilogy are special. You're never allowed to dupe them.

sec.se almost got closed - repeatedly - for ostensibly being a dupe of SF/SO/SU at various stages, depending on outlook of close-requester...

I would say that typical computer geeks are much more SOFU literate than security. So they think they "get" those topics, but admit to not having a clue what Sec.se is about.

Rory Alsop

11:26

Morning

Or afternoon, or something.

Beer festival yesterday = late up today :-)

TildalWave

@AviD I think it's specific enough, plus I don't find SU all that useful TBH, it's one of those let me Google this for you sites and if it's even half specific, it's tossed to more specific sites anyway. Would be interesting to see how many OC questions on SU ended up on EE or vice-versa

@RoryAlsop that sounds fantastic :) beer beer beer!!

AviD

@TildalWave so you think a discussion there is in order? I didnt want to do it since I figured I'd be talking out of my arse anyway... but go for it! I'd back you up...

@RoryAlsop Beerpalooza!

2

@RoryAlsop Beerfest!

TildalWave

@AviD need to study SU in depth then 1st LOL

AviD

ahh, need to watch that again... :-)

TildalWave

11:47

@AviD there's 138 questions tagged as overclocking on SU (169k total, so not even 0.1%), none with that tag and say "dry ice" keywords in their text, 25 unanswered (18%). I can not find other OC specific keywords except voltage (no PLL, vcore, frequency even). The site description does seem suitable for OC too, then again it's also for U&L, Ubuntu,...

Dunno, not so sure what's the policy regarding new suggestions, some seem to pass through even if they overlap with existing ones, some don't

AviD

@TildalWave right, I saw that too (albeit with less specificity - what about LN?), which is why I proposed the site. Then again, that doesnt mean those types of questions wouldn't be on topic or get good answers, though the unanswered stat is more problematic.

TildalWave

@AviD which one is LN again? :)

AviD

though not much worse than the overall sitewide unanswered stat - above 20% anyway...

@TildalWave liquid nitrogen :-)

TildalWave

low noise? ah

:)))

AviD

I see that around more than dry ice, at least in the newbie articles I've read...

@TildalWave overlap is usually okay, as long as its not a perfect subset.

TildalWave

11:53

maybe it's easier to get/handle dunno... either case, where do I ask such questions on SE? (chemistry? giggle)

AviD

though those have been known to be approved too, it depends more on "community".

TildalWave

actually... how is the boundary between chemistry and physics defined? hmmm.... let's see their FAQ :))

not a clear line there IMO... probably also not for maths and theoretical CS... or the latter and code golf... or any of these and SO... some guidance is needed here so we know what to stick to IMO

130

Repurpose Hacking

Proposed Q&A site for those who test the limits of hardware, who modify electronic devices or combine together separate components to create new inventions, and those who like to void warranties; for those who like to make gadgets do things they were never intended to do!

Currently in definition.

Wasn't closed... could be a part of EE as much as OC is a part of SU

OK, I don't wanna get all political, I must admit I'm partial here, but I'd like to see some proper explanations behind some of these decisions, maybe I'm missing something

Where's @Gilles? ping ping ^

AviD

I dont disagree on all of those. I think you bring up some good counter-examples. you should create a discussion on the proposal, imo.

Lucas Kauffman

12:13

@AviD I'll gather the pitchforks and torches

AviD

@LucasKauffman I'll bring the tar and feathers. @TildalWave you grab the franks and marshmallows.

TildalWave

12:36

@AviD I don't know where to dispute the closure. On the proposal itself, or in the Area 51 discussion zone? I also don't know what I should say... just that I oppose the closure and why (those reasons from above), or should I make it as an appeal? Both can fast lead into a discussion... shouldn't there be a chat for that?

Terry Chia

@TildalWave I think A51 is one of the few places where discussions are ok.

AviD

@TildalWave I think that @TerryChia is right, on the proposal there is a link to "Create new Discussion". (use the link from the proposal, it sets up the conversation correctly, apparently. )

I seem to recall seeing most appeal / closure / overlap discussions taking place like that.

TildalWave

@AviD Aye! I'm on it... just collecting my thoughts :)

AviD

@TildalWave good man! post here when you're done, we'll all upvote.

TildalWave

@AviD ;)

Terry Chia

12:49

@AviD I'll downvote because I want to be special.

AviD

@TerryChia We are ALL special. I'm not.

AviD

13:06

@TildalWave I'm really getting annoyed by that closure. I'm reading around some questions from the overclocking tag on su, and it's pretty clear that they consider it unrelevant.

not quite off topic, not quite important enough to answer...

TildalWave

@AviD exactly... I'll try to include it in my enquiry

or is it inquery? :hmm

:))

AviD

some solid OC q's closed as narq, some others left hanging and ignored... this is my favorite, OC 101 q that should be on the proposal, the answer is basically "talk to overclockers.com, we have nothing further to say here".

and why do they keep saying you cant change the gpu voltage? I see the setting, it looks pretty simple enough to change. Whether you should or not, is a different question altogether...

Terry Chia

@AviD It makes me sad thinking about GPUs. :( I might have to RMA mine.

AviD

RMA?

Terry Chia

It isn't stable even at factory overclocked settings. :(

Return merchandise authorization

A return merchandise authorization (RMA) or return goods authorization (RGA) is the process of having a product repaired or replaced in order to receive a refund or credit for another product from the same retailer or corporation within the product's warranty period. The RMA process and the issuance of an RMA is a key gatekeeping moment in the reverse logistics cycle. This term is often used in the electronics industry as a part of service agreements, according to which the customer returns the product back to the company and gets a new or repaired product back, generally with an additional...

AviD

13:11

ah, of course

thought it was some leet OC term...

Lucas Kauffman

@AviD Resource MEGA ACHIEVEMENT

AviD

hehe

Read My Acronym

should be RMFA

Terry Chia

Bear #2 has passed @Jeff.

nealmcb

13:29

@RoryAlsop Howdy! I just saw you listed as attending the Ingress event Save Klue at the Wallace Monument. What faction are you with? I'm enlightened, L8. (And for the rest of you, Ingress is an amazing plot by Google to get geeks walking around public art and meeting fellow geeks IRL (augmented). But it can be highly addictive, so best not shared with people you rely on for real work)

Scott Pack

@nealmcb! It's been a while.

nealmcb

@ScottPack Indeed.....

Scott Pack

To the best of my knowledge the Rories and myself are the Ingress players in here, all enlightened.

AviD

►

nealmcb

Excellent! Don't want to see good security folks working for the resistance / NIA....

AviD

13:36

@nealmcb?? wow, Heya @nealmcb!

nealmcb

@AviD Howdy!

AviD

@nealmcb starwall been keeping you away....? :-)

Scott Pack

The Enlightenment faction here is rather overwhelmed by high level Resistance members.

nealmcb

Gotta go in a minute to continue working with Travis County TX folks on our cool uber-auditable voting system spec: STAR-Vote: A Secure, Transparent, Auditable, and Reliable Voting System

@AviD starwall?

Scott Pack

I must be going as well, I've just been informed that breakfast is about ready.

AviD

13:39

@nealmcb the list on the right of pithy comments, often rude, that people here decided should stick around and offend everyone who walks by. :)

@nealmcb sounds cool, this works? secure voting and all that?

Terry Chia

@nealmcb That sounds awesome if it works.

nealmcb

Still paper-based, of course. Remote voting is "right out"!

ttfn

AviD

@nealmcb ah. well Heres hoping!

wait, WHY can't I vote from my own mobile over an untrusted wifi connection?? ;-)

Terry Chia

@AviD Because you don't have some magic unicorn dust.

AviD

@TerryChia ah, right. I used it all up on that homegrown crypto solution.

TildalWave

13:48

0

Q: Not sure the closure of this proposal was properly justified

Proposal: Overclocking So the proposal was closed as duplicate of Super User. I'm not entirely convinced that decision was on the spot, though. Super User has at this moment barely 138 questions tagged overclocking, 25 of which are not answered (that's a healthy 18%). At the same time, I wasn'...

technology closed-proposals

Suggestion and corrections are of course more than welcome, if you have any. Feel free to edit as you deem necessary ;)

Thomas Pornin

@Tinned_Tuna Well, then, go for NIST. To convince managers, official recommendations from a governmental standards body totally trump academics. And NIST says (SP 800-132, section 5.1): "The length of the randomly-generated portion of the salt shall be at least 128 bits."

The bold emphasis on "shall" is in the text. To get things more mandatory than that, it would have to be engraved by God's own fiery hand on a stone tablet in Sinaï.

3

Plus, nice bonus: in that specific case, NIST is right: 128-bit salts, generated with a strong PRNG, are fine.

AviD

@TildalWave good man!

Terry Chia

@ThomasPornin How do you keep coming up with these references...

TildalWave

@AviD you think I'm too harsh in my critique for the closure?

AviD

hmm, I think you should remove the part with the SU-bashing. Wont be seen in positive light, I think.

TildalWave

13:55

@AviD remove it altogether? or ... make it more PC?

AviD

perhaps leave the part of focused specialized sites...

@TildalWave remove it. Dont say "I dont like SU so I need a different site", it should always be SU is great! But here is something that SU doesnt really want.

the part of overlapping, maybe make more PC.

feel free to throw in some of those examples I give you above...

oh yeah, and make the title stronger. "closure was NOT justified", not "umm mebbe Im not really sure... " ;-)

TildalWave

@AviD Could I bother you to go through it? I have problems rephrasing myself and not losing the meaning in the process. I'm just not good at being PC at all. Honestly! LOL

AviD

heh, yeah, in a couple minutes...

Thomas Pornin

@nealmcb Hello ! Long time, no talk.

TildalWave

@AviD And this is where it's kinda required to say love when you mean fuck ;))

AviD

14:03

hmm, umm, no - I cant edit it :-(

TildalWave

ok then pointers... I just deleted that --- SU fails to... blah blah...?

Thomas Pornin

Hey, the four top rows of users are now above 10k.

For the fifth row, we'll need @Iszi to make an effort.

AviD

@TildalWave hmm, perhaps something like "SU focuses more on the mainstream, and less on HCOC freaks"?

bring up those examples narq and go look elsewhere.

Terry Chia

@ThomasPornin You could toss him 2 bounties. :P

Thomas Pornin

@TerryChia Well, yes, if he writes 2 bounty-worth answers.

nealmcb

14:17

@ThomasPornin Indeed - howdy! Just so much fun stuff going on I haven't been finding time for good ol' secse.....

TildalWave

14:28

@AviD hmmm no, not in the question... I think you should save some ammunition for the ensuing fight over it ;) anyway... I've updated my question, hope it's any better now, I ran out of ideas on how to be polite and concise at the same time.

AviD

:-)

@TildalWave @D3C4FF - isnt lowering the CPU's PLL supposed to lower the heat?

Obviously, using less wattage should obviously produce less heat, but more specifically...

I changed it from "Auto (1.800)" to 1.800 (manually), then gradually lowered it down to 1.500 (the safe minimum, as I understand it). There was no noticable heat difference, if at all. (This is at x44, VCore=1.200, BCLK untouched at "Auto (100.00)". Temps were consistent, up to 82C at stress).

TildalWave

@AviD you realize you alone had more OC questions on DMZ than there are on SU in total? :P But I'm not sure which way to adjust PLL actually, never played with it... logic suggests it's the lower value that's supposed to polish out the crevices, but my logic fails often enough I don't trust it either, so why would you LOL

AviD

Sure, I have where to push it - in either direction - but I'm first trying to get a handle on what each effect each setting has, while still on a stable setting.

Polynomial

0

Q: stackexchange.com - login w/o prompt for credentials after logout?

I am experiencing logout problems on security.stackexchange.com. After logging out and restarting the browser the login page logs me in without asking for login/password. Anybody seeing this ? I tested using FF and IE. Looks like some cookie stored that 'remembers' login creds, but this dont...

web-application

needs migrating to meta

AviD

@TildalWave haha, yeah! not bothered asking there, dont think it'd be worth my time. Might ask one or two, later...

Terry Chia

14:43

3

AviD

@Polynomial dammit, I think he trolled me off the site.

TildalWave

@AviD frankly, on SU, I always fear I'll get less than stellar answers to my questions, so I always check first what other SE sites I'm not a member of yet and rather post there. Maybe I'm a bit harsh with it, but the fact I'm there as long as here and didn't gather a single rep point says enough to me. If I'll get stuck at some installation... maybe. But I kinda doubt I won't be able to answer my own questions just as good with Google and manuals as I would get them on SU.

Terry Chia

@TildalWave Yeah, SU is the crappiest of all the StackExchange sites imo.

AviD

@TerryChia at least of the trilogy, sure. There are some crappier sites.

and its in a tough spot, they're pretty close to being online tech support. which sucks.

TildalWave

@AviD Trilogy? You mean SO, SF, SU? Sec.SE beats SU in quality fair and square, and so do many other SE sites. SU, for what audience it attracts, is too broad in definition and doesn't attract real experts. Best answers I've seen on SU were answered on other sites and later migrated there... to me, it looks like SO Valhalla

AviD

14:52

@TildalWave that is always the problem that SU mods have, keeping it from being an SO/SF dumping ground (which it kinda was, at the beginning).

there might have been room to have a dedicated "Windows.SE", on one side, and Hardware.SE (which might have been able to include OC) on the other. I think there might be a few random bits that get lost there, though.

like home routers, HTPC, etc...

Rory Alsop

Hey @nealmcb - yes, was there through that while battle. Made level 2 just before it so not sure how helpful I was. Now I'm a level 6 after an excellent battle this week against some visiting 7s and 8s. In Scotland Edinburgh is mostly Enlightened and Glasgow mostly Resistance

Is excellent fun

Terry Chia

15:10

@AviD Isn't the trilogy sites the main income earning for SE? That might be why they are reluctant to open new sites that cut down on the size of the three.

Or was it only SO?

CodesInChaos

I think careers makes the most money

AviD

I honestly wouldnt know. But SO does dwarf all other sites in size.

Terry Chia

@CodesInChaos Rightttt. Totally forgot about that one.

AviD

yeah, there is that. But actually I wouldnt be surprised of they had a very lucrative deal on Ask Patents ;-)

Terry Chia

I wonder what my life will be like without StackExchange.

No more repwhoring for one...

AviD

15:23

@TerryChia Don't worry, I'm sure you'll find something else to whore yourself out for.

Scott Pack

@RoryAlsop It looks like the Enlightened are starting to get a toe-hold here. There were a couple of sites that were focal points of gobs of links. A couple of higher level guys took out those and broke down several very large fields.

Polynomial

16:22

Another NFO job:

0

Q: Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run it as php file. And I have few question: How can I delete/block backdoor what it did. I did blo...

linux malware php firewalls exploit

TildalWave

3

A: Closure not properly justified

I believe the best proof of usefulness of this site would be positing the questions suggested so far to Superuser. If the answer rate to these fails to meet Area51 criteria (over 80% answered, >1 answer/question) then SU is sufficiently good. If it fails this test, it means admins closed this pr...

I think it's a great suggestion and also the story behind it... unicorns rule! :)

Lucas Kauffman

19:02

@Polynomial NFO?

Polynomial

19:23

@LucasKauffman Nuke From Orbit

Rory Alsop

20:13

Pretty sure we have a dupe of this but I can't seem to find it:

0

Q: Question about HTTPS

I have a question about HTTPS, which I need help understanding. So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who is trying to MITM attack) find out that I requested the FOOBAR resource or is everything encrypt...

ssl web-service

Luc

why is it that youtube throws an HTTP 500 whenever I have a forward slash in my X-forwarded-for header

Polynomial

@Luc because x-forwarded-for is meant to be an IP address.

or a domain name at a push

are you thinking of Referer?

Luc

Clearly, but no other value triggers the problem... Wonder if it could be exploited

No not referer

Polynomial

what, so ?*£"!!PEW#~! works just fine?

I'd imagine it fails explicitly on containing a / to ensure that developers recognise that X-Forwarded-For is not meant to be used as a Referer tag.

Luc

Let's see

Doesn't trigger it

not sure if the header modified urlencodes it

Nope, not urlencoded

Thomas Pornin

21:06

@RoryAlsop Well, most of SSL is covered by this:

160

Q: How does SSL work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. How the key exchange works. How authenticity, integrity and confidentiality are enforced. What t...

ssl certificates public-key-infrastructure

Rory Alsop

21:17

2

Q: Does mobile send signals when it's off?

I've heard that mobile phones send signals to the tower even when the mobile goes off so your location can be detected. Is this possible?

mobile-phones electronics

Might need some security folks to weigh in here

In fact don't we have a question on this?

Will look once I get back to a pc later

@thomasp that looks like a useful dupe.

Xander

21:44

@RoryAlsop We have a bunch of sort of related questions. Here are a few.

9

Q: Can Android phone running without SIM card be tracked (localized) by police?

I am running an Android phone without a SIM card. I am using it for web surfing. Can the police localize my phone using the cell towers (BTS)? In other words, I know Android phones emit radiations even if there is no SIM inserted. Can the service provider use these radiations to detecte where my...

android phone

3

Q: Can a SIM card be tracked without cell phone and battery?

I have a SIM card alone without cell phone and battery. Can it be be tracked?

privacy forensics phone detection rfid

14

Q: Can A Powered Down Cell Phone be Turned On Remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion (http://www.politechbot.com/docs/fbi.ardito.roving.bug.opinion.120106.txt) referenced a bug that could track/listen in on the subject "whether the phone was powered on or off," although that may have been a judge misinterpretin...

mobile exploit phone rootkits

16

Q: How to trace a (mobile) phone?

Even since growing up, I've watched films in which the "bad guy" is repeatedly tracked down when they call the police or FBI or police force de jour. They always have "about 30 seconds". Regardless of whether those specific realisations are accurate or not, I've never understood what is going o...

mobile phone

Lucas Kauffman

22:05

theoatmeal.com/comics/religion

AviD

22:32

I am SO furious right now.

Damn f***ing adobe flash decided to reboot my computer while I was away putting kids to sleep.

Reboot! Flash needing teh updatez!

I must have had 4 dozen tabs open, most of which I have idea what they were, they were open just to remind me to do whatever. Gorrammit.

Gilles

22:45

@AviD what kind of antique browser are you using that doesn't restore the crashed session automatically?

@AviD and for that matter what kind of crappy OS are you using that reboots without your consent?

AviD

@Gilles "session"? Ah see, the problem I guess is that I have 6 different, independant "sessions" open. cant restore ALL of them.

Gilles

@TildalWave what? I've never been involved with that proposal

AviD

@Gilles its not the OS, its flash. One might say, what crappy OS lets flash reboot with my consent.

or even, what crappy OS allows flash to even run.

you'd be right on both.

Flash does NOT need to be installed with such massive privileges.

Gilles

@AviD this isn't the 1950's anymore. Apps don't get the permission to reboot

AviD

@Gilles Flash installs with much more than "app" permission.

it's practically one step short of a driver.

and I dont think it actually did a proper reboot, it just crashes the system anytime it wants anything.

yes, this is empiric and repeatable. it is ALWAYS flash, and flash ALWAYS crashes.

nealmcb

22:58

@RoryAlsop Fun. I'm "emergent" on ingress. What's your codename? And you, @ScottPack? I'm in Austin now, sightseeing at the local portals.

Thomas Pornin

@Gilles At least Windows 8 will reboot spontaneously. It has needs. It requires attention.

nealmcb

I got the sense that in Austin, relations between the factions are strained rather than cordial, due to some high level bad actors. And they're scary in LA. Whereas in Denver we just had a fun cross-faction party with a few dozen agents. What are relations like in your areas?

Transcript for