« first day (865 days earlier)      last day (4024 days later) » 
00:00 - 15:0015:00 - 00:00

D3C4FF
D3C4FF
12:14 AM
@MMavipc Alright, sore all over from violent beatings, but otherwise good.
And, added! :)
 
 
1 hour later…
D3C4FF
D3C4FF
1:29 AM
Anyone have any suggestions for a simple, lightweight (PHP and database free) blog package?
 
Xander
Xander
2:20 AM
BlogEngine.net doesn't require PHP or a database, if you're ok with ASP.NET.
 
D3C4FF
D3C4FF
@Xander yeah, i'm giving that a shot now actually :)
 
TildalWave
TildalWave
2:43 AM
1
Q: .JPEG File upload shell via EXIF comments

D3C4FFI came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why this exists as a condition). I tried using a shell like this and inserting it into the comments s...

exploit known-vulnerabilities file-upload
@D3C4FF - I believe there was an EXIF type exploit described in the writeups on previous Plaid CTFs, if that helps. I understand it, but am not sure I can word it sufficiently good to post an answer tho... not after the beer I had :)
I'll try finding you a link
codezen.fr/2013/03/17/… is one example (from ForbidenBits 2013)
 
D3C4FF
D3C4FF
@TildalWave okay, but i don't think that's the same exploit as the one i upp'd there
 
TildalWave
TildalWave
@D3C4FF not exactly the same no, but it uses EXIF data to change the uploaded file extension because the system it's exploiting is written to trust EXIF data without questioning it. I think your case is describing the same problem. Imagine you use this EXIF data to display it in the output for example.
meh words are failing me, I better go to bed lol
 
 
1 hour later…
Stack Exchange
Stack Exchange
4:17 AM
 
 
2 hours later…
Rory McCune
Rory McCune
6:19 AM
@D3C4FF if you want completely free of dynamic content you could look at some site generators like octopress or Jekyll
 
D3C4FF
D3C4FF
@RoryMcCune Cool thanks :)
octopress sounds pretty sweet
 
Rory McCune
Rory McCune
yeah if I didn't have a load of legacy content to manage I'd probably move over to it. Less worry about compromise than usual blogging engine s
 
D3C4FF
D3C4FF
6:53 AM
@yeah, my needs are very minimal, and i dislike all the extra's that standard blogging engines require like databases etc...
 
Lucas Kauffman
Lucas Kauffman
Any assembly experts around?
I'm getting a segmentation fault on the following instruction:
0x08048092 <+11>: mov BYTE PTR [esi],bl
 
D3C4FF
D3C4FF
@LucasKauffman sorry i can't help :/
What arch is it?
 
Lucas Kauffman
Lucas Kauffman
x86
I'm probably performing something illegal
I took a byte pointed to by esi, moved it into bl, rotated it and then wanted to put it back
wait
 
D3C4FF
D3C4FF
waiting... :P
 
Lucas Kauffman
Lucas Kauffman
Im stupid
6
 
Rory McCune
Rory McCune
7:07 AM
@LucasKauffman insta'star :)
 
D3C4FF
D3C4FF
nonsense, you're playing with assembly
 
Rory McCune
Rory McCune
although what @D3C4FF said, playing with assembly rarely indicates stupidity :)
 
D3C4FF
D3C4FF
@LucasKauffman wana explain solution?
Also. Fuck. I just realised i'm down to my last 500 gig again D:
19.5TB of data... used D:
 
Lucas Kauffman
Lucas Kauffman
no I'm still wrong
 
D3C4FF
D3C4FF
@LucasKauffman why are you using BL instead of EBX?
(i'm an ASM noob but learning!)
 
Lucas Kauffman
Lucas Kauffman
7:10 AM
ah because I'm doing operations on a byte
so bl is the lower 8 bits of ebx
 
D3C4FF
D3C4FF
Oh right,
 
Lucas Kauffman
Lucas Kauffman
I'm doing a rotation operation on bytes, if you would use ebx, then you would rotate over it's full length (32bits) and you only want to rotate over 8bits
 
D3C4FF
D3C4FF
isn't there a specific operation for doing that?
'ror' - not rory
 
Lucas Kauffman
Lucas Kauffman
yes
 
Lucas Kauffman
Lucas Kauffman
7:32 AM
0
Q: Moving from register to effective address

Lucas KauffmanI'm trying to move values from al and bl into effective memory, but I keep getting segmentation faults. What my program does is it takes the value located [esi] and [esi+1], it then rotates these bytes and puts them back. However when putting them back [esi] and [esi+1] need to be swapped (so bl ...

x86 nasm
 
 
1 hour later…
Polynomial
Polynomial
8:43 AM
haha, I see we have my donut shame captured in full glory
my missus always complains that I pull faces when people take photos. I have no idea what she's talking about ;)
 
ManishEarth
ManishEarth
2
Q: how to secure my javascript client in which users will fill their passwords

Milka SalkovaHow I have a basic javascript registration form which sends the password that an user has filled to a secure axis2 web service (which stores the salted hash of the password in a database). Mu question is - is there ANY WAY the password to be cracked before it's send to the server as the user en...

javascript passwords web-security
Quite similar to yesterday's "I don't wanna use HTTPS, I want to do javascript encription!" question :P
 
Rory Alsop
Rory Alsop
@poly - there is no such thing as donut shame. Only donut glory! Claire was delighted that her birthday breakfast was her first ever Krispy kreme.
 
ManishEarth
ManishEarth
DONUTS
@RoryAlsop I thought you Brits called them doughnuts..
 
Polynomial
Polynomial
@ManishEarth that's too many letters to type.
do(ugh)nut
 
ManishEarth
ManishEarth
ah
 
Polynomial
Polynomial
8:57 AM
or, if you prefer, /do(ugh)?nut/
 
Rory Alsop
Rory Alsop
We do. But y'know - this is the intranets
Or d'oh - nuts
 
Polynomial
Polynomial
@RoryAlsop Did you end up meeting Mr. Reznor? Or is that at a later date?
 
Rory Alsop
Rory Alsop
He now has a metal tech t shirt and cd, and other merch. But I didn't get to meet him
Was friend taking stuff for him
Fingers crossed though - who knows...
 
Polynomial
Polynomial
sweet
He's probably borrowing samples for his next album ;)
 
Terry Chia
Terry Chia
DAMMIT @Adnan, can't believe that answer got 81 votes. :(
The rep gods hated me yesterday. :(
 
Lucas Kauffman
Lucas Kauffman
9:21 AM
Finally found it, .text section isn't editable, at least not when just executing the asm, however if you extract the bytecode and execute it from the stack, it just runs
 
Adnan
Adnan
@TerryChia 82, and I can't believe it either.
@TerryChia Not only that, it caused me to hit the rep cap for the 2nd day now
 
ManishEarth
ManishEarth
@Adnan this capped me for 5 days
(not in a row sadly)
 
Adnan
Adnan
@ManishEarth Very understandable. Meta.SO and unicorns.
 
ManishEarth
ManishEarth
@Adnan yep
I got three gold badges that week ^.^ (only one of them due to that answer)
 
Adnan
Adnan
10:31 AM
Here's something interesting
69
Q: How does CTRL-ALT-DEL to log in make Windows more secure?

EddieWhen logging into Windows, it says on that page that CTRL-ALT-DEL somehow makes Windows more secure. I have never been able to figure a mechanism where having to press some specific key combination before logging in makes the system more secure. I have never encountered a VMS, UNIX or related s...

windows security
and
70
Q: CTRL+ALT+DEL Login - Rationale behind it?

Count ZeroMaybe a rather noobish question: Why is CTRL+ALT+DEL required at login on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view it's a bad idea, adding an extra step in getting access. So does it improve ...

authentication windows password-management
Check the votes on the questions and answers, very interesting correlation.
 
Lucas Kauffman
Lucas Kauffman
@ScottPack you use a MAC?
 
Polynomial
Polynomial
10:59 AM
@LucasKauffman Message Authentication Code / Media Access Control? ;)
Mac != MAC
 
Lucas Kauffman
Lucas Kauffman
@Polynomial dirty white computer
 
Polynomial
Polynomial
@LucasKauffman Oh, that one that runs HipsterOS.
5
 
Adnan
Adnan
Do you guys know if it's possible to know the last user who modified some file?
(Linux)
 
Terry Chia
Terry Chia
@Adnan Not unless you got that info logged I think.
@Polynomial OS X >>>>>> Windows. :P
 
Antony Vennard
Antony Vennard
Address space layout randomization
Address space layout randomization (ASLR) is a computer security method which involves randomly arranging the positions of key data areas, usually including the base of the executable and position of libraries, heap, and stack, in a process's address space. Benefits Address space randomization hinders some types of security attacks by making it more difficult for an attacker to predict target addresses. For example, attackers trying to execute return-to-libc attacks must locate the code to be executed, while other attackers trying to execute shellcode injected on the stack have to fin...
Compare the times each ASLR prevention mechanism was shipped for MS, Linux, OSX.
 
Adnan
Adnan
11:06 AM
@TerryChia Yeeah, damn. It already happened. I guess we'll never know.
 
Antony Vennard
Antony Vennard
All I'm saying is it might have become the world's most advanced operating system a little later than Vista and the Linux Kernel. That's all ;)
 
Terry Chia
Terry Chia
@AntonyVennard Meh, I just like Unix-based systems more.
@AntonyVennard Did Apple ever claim that OS X was the world's most advanced operating system? I thought they only applied that claim to iOS and mobile.
 
Antony Vennard
Antony Vennard
@TerryChia apple.com/osx
 
Terry Chia
Terry Chia
@AntonyVennard Ahhh.
I don't visit their site much. :P
 
Antony Vennard
Antony Vennard
@TerryChia Nor did I. I actually own a Mac btw, so I can't mock you too much. However, it isn't my main system - I use it to experiment.
 
Terry Chia
Terry Chia
11:12 AM
But meh, good quality hardware running a pretty desktop interface with great support for bash. I'm happy.
@AntonyVennard Well, my main system is a desktop running Windows. I play games or I'd have installed Ubuntu long ago. :( Dual-booting is just too troublesome.
 
Antony Vennard
Antony Vennard
@TerryChia You can't complain about the hardware, that's true. I don't like the UI much, but then I like gnome 3 so my opinion probably doesn't count!
 
Terry Chia
Terry Chia
I have a Macbook Air that I use in school though.
 
Adnan
Adnan
@TerryChia I still can't believe those things are real
 
Terry Chia
Terry Chia
@Adnan Why?
 
Adnan
Adnan
@TerryChia They're so thin! What the hell?! There must be something hidden somewhere!
 
Terry Chia
Terry Chia
11:15 AM
@Adnan Meh, no thinner than most ultrabooks in the market now. It looks thin because of the tapered design.
Plus remember, they don't have graphic cards in them.
 
Adnan
Adnan
@TerryChia Now you're blowing my mind!
 
Terry Chia
Terry Chia
@Adnan Well, they don't use a dedicated graphics card. They run the Intel integrated graphics.
 
Adnan
Adnan
I don't know, I treat all technologies as miracles, magic little beings inside. I mean circuits are so small yet they do a lot.
I'm cavemanish when it comes to that.
 
Terry Chia
Terry Chia
@Adnan Awwhhh, here's a cactus to play with. :)
 
tr1n
tr1n
Can anyone give me advice on current research into cryptography?
 
Adnan
Adnan
11:19 AM
@tr1n No, sorry.
 
Terry Chia
Terry Chia
@Adnan Bad Adnan!
@tr1n What do you need to know?
 
tr1n
tr1n
I hear whisperings of a mystical figure known as 'The Bear'
Is it true he knows all about crypto?
 
Adnan
Adnan
@TerryChia It's not a question.
 
Terry Chia
Terry Chia
@tr1n Yes. Unfortunately for you he isn't here at the moment.
 
Adnan
Adnan
@tr1n Ask an understandable question, and someone will hopefully answer you.
 
Antony Vennard
Antony Vennard
11:22 AM
@TerryChia THey don't? Wow. In fairness, the Air is one awesome bit of hardware for what it is.
 
Adnan
Adnan
@AntonyVennard Exactly! It's soooo thin!
 
Terry Chia
Terry Chia
@AntonyVennard I'm really looking forward to the Haswell Macbook Air's.
 
tr1n
tr1n
Alright @Adnan, I'll be more specific. I'm an undergrad pure maths student beginning a masters soon. Crypto/security interests me so I'd like to write my thesis on a topic within it but I don't know where to start. What are some current problems in the field of Mathematical cryptography and what are some books I should read to start learning about it?
I guess that was to @TerryChia as well.
 
Terry Chia
Terry Chia
@tr1n Book-wise Applied Cryptography seems to be a really good one, if a bit dated by now. schneier.com/book-applied.html
 
Adnan
Adnan
@tr1n Please don't interpret this in anyway that make me look as if I understand even the basics of cryptography. Because I don't.
 
Terry Chia
Terry Chia
11:24 AM
Anything else besides that, ask @ThomasPornin.
He just floated in.
 
Adnan
Adnan
The "current problems in the field of Mathematical cryptography" isn't something you just find in a Google search
 
tr1n
tr1n
Alright, @ThomasPornin could I grab some help?
 
Adnan
Adnan
it's something you learn after you gain some knowledge about cryptogtaphy
 
Terry Chia
Terry Chia
@Adnan You need Bing obviously.
 
Adnan
Adnan
Get deep into the field.
 
D3C4FF
D3C4FF
11:25 AM
@TerryChia BING
 
Terry Chia
Terry Chia
If you still can't find the answer, you are bing-ing it wrong.
 
Adnan
Adnan
Read research papers
 
Thomas Pornin
Thomas Pornin
@tr1n For a thesis, you first need to choose the advisor; that's more important than the subject
 
Terry Chia
Terry Chia
@D3C4FF BANG
 
D3C4FF
D3C4FF
@TerryChia BONG
 
Adnan
Adnan
11:26 AM
@TerryChia BONG?
 
D3C4FF
D3C4FF
rips conez
 
Adnan
Adnan
@D3C4FF Damn it!
 
D3C4FF
D3C4FF
pwnt
 
Terry Chia
Terry Chia
@Adnan fail
 
Adnan
Adnan
@TerryChia 1.5 seconds apart.
@TerryChia and duude it's 96 now! What the hell?!
 
tr1n
tr1n
11:27 AM
@ThomasPornin Ah yes. Well I suppose I'll have to choose a uni that has people researching crypto. I'm fairly sure the closest thing my current uni's maths department has is a single number theorist.
 
Terry Chia
Terry Chia
@ThomasPornin I guess I should give Bruce Schneier a call.
 
D3C4FF
D3C4FF
@Adnan Can you actually get timestamps that accurate here?
 
Terry Chia
Terry Chia
@Adnan I think we need @AviD to come back from the beach and nuke your answer.
:P
 
tr1n
tr1n
@ThomasPornin How's your knowledge of crypto researchers in Australian universities?
 
Thomas Pornin
Thomas Pornin
@tr1n Well, I cannot give you the name of an Australian team in crypto out of my head, but that does not mean that they do not exist.
I have been somewhat out of the research circles these last ten years
 
tr1n
tr1n
11:34 AM
Cool thank you
 
Adnan
Adnan
@D3C4FF I just looked at how far apart my timestamp and yours change. It was slower than 1 second, but faster than 2. So I assumed it's 1 and a half
 
D3C4FF
D3C4FF
@Adnan Oooh. very scientific.
 
Adnan
Adnan
@D3C4FF I guess I was wrong. It couldn't have been anything other than 1 or 2
Yours is: 1367234783. Mine is: 1367234786
@D3C4FF So I guess they were actually 3 seconds apart
 
lynks
lynks
about to dive into muttrc for the first time. my journey to ultimate neckbeard continues. wish me luck :P
 
D3C4FF
D3C4FF
I swear i just saw a new question appear on sec.se, then disappear straight away... 'is this site malicious'?
 
Adnan
Adnan
11:40 AM
@lynks I don't know what's that, but good luck.
 
D3C4FF
D3C4FF
@Adnan How do you get them?
 
Adnan
Adnan
@D3C4FF $('#message-'+MESSAGE_ID).data().info.time
 
D3C4FF
D3C4FF
$('#message-'+MESSAGE_ID).data().info.time
?
Where do i punch that in :/
 
Adnan
Adnan
@D3C4FF Click on the arrow next to any message and choose reply, you'll get the message id
Go to your console (Press F12) and type
$('#message-9192036').data().info.time
For example
 
D3C4FF
D3C4FF
Oh i see
:D
handy
Actually, not really handy
but interesting.
 
Polynomial
Polynomial
11:46 AM
haha
 
Rory McCune
Rory McCune
@Adnan cool
 
Adnan
Adnan
@D3C4FF You've given me hope, then you took it away.
 
D3C4FF
D3C4FF
Yay, my evil plan worked!
 
Rory McCune
Rory McCune
Is it just me or does @D3C4FF 's gravatar remind them of the German flag
 
Adnan
Adnan
@D3C4FF Just like that girl 2 Saturdays ago.
 
D3C4FF
D3C4FF
11:49 AM
@RoryMcCune shit. They're onto me!
@Adnan No no, wasn't that you last week?
Ich libe die butt.
 
Adnan
Adnan
@RoryMcCune and it's palindromic, so there's gotta be something suspicious there.
@D3C4FF Who doesn't libe die butt?
 
D3C4FF
D3C4FF
Don't suppose any of you fine folks are into urbex?
 
Adnan
Adnan
@D3C4FF Shit! Last night I was discussing it with someone
I didn't know the exact name
 
D3C4FF
D3C4FF
@Adnan What do you mean discussing? Planning?
:D
 
Terry Chia
Terry Chia
@D3C4FF Should I google that?
 
Adnan
Adnan
11:57 AM
@D3C4FF Yup, there's an abounded factory in the area.
@TerryChia Safe
 
Terry Chia
Terry Chia
Hanging out in this room has made me a suspicious man.
3
 
D3C4FF
D3C4FF
@Adnan Dooo eeeet
@TerryChia urbex = urban exploration
 
Terry Chia
Terry Chia
@D3C4FF Ahhhh
 
D3C4FF
D3C4FF
www.sleepycity.net
 
Scott Pack
Scott Pack
@LucasKauffman I do.
 
tr1n
tr1n
12:02 PM
@ThomasPornin Is the elliptic curve DLP "better" than the standard DLP only because it's computationally more expensive to crack?
 
Adnan
Adnan
@ScottPack Awwwwh!
 
CodesInChaos
CodesInChaos
I don't really get your question tr1n
 
Scott Pack
Scott Pack
@Adnan It depends heavily on your logging configuration.
 
Adnan
Adnan
@ScottPack Unfortunately, that wasn't taken into account before this incident.
 
tr1n
tr1n
@CodesInChaos hmm ok I think I'm trying to cram too much into one question, so it's not very legible. I'll reassess what I'm trying to ask.
 
Scott Pack
Scott Pack
12:05 PM
Stack Exchange Security Blog: A Brief Introduction to auditd
scottpack on January 18, 2013

The auditd subsystem is an access monitoring and accounting for Linux developed and maintained by RedHat. It was designed to integrate pretty tightly with the kernel and watch for interesting system calls. Additionally, likely because of this level of integration and detailed logging, it is used as the logger for SELinux.

All in all, it is a pretty fantastic tool for monitoring what’s happening on your system. Since it operates at the kernel level this gives us a hook into any system operation we want. We have the option to write a log any time a particular system call happens, whether that be  …

@Adnan In there I talk about how to get logs of who edits a file, or any file within a directory.
 
Adnan
Adnan
@ScottPack Perfect! I guess I'll start configuring auditd very soon. Thanks
 
Scott Pack
Scott Pack
@Adnan Beyond something like that? It gets a little wonky. What you have to do is some forensics work to try to figure out when the file was modified, who was logged into the system at that time, and who had access to edit the file.
 
Adnan
Adnan
@ScottPack It gets problematic in our case. The file might have been modified by different users. We need to track the specific change.
I guess I'm looking at this from the wrong angle, right?
I guess what I need is a VCS
 
Scott Pack
Scott Pack
@Adnan When I wrote that I had this grand idea of taking use case submissions and developing out a corresponding ruleset. Something similar to this answer: security.stackexchange.com/questions/4629/…
@Adnan Oh, so you want to find out what changed not who changed it?
 
CodesInChaos
CodesInChaos
@Adnan Which angel? Lucifer?
 
Adnan
Adnan
12:08 PM
@CodesInChaos Corrected! Now it's the right angel
 
CodesInChaos
CodesInChaos
haxxor
 
Adnan
Adnan
@ScottPack I know what changed, but I want to know who made that specific change.
 
tr1n
tr1n
@CodesInChaos So the ECDLP n=log_P (Q) is the normal discrete logarithm problem with P and Q elements of some elliptic curve over a finite field with prime characteristic. But to actually compute n*P (where * is the group law for elliptic curves) is computationally harder than to compute something like g^x (mod p). So my question is, are there other reasons for using ECC, or is that the crux of it?
 
Terry Chia
Terry Chia
@Adnan What exactly is being changed?
 
Scott Pack
Scott Pack
@Adnan Ok, I think I'm starting to get to the bottom of this rabbit hole. :)
 
tr1n
tr1n
12:10 PM
and by normal, I mean the standard one in use
 
CodesInChaos
CodesInChaos
At a given security level ECC is faster and has smaller keys
or if you prefer the other way round, for a given key-size, ECC is stronger
 
Scott Pack
Scott Pack
@Adnan Now you're getting into a world of hurt. If you know when the change happened you can do the forensics to figure out exactly which set of people it was.
 
Adnan
Adnan
@TerryChia Access Control bit in a python script.
 
tr1n
tr1n
It's faster?
 
Scott Pack
Scott Pack
@Adnan Your best bet is to must move on, treat this as a learning experience and move onto a VCS or VCS integrated configuration management system.
 
CodesInChaos
CodesInChaos
12:11 PM
computing n*P is much faster that g^x (mod p) at a given security level
 
tr1n
tr1n
Right ok
 
CodesInChaos
CodesInChaos
at the same key size, g^x would be faster
 
tr1n
tr1n
And what about the inverse?
 
CodesInChaos
CodesInChaos
but that's not a useful comparison
 
Terry Chia
Terry Chia
@ScottPack This basically. Logging all that info is gonna be painful.
 
Scott Pack
Scott Pack
12:12 PM
@TerryChia Not necessarily. It depends on how you decide to get the logs.
 
CodesInChaos
CodesInChaos
256 bit ECC is about as strong as 3000 bit finite field crypto against classical computers
both have a security level of around 128 bits
 
Scott Pack
Scott Pack
@TerryChia If you use any kind of modern VCS you can pretty quickly tell who committed what change.
 
Terry Chia
Terry Chia
@ScottPack Well yeah, VCS. Using something like auditd is gonna be painful though.
 
tr1n
tr1n
@CodesInChaos What does that mean, "security level of around 128 bits"?
 
Scott Pack
Scott Pack
@TerryChia Only if you're a pussy.
 
CodesInChaos
CodesInChaos
12:13 PM
cost of finding a discrete logarithm is about as expensive as breaking a 128 bit symmetric cipher
 
Terry Chia
Terry Chia
@ScottPack Heh.
 
Adnan
Adnan
@ScottPack @TerryChia What do you think of this? Users commit to the VCS repo. An API they ask for deployment. We can track changes and deployment attempts.
 
tr1n
tr1n
Right got it
 
Adnan
Adnan
Sounds sane?
 
Scott Pack
Scott Pack
@TerryChia It also depends pretty heavily on how you set up your logging and how often the environment changes.
@Adnan That sounds pretty normal.
 
tr1n
tr1n
12:14 PM
Thanks @CodesInChaos
 
Terry Chia
Terry Chia
@ScottPack True. The logs are gonna be huge if the file is frequently modified.
If it's something that is touched rarely it should be fine though.
 
CodesInChaos
CodesInChaos
personally I use Curve25519 for everything, which is a 255 bit elliptic curve. Results in ~5000 keyexchanges/signature verifications or 10000 signatures/key generations per second.
 
Adnan
Adnan
WOOHOO! I've just received my first gold!
 
CodesInChaos
CodesInChaos
with nice, small 32 byte public keys
 
Terry Chia
Terry Chia
@Adnan Bitch. :(
 
Rory Alsop
Rory Alsop
12:15 PM
Congrats @adnan
 
Terry Chia
Terry Chia
Congrats tho. :P
 
ManishEarth
ManishEarth
@Adnan Congrats :)
 
Lucas Kauffman
Lucas Kauffman
@Adnan gratz ^^
 
CodesInChaos
CodesInChaos
expected fanatic, the easiest gold
 
ManishEarth
ManishEarth
@CodesInChaos Reversal is the easiest on meta
 
Adnan
Adnan
12:16 PM
@ScottPack Of course, that "API" can be just a small script that copies from the VCS repo to the production. It just asks for credentials (in the Domain context in our case)
I actually like the idea. Thanks @ScottPack
And thank you all! Although I'd have wanted to be for an actual answer. But I guess things happen.
 
Scott Pack
Scott Pack
@Adnan So here's one pretty typical workflow: 1) Every push into a development branch triggers an IM/email to the development team announcing that the branch has changed. This will inform the team to synchronize. 2) Every push into a staging branch triggers a build/deployment into test and an email/IM to managers and/or testers. 3) Every push into the production branch triggers a build/deploy and an IM/email to managers, operations, and change management.
 
Adnan
Adnan
@ScottPack We have the first two. But I guess 3 is the most important for us.
 
Scott Pack
Scott Pack
Then your development process means making changes as often as you want to development. Then when the devs think a build is ready they push development into staging. That gets banged on, and if it passes staging gets pushed into production.
@Adnan The real tricks are to make sure there's an intermediate step between development and the live system. the list of people who can push out live code is small and trusted, and at every step along the path the right people know what's going on.
 
Adnan
Adnan
I actually really like this answer
95
A: "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong?

Terry ChiaIf a malicious user starts attacking a website by guessing common username/password combinations like admin/admin, the attacker would know that the username is valid is it returns a message of "Password invalid" instead of "Username or password invalid". If an attacker knows the username is vali...

 
Scott Pack
Scott Pack
Short and pointed. Just like the author.
 
Gilles
Gilles
12:21 PM
-4
A: How to generate a list of unique random strings?

TofigNow it is easy. Xincrol - Unique and random number generator Explanation and code example: http://openpatent.blogspot.co.il/2013/04/xincrol-unique-and-random-number.html

> How to generate random numbers, but in a way so each number will appear only once. Regular Random Number Generators (RNG) don't guaranty any uniqueness of provided numbers. Programmers were using large random numbers like UUID to hope that the same number will not appear twice in their life . But this does happen, I have seen it many times with large and dynamically changing databases, where object IDs were collided which caused applications to crash, reports to fail etc.
> The Discovery.

If your input is serial numbers stream (like 0,1,2,3...) and you will perform cycling and directional bitwise operations in some predefined order you will get the same set of numbers but placed in different positions.
Magical operations are XOR, INC and ROL (the name of algorithm). There are also DEC and ROR which could be used instead of INC and ROL.
 
Adnan
Adnan
@ScottPack Thanks. I will start annoying the management about that right away.
 
Scott Pack
Scott Pack
@Adnan What VCS are you guys using now?
 
Rory McCune
Rory McCune
for any touch typists with time to burn drop.notch.net
 
Adnan
Adnan
@ScottPack SVN
 
Terry Chia
Terry Chia
@ScottPack heh
 
Scott Pack
Scott Pack
12:25 PM
@Adnan You should be able to throw together hooks post-commit hooks to do that.
 
Adnan
Adnan
@ScottPack I'm reading about that right now.
 
Scott Pack
Scott Pack
@Adnan I don't know the branching model of SVN well enough to know if my proposal would actually work.
 
Adnan
Adnan
@ScottPack Branching as you described it might be a little tricky here, but I'll work with the equivalents
 
Scott Pack
Scott Pack
@Adnan Commit hooks are nice. I was using them to syntax check my puppet files. My commit was rejected if the syntax check didn't pass.
 
Adnan
Adnan
@RoryMcCune Very interesting "Game Over" messages. It says instead "Lonely", "Isolated", "Unheard".
 
TRiG
TRiG
12:35 PM
I don't trust wizards more than any other user. Within 2 weeks we'd have lists of "the top Sindarin passwords" in all the trade rags. Though the postit notes on monitors might have cooler writing... — John O Jul 10 '12 at 16:09
 
Thomas Pornin
Thomas Pornin
@tr1n We like elliptic curves because they allow for faster computations. It takes roughly ten times as many field operations to compute a "modular exponentiation" in an elliptic curve (compared to classical DH / DSA) but we get the same security level with a much smaller field, and this yields a net gain overall (like, 8 times faster).
@CodesInChaos Electorate is actually much easier. All it takes is clicking, and can be done in a fortnight.
 
Adnan
Adnan
@TRiG Damn! Your hair and hat are awesome
 
TRiG
TRiG
@Adnan That's a silly cloth hat with a paper crown from a Christmas cracker worn over it.
My hair's been cut since, but I still tend to wear silly hats a lot.
 
Adnan
Adnan
@TRiG AKA, the perfect hat
 
TRiG
TRiG
@Adnan Oh, I think my jesters hat is even better. Or perhaps the rainbow beanie. Or the really long black thing that hangs half-way down my back. Or ....
I have a lot of silly hats.
I collect the things.
 
Adnan
Adnan
12:46 PM
@TRiG Ahaaa.. Now I see your SO profile pic
 
TRiG
TRiG
@Adnan That's an older one. And no hat.
I was at a Toastmasters meetup the other day, where five clubs came together for a competition. Someone from another club said he recognised me by my hat. I told him I was wearing a new one: he hadn't seen that hat before. But he recognised me by it anyway, probably because I was the only guy in the room wearing a hat.
 
Adnan
Adnan
1:07 PM
Anybody here consumes Yerba Mate?
 
Scott Pack
Scott Pack
1:32 PM
I do
 
Adnan
Adnan
@ScottPack I looked in many stores here and I wasn't able to find it. Any reliable online store?
 
Scott Pack
Scott Pack
I find the tea dusty enough that those bags don't quite do it.
 
Adnan
Adnan
@AJHenderson Could you please explain that first paragraph, because it has nothing to do with the answer. It even doesn't make sense at all.
@ScottPack I was looking for those without bags, you know, I don't know the exact word for it.
 
Scott Pack
Scott Pack
@Adnan loose leaf
I brew mine in this
But the mate is so freaking dusty that my cup was pretty gnarly.
 
Adnan
Adnan
@ScottPack Yes yes, I guess that's what it's called. Something like this
 
Scott Pack
Scott Pack
1:39 PM
Between the pre-bagging and that teapot, which has a built in filter (it was designed for looseleaf) the final result is drinkable.
@Adnan Yeah, the English term for that is loose leaf.
 
Adnan
Adnan
@ScottPack I liked to drink it in a calabash gourd
 
Scott Pack
Scott Pack
Oh look at you Mister Fancy Pants.
3
 
Adnan
Adnan
@ScottPack Well, it's the "right" way to drink it where I grew up.
 
Scott Pack
Scott Pack
A gourd and wooden straw will be a bit much for my office.
 
AJ Henderson
AJ Henderson
ok, fixed my answer Adnan
did not realize that keyfile doesn't actually refer to a key file, but rather refers to a random file that they hash as part of a key derivation
 
Adnan
Adnan
1:44 PM
@AJHenderson Well, something new for all of us everyday.
 
AJ Henderson
AJ Henderson
at some point I suppose I should actually play around with TruCrypt a bit
 
Adnan
Adnan
@AJHenderson At 10K.
@ScottPack Now that I think about it, it's probably not such a great idea.
 
AJ Henderson
AJ Henderson
I've just never needed encrypted volumes
 
Scott Pack
Scott Pack
@Adnan Being able to brew it up just like any normal tea is totally fine by me. :)
 
Adnan
Adnan
@ScottPack Yeah. Sounds good enough I guess
 
AJ Henderson
AJ Henderson
2:00 PM
@D3C4FF I don't know if I'd brag about that too much, it's only like an inch and a half on my screen
3
and "it's not the length but how you use it" is equally false in crypto and other purposes. Sure you do have to know how to use it, but too short isn't going to last long
 
Terry Chia
Terry Chia
@AJHenderson THAT'S WHAT SHE SAID!
 
AJ Henderson
AJ Henderson
and with that I should really probably get back to work
 
Terry Chia
Terry Chia
@AJHenderson THAT'S WHAT SHE SAID!
 
Adnan
Adnan
@AJHenderson To be honest, in Crypto and penile matters, it's the length and the implementation.
6
 
AJ Henderson
AJ Henderson
2:22 PM
@Adnan exactly, that's what I'm saying
it's a little creepy actually
the "key" to a "secure" marriage?
gah, I can't make it stop now
 
ManishEarth
ManishEarth
@AJHenderson you still need a public key
 
Terry Chia
Terry Chia
@AJHenderson You need to hang around here more often.
That's a little creepy to you?
 
Adnan
Adnan
@AJHenderson At a certain stage of one's life, the word creepy loses its meaning.
 
AJ Henderson
AJ Henderson
@TerryChia well the fact you can draw so many parallels between sex and well, just about anything
@Adnan is that point childbirth?
 
Adnan
Adnan
@AJHenderson It's different from person to another.
 
Terry Chia
Terry Chia
2:25 PM
@AJHenderson No, for him it's the first time he had a cactus up his ass.
;)
 
AJ Henderson
AJ Henderson
@TerryChia well I can see the similarities between that and having a newborn
in fact, the cactus might be slightly more comfy
not that I would know about either yet
one of them may be on my todo list
I'll leave which to your imagination
 
Terry Chia
Terry Chia
@AJHenderson Don't get @Adnan excited.....
 
tr1n
tr1n
Is @ThomasPornin or @CodesInChaos still in?
 
Adnan
Adnan
@tr1n Again, buddy. Ask your question, and somebody might help you. After asking it, you can notify the users you want. This eliminate the need for both of you to be here at the same time.
 
tr1n
tr1n
2:41 PM
@Adnan I was looking to follow up a discussion I was having with Thomas earlier regarding research. Doesn't really fit into a nice neat question so I didn't want to vaguely ask the room.
 
Thomas Pornin
Thomas Pornin
@tr1n I am there, but intermittently. It's a work day...
 
tr1n
tr1n
@ThomasPornin That's alright I'm in no hurry, I'll be idling here for a while anyway. To extend my earlier situation, I'm actually taking a year off in between my undergrad and masters and so my earlier question was aimed at finding research I can do and topics I can learn in the interim. I guess my question is more of a question about direction: what are topics involved in mathematical cryptography? Or more specifically if you know, what are some books I should pick up and read?
 
Lucas Kauffman
Lucas Kauffman
argh why can't lenovo have a full hd i7 laptop
 
Thomas Pornin
Thomas Pornin
@tr1n You can start with the Handbook of Applied Cryptography: cacr.uwaterloo.ca/hac
it's good and also a free download.
It is not totally up-to-date (last edition was in 2001) but it is still a very good starting point
 
Xander
Xander
2:58 PM
@LucasKauffman You can get a Thinkpad T530 spec'ed that way. I don't know about other models.
(At least you can in the U.S. market)
 
00:00 - 15:0015:00 - 00:00

« first day (865 days earlier)      last day (4024 days later) »