The DMZ

Matthew

11:00

@kalina Getting a head in can be painful... Especially the ears

kalina

I wouldn't even watch to imagine

I am absolutely starving

well, as much as somebody in the first world can be starving

Zachiel

Ok, I posted like the worst question ever on this site, I think.

kalina

I am mildy hungry doesn't have the same ring to it

AviD

you can borrow the trophy from @Simon

kalina

@Zachiel I hope so, it will make my worst question ever on this site seem better

Zachiel

11:09

@kalina what was it about?

kalina

oh that's not bad a question, it has capitalization and paragraphs and everything

Zachiel

@kalina I'm coughing and laughing so hard I need help breathing.

kalina

if you're coughing you should cut back on the smoking

Matthew

@Zachiel I suggest looking at how much a security manager would cost, and then just hire a decent developer and specify some security requirements in the contract. Maybe get a security company to do some testing before deployment, and have a regular VA scan contract too

kalina

I could be pedantic and say "Jooma! needs capitalization as it's a product name and that's how they write it" and "did you mean Heartbleed" and "ew Joomla" but I'm not a pedantic individual

yes, you could always ask @RоryMcCune for a penetration test

Zachiel

11:13

@kalina I should definitely cut back on this flu.

kalina

but I think he'll ask if that's what you really want or if in fact you're after a vulnerability scan

@Zachiel boo flu :(

Rоry McCune

@kalina well really the best bet would likely be to do some decent hardening stuff and then keep it patched up :) VA wouldn't hurt afterwards to make sure things were ok...

Lighty

0

Q: Website security - should I hire a developer?

I'm going to create a new website with Joomla! 3. Potentially, this site will get me some money through ads but I'm a little worried about what could be done to attack it. I say a little because I'm not hoping in huge revenues and I don't think someone will try to bribe me into giving them contr...

websites

Zachiel

Thanks for the suggestion @Matthew, changed the question a bit.

Lighty

whistles

kalina

11:16

remember that most developers consume an unreasonable amount of sugar and caffeine and this will impact costs

Zachiel

I feel like I should learn some hardening. The less I spend for a thing I'm not sure will work, the best I feel like actually doing it.

kalina

you can't say things like that in here

there's at least two euphemisms in that statement

Rоry McCune

@Zachiel yeah some Joomla hardening stuff and limiting who can log in to the system (and getting an SSL cert) would likely go a long way to sorting your issues..

Matthew

@Zachiel Essentially, use peer-reviewed modules and code, keep the core system updated, and make sure your hosting provider is keeping their systems up-to-date, and you're probably about 90% of the way there

kalina

self hardening is the best hardening, less effort for us that way

Zachiel

11:18

My hosting does not use PHP 5.5.9, they have 5.4 at most. Maybe I should start worrying.

kalina

you should have started worrying when PHP became the thing you were using

Rоry McCune

@Zachiel docs.joomla.org/Security_Checklist/Joomla!_Setup they seem to have a security checklist that has some decent advice on there

Matthew

@Zachiel Yes, that version is out of support lifecycle: php.net/supported-versions.php

It is possible they're using a LTS release of a Linux distro which provides security patches, but you'd need to check that

Zachiel

Well I need to manage a huge number of pages and links, and I'm learning Joomla anyway because we're using it at work so... I went with the easiest way.

kalina

the actual answer to your question though is all about scope IMO

you said you don't need to be storing other people's personal information

Zachiel

11:21

@Matthew this is the bad side of using a free hosting, I guess

kalina

ultimately if you're hosting with a third party they'll have access to all of your stuff anyway

Journeyman Geek

@Zachiel and or they could get hacked. ala 000 webhost.

kalina

if you're hosting for free then I'd guess after following best practices it's more likely that they're the weak link

if you're willing to buy a developer then maybe it's worth upgrading your hosting solution

Zachiel

I think I'm moving out if I see that this thing gains viewers. Which will mean gaining back my views but at least I will know it works.

Sometimes I hate being cheap

Rоry McCune

@Zachiel looking to be the next D20PFSRD.com?

Zachiel

11:24

@RоryMcCune how did you guess?

Rоry McCune

@Zachiel heh, it's a good site, so guessed a 4e person might replicate it.. (I don't 4e , so don't know if there's anything equivalent for that..)

kalina

oh right, I forgot this room was full of D&D players

Rоry McCune

@kalina hey hey, none of that I'm a pathfinder player (these days)

kalina

there's even an ingress player in here

@Zachiel if you're paranoid about that perhaps you'd want to continue not saying it in chat

it is a google indexed chat room afterall

Rоry McCune

@Zachiel yeah good plan :) probably don't have to worry about people nicking the idea as it's a lot of work :) people who nick ideas tend to be allergic to that...

Zachiel

11:27

Mh, right. @Journeyman, might you please remove my last message?

Journeyman Geek

DOne

Zachiel

@kalina a blue name was all I needed ;)

kalina

he's only a journeyman moderator, you might need a more experienced one

nobody ever needs the blues

Zachiel

I sometimes hate this chat

kalina

sorry, I have that effect on everybody else too

Zachiel

11:29

No you, just the editing shortcuts.

Rоry McCune

@kalina no

kalina

I keep longingly looking at the DJI inspire v2 knowing that my existing history with drones is a shocking 100% failure rate

Rоry McCune

@kalina in terms of crashing them, or just not using them?

kalina

crashing them

or... well, sinking them

Rоry McCune

@kalina oopsy, well you could get that waterproof one

Lighty

11:33

wtf is it with these spammy posts about BEAUTY PRODUCTS

kalina

it wasn't my fault, it decided to allow me to fly it outside of the range of the controller and then instead of returning to its start point it continued flying forwards into the distance

Lighty

we're all nerds here, we don't need beauty products, we don't go out

kalina

speak for yourself, I'm neither a nerd or housebound

Matthew

@Lighty Well, they know we stereotypically don't have any beauty products, so might be a good new market. They fail to realise that we all buy high end custom made products tuned for our specific skin tone!

Rоry McCune

@kalina ahh that, yeah my next quad will not have GPS , for that reason

@kalina too many storys of fly-aways

Lighty

11:35

@Matthew Like a sledgehammer?

Rоry McCune

@kalina I'm getting a relatively cheap Micro-Drone3

Mark Buffalo

@RоryMcCune flashbacks ensue

Matthew

@Lighty I use a hammer, and a lack of accuracy, but yes...

kalina

@RоryMcCune over the ocean... no recovery

Rоry McCune

@kalina ouch, yeah I think for hobbyists, cheaper drones are better, less pain if they break (but the inspire v2 is very shiney)

Matthew

11:39

@kalina Clearly you should take up indoor first person drone flying!

Mark Buffalo

@kalina That sounds so sad :(

Matthew

Almost no chance of them flying away

Almost 100% chance of being able to pick up the bits when you crash into a wall

Almost 100% chance of crashing into a wall too, but still...

kalina

@RоryMcCune yeah, even with the money isn't really an issue thing spending money that you know is going to be essentially wasted within a couple of months is still wasteful

hence why I keep looking

and not buying

Mark Buffalo

sweet

kalina

although I have got as far as the checkout stage

Mark Buffalo

11:41

snapchat got hacked

3

kalina

I will remain strong

@MarkBuffalo link required

Rоry McCune

@kalina yeah I'm hoping to be like that with VR stuff till I see how it shakes out, but the VIVE does look v. cool

kalina

@RоryMcCune I, fortunately, have no interest in VR at this time

I appreciate "exciting times" etc

Rоry McCune

@kalina I saw JackSepticEye's play of the little portal demo, looked awesome

Mark Buffalo

newsfactor.com/story.xhtml?story_id=131004IPFARS

kalina

11:44

@RоryMcCune sure, like I said, "exciting times" maybe

but the mainstream isn't going to adopt it any time soon and I don't really have time for niche anything

Rоry McCune

@kalina also I really want my VR space flying with E:D

but yeah it'll take a gen or two for mainstream adoption

kalina

VR got exciting to me when John Carmack quit ID, got sued by Bethesda and went to work at Oculus

Ixrec

I'm intrigued by VR but obviously the value proposition just isn't there until the hardware costs fall and there are multiple games I care about which support it

kalina

since he's the kind of crazy person that will actually make it work

Rоry McCune

I actually think in practical terms AR will be bigger

kalina

11:46

but I can't really be bothered with being an early adopter to play a bunch of tech demos on second rate hardware that cost more than my gaming PC

Rоry McCune

but it's a bit behind VR so far

Matthew

@RоryMcCune I would love a system that gave me live subtitles for conversations...

Rоry McCune

@Matthew so if you get a job in like Norfolk, you'd have a clue what the customer was saying?

kalina

didn't Microsoft announce their holo lens for €3000 or so

Ixrec

to me AR is in the same category as "internet of things"; I'm still waiting for someone to come up with a genuinely compelling use case for the idea

Rоry McCune

11:47

@kalina yeah for approved devs only

kalina

sorry but in Microsoft's "market leading position" (cough) they should be giving their dev kits away so they don't get another Windows Phone app store.

Rоry McCune

@kalina well so far in AR their only competition is MagicLeap (have released nothing) and MetaVision (have a niche product and a cool TED talk) so I guess they're not feeling the pressure yet

could well be a mistake though

Matthew

@RоryMcCune Good start - how about being able to have conversations in loud environments thanks to a camera lip-reading and overlaying the spoken words?

Rоry McCune

although meta are announcing something in 2 hours

that that may all change

@Matthew that would be awesome

kalina

you say awesome now

but imagine: same technology used in CCTV cameras

Rоry McCune

11:51

@Matthew also a pop-up with the persons name so I don't get embarrassed by forgetting it...

@kalina they've already got that

Matthew

@RоryMcCune Dynamic recipe book, which can see when your eggs are sufficiently peaky

kalina

@RоryMcCune really?

Rоry McCune

@Matthew DIY guide floating in mid-air while you work on pipes under a sink

@kalina IIRC but it could be my dodgy memory, let me see if I can find a link

kalina

@RоryMcCune I can find links for people using video without audio tracks and transcribing them

Matthew

@kalina I'm sure someone is working on it already, and yes, it would be bad, but I live in the UK - our government loves spying on us

Rоry McCune

11:54

@kalina theweek.co.uk/technology/60421/…

people working on it, but not widespread public products yet...

kalina

oh I don't doubt that it's an "in progress"

Matthew

@RоryMcCune 76% isn't bad. I know some professional lip reading trainers with only about 80-85% accuracy

diagprov

@M'vy and Romansch just about.

Rоry McCune

technologyreview.com/s/530641/…

Apparently growing a beard is a good defence against automated lip reading

kalina

@RоryMcCune ...

diagprov

11:57

@Lighty another "secure" email provider?

kalina

niqab it is

Matthew

@kalina partypacks.co.uk/…

Ixrec

I like how "“Is (x) Secure” Question Anti-Pattern" is the featured meta question when "Is this authentication scheme secure?" ends up on the HNQ list

kalina

I am not muslim, I just dress like this to avoid surveillance

WHICH IS IRONIC

since that got me on a list

Rоry McCune

@Ixrec yeah the commonness of that pattern is what caused me to ask the meta-question

Matthew

11:59

@Ixrec The OP for that is apparently looking for a very specific answer

Which may be "yes, it's secure"

Ixrec

@Matthew you mean how he accepted the "it does protect against this other attack you didn't ask about maybe" answer instead of the much higher voted "no, use HTTPS, that's why it exists" answer?

kalina

"The correct answer to my question is one that blindy approves my current actions and meets my expectations"

2

Matthew

@Ixrec Yeah, that would be the one...

Rory Alsop

@kalina there are a few Ingress players in here :-)

Matthew

I like how the accepted answer has negative points...

Rory Alsop

12:03

(P.s. That's me just caught up on the entire transcript - you chatty b*****s)

Ixrec

@Matthew honestly, when there's a blatant mis-accept like that even I'm tempted to downvote the wrong-ish answer so the drive-by readers are more likely to look at the correct one below

Terry Chia

@RoryAlsop I have long since given up attempting to do that.

Ixrec

but -1 is probably enough to trigger that

M'vy

The comments on that question are as long as the question itself

There should be a community "vote to accept" feature

Ixrec

as with most ideas, it's been on MSE many times

Rory Alsop

12:05

@RоryMcCune MagicLeap have the most interesting plans...

@TerryChia mods need to. A

Ixrec

and tbh I agree with the argument that allowing not-OP to assign the check mark essentially robs the check mark of most of its meaning

Terry Chia

@RoryAlsop Pretty sure @AviD doesn't. :P

He pops in all the time with an out of context sarcastic comment.

Rory Alsop

Okay - at least one mod per site

AviD

@TerryChia I've tried to, but not able to anymore. Unless there are issues.

most of the time its inane chatter.

Terry Chia

@AviD So... @Simon?

AviD

12:07

@TerryChia That's my speciality.

Simon

@TerryChia WOT U SAY

Terry Chia

@Simon pls

Rоry McCune

@RoryAlsop it sounds very cool, but I'm a bit leary with the lack of detail after many years of development and no sign of a product

Simon

Was there another drama spree last evening/night?

DID I MISS IT AGAIN?

Journeyman Geek

YES YOU DID. (I have no idea what tho)

Simon

12:10

Ah no, I'm re-reading the same drama.

It all started when some dumbass flagged the bot I think.

Rоry McCune

@Simon nah we had @Adi 's bot hanging about and Mick who hangs about in the hopes that @kalina will be in-room and a couple of other randoms, but apart from that pretty normal

Simon

wot

What was flagged though?

Something not worth flagging at all? (as usual)

Rоry McCune

@Simon it started when the bot posted an e-mail address and was about to post what it said was the password

MickLH

Excuse me I don't just come in to wait for @kalina ...

Stu W

@RoryAlsop - What about directional infrared microphones inside cctv camera domes

Rоry McCune

12:12

@MickLH well that's why you turned up originally

Simon

@RоryMcCune Huuuuuuuuuuuuuuuuuuuuuh

wat

Rоry McCune

after that I'm sure you stayed for our scintillating wit

MickLH

Well, and other stuff, like starring her messages

Simon

Oooooh, the bot is the Henry guy?

He's not a bot, he's a 12 years old begging for attention.

kalina

great, he is here.

Rоry McCune

12:14

@Simon yeah if you look at his messages it's pretty obvious

Simon

He's like me except slightly less clever.

slightly

Rоry McCune

@Simon you have been known to be able to engage in conversations some times, which the bot doesn't...

kalina

zero divided by any number is still zero

Simon

@RоryMcCune BEEP BOOP

Ixrec

*any nonzero real number

kalina

12:15

@Ixrec zero divided by zero is still zero

Ixrec

nuh-uh

kalina

yuh uh

don't you dare math at me

3

diagprov

Ooooooooooooooo boy!

Ok so @kalina, are you familiar with real analysis? :)

Journeyman Geek

@Simon I might be convinced you';re smarter.

kalina

33 secs ago, by kalina

don't you dare math at me

I don't care about math

Simon

12:16

@JourneymanGeek The most important word in your sentence is "might".

Ixrec

I don't think you need real analysis to understand that division by zero is undefined =)

kalina

if you're about to try and blind me with mathematics you should know I care not for pure subjects

diagprov

@Ixrec No, but if you want to understand 0/0, or what happens when you get limits of the form 0/0, or infinity/infinity, then it helps.

Stu W

they do occasionally come in useful though

Ixrec

I didn't even mention complex numbers

kalina

12:18

this gets worse

MickLH

@kalina How do you slice up a pie for zero people?

kalina

I remember when I used to complain about information security conversations

@MickLH easy, you do not slice up the pie

Journeyman Geek

@Simon see? Learning already.

MickLH

Exactly

kalina

the pie is still in its packaging

MickLH

12:18

You simply do not divide by zero ;)

Ixrec

you throw an exception and let the program terminate early because there is no point cutting the pie

Simon

@JourneymanGeek Woohoo!

kalina

thus, zero divided by zero is still zero

Stu W

no

kalina

yes

MickLH

12:19

Are you sure, we have 1 pie

Ixrec

there's a difference between not cutting the pie and cutting a zero-width slice of pie

technically

MickLH

That would be slicing the pie for infinity people. Not relevant

kalina

somebody tell these people that attempting to be an unstoppable force against an immovable object is how the big bang occurred

Rory Alsop

@Ixrec Not really - I just get the pie by default

@kalina I remember it well. My favourite bang :-)

Stu W

what pie?

Rory Alsop

12:20

Mmmmm pie

Ixrec

@kalina nah, it's just how all your variables turn into NaNs and corrupt the website

Journeyman Geek

No Pi for you

MickLH

@StuW Actually it's a cheesecake tbh

Simon

Pies suck, power to donuts.

kalina

@Ixrec pls if you don't validate your sets then of course your gets will return nonsense

Stu W

12:21

But if there is noone to give it to, do you tell the outside world of its existance or simply devour it in private and hide the evidence?

RoraΖ

The latter

MickLH

Why would you even ask that?

It's already gone

kalina

you can't hide the evidence, a moment on the lips, a lifetime on the hips

diagprov

@kalina Sometimes. You want L'Hôpital's Rule for the evaluation of limits of quotients.

Stu W

hence - what pie?

Simon

12:22

@diagprov You're an hospital.

Stu W

try being a guy in his early 20s :)

kalina

"try being a guy", thanks @Stu your input is eye opening

diagprov

And technically, it is not one pie, it is a sequence of pies that get increasingly smaller.

kalina

of course, that means it's super special because my eyes were firmly sealed shut by the amount of mascara

...

Stu W

i have eaten a whole pack of custard creams this morning and wont put on any weight because of it

Adi

12:23

Oh. My. God!

John McAfee and the FBI Finally Face Off On CNN (CNN Interview)

►

Stu W

can not claim to speak for anyone who is not a guy lol

Adi

The interviewer and the FBI guy are absolute idiots!

They have no knowledge of the topic at hand

kalina

why does this surprise you

MickLH

Back to relevant cheesecake

RoraΖ

@kalina I think this also applies to sex...

MickLH

12:24

or that

Matthew

If you disconnect from a conference call system that says "Now leaving: Bob" as each person leaves, does it still say "Now leaving: Matthew" if I'm the last to leave... This is like the fridge thing all over again...

diagprov

@Matthew is that how do you put a giraffe in a fridge?

@Simon So predictable Monsieur Simon.

M'vy

@Matthew or Toy Story

Matthew

@diagprov No - does the light go out when you shut the door? Really?

Simon

@diagprov You knew I was gonna translate the guy's last name to English from French and call you that? Damn.

MickLH

12:27

Simon is basically as simple as it gets. Textbook predictable

Simon

Shut too Mich.

That was supposed to be "top" but typing on mobile is like having to deal with Satan.

MickLH

Yeah satan usually has my back

Stu W

i went and bought a bluetooth keyboard last time i was in shenzhen

best purchase ever

diagprov

@Matthew Aahh, hmmm.

@Simon because you pick a noun from the sentence and say "you're a $thing". For example from this sentence you would respond "you're a noun".

Stu W

@Matthew - ours says "You are the last person on the call"

as if it is mocking you being alone

Simon

12:38

@diagprov I would never do that.

whistles

Rоry McCune

now that's weird

chat.stackexchange.com/search?q=you%27re&user=&room=151

if you search for "you're" on the search function

it only returns oneboxed posts

Simon

That is indeed quite weird.

Rоry McCune

doesn't return anything from the room

does the same thing on we're

Simon

Ya, it has to do with the apostrophe (can't does the same).

Rоry McCune

bad SQL Injection filtering?

Simon

12:41

Very possible.

Rоry McCune

hey mods, where do we post bugs?

Simon

Let's find a proper exploit and then ask where we post bugs.

Rоry McCune

@Simon yeah given SE doesn't have an official bug bounty (AFAICS) I think I'll stick with the general bug :)

Simon

@RоryMcCune Ew.

Let's not spend a damn minute on this.

diagprov

@RоryMcCune stackexchange.com/about/security

Simon

12:43

It's not a security matter at the moment though.

Rоry McCune

@diagprov yeah the prob. with that is that there's no mention of allowing traffic that could be an attack

it just says if you find something, report it...

without clear wording "you can do [x] to these systems" I wouldn't touch it :)

Simon

I hope this does not mean that they're not using prepared statements.

M'vy

@RоryMcCune meta?

diagprov

@RоryMcCune Yeah, I agree.

SE search has always been... interesting.

Rоry McCune

@M'vy meta.se yeah absent other options I guess that makes sense.. I was wondering if the mods had a super sekret bug reporting forum (cc @AviD @RoryAlsop)

Simon

12:45

@diagprov You're interesting.

diagprov

@RоryMcCune I think they'd just end up using the same thing we would - email team@.

M'vy

@RоryMcCune or meta.meta would work

Rоry McCune

@M'vy surely meta.meta.meta would be even better!

diagprov

You wouldn't want to post an exploit in TL, that's like flagging something in chat :)

@Simon why thank you.

Stu W

[email protected]? lol

Gilles

12:51

@HamZa Maybe. Post the usual announcement on meta?

HamZa

@Gilles I will

working on it

M'vy

4

Q: Search for terms containing special characters in chat returns garbage

I did a search for A$, but a whole bunch of results containing "Å", "A's" and "as" were return, could not find one containing "A$": http://chat.stackoverflow.com/search?q=A%24&page=1&pagesize=50&sort=newest Same thing for other special characters such as "#".

bug chat search

Rоry McCune

@M'vy interesting that it got no answer...

Ohnana

@RоryMcCune i'm actually having that issue with my conference... asked three women to speak, all begged off because of family commitments

Rоry McCune

I've posted this one on meta.SE anyway

Ohnana

12:55

and we asked every single lady we knew to speak

Rоry McCune

@Ohnana interestingly the thing I saw which helped was the conf. started making it more family friendly

so people brought their kids

Ohnana

@RоryMcCune wait, like people bringing kids?

ew.

Rоry McCune

has a cost/time implication but it seemed to help

Ohnana

i mean, it's a tiny conference

Rоry McCune

@Ohnana 2014.scottishrubyconference.com/news/#/posts/…

M'vy

12:56

"we remind our attendees that the ball pool is strictly reserved for actual children"

Rоry McCune

so this one wasn't huge, but they got a venue which had child care

Ohnana

i had at least two or three people lined up to speak, and they ditched last minute... :|

Rоry McCune

@Ohnana that sucks and those people are like the worst

Ohnana

@RоryMcCune i know

Rоry McCune

I wouldn't ditch unless I literally was super-ill and couldn't talk/speak

SEJPM

12:57

Anybody here knows whether a specific smart card reader has to be specifically supported by the middleware (i.e. the PKCS#11 library) ?

Rоry McCune

I've seen it happen though and I think it is a really lame thing to do

conf. organisation is really tricky

Transcript for