« first day (912 days earlier)      last day (2823 days later) » 

12:03 AM
It is pretty relevant as ssl slows a network down aswell as it raises exceptions in some browsers. In firefox a totally legitimate thwate certificate is shown as a certificate for an "unknown company". Without the certificate it wouldn't have even shown the message. People are more likely to not visit the site after that message than having been presented with no message at all. As even ssl-protected sites can be easily observed with Firesheep I see almost no use in using this protection at all. — Zurechtweiser 6 mins ago
This guy is bound and determined to convince the world that SSL is unnecessary overkill.
 
and then there are the guys who think that NSA can break everything except OTP
but consider generating the OTP with a csprng...
 
12:20 AM
@AviD @RoryAlsop @JeffFerland Do you guys want to pop something similar to this on our Meta?
7
Q: What should be our Off-Topic reasons?

KeenChanges are coming to the Question Closing system. The existing Vote To Close reasons are being overhauled. We've already seen some of these changes in the Duplicate Question area. That link above has a full rundown of the changes, and I recommend reading it, but this question is for one speci...

 
@Iszi I don't see why, we don't have any common non-intuitive excluded topic here
it's expected that many sites don't need custom reasons
 
@Gilles So, under the new system, we'll have to do manual entry every time we close as OT?
 
@Iszi ??? No, it's optional
 
I expect they will (or at least should) impose a minimum length for free-form off-topic reasons, to ensure that the user does get feedback as to why the question is off-topic. That is the whole reason for this overhaul after all.
 
@Gilles @Iszi I'd say the one we see regularly is the TL - "Please decrypt this / Tell me which algorithm/function this ciphertext/hash was generated with."
 
 
1 hour later…
1:41 AM
Ack. I hate to turn down @troyhunt, but isn't this more of an Super User question?
0
Q: Is there any way to get Chrome 27 to trust a self-signed cert?

Troy HuntI'm running latest gen Chrome (27) and preparing a demo that requires using a self-signed cert to support HTTPS on a local IIS website. The cert has been created with the correct common name for the website (good little guide here) and then added to the trusted root certs on the local machine. I...

 
 
7 hours later…
8:26 AM
Sup bronies
Guys is a question about resources for fuzzing lists on topic?
 
9:17 AM
@LucasKauffman lol @ bronies :) goedemorgen!
@LucasKauffman say what? you mean prebuilt fuzzer lists that you could include in yours? we had similar questions before for password dictionaries, nobody seems to have been bothered by them:
35
Q: Where can I find good dictionaries for dictionary attacks?

Chris Andrè DaleI’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your dictionaries from.

 
@TildalWave That's pretty long ago. I think we strongly discourage list questions now.
 
one example, there are others
@TerryChia oh, didn't know :(
 
@TildalWave Unlike @ScottPack, we have standards now.
3
 
9:34 AM
@ManishEarth Ha! I would really like to downvote that question, but I haven't enough rep on mSO to do so. Serves them right, and their "downvotes here are different than on other SE sites and it's all for your own good" reasoning :)))
The guy is still suspended for 4 more days on Sec.SE
 
9:52 AM
@D3C4FF Were you the one looking for a tool to parse comments in HTML code a while back?
 
10:30 AM
@TildalWave I think I should update my list of stackexchange user email addresses so I can troll people like him :)
combine that with the classical IP viewer images and he'll get really paranoid
 
 
5 hours later…
4:00 PM
Never heard of that provider name
 
in my experience it works for most people
but perhaps their database is a bit old. Those signatures where popular 10 years ago
 
4:46 PM
Ahoy
 
 
1 hour later…
5:50 PM
@Adnan can America hax you? They have super compiuter they crack RSA yes?
love those questions
 
6:17 PM
@LucasKauffman Why do you love these question? Do you use to collect information about what people think of the intelligence agencies? ANSWER ME, NSA AGENT!!
@Lucas Also, no word from PasswordBox yet?
 
@Adnan suddenly Adnan hears windows shatter as NSA agents raid his house
let me check my account
nope
no response
ah need to go for dinner
brb
 
@LucasKauffman tyt
Ahh! Look at me! Talking in young people's language
 
@LucasKauffman For RSA 1024 we can't exclude that possibility
I don't think it's likely, but for somebody like the NSA that should be at the edge of feasability
 
7:20 PM
Agreed they do seem to have shitloads of money and it would not surprise me that they use their intelligence as advantage to gain more funds ( eg insider trading)
 
@LucasKauffman But, you know, I'm most concerned about the 0day thing. They don't need to brute-froce or use social engineering or whatever. They'd just type my Internet-facing machine's IP and they're in.
 
7:47 PM
@Adnan well yea, but that's already been known since the first analysis of Stuxnet
 
8:40 PM
Is this question on topic here, or is it just not constructive?
0
A: 448-bit Blowfish, considering the 64-bit blocksize, is it secure at all for large files/volumes? (Crashplan)

CodesInChaosA distinguisher is a pretty weak attack. It doesn't allow an attacker to decrypt the data, it only allows them to figure out that is is encrypted data, not random data. The impact of 64 bit blocks depends a lot on the chosen mode. With single-use keys in CTR mode the problems are minor. There ...

 
@CodesInChaos Yeah, I'd say it's on-topic here. I was just reading a question yesterday about the security implications of block sizes.
 
it's a bit ranty and smells non constructive. So I'm not 100% sure.
 
@CodesInChaos After re-reading it, I'd say the first two paragraphs are on topic. The rest is, as you say, rant.
 
 
2 hours later…
10:19 PM
@MarkY. Hello
I was writing you an answer for your question.
It was a bit long, though. Allow me to summarize it: Someone will capture your authentication handshake and attempt an offline attack. Have your password strong enough, and the attack will be extremely infeasible.
 
10:31 PM
Is it usually possible (I know that it's theoretically possible) to jump to kernel code without a mode switch and then run only unprivileged instructions?
In any existing OS
 

« first day (912 days earlier)      last day (2823 days later) »