The DMZ

deed02392

15:08

that gif/script thing is still quite significant though

especially if it's a site which lets users upload images

since then it beats the cross-domain restrictions, even if you do have some other way of injecting a src value for a script tag

AviD

yes, but note that the script only runs from a script tag.

bascially, the renderer doesnt care what the url is, or what format is sent over the wire. Whatever it gets, it plugs into the script tag, and passes it off to the JS engine for execution.

it's actually not that big a deal, just surprising.

the only real scenario, is if you can control the script tag source. Then this either helps get around the cross-domain issue, or bypasses a constraint of the src having to be on the same server.

deed02392

@AviD that's only half of it though, if the image was hosted elsewhere then wouldn't cross-domain security stop you getting the browser to send POST/GET to scripts on the site server?

or is that limited by the location of the script tag?

rather than the ultimate source of the js itself

AviD

yes, and anyway you could always send GETs.

post too for that matter.

deed02392

really?

AviD

the cross domain is about reading the responses.

deed02392

15:13

oh

AviD

sorry! I think I'm confusing cross domain with same origin policy.

cuz I'm on the phone.

deed02392

lol yeah I was going to say

Terry Chia

@AviD Excuses! ;)

deed02392

@ManishEarth that AES thing is genuine

you control the key and IV and use AES-CBC

pbs.twimg.com/media/BewgPI-CIAAxU5x.png:large

another example

Iszi

It would seem to me that, by controlling the key & IV, you can use AES to encrypt anything in such a way that it produces any output you desire. It's just a matter of finding the right key & IV - correct?

Then again, isn't that more or less true for just about any encryption protocol and implementation - good or bad?

Kinda like the infinite monkeys with typewriters thing?

kalina

15:25

95 minutes to go

Iszi

@kalina Until noon, U.S. Eastern? Yeah. What about it?

kalina

94 minutes until hometime

Iszi

@kalina Cue irrational time zone jealousy.

kalina

:D

92 minutes to go

not clock watching much

10 minutes later...

82!

M'vy

Disclaimer: this approximation does not take time-space continuum alteration into account.

kalina

15:41

...

Terry Chia

@M'vy You will want to be careful around @kalina or she will set you on fire.

kalina

76 minutes...

M'vy

@TerryChia I know, I know

CodesInChaos

@Iszi This is just about choosing an IV. And it's a bit tricky, since you need to file to valid both in encrypted and plaintext form.

Check the backlog, I posted an explanation yesterday

kalina

66 minutes

Rory Alsop

15:54

@Iszi Yup - I'm the same. Most sites I have as permissions denied. It means I do have a fair few clicks to temporarily allow, but it's betterererer

@kalina ...I'm at home :-)

kalina

I hate you

Rory Alsop

(admittedly still two conference calls to go, but still....)

kalina

tests implementation of fire over IP

4

Terry Chia

@kalina Is that a IETF standard?

AviD

@kalina I've been at home all day....

kalina

15:57

soon™

AviD

then again, my office is pretty much at home

Iszi

@kalina I'm at home, but working. So yaaaay....aww.

kalina

62 minutes

AviD

@Iszi staycation time! go get those mojitos!

Rory Alsop

Is everyone at home except @kalina? heh heh heh

Terry Chia

15:58

@kalina What a coincidence. 62 minutes is exactly when I'm going to go sleep.

kalina

60 minutes now

@RoryAlsop you are mean

and you smell funny

I hope you can live with yourself.

Rory Alsop

If I smell funny, I would feel sorrier for others who live with me :-)

kalina

53 minutes left

Scott Pack

@RoryAlsop I'm at home, aye.

There's also an 8F difference between my office and the hallway. That was a bit of a surprise when I opened the door.

Iszi

@CodesInChaos Too lazy and/or short on time to dig. Link?

Rory Alsop

16:15

@kalina 45 minutes?

kalina

no, 44 minutes

ManishEarth

DIE PHP DIE

older version on deploy server. grr

no...square...brackets

die

die()

kalina

41 minutes

ManishEarth

Wait so long to get access to the server. Then wait long for mysql access. Now realize that they run PHP 5.2. gaaaaaah

CodesInChaos

yesterday, by CodesInChaos

@Griffin The IV in CBC mode allows you to choose the first 16 bytes of the decrypted file

kalina

16:30

30 minutes to go

TildalWave

@RoryAlsop @tylerl's comment is pretty much spot on too, snarky as it might be (which only earns him a few more brownie points in my book anyway) :)

@AviD yes, "to tweet" is the verb you're looking for ;)

encrypted.google.com/search?q=define:tweet

kalina

16 minutes

Iszi

Looks like Microsoft lost another trademark dispute, and is having to change the name of yet another product. Don't big corps do any research before naming their products these days? infoworld.com/d/cloud-computing/…

Scott Pack

16:46

Trademark is hard because if it's a small service it may be hard to find, or it may be abandoned.

PaulDotCom was recently rebranded as Security Weekly because of a long running trademark dispute.

Paul gave a good rundown of it on the first episode of this year.

Iszi

Why can't trademarks be like patents - if you don't file it, it doesn't exist?

CodesInChaos

The problem with trademarks is figuring out when they're similar enough

Scott Pack

Not to mention, unlike copyright, if you don't actively enforce your trademark it can be revoked.

kalina

5..

deed02392

I expect a good measure for similarity is if you're questioning it's similar to something else then it's too similar

Stack Exchange

17:41

Blog - Stack Exchange: Stack Exchange for Android is here!

David Fullerton on January 27, 2014

This mobile thing will never last, right? We figured if we waited long enough, this whole “mobile application” thing would blow over and everything would go back to the way they used to be. You know, when phones were for calling people, and computers were for typing long, angry rants about how things aren’t the way they used to be.

In retrospect, we may have misread that one a bit. It turns out that even for Stack Exchange mobile is eating the world.

So today we’re excited to announce that Stack Exchange for Android is finally available for download on the Google Play store, for Android phones version 4.0 (ICS) and up: …

ManishEarth

17:56

@StackExchange time to boot up the emulator....

(have a Droid, but not on ICS)

TildalWave

Iszi

18:31

Well, that was uber-weird. Had an odd issue with my mouse pointer just a bit ago. For some reason it glitched so that it looked like a text pointer duplicated over itself vertically a whole bunch of times. Tried changing the pointers in Windows' mouse settings to clear it up but no luck. Problem persisted in local and RDP sessions. Closed down the RDP session to prepare for a reboot, and the problem cleared up.

Wow. Check the comments, here.

15

Q: Using the AND and NOT Operator in Python

Here is my custom class that I have that represents a triangle. I'm trying to write code that checks to see if self.a, self.b, and self.c are greater than 0, which would mean that I have Angle, Angle, Angle. Below you will see the code that checks for A and B, however when I use just self.a !...

Xander

19:10

@Iszi Ha ha.

ekaj

Is someone just serial downvoting the newest questions or are they really that bad/

AviD

@TildalWave no no, again, I was asking "tweet at him", "tweet to him," tweet on him", etc

Iszi

@ekaj Without looking, I generally assume the latter - that's been the trend as of late, it seems.

ekaj

Good thing I haven't asked any questions lately then =p

TildalWave

19:29

I'd love to have something to upvote actually, I think I chipped a piece off that downvote button already (joking)

@AviD I'd say "to tweet somebody" so ... tweet him

AviD

@TildalWave ah, I see. Seems counterintuitive, though....

TildalWave

besides, it's not mentally healthy to play with variations on "twitter" at all

AviD

@Iszi dammit, that's like the 3rd renaming of the same damn service (and associated apps) in as many years.

Who gives a damn! Get over it! "Sky" is not a non-generic word!

Scott Pack

What about trademarking Candy?

AviD

or "word"?

or "i-anything"

Scott Pack

19:38

iPod, iPhone, those are at least formal product names. Not a single generic word without context.

Iszi

@ScottPack Oh, I'm sure you'll be happy to hear that King is trying to sue over trademarked use of the word "Saga".

Scott Pack

Just so long as they don't trademark "iWord" because I think IBM might have something to say about it.

@Iszi Fuckers.

AviD

@ScottPack yes, but I'm pretty sure there was a case of Apple suing over i-something else.

Scott Pack

1 min ago, by Scott Pack

@Iszi Fuckers.

Iszi

@ScottPack Oh, there was a case of King trying to TM "Candy" also, apparently.

venturebeat.com/2014/01/27/…

Scott Pack

19:42

@Iszi Welcome to the past couple of weeks of whining.

I thought the Candy trademark was approved

Xander

@ScottPack It was in Europe. Not in the US yet.

Iszi

@ScottPack Based on the linked article, USPTO has approved it but there's a waiting period to allow for others to contend it.

TildalWave

20:11

@ScottPack IIRC that "i" stands for "interactive"

Scott Pack

@TildalWave meh

TildalWave

@ScottPack wot meh I didn't think of it myself... get a drink! :P

Scott Pack

I probably will later.

TildalWave

I could use one too actually ... it's moanday

Gilles

twss

Scott Pack

20:16

blinks

That's a joke I never expected you to make.

I applaud our influence on you and/or your ability to consistently surprise.

Gilles

20:59

@ScottPack is this addressed to TildalWave or me? Either way I don't understand why you didn't expect whatever it is you didn't expect

AviD

@Gilles No one expects the Spanish Inquisition.

2

Scott Pack

21:35

@Gilles You making a TWSS comment caught me off-guard.

AviD

Nov 2 '13 at 23:35, by Gilles

@RoryAlsop meh, I liked TWSS better than all the fighting we have now

Oct 17 '13 at 0:10, by Gilles

TWSS?

Nov 2 '13 at 23:35, by Gilles

a month ago this conversation would have triggered a bunch of TWSS, all in good cheer. Now it's users whining about other users. Not cool.

not the first time, apparently.

Scott Pack

Those were all references to TWSS.

Iszi

@ScottPack Arguably, the second was not.

Scott Pack

Your face is arguable.

Iszi

@ScottPack Oh, context. Yeah - totally a reference.

Gilles

21:51

@ScottPack chat.stackexchange.com/… plus many variations (“what he said”, “she didn't say that”, …)

Ladadadada

22:14

Hmmm... ssllabs.com/ssltest/analyze.html?d=nsa.gov

Xander

22:24

@Ladadadada Who cares? Do you really need strong security while reading a press release on the NSA website? Is there anything you can do that actually merits SSL?

Ladadadada

@Xander Ignoring the recent revelations about the NSA snooping on SSL connections, it wasn't that long ago that we took security advice from the NSA and I would imagine 40-bit keys were not part of that advice.

Of course, that's technically an Akamai server, so make of that what you will.

Xander

@Ladadadada Ah, not following their own advice. Gotcha.

Ladadadada

I just ended up on SSLLabs because of this and spotted nsa.gov on the front page.

Xander

22:46

@Ladadadada Ha. I like the term "high grade." I should start using that.

AviD

@Xander isnt that the term they used on Breaking Bad?

Xander

@AviD Could be. Never seen it.

TildalWave

23:06

@AviD didn't they use "purity"?

AviD

@TildalWave ah, could be, I never watched it.

TildalWave

you know, like the rest of normal arians

AviD

cop movies they always say that though.

TildalWave

yes... see above why that might be the case

Transcript for