The DMZ - 2015-05-20 (page 1 of 2)

« first day (1616 days earlier) ← previous day next day → last day (3269 days later) »

1:25 AM

imgur.com/gallery/IjzhVTa

cc:\ @Simon

4 hours later…

5:00 AM

At this point, if we're going to keep insisting on portraying dinosaurs as featherless because it's "cooler", it's time to apply that same logic to art involving bald eagles.

3 hours later…

7:45 AM

@LucasKauffman nice! which Model did you go for?

8:29 AM

@RоryMcCune i5-4300U 128GB

8:51 AM

folks - opinion wanted:

20

Q: If we built two-factor authentication for Stack Exchange OpenID, would you use it?

[Related: Two factor authentication for Stack Exchange] So, over the last couple of weeks, I built a bare-bones two-factor authentication system for Stack Exchange OpenID. Currently, it only supports: Logging in via Stack Exchange OpenID Google Authenticator-style code generation Recovery code...

discussion stackexchange-openid

@RoryAlsop hm, fair question. StackExchange is an OpenID provider, right? Meaning that they are relied on to assert the identity of users to sites beyond the StackExchange network? If so, it depends on the requirements of the external sites, unless I've mis-understood something?

9:15 AM

And what exactly is gonna happen if someone steals my account? They'll post stupider and angrier replies than I do, or give donuts to @Simon?

The only actual reason I spend time on SE is I don't have any effort to do to authenticate :-)

@SteveDL See Deer Hunter's comment there :-)

yup, i saw i'm not concerned :-)

9:37 AM

2FA is good. But depends what for

@M'vy exactly.

If it turns they want to be a fully-fleged OpenID provider, then I'd be wanting 2FA

If it's just for SE network... well

Has anyone used nmap's ssl-enum-ciphers?

I'd probably use it if it's there, but I won't be asking for it

10:18 AM

security.stackexchange.com/questions/89658/… I can fix it if I get a month's salary :|

1 hour later…

11:19 AM

@SteveDL It'd take you a month? I'd do it in a week.

@raz no, he said he would fix it for a month worth of salary.

@M'vy Ah, a small but important detail

... isn't it just locate and upgrade the 2 affected servers?

Although, I suppose, comms, downtime management, change control, etc. could easily spiral.

For those types of upgrades, would you need to reboot the server?

11:35 AM

@SteveDL My name was in the same sentence as the word "stupider" and it wasn't directed towards me? Today is gonna be a good day.

@DavidFreitag I miss that dance, I don't get to do it now that I'm with my donut.

@raz I ask for payment inversely proportionally to my intellectual interest in a piece of work.

I'm not very interested in configuring IIS for a lazy sysadmin. :p

@SteveDL Oh stop it, I'm sure you love IIS' interface.

@Simon familiar with the concept of tautonomies? ;-)

@SteveDL You're not?! But it's so interesting

I've heard of topologies

@Simon I don't know what it even looks like.

hm pretty sure i mispelt it

11:39 AM

It looks like a cluster. Of fucks.

and pretty sure the word's also different in English

@SteveDL Imagine a Windows Application... with all your server needs in a single window

<- silly

@SteveDL Yeah, google didn't help me out on this one.

What's your main language you donut?

right, im an idiot. Tautologies.

11:41 AM

user image

What's not to love!?

lolololol

@raz to be fair I can't see how that'd be worse than tinkering with postfix's many mysterious files...

/me doesn't do printers or mail servers any more...

Unless you're super paranoid about privacy, paying to use a mail service is definitely worth it.

@SteveDL Valid argument. I just think Linux is more straightforward. Maybe it just makes more sense to me than a GUI setup.

@raz Command line makes more sense to me than most GUI usually.

to me to me to me

11:50 AM

@Simon I needed one set up for the remote study management website i'm developing for my group

our current site is a collection of perl scripts (or something similar) running on some solaris server from the 80's or 90's

apparently our samba server is currently hosted on the machine that was originally processing DNS requests for .uk, too...

That's old school.

we have badass sysadmins, but they dont use the same technologies as our students... makes it hard to do in-house development :|

@RoryAlsop I just saw it now (too busy with enforcers of prior research elsewhere on a site that goes to enthusiast level ...) but why did you delete your answer on SEx.SE? You're not wrong you know?

@TildalWave I figured I wasn't wrong, but mine was a cheap throwaway answer with almost no research effort - yours was excellent

@RoryAlsop wait, I thought we ask of those asking questions to do research, not of those answering them? :D

I mean, look at @LucasKauffman's answers :)))

:P

11:54 AM

:O

@TildalWave :'( you broke my heart

Donuts fired.

@LucasKauffman What again? How many times can it be broken? :O

@TildalWave I totally concur. There is no need for extra research if you already know the answer.

exactly

@Simon dude, too much information!

@SteveDL tautonomy kinda makes sense too, you sure it's not a real word?

The "new attack" on TLS is called "Logjam".

weakdh.org

12:07 PM

@TidalWave i can't find traces of it existing and I'm confused as to why I used that word

It has actually no relation with POODLE.

They claim it to be a protocol flaw, which is a bit of a stretch.

@SteveDL Because you were replying to @Simon? :)

In a nutshell, if the client and server accept to use weak crypto (DH with a 512-bit modulus), well, it's weak and can be broken.

A tautonym is a scientific name of a species in which both parts of the name have the same spelling, for example Bison bison. The first part of the name is the name of the genus and the second part is referred to as the specific epithet in the International Code of Nomenclature for algae, fungi, and plants and the specific name in the International Code of Zoological Nomenclature. Tautonymy (i.e., the usage of tautonymous names) is permissible in zoological nomenclature (see List of tautonyms for examples). In past editions of the zoological Code the term tautonym was used, but it has now been...

@ThomasPornin so now all protocol downgrade mechanisms are a design flaw regardless of context?

12:09 PM

@ThomasPornin and here is how it works vuln.name/?q=Logjam :D

@TildalWave pls

@Simon you're saying you're not a donut donut?

No, I'm a donut donut donut.

@SteveDL There is an interesting point, in that the ServerKeyExchange message for a DHE_EXPORT suite and for a plain DHE suite are interchangeable.

> Test Failed Your web browser doesn't look to support Javascript. Please enable Javascript for this test.

12:11 PM

So the client still believes to do plain DHE and not export DHE.

Well that sucks as an exploit

However, the main problem is still that the client and the server accept to use a 512-bit modulus, which is weak, regardless of how you look at it.

When SSL was designed, it was hoped that client and server could opportunistically select a strong cipher suite if they both support it, fallbacking to weak crypto only if there is nothing better available.

The hope was that attackers could not force a downgrade.

What I don't understand is why the only mechanism through which we expect these problems to be solved is for every sysadmin and user in the world to watch crypto crypto mailing lists to figure out they're using a "weak" cypher

That hope relies on the weak crypto not to be completely weak, though.

@ThomasPornin in practice everyone picked the same primes because that allowed for HW optimisations, right?

and then the hardware stays on and nobody wants to switch, or is there something else I'm missing?

12:14 PM

@SteveDL Oh no. In practice everyone picked the same primes because they come with the implementation.

3

@SteveDL Since most people just copy the cipher suite list from the web somewhere the reality is probably a bit worse than that.

These 512-bit primes for DH are not better for hardware than any other.

@Rhino I'd never do a such thing. Cough cough.

The logjam creator also add a fair sprinkle of FUD, by suggesting that 1024-bit DH is also vulnerable to "attackers with nation-state resources".

Although I should take the time now to announce my new TLS vulnerability: if you can downgrade TLS symmetric encryption to the vigenere cipher, then you're in trouble. 11.8% of web servers affected.

12:16 PM

@ThomasPornin ok, i've heard in the past that some people chose specific primes because it allowed optimising hardware implementations for that prime (but maybe it was software, I dont usually listen fully in classrooms :x)

@SteveDL That was for the base field for elliptic curves. Not the same animal.

ah right!

/me feels like a donut.

Although some people have indeed tried the same with plain DH, and it lead to disaster, because the "special primes" allowed for much faster attacks (SNFS vs GNFS). But these do not apply to elliptic curves.

10/10

There's also

17

A: Impacts of not using RSA exponent of 65537

Using $e\ne65537$ would reduce compatibility with existing hardware or software, and break conformance to some standards or prescriptions of security authorities. Any higher $e$ would make the public RSA operation (used for encryption, or signature verification) slower. Some lower $e$, in particu...

that is, e=65537 often in RSA

@ThomasPornin @SteveDL wasn't that binary extension fields (GF(2^x)) and didn't Joux work out they're not great, security wise?

12:21 PM

@Rhino That one is yet another subject

@ThomasPornin That and the small characteristic fields.

Plain DH in field GF(2^m) was already known to be slightly weak, but Joux showed it is much weaker than previously assumed.

/me goes back to his psychology papers... O_o

I wish I could go back to my psychology papers too.

There again, it does not impact use of GF(2^m) for elliptic curves, except if you try to use these special, "weakened" curves for pairings.

A pairing can turn DH over a curve in a field of size q into plain DH in a field of size q^k for some integer k (called the "embedding degree"). For normal curves, k is astronomically high and there is no issue.

In order to use pairings, some people use special curves where k is very small.

Joux's research shows that this is a bad idea to do that if you use binary fields, because the "weakened curve for pairing" turns into a curve which is too weak.

12:26 PM

@ThomasPornin I see. Ok thanks! When I first read the papers I realized I didn't know enough about EC. A year on I'm realizing it's a massive field... no pun intended.

@Simon for a reevaluation?

pls

Everyone needs to reevaluate at some point, you know.

If not constantly.

As for the logjam, it is unrealistic to believe that sysadmins will try to select their ciphersuites and generate their own DH parameters.

Instead, clients will be patched to simply refuse to use a 512-bit modulus.

And servers will be patched to stop using "export" cipher suites by default.

@ThomasPornin I thought !export was quite normal in TLS configs - I've added it to every one of mine since forever.

Another possible mitigation, which cures the symptom, not the actual issue, is to generate a new DH modulus upon server startup.

@Rhino You added it. Most sysadmins don't know or care enough to change anything to the default config.

12:31 PM

@Simon dude my missus has master's degree in psychology... tell me about it :)

@ThomasPornin True.

@TildalWave Nice! I believe that's what I would have done if I didn't like CS.

@ThomasPornin most sysadmins shouldn't need to care. If most sysadmins need to change the defaults, the defaults are bad.

Are export ciphers still in the defaults for typical web servers‽

I thought that ship had sunk

@Gilles I was hoping most people were copying from here: wiki.mozilla.org/Security/Server_Side_TLS

@TildalWave the one I really like is Troglodytes troglodytes

12:34 PM

or using qualys ssl labs

@Rhino “most people” being web server vendors? Because there's no reason why website administrators would read this page

Install Apache, add your domain name and the path to the files you want to serve

if you need to do more then your vendor hasn't done their job

There is a known protocol flaw in TLS with regards to DHE: there is no method for the client to indicate supported modulus sizes.

That flaw is not new but has lead to some issues. E.g. servers tend not to dare use DH modulus larger than 1024 bits for fear that it would break some clients.

Recent Apache version has finally switched to a larger modulus, but it is known to break Java-based clients (up to and including Java 7, which is pathetic).

@RoryAlsop mine is piri piri (or peri peri), mostly because I have it on my windowsill and it's crazy full of pods already :)

12:59 PM

@TildalWave oooh - that's much more edible than a wren

Lovely, thank you VS 2012! Even though I modified a class, it's like if it would compile the previous version. The solution was to "clean" the project.

Sigh, sigh, sigh.

MY PHP DOESN'T DO THIS

@Simon Precompiled headers. If you're using pch, you need to clean. builds won't rebuild pch.

That's if you're using C++ anyway

Nah, VB.NET.

I did import the file from a previous project, that may have to do with it.

Well, use less shitty build tools then :p

QQ

1:04 PM

@Simon I've not used VB in nearly 15 years, so I have no idea what the latest state of it is.

@Rhino it's good that you can open up about it now... Stay strong!

waiting for the hot question about how to mitigate the latest new vulnerability

@SteveDL make? :P

@SteveDL Well first I went to VB users anonymous. After they decided to add VB to .net I was like... man this is ruining my life. So I worked through my problems and got a lot of support, particularly during those hard times I had to work on VBA macros in summer jobs. But, I made it. I've been VB-free for a long time now and never felt better!

3

@TerryChia some IDEs like QtCreator have ways to tell when they need to re qmake

I expect autotools can deal with this kind of situations in C projects, too

@Rhino is your hair more shiny and are your teeth stronger, and do you sleep better now that you've moved on!?

Did it bring back your loved ones?

1:10 PM

@SteveDL autotools can do a lot of things. That doesn't make it not a shitty build tool. :D

@TerryChia unfortunately I have to agree on this one...

@SteveDL Yes definitely. I have the occasional nightmare about whether I should use "option explicit" and whether arguments need a "ByRef" prefix but aside from that, I find myself starting each day like it was my last!

Still haven't figured how to configure glibc without disabling all the silly checks...

@SteveDL Honestly I have not seen a build tool that does not suck in one way or another.

@Rhino You're a courageous man.

1:12 PM

@Simon Well, actually a Rhino.

yup...

they should hire HCI people to design build tools :D

@Rhino On the Internet, nobody knows that you're a rhino.

@Simon But it says so in my username and picture. Are you implying content on the internet is inaccurate?

Please tell me no! I learnt everything I know from the internet.

@Rhino Want some proof? Personally, I've learned that the past tense of learn is "learned" on the Internet.

@SteveDL I like to do my bit to help other poor souls who are having trouble with VB, y'know. I mean I'm not special, not a role model or anything, just some guy who learnt to program with VB and overcame those odds.

1:21 PM

@TerryChia ONE WAY OR ANOTHER

I mean, everyone has their moment of weakness where they just want to drag and drop UI components in RAD fashion.

@Simon learnt is English English past tense.

@Rhino Personally, I'm a big fan of Dreamweaver.

I'M KIDDING, EVEN I WOULDN'T USE DREAMWEAVER

Alright, alright, I'm sorry. I didn't mean to kill the chat.

1:42 PM

GAWD SIMON

soz

2:05 PM

@Simon is it even still a thing?

@RoryAlsop No idea, let's hope not!

Oh lawd, Adobe owns it now.

@Simon still charges for more than 4000 I guess?

@M'vy Probably, what a piece of crap.

2:21 PM

Mmh... nobody is rushing to stackexchange.SE to ask about Logjam

Either the news have not circulated enough, or people are just fed up with SSL, or (worryingly) sec.SE is no longer considered the right place to panic about vulnerabilities.

Nah we all got bit by a VIPER and we haven't realised we are dead yet… And our immortal souls live on in StackChat

@ThomasPornin I could go and ask a question, but it would lack any and all research. It would basically be "I heard there is a new TLS vulnerability named Logjam, what does it do and how do I prevent it?"

As in: that would literrally be the question body.

@ThomasPornin It's almost summer, people are less attracted to drama right now.

2:39 PM

@Arperum I heard there is a new TLS vulnerability named Logjam, is my log house vulnerable? Hasn't been patched in 20 years.

@Simon Ain't no vulns on the beach!

@SteveDL *that would be flat out trolling, mine is just being a dumb unknowing idiot.

@SteveDL Your mom got patched by a log jam

@raz Exactly.

@raz dayum

2:51 PM

chat bombs

:'(

http://security.stackexchange.com/questions/89642/web-developers-responsibility-for-ddos?noredirect=1

Hmm this thread... people speaking about legal responsibilities with no clue and no reference to law books or court decisions

Looks like you were the final decision needed to put it on hold.

It's off topic, but the advice isn't wrong.

yup, though my decision is "opinion-based"

@raz it really depends on what contract you sign and where

2:59 PM

@SteveDL I believe I marked opinion-based as well. They just take the majority as the reason.

if there is a glaring fault in your software and that makes a DDoS very practical (to the point of reducing the efficiency of hosters' DDoS protections) you could be liable to repair if you haven't taken reasonable precautions to limit the risk during development

@SteveDL You can always downvote. I'm actually surprised that it got 42 votes.

Like inserting strings with almost no maximum size constantly.

I'm still trying to figure out the issue with this guy. His english isn't so great, so it's tough to determine his problem.

-2

Q: Connecting to SSL server with openSSL client

I am trying to establish SSL server connection. I just want to understand what are all the parameters i should make sure for proper connection establishment. From server side they give certificate file : "foo.crt". Since , I am using OpenSSL I just rename the file to PEM format : "FOO.PEM" In E...

tls openssl server client-side

Limit your varchars, kids!

3:04 PM

varchar... isn't that a database thing

@raz me too... a lot of the voters vote for what looks like a correct / complete answer rather than what actually is correct

@SteveDL The answer's not wrong, it's just not complete

@Arperum I think it would be a good idea to ask that question, yes.

So that I may push an answer right away.

@raz as far as I'm concerned it lulls OP into not caring about doing her job right

in most cases that won't be a problem. In some contexts (critical-safety systems, contracts with liability for preventable errors) it might be

I don't know anything about the exact legal obligations of OP, so I don't answer "oh, you'll be fine". I tell OP to talk to lawyers :-)

@ThomasPornin I'll ask it, but be aware that it'll be a very basic question (as said before, I have a pretty extreme lack of knowledge on the area)

3:14 PM

@ThomasPornin does it for the reps

@raz Some say he's the whore kind of rep gainer.

@Arperum Basic questions are not an issue; basic answers may be, though.

@ThomasPornin That's why I'm not answering anything on sec.SE

I'd prefer the first answer on the site not to be of the OMG-the-NSA-can-decrypt-everything kind, which is why I'll do it myself.

@Arperum Oh come on, if I can do it once in a while, you can do it too.

3:16 PM

You just have to be thorough, it's really not that bad.

This question has me confused

0

Q: Best Cipher for Client Application to Web Server

I am making a Application that requires a login. I'm using a HTTP Server for accounts. My question is, what is the best Encryption/Hashing/Cipher to use in this case ? I know that SSL/TLS won't cut it, as they are pretty weak on their own. What's the best to use ? I use C# (Client) and PHP (WebSe...

encryption .net

@ThomasPornin Question will be up in a bit, I want to add something more to it than just that one sentence but I'm strugling with wording my thoughts.

@Arperum I'd prefer you do not wait for too long because I'll go for dinner in 30 minutes or so.

@Arperum Ask the question!

@ThomasPornin I'll post it in 5-10 minutes. Just busy smacking my brain for a bit.

@ThomasPornin It's called lunch you donut.

3:20 PM

@Simon I eat dinner as I see fit !

Fine.

fuckit, posted as is. brain is down after a day of fixing mindnumbingly stupidities.

Bears eat meals, they don't make yuppy distinctions in name conventions.

1

Q: What is Logjam and how do I prevent it?

I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?

OMG I'M VULNERABLE TO LOGJAM RUNS AROUND SCREAMING

3:23 PM

Is my iPod shuffle vulnerable to Logjam?

@Simon More importantly: is your donut vulnerable to Logjam?

@Arperum IS SHE?

@Simon I don't know.

Hopefully, Pornin will let us know if she is or not.

Also, Chrome hasn't rolled out a fix yet. Since I just updated and I'm still vulnerable

3:30 PM

ehn, I just uni-laterally disabled DH in favour of elliptic curve DH.

Also took the opportunity to put AES-128-GCM as the preferred mode because I likes me some tiny improvement in performance.

@Tinned_Tuna No, no, no. Stop it. We were having a nice non-technical conversation that I was able to understand.

@raz that question is quite bizarre

@Tinned_Tuna which question?

0

Q: Best Cipher for Client Application to Web Server

I am making a Application that requires a login. I'm using a HTTP Server for accounts. My question is, what is the best Encryption/Hashing/Cipher to use in this case ? I know that SSL/TLS won't cut it, as they are pretty weak on their own. What's the best to use ? I use C# (Client) and PHP (WebSe...

encryption .net

> SSL/TLS won't cut it

haha

nope

3:35 PM

Wooo! Enough rep to downvote! FEAR MY POWER!

I mean, I know it's pretty bad, but I doubt that the (in)security of TLS is a serious threat, as opposed to say, the developer themselves.

Also that Logjam vulnerability basically depends upon keeping the handshake open for 90 seconds.

BTW: new user profiles?? have we been forgotten?

@M'vy We're always forgotten

Also, whoever thought that TLS False Start would be a good idea?

The link you've provided is a pretty complete answer to your question, including the "What should I do?" section. — gowenfawr 1 min ago

He's trying to stop us from having fun!

@ThomasPornin You're so slow that @Polynomial posted an answer before you.

3:47 PM

@raz They're trying to get to 0-RTT in terms of TLS handshakes. In theory it isn't a bad idea - if you want to serve lots of images on a https cdn, for example, you want minimal round trips to the server. Right now, it takes 2 just to get talking.

That's before you've sent any data. HTTP/2 will help this in some respects, by allowing multiplexing of the connection.

So session establishment needs to only happen once and you can request multiple http resources.

But essentially they want to minimize the cost of establishing a session in tls.

ietf.org/mail-archive/web/tls/current/msg14645.html and others

@Arperum My answer is up: security.stackexchange.com/a/89702/655

perhaps I shouldn't have said session establishment. 0-RTT allows you to start sending encrypted records straight away, but doesn't necessarily mean the session will be established.

the idea being if the connection does get set up, damn that was fast

damn beaten by a few minutes security.stackexchange.com/questions/89690/…

@SteveDL I feel like there are too many bolded parts in your answer here: security.stackexchange.com/questions/89605/…

@Simon allows for quick reading.. better?

3:57 PM

Yes, it's a tad less clustered now.

IM VERY HAPPY TO READ THIS YOU DONUT

oh you le didn't**!!!!!**

Oh come on, it was bolded for a sec and then it de-bolded (did anyone ever use the word "de-bolded" before me?)

your last partner?

jajaja

wat

I'm sorry everyone, I think I broke @SteveDL.

starts grazing his office carpet

4:05 PM

I had to translate the word "grazing".

What really?

Are you a frog-speaker, @Simon?

Is that a word that is indispensable to someone's vocabulary?

YES I AM.

@SteveDL what's a frog-speaker?

C'est comme un rosbif?

lulz

Non, un rosbif c'est un rosbif, un frog c'est une grenouille.

@Rhino though yeah, a frog eater or speaker of froglang would be the reverse of a rosbif in French

4:10 PM

"speaker of frogland", haha.

in US english, capitulating monkey Q.Q

@SteveDL Bah mais écoute un rosbif c'est un plat supérieur. On n'est pas censé de manger les grenouilles :)

Why not?

@SteveDL Yes. I have introduced myself as a rosbif once or twice, quite funny.

And what's next, we shouldn't be eating snails?

4:14 PM

@Simon Exactly. Stop it, it's not even remotely tasty. Please keep making bread and wine though.

I LIVE IN QUÉBEC

WE'RE NOT THE STEREOTYPE

@Simon Nor are most French people but that doesn't mean we can't go in for a bit of stereotyping, just for fun.

o

@Rhino rosbif literally means roasted beef, which apparently was used to make fun of the fact that Brits overcooked their meats.

so I wouldn't call it a superior dish, hehe :P

@SteveDL I heard it was to do with sunburnt holiday makers also - we turn up on your nice beaches in provence and turn red... like rosbif

4:17 PM

Frog's actually like dry chicken. Would try again in a proper restaurant though, might've just been poorly cooked.

@SteveDL You are allowed to put meat in the oven for longer than 20 seconds y'know ;)

In France I ask for my meat burnt. If they ask what I mean, I say "well done, then keep going for a bit"

@Rhino had a Wellington recently, the middle of the meat was quite chewy and I was surprised as to why. I've ended up reading rants from chefs or culinary critics about how rare meat is a new thing in the UK and some chefs might not yet have mastered it (and also many places refuse to serve rare meat still)

@SteveDL Your answer was better

Buying rep 10$ per 1k.

Also I LOVE pluma iberica, which is essentially medium-rare iberian pork loin

@raz agreed :p

Dunno which, but agreed :D

@Rhino you're not in London are you?

4:21 PM

@SteveDL Nope sorry. Not at the moment. I may end up back in the UK soon and if so can head over to London. Right now I'm in Lausanne, CH.

Oh right

Dont know why I thought you were there. Was gonna give you addresses for proper rare meat :D

Confusing the locals who all think I'm German.

ich spreche kein deutsch

Nor do I, which is even funnier, but CH has four national languages and people move around a bit and usually speak one or two of them. I heard someone shopping the other day ordering something in French then turn around and tell their kids off in German.

But people don't immediately work out I'm English, unless I tell them.

Or I'm with English people.

Missing a Brit speaking French? How do you blend in? Do you swear a lot?

4:26 PM

"Sacre bleu de donut!"

@SteveDL They usually figure out I'm a foreigner if we have an in depth conversation, just not necessarily that I'm British. I'm told I have a "little accent" but not much more than that.

I also might run out of vocab in the wrong context. Like the other day I tried to discuss greyhounds with a lady in the park and realized school doesn't prepare you for that...

actually, school didn't really help with any of my french, but there you are.

@SteveDL I've become acquainted with the swearwords, but that's an interesting story in itself. I picked up a DVD I thought was VO, but was actually VF, so I figured what the hell, immersion totale right? So I watched it and the first half an hour taught me a whole bunch of ways to be really offensive in French.

@SteveDL Also I stand out more in summer because I swear sandals and shorts like I'm a Brit on holiday.

@Rhino I can sympathize with that. I still make mistakes and forget words after over 10 years of English...

Also yay for swear words! Important part of the language :D

@Rhino we have a Californian colleague... he wears sandals in London all winter...

@SteveDL That's the spirit!

That'd be me but they have actual snow here that would cause the UK to explode in a fit of closed roads and cancelled trains.

@SteveDL Yes. My gf jokes that level A1 of language learning is knowing how to swear. Then A2 is basic vocab and verbs...

@SteveDL In the UK I was in the Manchester area but I have family and friends all over the UK, London included and I've lived all over too.

4:52 PM

I wear shorts all the time except when I have to wear a suit. And that's in Scotland. London is always too hot for me

@Rhino fair enough :-)

@RoryAlsop how do you travel past Belgium? It's going to be like hell for you :P

GO. TO. SPAIN.

:D

Come on dude, don't use gotos.

Not this again.

Where's Tigger? We need to argue about tabs and spaces.

4:57 PM

Tabs are just faster.

tabs are space macros

pls

I wasn't actually serious. Please stop!

1

Q: Do I need to upgrade damage/armor on my old gear before I can Ascend it?

Since House of Wolves came out, it seems the need for (and provisioning of) Ascendant materials is all but removed. All of the Legendary equipment I see on offering from the various class and faction vendors don't have the multi-step Damage and Defense upgrades which would normally require those...

destiny house-of-wolves

Look at this nurd posting nurdy questions on a nurd SE.

@Iszi nurd

that game looks cool D:

5:17 PM

And I siesta

I am going to Spain in a few weeks. Right down near Gibraltar. I just wear sandals and shorts.

For two weeks

Dubai and Vegas have caused me the greatest problems so far. At 50 degrees centigrade I fail

Completely

@schroeder Tabs are polymorphic space macros.

@ThomasPornin I stand corrected!

@SteveDL re: security.stackexchange.com/questions/89642/… in reading your comments, you appear to be using circular logic

no one brought up legal issues, but you are arguing that they are, then shooting down their defence because they are not lawyers

it's all very confusing to me

5:34 PM

@Rhino The Tigger is in Amsterdam at the moment

so I'd expect @Simon to take advantage of his absence by #YOLO'ing up the place!

@RоryMcCune What's he doing there? Being hipster?

@Rhino Actually limited hipsterism he, like I, am at OWASP AppSecEU

along with @Adi

@RоryMcCune ah I see

Oooh TI put out a new USB C interface chip. I can't wait until I can use Type C connectors :D

ti.com/product/HD3SS460

user image

Oooh and you can by Type C connectors on DigiKey! digikey.com/product-detail/en/898-43-024-90-310000/ED1391CT-ND/…

Ouch, $4.69 each though

@schroeder because that's what the word responsibility means?

@schroeder OP is asking what they can be held responsible for, responsibility between two parties is enforced by contracts and courts

5:45 PM

@RоryMcCune - not jealous at all....

@DavidFreitag just do what I do - contact bulk sellers on Alibaba and ask for free samples: alibaba.com/product-detail/…

@DavidFreitag for low-volume (e.g. 5 units) it's ridiculous to pay $25 for something that's sold at a profit for $0.10 per unit in bulk.

@RоryMcCune I'm not feeling it yet, man. It's still not time for a comeback.

@Simon yeah well you know, it's important for you to maintain your artistic integrity !

@Polynomial I don't want to wait a month for my connectors to get here

@DavidFreitag last samples I got were 5-day airmailed for £6.

5:58 PM

@Polynomial I take it you live in europe? All shipments from china to the US are on a boat.

@DavidFreitag UK, but that's not true at all - I know plenty of folks in the US who get airmailed boards from Chinese fabrication houses.

Every time I have tried to get an air-mail envelope it has been nearly $30 for shipping.

Ah - you're just saying it's expensive.

Ok. Yeah, it may be.

« first day (1616 days earlier) ← previous day next day → last day (3269 days later) »

Transcript for

May '1520

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile