The DMZ

Iszi

00:03

Figures. Internet's been dropping off every few minutes this afternoon. What happens once I start pinging from the home routers to sanity check the LAN? It stays up.

Kinda nice that these new routers allow unlimited continuous ping, though.

Gilles

@Iszi IP conflict?

Iszi

@Gilles Not likely. Mine's DHCP reserved.

D3C4FF

@LucasKauffman Interesting doco, but its more about the trippin' and less about the bunkers :(

Gilles

@Iszi which doesn't prevent someone else from trying to use your IP

Iszi

@Gilles No, but nobody else on the network would be messing with static IP settings.

Iszi

01:23

Urgh. So, it seems the network problem is probably local to my computer. The real annoying bit is it's like a frickin' watched pot. Never happens while I'm looking.

But it's so intermittent it goes away before I can do any meaningful diagnostic.

Terry Chia

@Iszi Schrodinger's network?

2

tylerl

02:20

@Iszi You look at the logs on the cable/dsl/wtf modem?

@D3C4FF do you, perchance, also go by "(211,196,255)"? Or does conversion to decimal not hold for names?

Iszi

03:37

@tylerl Reasonably confident it's not the infrastructure hardware at this point. Can't even get to the router pages when it's down.

Started the following PowerShell script, and connection hasn't dropped since:

$ConnStat = $true;while ($ConnStat -eq $true){$ConnStat = (Test-Connection google.com -quiet)};[Console]::Beep();tracert google.com;Get-Date;[Console]::Beep()

TildalWave

05:31

Moaning!

tylerl

@TildalWave You are?

TildalWave

@tylerl this early? always! :)

tylerl

how early?

lordy I wish StartCom would get their act together and develop a reasonable interface and set of policies.

No one would ever use another provider if they didn't suck so hard on their own idiocy

Lucas Kauffman

08:50

Boobies

Stephane

09:07

Hello folks

Oh... Talking to myself again...

Lucas Kauffman

Poor stepahne

Stephane

Nah: I always have company this way :P

Lucas Kauffman

True :p

Are u French?

Stephane

Swiss, but I can throw my mouse in France from my backyard

U'

?

Lucas Kauffman

Ah Swiss so whatever we say you will neither agree nor disagree :p

Belgium

Stephane

09:10

Nice :) I see we probably share a lot of important things then (beer, chocolate and a sense of being a misunderstood minority ;))

Lucas Kauffman

Indeed :P

Stephane

Say, I was turning an idea in my head and I came here to see if it was completely stupid or not. Not sure it's worth a Q in the stack though.

Mind if I ask your opinion ?

Gilles

neighbors! (I'm French)

Lucas Kauffman

Sure

Gilles

Our French Canadian regular is probably not up yet

Lucas Kauffman

09:18

Boufeur de grenouille!

Gilles

meh. It tastes like chicken but the bones are small and fiddly

Stephane

^^

Lucas Kauffman

I like it with garlic just as I like my escargots ^^

Stephane

You're all making me hungry. Not fair!

Griffin

Having a shitty day? youtube.com/watch?v=_y36fG2Oba0

Stephane

09:22

Well, anyway. I'm writing a TOTP system (RFC 6238, google authenticator app). I was wondering if adding some leeway (say, a 30-seconds allowance) in validating the PIN made sense

Gilles

not only makes sense, but is required IIRC

Griffin

STFU AND WATCH youtube.com/watch?v=_y36fG2Oba0

Gilles

doesn't the RFC specify the maximum delay?

Lucas Kauffman

Isn't that already implemented?

Griffin

It's funny

@LucasKauffman It's oldddd

2007

Stephane

09:23

Not that I remember, but I could have missed it. Let me check

Gilles

typically you can't be sure that the client's clock is correct

Lucas Kauffman

My google authenticator expires after x seconds

What's old :p? @ Griffin

Griffin

►

Stephane

Well, the counter is the unix epoch DIV 30 anyway so the PIN is teh same for 30 seconds

Griffin

@LucasKauffman It's amazing

Watch it

Gilles

09:25

4

A: Please explain Time-step in Time-Based One-Time Password Algorithm

Overview. TOTP is pretty simple and is described pretty well in the RFC you linked to again. You might want to read through the RFC another time: it's all there. I'm going to summarize the RFC for you, but you could have gotten all of this yourself by reading the RFC. Time steps. For example, ...

and in the RFC it's a recommendation: Resynchronization

Stephane

Interesting

Ok, I have my answer then :) thanks folks

(and for the music as well ;) )

TildalWave

@Gilles I don't get what's the problem with the answer? It's answering the question, as it was asked.

D3C4FF

@tylerl Doesn't have quite the same ring to it, but you could say that yes i do. :P

Gilles

09:40

@TildalWave what answer?

TildalWave

@Gilles You just linked D.W.'s answer here

Gilles

D.W.'s? I never said there was a problem, on the contrary I was citing it because it had useful information for the ongoing conversation

TildalWave

@Gilles Oh, I do apologize, I didn't read all the conversation and you didn't reply with it to anyone, so I assumed it's just one of those "mod dumps" :))

Gilles

we had short conversation about TOTP starting at chat.stackexchange.com/transcript/message/10802568#10802568

Stephane

Nah, it was a subtle way of telling me "use the search, Luke"

TildalWave

09:43

@Gilles I see now, thanks!

Simon

12:37

0

Q: how to implement a Browser's Security

i am creating a Web browser using visual studio 2010 with c#.What level of security a browser should have and how to implement it? Is visual studio is a good Plateform for developing such apps?

web-browser

Oh lawd.

Is there a rule for web browsers that says "don't roll on your own" too?

Terry Chia

@Simon Yeah, WTF.

Simon

He seems to be confused, he's asking if VS is a good platform to develop a web browser. Who cares about the IDE? It's all about the language.

And his second question is definitely off-topic.

(If that would be a legit one)

I'm gonna flag it as too broad.

There's no way someone can cover the whole subject.

Terry Chia

0

A: how to implement a Browser's Security

What level of security a browser should have and how to implement it? Boy, what a question. How long do you have? Find a vulnerability database like NVD. Do a search for the terms "Chrome" and "Firefox". Look at that little number indicating how many vulnerabilities were found on those b...

It's soooo gonna get delete but what the hell.

Simon

+1 for the lulz.

At least you might open his eyes.

Simon

13:02

Did you see what he commented?

I feel like replying "Explore elsewhere" but I feel like that'd be a bit too harsh.

Terry Chia

13:15

@Simon Even ignoring the whole security aspect, I'd like to see him implement his own Javascript JIT with anywhere near acceptable performance.

Simon

Man, I hate the way he types too.

Capitalizing random letters, always been a fan of that.

Gilles

@Simon he's a C# programmer, they inherited that from Java

Simon

Haha.

Gilles

AtLeastHeDidn'tOmitTheSpaces

Simon

At least.

Terry Chia

13:23

@Gilles what_are_you_talking_about?

Simon

CONST AT_LEAST

Gilles

@TerryChia (question (understoodp you me) :negated t)

Terry Chia

@Gilles Woah, what language is that? That hurt my brain.

Simon

^

Gilles

Lisp (programming language)

Lisp (historically, LISP) is a family of computer programming languages with a long history and a distinctive, fully parenthesized Polish prefix notation. Originally specified in 1958, Lisp is the second-oldest high-level programming language in widespread use today; only Fortran is older (by one year). Like Fortran, Lisp has changed a great deal since its early days, and a number of dialects have existed over its history. Today, the most widely known general-purpose Lisp dialects are Common Lisp and Scheme. Lisp was originally created as a practical mathematical notation for computer...

Terry Chia

13:26

@Gilles Oh.....

0

Q: What is the easiest way for a newbie to RSA to create & use a key pair on Windows?

So I need to get a block of text sent to me over email from a friend, but before he sends it he wants a public RSA key from me. Am wondering what is the simplest way for me as a newbie to generate this pair and then use it to decrypt the message that gets sent to me? I've been messing about fo...

rsa

I feel that adding a comment "The easiest way is to install Linux".

Simon

Did everyone book their flight? The party should happen next week.

Gilles

@TerryChia come on, even I didn't do that

@Simon ?

Simon

@Gilles My 1k rep party!

Terry Chia

@Simon 1k? Awwww, that's cute.

Gilles

@Simon what, you aren't paying for our travel?

Terry Chia

13:33

RHCE certification exam tomorrow wooo. Nervous...

Simon

@Gilles My budget doesn't allow it, unfortunately. We could perform black hat activities to raise funds if needed.

Rory McCune

14:00

@TerryChia coolio, what does the exam consist of? is it purely written or is there a practical element?

Terry Chia

@RoryMcCune It's a 2 hour purely practical test.

RHCE is mostly about configuring various network service. I.e, things I could do easily if I could just Google the damn configurations. ;)

Rory McCune

ooh well practical has advantages over paper based in that you need to be able to do real-world tasks, but yeah open book would make more sense :)

Adnan

14:22

@Simon So, next Saturday?

Simon

@Adnan Sure.

Adnan

@Simon Okay, you'll send me your address and phone number soon.

Trains or buses reach near your place?

Simon

@Adnan Subway.

Terry Chia

@Adnan He lives in Canada. I'm pretty sure you have to ride a horse down there.

Adnan

@Simon Perfect. I'll book the flight for on Friday

Simon

14:25

@Adnan I'm almost scared that you're gonna do it.

Adnan

@Simon What?! So you're not being serious?

Ahhhghh! You should've said that before I booked the flight

and it was reasonably priced, 1242 €

Simon

@Adnan Not bad at all.

Adnan

@Simon In the future, I'll invite to Finland.

I'll wait until you're lost

Simon

@Adnan I've never been to Europe but it is definitely in my plans.

Adnan

Then send you an email telling you that I was joking

Simon

14:32

@Adnan I'd probably kill myself.

Adnan

and tell you that I've given you the wrong address

After spending days and days filling your head with wrong information about stuff here.

Oh.. I'm gonna enjoy my revenge.

Simon

There's a story like this in a gaming forum. Some unemployed dude trusted a guy who said he'd give him a job in a foreign country.

He said he'd pay for all his expenses but it turned out to be a prank

The dude wasted a shitload of money.

Thomas Pornin

@DavidFreitag Actually you can, now. UEFI. Not counting that there are non-x86 platforms out there.

David Freitag

14:55

@ThomasPornin Yes, that's true UEFI can plop an OS directly into long mode, but the UEFI must first put the CPU into long mode.

CodesInChaos

Leaked screenshot of the upcoming Windows 8.2:

twitter.com/JohnBristowe/status/367156216260087809/photo/1

David Freitag

@CodesInChaos No, that's just windows 8 server edition, duh.

Thomas Pornin

@DavidFreitag That you don't really know. The CPU boots by beginning to execute code in the BIOS, which, at some point, jumps into the code read from the boot device. Though x86 tend to boot in real mode, they might also boot in long mode if that's what the BIOS expects -- it really is a matter of convention between CPU and BIOS, and you cannot access that as a bootloader developer.

I expect it to be the next step, if not already done: CPU boots right away in long mode, BIOS agrees, then goes through UEFI and then the OS, without ever switching to 32-bit mode or real mode.

At which point the real mode support will be "removable" and then be removed from subsequent x86 CPU. At long last.

David Freitag

@ThomasPornin It's probably true that no modern CPU boots into real mode, but i think that at the very least the process enters in 32-bit mode.

But that begs the question, how does the system bootstrap? The A20 line doesn't stay configured forever...

Thomas Pornin

@DavidFreitag Mmh, there are two 32-bit modes: the original "protected mode", and the 32-bit subset of long mode. Which one are you talking about ?

Simon

15:04

@ThomasPornin When I say "rouge", the first thing that comes to your mind is a lipstick?

David Freitag

@ThomasPornin Depending on how complex the UEFI is, protected mode.

That way if the installed OS is in fact a 32-bit OS, the UEFI does no more work and does a long jump to the entry point of the OS

Thomas Pornin

@Simon No -- but that's what a British would think of. I looked on Merriam-Webster: "rouge" is used primarily to describe some lipstick (an import from the French "rouge à lèvres", of course).

Simon

@ThomasPornin They always steal our words, like déjà vu.

And they pronounce it badly.

Thomas Pornin

@DavidFreitag Protected mode requires some rather heavy tables in RAM: tables of descriptors, tables of interrupt handlers...

When real mode disappears, I expect non-long-mode to follow the same path rather quickly

It is not done yet, but it will be tempting for CPU vendors to sell a CPU which works only with 64-bit OS, since that would save some transistor space, and 64-bit Windows seems to "work well".

David Freitag

@ThomasPornin Right, but todays UEFI environments are pretty powerful, it only takes a few hundred lines of code to get your descriptor tables and a handful of IRQ's out.

Thomas Pornin

15:08

@Simon "The problem with the French is that they don't have a word for 'entrepreneur'" (G. W. Bush)

Simon

@ThomasPornin Please no, he didn't really say that? He's even more idiotic than I thought.

Adnan

So I was just told the following by a project manager in a British company

> Meh, I wouldn't bother with SSL anymore. You have SSLStrip, BEAST, CRIME, and now BREACH. Implementing it in our product is just a waste of time at this point, anybody could just decrypt your data. That's just security by obscurity.

David Freitag

@ThomasPornin I just don't think we will see real mode disappear, at least until we get 128 bit CPUs, then there will be 32, or even 64 bit real modes.

Simon

@Adnan What did you reply?

Thomas Pornin

@Simon The involved people seem to deny it: snopes.com/quotes/bush.asp

Adnan

15:12

@Simon I'm still unable to formulate a reply.

Simon

@ThomasPornin Anyone who wants to protect his reputation would lie about it.

David Freitag

Bush only had an IQ of 91??? And he graduated from Harvard? How is that even possible...

Rory McCune

@DavidFreitag money, lots of money

Adnan

@RoryMcCune You ninjad me on this one

Simon

@DavidFreitag You don't have to be clever to succeed at school.

David Freitag

15:14

@RoryMcCune Good god man, and people ask why i don't want to live on this planet anymore

Rory McCune

@Adnan I was typin' fast like a ninja alright :)

David Freitag

My toothbrush has an IQ of 91, maybe we should give Harvard a ring.

Adnan

@RoryMcCune Just like what I do when my gf is downstairs collecting the laundry.

@DavidFreitag No wonder you're good friends with your toothbrush

Rory McCune

@DavidFreitag it's unfortunate (I think) that the higher education sectors of a lot of countries (US included) are run like a commercial concern. when that happens things that generate a lot of cash (e.g. college football) can change academic decisions unfortunately...

David Freitag

@Adnan Intelligence isn't that great, it screams when i use it. It's kinda entertaining though, to hear those muffled screams.

Rory McCune

15:16

@Adnan yeah I've always wondered how you had such a high score on this site and a girlfriend! :op

Terry Chia

@Adnan Houses get robbed all the time. I should just leave my door unlocked.

Thomas Pornin

@Simon The quote is said to have been real but in private, with Tony Blair. Tony Blair later claimed that this is false.

Adnan

@TerryChia Laws get broken all the time, there's no point of gun laws

@RoryMcCune It was a masturbation joke

Terry Chia

@Adnan I'm gonna die anyway so I might as well shoot myself in the head now.

David Freitag

@TerryChia I'll get some bullets and some popcorn

Rory McCune

15:18

@Adnan typing.. that's what you crazy kids are calling it these days...

CodesInChaos

nukes>guns

Terry Chia

@CodesInChaos nukes+guns>nukes>guns

David Freitag

@TerryChia lazor beams from space > nukes + guns > nukes > guns

CodesInChaos

nukes from orbit > nukes+guns

Terry Chia

@CodesInChaos NUKE ALL THE THINGS!

Ok, bed time. Good day gents. @Adnan.

Gilles

15:21

@Simon “The problem with defending the purity of the English language is that English is about as pure as a cribhouse whore. We don't just borrow words; on occasion, English has pursued other languages down alleyways to beat them unconscious and riffle their pockets for new vocabulary.” (James Nicoll)

Simon

@ThomasPornin Boo :(

@Gilles Damn, that's a nice quote.

Adnan

@TerryChia Good night, sweetie

Laser based weapons are amazing! Imagine a laser sniper!

No external or internal ballistics

WYSIWYG

Oh, and best part, no leading or trapping needed for moving targets

Thomas Pornin

@Adnan huffingtonpost.com/2013/04/09/navy-lasers-drones_n_3044177.html

gizmodo.com/5978740/…

Adnan

@Thomas That's very impressive

Thomas Pornin

smartplanet.com/blog/thinking-tech/…

Apparently (and quite predictably) people are really working on military laser rifles.

Lucas Kauffman

16:10

@ThomasP I know they already made laser rifles for teams who need less lethal force, the lasers were meant to cause you to go blind for a few minutes

They also had something with unidirectional sound which made your ears pop

Adnan

@ton.yeung Oh true. Or, mirrors

Lucas Kauffman

Ouch

David Freitag

16:36

@ton.yeung I'm going to be honest, i would rather fried retinas then a nice neat hole in my forehead.

Adnan

@DavidFreitag Is that "than" ?

Because currently that sounds confusing

David Freitag

@Adnan Perhaps. It's too late to fix it now though.

Adnan

@ton.yeung No no, but the way he said it it means he would rather to have fried retinas and a nice neat hole in his forehead afterwards.

So it actually affected the meaning

David Freitag

@Adnan You got the point though.

Adnan

@DavidFreitag After you said it's a mistake, yes. But before that, not really.

David Freitag

16:41

@Adnan Oh well. It was good that you asked then.

Adnan

@ton.yeung Where do I apply?

David Freitag

@Adnan It all starts with a bit of cybermail.

Saladin

17:21

hey crew

anybody home

Griffin

17:39

This stupid song is stuck in my head

►

Griffin

19:13

SOMEONE SAY SOMETHING

@ton.yeung Thank you.

Jon of All Trades

19:25

Howdy, everyone. Quick question regarding HMAC: if the message to be hashed is shorter than the block size, is it still hashed or is it left as-is and zero-padded? I would expect that you'd always hash it, but the Wikipedia article (en.wikipedia.org/wiki/Hash-based_message_authentication_code) implies otherwise. Unless I've misread their code examples.

Thomas Pornin

The message is always hashed. It is the key which is not necessarily hashed.

That is, if the key is shorter than the block size, one HMAC computation will involve two hash function invocations. If the key is longer than the block size, you will need three hash function invocations.

tylerl

stupid enter key

Jon of All Trades

Thanks, Thomas! That clarifies things.

Simon

19:48

@ton.yeung You too click on the send button everytime?

Gilles

20:04

AES explained with stick figures

Adnan

20:28

@Gilles Wow!

One of the greatest explanations I've ever seen.

I've just sent a thank-you email to Jeff Moser (the person who made it) and here's a thank you to you for posting it.

@Thomas Explanation or debunking needed

0

Q: MIT says: mathematical theory behind encryption is wrong. What are the consequences?

A friend shared with me the following link: Encryption is less secure than we thought I'm not a security expert and could understand great part the article, except the section about noise, but what I haven't figured out is the impact of that research in real life. What does it mean for mortals,...

encryption

Iszi

@Adnan Or migration to Cryptography.

Adnan

@Iszi Agreed.

To be honest, I've just finished reading the article. Very disappointing. As usual, only a flashy title.

The author talks as if she's the first in the world to ever know that finding correlation between multiple ciphertext and multiple plaintext will make it a bit easier to extract the key.

My non-expert opinion is that the article is ridiculous!!

Also, looking at the author's personal page, she has nothing to do with cryptography. Her field is electrical engineering!

> RESEARCH INTERESTS: Network Coding, High-speed access networks, Wireless/optical interface, Robustness and reliability of optical networks Wideband wireless channels, Capacity of time-varying channels, Capacity of packetized wireless channel.

AJ Henderson

20:51

@Adnan - too bad I can't unaccept someone's acceptance of my answer. Even I don't think my answer should be the accepted one, at-least not yet. There is a TON of room to improve on my answer

though I suppose my answer is probably still more informative than that article

which is part of why my answer is still kind of blah. It honestly wasn't worth my time to waste more time trying to figure out what the paper was claiming in detail since it doesn't seem to be anything new or even noteworthy

Adnan

@AJHenderson I definitely agree with that.

AJ Henderson

I just responded to let him know the sky isn't falling

in fact, in the realm of things that could cause an information apocalypse, that ranks up there with my fears of santa leaving live hand grenades in the stockings of little girls and boys everywhere

well anyway, time for me to head home

Simon

@Adnan 58 rep left, it's unbelievable!

Iszi

22:20

How is this still open, and such a friggin' rep-train?

94

Q: Is Google spying on all of us?

I am curious because, I experienced something bizarre recently. About a month ago, someone asked me to find out a price for a T-shirt printing machine, and probably for the first time, I pressed these keys and started searching, searching, for long and many found many results only using through t...