The DMZ

Terry Chia

3:01 AM

@DavidFreitag Jenkins is horrible. :(

David Freitag

@TerryChia What else is there for private CI servers that I can install locally?

Terry Chia

@DavidFreitag JetBrains has one that's slightly less horrible.

But all the CI solutions are horrible to a certain extent sadly. :(

David Freitag

Well I suppose if you were motivated enough you could run Travis locally

It is FOSS IIRC, but I haven't read their license, they may require that any projects built with it be FOSS as well

Terry Chia

@DavidFreitag The main issue I have with Jenkins is that it's damn near impossible to automate the installation.

Which gets really !@#$% annoying if I want the same config in a few places.

David Freitag

@TerryChia It isn't really the sort of program that you install more than a hand full of times though

Terry Chia

3:06 AM

@DavidFreitag It gets really painful to setup if you have a complex config and something goes wrong with your boxes.

I like to automate setups of everything nowadays. Much easier in the long run.

David Freitag

@TerryChia Isn't that what backups are for? :]

Terry Chia

@DavidFreitag One example of a pretty complex Jenkins setup: jenkins.cryptography.io/job/cryptography-pr-experimental/2436

Reproducing that is a PITA.

Stack Exchange

5:54 AM

'Can't you just use the LHC you already built to find it again?' 'We MAY have disassembled it to build a death ray.' 'Just one, though.' 'Nothing you should worry about.' 'The death isn't even very serious.'

tylerl

Posed a softball question:

0

Q: How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions such as SecureID and TOTP? Specifically: In what way is U2F fundamentally different from OTP...

Terry Chia

@tylerl Heh. That's a copy-paste from specs answer. :)

tylerl

@TerryChia some digging and interpretation required. I mean, minimal effort at least.

Terry Chia

@tylerl True. I know the answer to most of them but I'm too lazy to go get quotes from the spec.

Lighty

7:24 AM

morning all

cold weather, aint it?

Rоry McCune

7:58 AM

@Lighty , Mornin' here's it's just wet and windy!

Tinned_Tuna

Ehn, not too bad: weather.elec.york.ac.uk

Rory Alsop

Nice here too - little bit grey but bright

Lighty

@RоryMcCune over here 'bout the same, but kinda chilly on the bike this morning, first day it was that chilly, I should bring some gloves next time

even my eyes kinda hurt from the cold o.o

the cold breeze that is

Rоry McCune

well you'll need to get used to it

"winter is coming"

Tinned_Tuna

I think you should tell who ever this "winter" person is to keep that kind of stuff private. Ew.

Lighty

8:09 AM

Well, some leather gloves and some clear glasses should be enough (since the #1 reason for cold is WIND, you'll get warm through cycling anyways)

Rоry McCune

I had not thought of the saying in that way... I shall now add it to a list of "things not to search google images for"

Lighty

leather gloves because it's easier to operate my phones Touchscreen, and if it's wet outside, it won't soak, unlike wool gloves

@RоryMcCune Add "Game of Bones" too, now we're referencing dirty jokes

Terry Chia

@Tinned_Tuna Pervert.

Rory Alsop

@RоryMcCune ... oops

2

searched

heh

was not disappointed

Rоry McCune

heh

CodesInChaos

8:15 AM

@RoryAlsop Why was How does ASIC cryptocoin miners affect the security of scrypt? migrated to bitcoin.se?

As far as I can tell it asks for the impact of custom hardware designed for bitcoin/altcoin mining on password hashes.

Which is a security question, not a bitcoin question.

Tinned_Tuna

9:02 AM

@RoryAlsop My other half searched for it... it came up with a puppy with snow! It was so cute!

Lighty

ugh, i'm short on one project i could make for school, i need to make one project every week in JavaScript, that could be turned into a HTML5 App later on, i've already made Serveral Calculators, practised on functions to validize Data (NaN, Emptyness etc.), even reset functions for forms and such

anyone have an idea? :/

Tinned_Tuna

@Lighty what sort of projects are you looking for -- anything in the same vein as you've already mentioned?

Lighty

this page is the main navigation to all fo my current projects (green ones are done) studiolupa.nl/kevin/index.html

@Tinned_Tuna yup, something alike, since i'm still learning JavaScript, it shouldn;t be too hard, but also not something easy xD

i know in that list, that the Memory Game was insanely hard (not gonna do such a thing again), and that the "Boete Calc", which is for defining speeding tickets was tricky, yet learned me a few things

but that was because the netherlands do NOT have formula's for speeding tickets, so its not really a calculator, but simply gets your data out of a list based on what you put in

using a HUGE If/Else thing X.x

hm, i already got a "final" project, which is going to be a simple JS tool to convert text to an encrypted string, and re-convert it back using the good password

just a fun thing to maybe even elarn what basic encryption is

i thought about filling the missing project with something like a converter... but i think thats way to simple

Tinned_Tuna

@Lighty there's lots of projects around encryption that you can do :-)

Lighty

@Tinned_Tuna yea, i have a fun one as last project, lemme find an example

hanewin.net/encrypt/PGcrypt.htm

here, should become something really simple like that

Tinned_Tuna

9:13 AM

ooo, PGP-style is not necessarily very easy. There's a lot going on there.

Lighty

@Tinned_Tuna i jsut googled "Javascript Encryption Tool"

what i mean is, just 2 fields, and a password field, and a button

Tinned_Tuna

ahh okies

Lighty

I was thinking on making a MD5 encryption one

Tinned_Tuna

you could do a lot of classical-type crypto quite easy, Ceasar, Simple substitution, etc.

Lighty

and a "break" button, which runs a script to prove MD5 can be broken ;o

Tinned_Tuna

9:16 AM

Vigenère cipher

The Vigenère cipher is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. It is a simple form of polyalphabetic substitution. The Vigenère (French pronunciation: [viʒnɛːʁ]) cipher has been reinvented many times. The method was originally described by Giovan Battista Bellaso in his 1553 book La cifra del. Sig. Giovan Battista Bellaso; however, the scheme was later misattributed to Blaise de Vigenère in the 19th century, and is now widely known as the "Vigenère cipher". Though the cipher is easy to understand and implement, for...

Lighty

@Tinned_Tuna hm, interesting :o

Tinned_Tuna

tbf, if you're interested in cryptography, there's lots that you could do.

Lighty

@Tinned_Tuna I'm interested indeed, the only things i know about it is that it helps keeping nosey eyes at bay... for a while

Tinned_Tuna

@Lighty there's loads of projects in the area. I think a not-bad place to start is Coursera's Crypto 1 (Stanford, Dan Boneh is the instructor), but you'll need to understand some discrete probability.

Lighty

@Tinned_Tuna hm, i'll look into that one too, still reading on Vignere here

Tinned_Tuna

9:22 AM

I think breaking a simple substitution cipher is a neat little evening project.

Aside, does anyone have any experience with Java's keytool ?

Oh, never mind, my Google-fu was just off yesterday, got what I needed

Lighty

@Tinned_Tuna Isn't that called tiredness? xD

Tinned_Tuna

@Lighty possibly... it was late in the day that I came up against this issue

Is it just me, or are all the tools for working with public key crypto (openssl, keytool, pgp/gpg) are a user interface abomination?

Lighty

@Tinned_Tuna yup

thats also a reason alot of people don't want to encrypt their emails/traffic/data etc.

not even the confidential data in the office i work at is encrypted :/

jsut because its too hard, not user friendly and such :/

and they claim "we don't care if someone noses in there"

while he signed a contract for not talking about projects (stored in there) before the launch of them

but the usability is indeed a problem in the office...

becaue we use iMacs

if we had Windows machines with Win7 Pro/Win 8 Pro, we had Bitlocker, which is pretty good and user friendly

imo atleast

Tinned_Tuna

Mac OS X does have an FDE feature these days, and Apple are (historically) quite good at user interfaces. I know that in the past, their "encrypt home directory" feature was very easy to use.

Lighty

@Tinned_Tuna it is.... problem is, no-one here knows how to use that thing

whih can be trained, bviously

but that the leyboard and the mice/trackpads kinda... suck, discourages the boss to look into it and secure everything properly

he shrugged the Hearthbleed, ShellShock and the POODLE vurln. off too

while we all know the iMacs are 101% affected here :P

i don't know if people just don't care ar all, or are stupid for not caring

Tinned_Tuna

9:35 AM

@Lighty alert fatigue, probably.

Lighty

@Tinned_Tuna well, a regular PC user (biggest portion of the market) that only use it for basic work, writing emails, doing banking online and sitting on FB/Twitter, its not important

but the boss of a Application/Web developer company, that has enough strict confidential projects people are wihtout doubt after?

Rory Alsop

@CodesInChaos ... oh, I couldn't get that from it at all. It was flagged as not a security question, and the answers also seemed to indicate that, so I agreed.

If you/other folks on Crypto reject the migration, that would work

CodesInChaos

It's on bitcoin.se not crypto.se. I can't VtC on bitcoin.

Lighty

10:31 AM

free flags

-1

A: What XSS attacks doesn't "Reflective XSS Protection" defeat?

hellow brother hi r uffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

Adnan

11:23 AM

Oh man, I aced the presentation I gave to the company just now. It was about secure coding and I demonstrated hacking, pen-testing etc.

@Adnan Congrats :3

@Adnan congrats :)

Thanks :D

@Tinned_Tuna you obviously have safe search on

Lighty

@RoryAlsop what a pussy

badumtss.net

Terry Chia

12:01 PM

@Tinned_Tuna It's not just you.

The only half decent one I have seen is Cloudflare's CFSSL. But that's pretty limited in functionality.

Simon

1:12 PM

@Lighty I feel like flagging you for this, as a payback y'know.

Rоry McCune

@Simon sometimes you just need to learn to turn the other doughnut you know

Simon

@RоryMcCune Yeah, that's why I haven't done it.

Terry Chia

@Simon Ignoring is a more peaceful option.

Simon

@TerryChia He still hasn't made it out of the blacklist?

Terry Chia

@Simon That involves clicking buttons and I'm too lazy so meh.

Simon

1:15 PM

@TerryChia Oh, I know the feeling.

Xander

1:37 PM

0

Q: Competitor app blocks our app, need a way to bypass their check

We have a taxi app which has been quite successful in Europe. But recently one of our competitors has started checking if our app is installed and if it is, theirs won't run until the user uninstalls our app from their phone. We initially did a few manual updates with a different package name to...

android

Wow. Talk about shady business practices.

Simon

Indeed, wow.

Transcript for