« first day (1198 days earlier)      last day (2685 days later) » 
00:00 - 18:0018:00 - 00:00

12:03 AM
@pacifist Hints: He wears a kilt, eats a haggis, plays the bagpipes, and might slay you with a claymore.
@pacifist Ok, he plays the guitar, not the bagpipes, (a guitar that shoots flames, no less) but you get the point.
heh, k, thanks
little far for me to try and reach by radio, without getting lucky on rare phenomenon. I'm probably a lot closer to MH370, unless it turns out to be in Afghanistan again
@pacifist To your question - Truly random data is incompressible, so the size of a OTP cannot be decreased using compression.
@Xander - doh... I don't know why I didn't think of that. Good point. kinda feel like trying to remove the question now
12:19 AM
@pacifist Ehh, I don't know that it's a bad question. Just one with a very simple answer. :-)
Unless somebody wants to get into the math involved to demonstrate that random data in incompressible. Then it becomes a mind-numbingly complex and boring answer. @ThomasPornin might be willing to do that.
@Xander that might not be correct - if it's stored sparsely, it could certainly be compressed.
@FalconMomot Storage mechanisms are completely irrelevant.
@Xander if the OTPs are numeric you could compress them by using binary symbols instead of ASCII ones is all. Otherwise, yes, they are noncompressible.
12:40 AM
@FalconMomot That's a bit of an odd scenario. ASCII is an encoding, which is not typically what you deal with when encrypting data using a computer. You usually work in bits and bytes.
ok so yes, as I poposed the question it looks very unlikely. I won't edit the question to be asking it slightly differently, but can it be used to 'update' one-time pads? Say (for some silly reason) you believe you've leaked a copy of your onetime pads, can you use a chunk (say a few hundred bytes) to tell the other party that the remaining amount of pad left after that you're going to use to transmit a new pad, in an attempt to 'close' the leak if you think you're not being intercepted yet?
so both parties end up with a 'new' pad of the reminaining length... actually no nevermind. This one never works since if your new pad being transmitted is intercepted its moot.
@pacifist Yup. This. :-)
1:09 AM
@Xander that's different. if you can compress encrypted data much at all without knowing the key, the encryption is probably full of side-channel attacks.
3 hours later…
4:04 AM
@pacifist TL;DR: OTP is not practical for most purposes.
4:39 AM
@TerryChia oh - I knew I was just reading the OTP stuff from above (about whether OTP can be used large scale) and as edge case was wondering whether you can actually keep OTP 'going' after some initial state is securely established. Punchline turned out not to be surprising
5:37 AM
@StackExchange He does have a point. I, too, would rather eat an iPad than watch daytime TV again.
1 hour later…
6:50 AM
@tylerl next time you go and do that kind of trainbait, give us a heads up, so we can throw a preemptive protect on it....
but daaaamn there is some crap there.
curious how much rep you lost out on there.... ;-)
7:16 AM
@Xander oo, just subscribed to coffee.
sorry, followed.
Tengo más hambre que los pavos de Manolo.
"I am hungrier than Johnny's turkeys"
@TerryChia well, that actually depends. Depends on which "OTP" you're talking about....
@AviD I'm obviously referring to one time pad given the previous discussion.
One-time pads are not practical (for most purposes). One time passwords are much more practical, in certain situations.
@TerryChia still, it needed to be said.
Someone needs to come up with unambiguous acronyms for these.
8:05 AM
in news that @RoryAlsop will be insanely happy about, you can now get MS Office for iPad :)
so now he can spend even more time on his beloved iPad :op
8:17 AM
8:31 AM
8:49 AM
Why is this PGP signature not apparently compliant with the RFC? paste.ubuntu.com/7167325
My calculations show that the first two octets which are supposed to be the scalar of how many bits the MPI is comprised of, equals far more than the number of bits remaining in the signature
So that hex can't be the start of the big RSA signature value
that's why.
Nah @AviD I want to understand this at a byte level
it's missing the --- BEGIN PGP .... .
Oh I just realised that's exactly 512 bytes
so that whole string must be the 4096 bits of the integer
@RoryAlsop I think we need to ban @Lucas for a while.
He's getting dangerously close to passing my rep and pushing my off the 2nd row....
9:03 AM
Ah actually maybe it's because the MPI is encrypted
so it does represent that space but I need to decrypt it first according to the fact that number = m^d mod n
Oh God damn it was there all along '10 00' = 4096
@AviD Just play nuke the answers.
@TerryChia heh, thats a good idea. I'll moddelete his highest scoring answers...
its not like any of them are any good, anyway....
Does moddelete override the rep preservation threshold?
I mean, it probably should, but this being SE ...
@FEichinger Good question. I guess @AviD should experiment.
moddelete is the same as regular delete....
@FEichinger how do you mean? this removes rep...
9:15 AM
@AviD Deleting posts above a certain score threshold does not remove the rep earned.
oh wait, I thought you were talking about repcap.
@FEichinger really? Did not know that. Whats the threshhold?
@AviD I believe it's +3, but I'd need to check.
so fine, I'll remove all his posts with less than 3 score. That's most of them, anyway ;-)
9:56 AM
who dared decline my flag?
> Migrate to Information Security Meta or covert to CW? – TildalWave yesterday
declined - Meta site is only for q's about the site, or the community.
we all know that's not all that meta is there for :P
not all "questions" there are even questions
Q: The Memes of Information Security

Andrey BotalovThere are memes common to whole Stack Exchange. But after spending some time in The DMZ it becomes evident that Information Security has it's own memes (e.g. rory). I therefore propose that this space be used to document the memes endemic to Information Security's culture. One meme per answer p...

should then be edited to "Are there any Information Security memes?" and all the answers should start with "yes..." :)))
10:25 AM
@TildalWave that one IS community
@TildalWave "What are the..."
@AviD flagged as too broad
@FEichinger so was yo momma.
That's actually true, yes.
morning all
@AviD Niceeeee
@RoryAlsop Morning.
10:38 AM
@TerryChia so was yo momma.
10:49 AM
On.A.Roll @AviD
@RoryAlsop so was yo momma.
cmon you guys, you're just feeding these to me.
not unlike yo momma.
@AviD Don't you have work to do?
lol. Actually, it's Friday, which in Israel is like Sunday.
Also, we changed the clocks last night, so as far as the kids and weekend prep goes, we have a much longer day.
ooh - thanks for reminding me. think ours go forward this weekend
@RoryAlsop What did you do to get your name back?
@kiBytes What's up with this?
If you have follow the exploit guide and you have execute it and it has not exploited your machine you can be pretty sure your machine is not vulnerable to that CVE. — kiBytes 4 hours ago
It's clearly wrong. Not every exploit attempt is guaranteed to lead to a successful exploitation of a vulnerability.
In fact, some exploits that lead to privilege escalation or remote code execution, sometimes they lead to a DoS, and other times have no effect at all.
11:10 AM
@Alex Stop stalking me, will ya? The fact that you're in all of my frequent rooms is very unsettling.
@FEichinger Did he ask for your photo yet?
@TerryChia I wouldn't know, I've got him on ignore.
@FEichinger he's in ALL the same rooms as you - not just chat rooms.
dum dum dum dum
@TerryChia So... @AviD is a mellon now?
@Adnan Who said anything about @AviD?
11:18 AM
@TerryChia Who didn't??
@AviD Your mom.
@TerryChia Oh! I've just realized that @FEichinger said "@Alex Stop stalking" and not "@AviD Stop stalking"
Smart @Adnan is smart.
@FEichinger You forgot your sarcasm tags. :)
@TerryChia Oh, sweetie. It's obvious it's sarcastic
@FEichinger Heh, don't remind me. I know I'm not.
11:20 AM
@Adnan huh?
Yesterday I put my mobile in the fridge and kept looking for it for about an hour.
@Alex Huuto?
@Adnan That's not stupid behaviour. That's drunk behaviour.
@TerryChia The tragic part is that I wasn't drunk. Not even a bit.
@Adnan does it get better reception that way?
@Adnan has FEichinger been talking to me?
11:23 AM
@Alex Are you subtly hinting that you also have @FEichinger on ignore?
@AviD Nope, just battery ran out faster.
then why?
@AviD Low IQ, I guess?
@Adnan I was trying not to say it... but now you mention it I do, not sure why though... can't remember
I can't even formulate a sentence without 3 edits.
11:24 AM
it wasn't the voices, then?
19 secs ago, by Alex
@Adnan I was trying not to say it... but now you mention it I do, not sure why though
@AviD Maaan, I don't hear voices!
Not in the day.
11:43 AM
@Adnan - I just edited my name back to what it was:-)
Same process I used to change it in the first place.
@RoryAlsop Mods don't have the time restriction?
there is a time restriction?
I believe the time restriction has been removed.
> one display name change allowed every 30 days.
@FEichinger Fantastic! Meta source?
@Adnan I don't have any.
I just know that I haven't had any problems changing my name recently.
11:48 AM
@Adnan - I hadn't even thought about it. If it had enforced 1 name change per month then I would have just had to be Cyber Rory for a month :-)
cyber month
@RoryAlsop Then I think it just doesn't apply to moderators (or, you copied your name change across profiles)
cyber... that's a word I haven't seen for a while... brings back memories
... of yesterday?
11:54 AM
Internet-related prefixes include ', ', ', ', ' and ', which are prefixed to a wide range of existing words to form new, Internet-related flavors of existing concepts. the adjective ' is often used in a similar manner. E-, i, cyber- and virtual E-, cyber- and virtual are often used in names coined for "electronic" or computer-related counterparts of a pre-existing product or service. "E-" E-, standing for the word ', is used in the terms e-mail (electronic mail), e-commerce (electronic commerce), e-business ("electronic" business), e-banking (electronic banking) and e-book (electron...
brings back memories of childhood for some reason
@Alex Your childhood was in the early 1980s?
> McFedries observes that a backlash against the use of e- and cyber- can be traced to the late 1990s, quoting Hale and Scanlon requesting writers in 1999 to "resist the urge to use this vowel-as-cliché" when it comes to e- and calling cyber- "terminally overused."
@Adnan yes
12:12 PM
cc @AviD Israeli producer
that is awful.
tho it seems my baby likes it....
You know what's better than MySQL? WebScaleSQL! code.facebook.com/posts/1474977139392436/…
isnt that mongodb?
@AviD Mongodb is so 2013.
12:33 PM
@TerryChia The person who wrote that has a majestic hair
@Adnan as part of the guide you will read if that exploit it is going to work and the effect of the same.
My experience is that anytime I have found an exploit for an specific CVE it has worked everytime in an exposed system
If it really doesn't mean to work everytime it is usally because the CVE says "in specific circunstances this may cause..."
@kibytes - I have had the opposite experience, with much tweaking needed for some exploits to work
@kiBytes Many exploits aren't deterministic.
@RoryAlsop With tweaking you mean changing addresses and that stuff?
@kiBytes What @Terry said.
12:37 PM
@kibytes - yes, and setting specific compile flags, configuration settings etc
Especially with ASLR on. There was no indication on the question about it.
Just because in your experience they worked all the time, that doesn't mean it's true all the time.
@RoryAlsop Well but that is what you really need to do to exploit a system
the exploit is a template
and you then "tune it" for your system
I agree, and I was hoping that would come through in my answer
but the core of the exploit is the very same and I have never had to tweak the very core in an exploit to work (maybe I haven't tested enough exploits to gather a realistic experience though)
12:39 PM
@kiBytes Exactly.
Actually, slightly more than 50% of the time, the exact same exploit can fail on the exact same system after having worked before (no patch/update applied).
@kiBytes You have no idea if the guy in question did that. He could have very well just ran a default metasploit exploit against the system.
and that's what he actually is asking about
He doesn't want to exploit the system. he wants to see if he's vulnerable
@TerryChia Ok, I presumed that that was the standard procedure to make an exploit to work. I just didn't though anyone will just download an exploit and exec it...
@kiBytes Remember. People are stupid.
12:44 PM
Ok, then my comment is clearly misleading =)
> I just didn't though anyone will just download an exploit and exec it...
That exactly what most people do.
sadly true
1:17 PM
watcha' all
hows tricks?
@RоryMcCune What tricks? What did I miss?
@Adnan sorry UK'ian turn of phrase, meaning "how is everyone doing today"
Today I learned that "outwith" is an actual word.
@Adnan outwith isn't just a word it's one of the best words
@RоryMcCune I was reading on visa requirements when going to Scotland, and found it on one of the pages.
1:29 PM
only really used in scotland so I try to get it into all my reports :)
is it not used outwith Scotland?
@RoryAlsop indeed it is not, outwith some people who might use it after picking it up in scotland
1:45 PM
@RоryMcCune Whoa! Looks like a versatile word.
@RоryMcCune I'm coming to Scotland this summer, so hopefully I'll pick it up
@TerryChia First one is 80% an intentional troll. Hinted by the tomato example.
@Adnan TBH it's probably not a word I use in everday conversation but it is quite versatile...
you planning to tour about in Scotland or going to a specific part?
@RоryMcCune Still undecided. I'd like to see as much as possible, while steering away from the very touristy places.
I'd like to visit a couple of whiskey distilleries as well.
@Adnan so avoid loch ness, it's pretty but VERY touristy.
whisky stuff, speyside or the isles are good
orkney of course has the Highland Park distillary but @RoryAlsop is the expert on that area
Edinburgh is touristy but probably a must as it's the capital
Stirling and Glasgow are also good
1:51 PM
@RоryMcCune Are some local distilleries as friendly as some people say? I've read online on many blogs that people just went by a distillery and shortly after that were invited to have a look inside
@Adnan ya know I've not actually been to many (I know weird but I only recently got into whisky) . I think most of them have proper visitor centres and the like again Mr Also may know more...
The one in Oban that I did go to had a shop and a tour thing you could do
@TerryChia 9gag via imgur via reddit via Facebook.
@Adnan - yep, many of them now have visitor centres and tours with free samples
or you can get a driver and a tour round many distilleries
@RоryMcCune Who is this Mr Also you speak of?
I'm not only, but also
1:55 PM
@TerryChia there he is :op
@RoryAlsop Whoa! Definitely something I'm looking forward to do
That, and Scottish redhead ladies.
Ugh, i hate meetings.
@FEichinger Thanks. My spellchecker failed me. (I'm 5/10 with spelling)
@Adnan - you could also go for the very established distilleries (Glenturret - part of the Grouse group - has an excellent visitor centre, with a lot of whiskies under their brand) or niche ones, like the one where we will get our whisky from in 10 years time
1:57 PM
@DavidFreitag Anthrax.
@Adnan That would really only work for one out of several meetings i have today. Otherwise i would probably stop getting a paycheck.
@RoryAlsop Sweet!! Man, I cannot wait!
@Strathearn Distillery in Perthshire :-)
When you know dates for your visit etc., let us know
@RoryAlsop Absolutely!
@Adnan @RoryAlsop another DMZ verification!
2:08 PM
@RоryMcCune Oh, Jesus! I must schedule my sex change surgery ASAP!
@Adnan DMZ - Drink (although it's a bit early for europeans @TerryChia you'll need to drink for the rest of us...)
@RоryMcCune Early to drink? Hehehehe
@RоryMcCune It's a bit early for Americans too. ~10am.
@RоryMcCune Knowing the way you people drink, I'd die if I attempt to drink for the rest of you.
@RоryMcCune There is no such thing as "early".
2:11 PM
@DavidFreitag Americans can drink beer at 10 am, as long as it is the American notion of "beer", which other people know of as "tap water".
@FEichinger sure but you're in Germany, isn't beer for breakfast usual practice...
@ThomasPornin Well, he didn't specify. Personally i don't drink beer i would have a glass of whiskey or something.
God damn it! Wrong upload!!
@Adnan Was i not supposed to read that?
I don't even want to know what he accidentally uploaded there ...
2:14 PM
@DavidFreitag It's alright. Not very personal. It just had my last name. (Which, most people here know from LinkedIn)
@RоryMcCune I need to clean my glass.
@FEichinger Polite conversation, it would seem.
Awwh, how nice. The CEO just walked around the office and said "It's Friday and the sun is shining, what are you doing here at work?"
He looked at my glass and said "Looks like you started your holiday early." I said "Oh, it's just coffee". He said "but you don't drink coffee". He tasted the porter, laughed, and continued walking.
I feel a bit unsettled that he knows that I don't drink coffee.
@Adnan Eh. He is the CEO.
2:29 PM
@ThomasPornin But that means that there's actually somebody going around saying "Adnan doesn't drink coffee".
More importantly, what other "Adnan does x" does the dude know?
@Adnan Being able to unsettle you is justification enough.
@Adnan It is quite possible that the said "somebody" is you. You may have, at some point, politely refused a cup of coffee by asserting that you "don't drink coffee". The scary part is that there are human beings out there who remember small talk.
@Adnan He probably knows a lot about your sex life if he googles your name. ;)
@TerryChia Not as personal as my beverage preference.
@Adnan Beverage preference isn't really that personal. If he knew what type of condoms you prefer, that's probably time to start freaking out.
2:44 PM
@DavidFreitag Everybody knows it. Durex Pleasuremax, of course!
@Adnan Yeah, I'm not sure what i was thinking. This is you we're talking about.
Second to that is Durex Ultra Thin
@Adnan Ok, waaaaaaaaaaay too much info now.
@TerryChia So that's where we draw the line?
When it comes to publicly available information on publicly available products relating to the safe practice of sexual activities?
@Adnan No, but we were never able to get you to stop.
2:50 PM
@TerryChia To show my commitment to the drawn line, I'll ignore the obvious joke about not being able to get me to stop.
3:42 PM
Hopefully, everybody here will relate.
Actually, 99% of you will relate. I surely did.
@Adnan in what way?
@Alex Productivity of meetings and dealing with managements in the vast majority of cases.
@Adnan that video is quite amusing
@Alex Indeed. I haven't seen a nice comedic sketch in a while.
3:58 PM
@Adnan I have a solution for this!
you see~ when people start talking this way, the real underlying issue is that they're giving you specifications instead of requirements
this "red line" is a specification. as a developer/expert/whatever you need to gently dissuade your customer from giving you the specification. as you see in the video, the Expert should've asked what they wanted the line to represent or communicate... every time they said, "draw a red line" he should have asked what the line was for
@Krazer "specifications instead of requirements" Oooh, now let's just flash those two words and spend the next 3 hours explaining the difference between them.
In that video, the requirements were indeed to draw 7 red lines.
@Adnan That sounds like something @AviD will enjoy.
The end result is a board with 7 red lines.
the answer might be something like, "we need to show our sales figures for the last six months. sales have gone up, then down (perpendicular) then up again, then down - so it'll be seven lines." the requirement therefore is: show sales figures, so that's the actual problem that they are hiring him to solve
@Krazer Jesus Christ! You're assuming that you're dealing with reasonable people.
4:03 PM
@Adnan how the problem is solved is the specification. the specification is technical, and your customers will very often mess it up because, as we see inthe video, they don't understand all the words they're using when they try to be technical, but they do know their business, and they do understand their real requirements
@Krazer Wow! I understand specs vs. requirements. No need to explain it to me.
But that's not your issue. Your issue isn't me.
@Adnan Hey man I gots no beef wit j00! imma jut tryin' ta have a gud time yo
why you gotta be all up in ma biz d00d
The requirement is indeed to draw 7 red lines. The brand of the sharpies, the type of hand movement, and anything else is the specs.
you should also try to see this relationship between customer and developer from their perspective. often developers make no effort to really understand the business needs
the customer's fear is that they're going to try to tell you what they need, but you're not going to hear it. e.g., they'll say, show sales figures and you'll give them a spreadsheet (numbers, but not the graph they wanted)... while it's technically correct, but it doesn't help them
after getting burned by that, the next time they talk to a developer, they try to get "specific" but end up hiding their actual requirements behind specifications and looking like idiots in the process
4:37 PM
Woohoo, a meeting with a bunch useless of LCD distributors
@TerryChia Oh please. That's nothing im comparison to some of the things that @Adnan has shared in the past.
@DavidFreitag Thank you!!
Or, what others have shared in the past as well.
@Adnan Oh and DMZ - DRINK
@AviD Rep lost? none. Been rep-capped since the Q went up, so down-votes not really a concern.
@AviD As for train-bait; @Rory told me to do it. ... And at least this time he actually did.
5:03 PM
@tylerl: nice troll :)
5:26 PM
@JeffFerland A nice troll would be to still wear a Santa hat on the end of March.
I hate this dude's questions.
Q: Is all RSA encryption now considered insecure? (Notably SSH and SSL)

Naftuli Tzvi KaySome of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by default. Since both SSL and SSH typically use public/private RSA keypairs for their encryption, ...

He's the slightly-more-technical version of Jenny.
Is it because of his religion?
@Simon Ha?
@Simon Oooh, you mean because of his kippa and peyot?
5:36 PM
@Adnan Had no idea that's what these things were called and I don't plan to remember it but ya.
@Simon Well, when I really dig into it, I'd say yes, it does play a factor. 80% because of the questions themselves, and 20% because of his religious beliefs. I'm not a big fan of Ultra Orthodox Jews. Actually, I'm not a big fan of Ultra Orthodox/Extremest anything.
@Adnan I feel ya. I don't like the dogmas/life guidelines offered by religions.
@RoryAlsop see you got a namecheck from that Google SSL dude blogs.computerworld.com/privacy/23698/…
@RоryMcCune I don't know why he kept the article online.
Is he trying to end his career?
@tylerl ya see your thread got linked from the updated news article
so that'll be more rep-capping for you
5:47 PM
Why is talking about RoryA?
@Adnan well if you think about it, computerworld got tons of traffic (I've seen twits about this allll day) which they can show advertisers (look eyeballs!) which means they get more revenue, hell he'll probably get a raise!
@Simon Mr Also tried to educate him in comments by linking @tylerl 's question
Ah ok.
00:00 - 18:0018:00 - 00:00

« first day (1198 days earlier)      last day (2685 days later) »