« first day (1638 days earlier)      last day (3540 days later) » 
00:00 - 17:0017:00 - 22:00

00:33
Tearing it up. Two answers and two comments in the past 30 minutes. That's more than I've done in the last two months. Go me.
 
1 hour later…
01:59
@Xander for the next bear!
 
5 hours later…
07:11
morning!
 
2 hours later…
08:46
Good morning
I have a question for you.
shoot
Is it on-topic here to ask if a certain (bad-homemade) hash is reasonably working as expected?
I have this hash function I made in Javascript.
But, if the hash function is decent, I was thinking about rewritting it in C
It is for a code-golf challenge, which required that I hashed over 170000 bytes in less than 1 second
But, it's performance is awful (30s on an I7)
Here, I would think that you will most likely be pointed towards posts similar to this : security.stackexchange.com/questions/25585/…
If you wan't to know if it actually works, crypto.SE may be the place
Also if you say that, you should point out that the hash is not meant for passwords, as those should be slow.
The hash is meant for numbers
So, I was relaxed on it
All I wanted to know is if it hashed decently to be worth re-writting in C or not
(I know that home-made hashes are a huge NOPE, but that is partially the requirement of the challenge)
according to crypto.SE

Do we accept questions asking for cryptanalysis of your cipher (hash function, ...) design?

No, we do not. If you want peer review of your full cryptographic scheme, here is not the place to acquire it. However, you might like to break your problem down into specifics, such as "under these conditions, does structure X have desired security property Y?" which would be a perfect fit for us.
Maybe codereview.SE

If you are looking for feedback on a specific working piece of code from your project in the following areas…

Best practices and design pattern usage
Security issues
Performance
Correctness in unanticipated cases
08:55
I can't post it on code review.
@IsmaelMiguel simple answer, it is not. As @Morgoroth, you never roll your own.
@IsmaelMiguel answer: no. use an existing one.
@IsmaelMiguel the challenge requires you to do bad things?
@Morgoroth doubtful you would get any intelligent information relevant to security or crypto... .
It's codegolfing!
@AviD we want doughnut-crypto
@M'vy ymean crypdonutgraphy
@AviD I dan't knah da pretty names
09:10
@IsmaelMiguel ah. so it is specifically about creating hash code.
@AviD Exactly!
hmm. I knew there was a reason I dont hang out on codegolf ;-)
I could implement SHA1, but I don't felt it.
this is simply brilliant. I really dont think its a parody.
What's a JPD?
09:15
does it matter?
police department of some city that starts with J, I guess
Jackson, Mississippi
@IsmaelMiguel Properly analyzing a primitive requires person-years by expert cryptographers, who'd publish their results as a peer reviewed paper, not on some forum. That's why we don't allow it on crypto.se.
@CodesInChaos I don't want a full over-kill review, just a simple "Yes, it looks ok" or "NOPE, BURN IT WITH FIRE BEFORE IT LAYS EGGS!!!" will be perfect.
@IsmaelMiguel I think the clear answer is "NOPE, BURN IT WITH FIRE BEFORE IT LAYS EGGS!!!" except that its clear that your algorithm is impotent.
(sorry, too snarky? ;-) )
@AviD Well, you haven't looked at it, so, yes it is a bit sneaky
@IsmaelMiguel hey dont worry about it, it all goes back to the "creating your own algorithm". as you say, I havent even looked at the specific one.
09:23
I know that for general-public usability or for a secure environment, a home-made hash function is the worst
okay! I guess I'll lay off then ;-)
Is it about that question:
32
Q: Cryptographic hash golf

Dennis This contest is over. Due to the nature of cops-and-robbers challenges, the cops challenge becomes a lot easier when the interest in the associated robbers challenge has diminished. Therefore, while you can still post hash functions, your answer will not get accepted or form part of the l...

@CodesInChaos Yes, I already posted a link a while ago
The answer is deleted for being too slow
@AviD I understand what you are trying to do, but for that function, I don't care about any attack. Just if 1 and 2 produce the same hash.
@IsmaelMiguel if you're looking for experience on implementing hashes, you could do a JavaScript implementation of Makwa bolet.org/makwa
@IsmaelMiguel ok, cool cool. just consider this your welcome to the DMZ - initiation by fire ;-)
09:27
@AviD Meh, I had it worst on 1st grade
heh. yeah we take our dave rule very seriously here.
not much else, though.
@AviD well doughnuts, and bears
@RоryMcCune Thanks for the idea, I'll see what I can do with it. I hope I can make something decent out of it, in less than 300 bytes.
@IsmaelMiguel the advantage of doing that one is that the inventor hangs out here, so easy to ask questions :)
@AviD Dave rule?
09:30
@Ohnana When are you in Belgium? I might see if I have some time to meet up.
29
A: The Memes of Information Security

Rory AlsopMeme: Don't be a Dave! Originator: @Polynomial, @LucasKauffman, others Cultural Height: December 2012 Background: One of our most popular questions of all time, with over 17 thousand views in the space of 3 weeks, had as its subject poor old Dave: My developer, let's call him 'Dave', insis...

@RоryMcCune Well, if it is you, do you know if the output is within 2^128 bits of length?
@RоryMcCune oh youre faster than me, just pulled that up
@IsmaelMiguel from that homebrew question that @Morgoroth linked earlier
@IsmaelMiguel oh nono not me, that's not my speed at all you want @ThomasPornin for that kind of stuff :)
@AviD I still don't get it... I'm slow-ish today.
09:33
@IsmaelMiguel Just like your implementation thing!
oh snap
@RоryMcCune He probably will read this later and say something
@Arperum The idea of the "thing" was a bad one.
If you are interested, here is the code:

`for(I=prompt(N=[[7,9,3,7,3,9,9,0,9],[1,3,5,7,9,1,3,5,7],[3,5,1,9,1,9,0,7,9],[1,1,4,1,8,5,2,9,7]],i=1025);i--;)for(j=I.length;j--;){c=I.charCodeAt(j);N[p=(i/c)&3][0]=((c^128)&4)+N[N[p][2]&3][c%9];N[p][1]=((c/N[p][0])+2)^N[p][1]+c;N[p][2]=(N[c%9]&c|N[p][1])>>(c%3);N[p][3]=(N[p][0]&N[p][1]^N[p][2]/N[p][3])>>1;N[p][4]+=(N[p][3]/c)&N[p][1];N[p][5]=~((~N[p][3])&N[p][4]);N[p][6]-=N[p][6]|((Math.PI*1e9)%Math.abs(N[p][5]));N[p][7]=N[p][4*(c%3)]+33&c-N[p][7];}for(i=8,R='';i--;R+=((N[0][i]+N[1][i]+N[2][i]+N[3][i])&255).toString(16).replace(/(.)(.)?/,function(
@IsmaelMiguel that.... is not pretty. not the ugliest code I've ever seen, by far, but not pretty.
So, like, it's kinda like the @Simon's mom of code.
@IsmaelMiguel pastebin? gist?
@AviD I've seen worst too. An Heredoc within a string with an Heredoc inside, in PHP.
09:46
dont know what heredoc is, but you said PHP, so nuff said.
also, is heredoc pronounced like heretic?
@IsmaelMiguel I was hoping some carriage return there, but nwm
@M'vy extra points for obfuscation, natch
@M'vy I haven't rewritten it in pretty code since it is meant to be for a codegolf challenge. Which means: eat up as much bytes as possible, in the nastiest ways.
09:49
ok
You can tyr running it using your browser console.
I don't recomment inputs bigger than 400 bytes.
10:10
*try
@AviD codegolf is scored by code length
@CodesInChaos yeah, I get that.
1 hour ago, by AviD
hmm. I knew there was a reason I dont hang out on codegolf ;-)
You should hang on codegolf.
It doesn't look like good crypto code, regardless of formatting.
Sometimes, you get interesting challenges
@CodesInChaos That's because the only concern I had was colligions and nothing else (birthday attacks and all that)
10:31
Would the question be acceptable if it said something such as "What should I include in a VAPT"?
@SteveDL I think so.
Unless it's a duplicate.
hm#
i'll rework it. I think there's a good question behind that very lazy "pls do my homework" one
or actually i'll ask one myself
bah, tons of questions
10:51
For those who were here earlier, if you want, here's the 'glittered' version: pastebin.com/MpgK8Nys
It's the same poop, but better looking.
11:15
that infosec meme list is pretty cool
But it's missing donuts
@SteveDL donuts is not an infosec meme, it is universal
some say, the very universe itself.
oic
pls
The universe is a disk
not a donut
but it is said by some that the elephants and the turtle hold a donut in their mouth
adding to the overall confusion
@SteveDL there are some theories that space itself has a donut like shape, with the very force of gravity effecting the donut hole.
so not the overall physical shape, but the very cosmic building blocks themselves.
I see
@AviD a universal mis-spelling!
11:23
@RоryMcCune the universe prefers the canonical donut spelling
@AviD the universe prefers the mis-spelling born of US'ians inability to deal with non-phonetic spelling....
@RоryMcCune DOUGHNUTS IS NOT DONUTS
@AviD sez you
different spelling to differentiate different, though similar, products
deauneutes
raz
raz
11:28
I love this
0
Q: Is there a way I can search URL's on google/bing verbatim with dots?

Kit SundeI'm trying to do some security related research with google but it filters out . and fuzzy matches across the whole page? Is there search engine that will let me do exact in-url matching? I realize this isn't strictly speaking an infosec question, but a tooling question so I hope it's okay.

"I'm doing security related searches, so this question is on topic right?"
I upvoted it
and even made fake accounts to upvote further
I will reorient my PhD towards this brilliant question.
Can we have a "offtopic" tag for stuff that is on hold until deletion, to prevent such people from polluting real tags?
raz
raz
@SteveDL Oh, I kinda like that idea.
@raz WHY DID SOMEONE ANSWER HIS QUESTION?
raz
raz
@Simon Well look who answered it...
The dude of all dudes.
11:37
@raz thats like those classic "as a programmer" q's on SO
"As a programmer, which boat is best?"
raz
raz
The Colossus of Bros
@AviD hahahaha
@raz you know that was a real question
well, very similar.
raz
raz
Oh I don't doubt it.
it was "what do I need to be able to program on my boat"
Am I allowed to shit on LvB in the comments?
raz
raz
11:38
@AviD You need a boat
it was the source of the "boat programming" meme. really, look it up, it was awesome.
@raz surely the colossus of bros is Bob Yoloington from Arqade?
@Simon no idea who that is
@RоryMcCune What a man.
raz
raz
@RоryMcCune Yeah I don't know who that is.
11:39
@Simon the man... the legend
@AviD The dude who answered this gem: security.stackexchange.com/questions/91374/…
GOOD MIGRATION OVID
raz
raz
@RоryMcCune hahahaha oh the quickscope guy
@Simon duh yes I know, but I'd never noticed him before
raz
raz
11:41
@AviD he had a different name
Probably something like Turtle123
raz
raz
L<something> van Br<something>
Lanister van Brazil
@raz nope, still not familiar
raz
raz
I can't remember what it was, but he kept answering questions with comments
And the comments were even wrong
I'm not sure how he got the 2k rep he has
11:42
The Dutch are usually knowledgeable, I don't know what's up with this guy.
@Simon The DMZ is usually friendly, I don't know what's up with all the noob bashing today.
wait, what did I just say?? Nevermind.
wat
Do you live under a rock under the sea with @DavidFreitag?!?
raz
raz
@AviD You haven't seen what I've seen man
PATRICK?
Seriously though, you guys are totally being dickishly cliqueish.
11:46
Obviously, this is the first time that you've seen this user.
raz
raz
@AviD Not really, the guy constantly answers with 3 sentences.
^
What a sucky mod you are ovid.
You don't even know your user base.
raz
raz
Gotta come out from under that rock
UNDA DA C
@Simon he's out of touch and should obviously be overthrown by a younger mod...
11:47
@RоryMcCune Definitely.
raz
raz
Lets commence voting
Can I downvote someone?
raz
raz
No that's not how democracies work.
Damn it!
@RоryMcCune am I about to be poisoned or stabbed at my own wedding?
11:50
apt is downloading a Chrome update at less than 30 kB/s
Good guy apt.
raz
raz
That's not apt's fault. Have a less crappy connection
@AviD phhbt you wish you could get poisoned by that sand snake girly
@raz stop picking on his girlfriend
goes to speedtest.net
@RоryMcCune the most beautiful girl in the world?
yeah she seemed nice.
11:52
@AviD the very one
I got 113 Mbps down/18 Mbps up.
I THINK I'M DOING FINE.
@Simon ShutUpShutUpShutUpShutUpShutUpShutUpShutUpShutUpShutUpShutUp
:D
@AviD aaand the actress who plays her was born in 1996
@RоryMcCune I wasn't even born in... Wait, I was!
11:53
@RоryMcCune that's... inappropriate.
@AviD yes, yes it is
she was still in diapers when I was married.
@AviD I was working in an office before she was born
dayum
and then they go and nudify her. I feel like a pedobear right now.
3
12:00
And on this bombshell.
12:11
I think she is too young to be called a bombshell.
although she was trying to seduce a guy well older than even me...
also @RоryMcCune, just realized she is not even 20 yet. :-/
@AviD that whole youth thing.. bit of a surprise eh!
20 is young but wait until she gets to 24, she'll start to feel super old.
I remember when I was 20, I was young, in a shitty relationship and still at school.
Now I'm old as fuck, in a good relationship and doing le work-
Are you Merlin? Or why do you remember an age you didn't reach yet?
o soz I'm 12.
@Simon hey cmon, she's listening!
12:16
wat
@CodesInChaos maybe he's benjamin buttons.
@JeffFerland Ha ha. If only.
 
1 hour later…
13:30
6
Q: Why do we keep our keys secret, rather than our algorithms?

Mr SirOn almost any website that relates information about cryptography in general there is this common notion that almost all encryption/decryption algorithms should use a key as one of their inputs. The reason behind this is that encryption algorithms that don't use a key are technically useless. B...

^^ Surely this is a dupe several times over?
I'm not a regular on this site, but I know that this question comes up all the time in security discussions.
And I'm pretty sure I've seen it here before.
TRiG yes it is a duplicate but I couldnt find the previous instance
started a duplicate vote on the original question: security.stackexchange.com/questions/24449/…
(s/on/to make @TRiG's point towards/)
guize i got a jerb
@Arperum i'll be in brugges on the 19th, and the next day I'm flying out of brussel. this is a pretty rapid fire trip so idk if we'll be able to intersect
@Ohnana I am assuming not, because that weekend I am at Graspop on what is basically the other side of Belgium.
sweet
i'll have a waffle in your memory
@Ohnana SOunds fair.
13:43
@Ohnana erhh meh gerrd, what ya doin'?
@RоryMcCune security consulting
@Ohnana coolio :) what sort? Testing or more InfoSec'y stuff?
i'm currently trying to figure out if they have an anti-discrimination policy for trans people because i want this shit to go smoothly
@RоryMcCune both, people call them in for testing and auditing
@Ohnana nice, sounds like a good opportunity!
i'm so excited, it pays well and i'll get so much experience
+10 perma buff to resume
13:45
@TRiG actually, it never does come up in intelligent security discussions.
@Ohnana heh indeed experience is a good thing!
it only comes up often with clueless developers who think they are the first ones to think of making round wheels.
@Ohnana Are you in the process of doing it?
@AviD Well, yes. I'm not a security person myself, but I know that much. (I am also reasonably aware of my own ignorance, so I'm unlikely to try to invent a home-brew algorithm myself.)
@Simon as soon as I'm off the waiting list for the clinic, things should start rolling
13:47
@Ohnana congrats! good luck, enjoy!
@Ohnana Nice. How much is it gonna cost?
the job starts three months from now because it matches my school schedule
@Simon that's a good fucking question that I'll be posing to my health insurance
@Ohnana I hope they'll be paying a big chunk of it.
@Simon me too. testosterone ciprate seems to be approximately 40/mo. but the blood tests are going to be killer, and so is the counseling because my behavioral health plan sucks
@Ohnana Damn, sounds like a lot of trouble but I'm sure it'll be worth it.
13:52
@Simon you could say that about a lot of things
True.
14:03
@Ohnana Friend of mine has been transitioning recently, but he's in The Netherlands, which has a pretty good record on this kind of stuff.
@TRiG yeah some european countries seem to be nicer than others
14:44
@JeffFerland How's the startup going?
@Simon Pretty good. My worst complaint is a train commute and that's not really that bad. Working on fun stuff that isn't totally isolated to FB, working with lots of people I like.
@JeffFerland You're no longer at big bad?
@JeffFerland Sounds nice.
@CodesInChaos Nope. Departed in February.
@CodesInChaos Why do you think I was no longer asking if he needed a janitor? Keep track you donut.
14:53
Still trying to hire like crazy, just like everybody else in the Bay Area :-/
I can be the official immigrant of the startup if you like.
"startup" ... "working with lots of people"
sounds more like startedup.
pls
@CodesInChaos Guess it depends on where you draw the line. Series B funding, but with a full product and about 14 engineers right now. Introverted me considers that a full deck of cards.
Tim Post on June 11, 2015

Some time ago, we hired a Russian-speaking Community Manager named Nicolas Chabanovsky. He works remotely from St. Petersburg (we’re pretty sure it’s the one in Russia). In the past Nicolas was a software developer, and participated in the development of DLNA-stack at Motorola, webOS at LG Electronics and many other notable projects. What we found the most interesting about Nick is he’s one of the founders of the most advanced clones of Stack Exchange we’ve ever seen, which was ХэшКод, otherwise known as HashCode. …

15:01
How about you welcome our god damn new profile instead you silly donut?
raz
raz
^^
@Simon I still see the old profile on sec.se
raz
raz
Exactly @CodesInChaos
Not a fan of the new one
@CodesInChaos We all do sir, we all do.
15:02
Be happy, you weren't downgraded yet.
raz
raz
I like the new profile.
But it shows how many people we've touched without having to rely on @Adi!
@StackExchange gib new profile :U
raz
raz
gib?
yeah, gieb.
raz
raz
15:03
We could do a kickstarter for it.
Maybe that would help
@raz GIB
anyways i have to go to an interview in 93F weather, peace out
@Stackexchange behalt new profile :U
raz
raz
@Ohnana Have fun
@Ohnana babai
raz
raz
I still don't know GIB
15:05
It's a troll way to say "give".
15:16
@Simon Did you just call Germans trolls?
Oh lawd, I absolutely didn't know that is "give" in German.
But whatevs, I'll stick to what I just said, it's the troll way to say give.
Silly Germans.
emergency question: how do you kill all other logged in gmail sessions?
a buddy of mine is having his account actively misused right now, cant figure out how to kick the other guy out
Change password?
nver mind, found it
15:30
@Simon no, that doesnt kill already-logged in sessions
@Simon arsehole
HAHAHAHAHA
YOU GOT ME YOU DONUT
God damn it.
@Simon no, YOU got me.
ah crisis averted.
What?!?
was actually funny....
Did mine log you out?
It was the link from the "details" at the bottom -.-
15:43
so I get a phishy email from an old friend of mine, obvious spam / phishing / virus attempt, with a link to some malware in the guise of dropbox. So I email him back, to let him know about it... and the douchebag hax0r replies to me, to say its an important file! such nerve, actually amusing.
@Simon ohhh okay - must be some kind of token unique to each account, so my link logged you out, yours logged me out....
@AviD Eye for an eye, tooth for a tooth I guess.
heh, except that it wasnt on purpose.
16:01
You mean you unlogged him by clicking he link the sent?
@M'vy same type of link, which is obviously subtly different.
but dont click his link! that will log you out. my link should be fine, though. go ahead and click it.
yeah sure.
h-eh.
Hahaha.
I don't have my personal password manager on my work PC so I had to open it through my phone and type it like a damn donut.
hahahahahaha
now THAT is funny
why isnt your password stored in your browser?
you silly donut.
16:07
Because I don't trust my browser.
why dont you switch to a good browser, then?
you silly donut.
lulz
I'm using Chrome.
ah, I assumed firefoz.
heh. firefuzz.
16:22
mornin
raz
raz
-2
Q: how to make $3500 per a day with free software..DOWNLOAD IT NOW FOR FREE?

paypal moneyGuyz checkout what people are saying on my Blogger about free paypal money hack http://tinyurl.com/q7p8w6e how to make $3500 per a day with free software..DOWNLOAD IT NOW FOR FREE https://lnkd.in/dC_4h99

Free flags
In b4 the modz
Nice "screenshot"
Also, it is very hard to alter the html to display the amount, right?
@Simon Meh. Just Photochop it.
Much simpler to edit the client than photoshopping lulz.
16:28
"Unlimited free Paypal money on your Paypal account." -- sounds legit.
I'm not sure I like what the new profile format on SO has to say about that guy. Sounds a little threatening.
raz
raz
Lets see what it says on Sec.SE
OH WAIT
We can't
Whoah. Locked/Deleted by Community! Mods couldn't even touch it!
raz
raz
@Iszi What was?
@raz The spam Q.
raz
raz
16:32
@Iszi Oh damn that was fast
Too bad they're not that fast implementing the new profile on InfoSec
2
I flagged it and then immediately it redirected me to 404.
I guess I was the final blow.
@raz lulz
raz
raz
@Simon Your mom gives a good final blow
@Simon Your mom's the final blow.
Damn. Ninja'd.
raz
raz
hahaha man sandwiched @Simon like we did to his mom last night
2
AMIRIGHT
o pls all
16:35
@raz I don't think we want @Simon to have anything to do with what we did to his mom last night. Ew.
all
raz
raz
all?
pls
@Simon That's what your mom kept saying last night. Usually preceded by "more".
lsp
16:42
@Simon And that's what she had after we were done, since she'd been worked so hard.
rfsfdsf
@Simon Oh, you don't want to know about that.
@@@@@@@@
@raz - You're up.
Adi
Adi
@Simon :(
There will be new features at some point in the future, and you'll rely on me to crunch the numbers again
16:49
@Adi Hey, we can't bother you every time that we know how many people we've touched!
@Adi True, true.
Adi
Adi
@Simon Have I told you how many people you've touched?
I think I did
@Adi Yes but I believe that I forgot.
Adi
Adi
Wait wait, did Sec.SE get the new profile?
Nope.
Adi
Adi
I really forgot the query I used to get the number of touched people
it was a modified version of some other dude's query
16:53
@Adi No, I think it was some search of public arrest records or sexual harassment claims.
Adi
Adi
Could be.
But I think that would only work for our US-based members
I don't think such records are public in EU
Eh. I'm sure you can extrapolate for @Simon - he's probably touched people worldwide.
00:00 - 17:0017:00 - 22:00

« first day (1638 days earlier)      last day (3540 days later) »