The DMZ

9:54 AM

Just created a PR for byobu, because their external IP address script was broken

It uses v4.ipv6-test.com/api/myip.php as API for their calls, with a 1 second timeout

But the api requires almost 10 seconds for me to respond

Whereas if you use dig myip.opendns.com @resolver1.opendns.com +short, it responds with in 50ms

github.com/dustinkirkland/byobu/pull/36

10:16 AM

Does anyone know how many browsers support HSTS preload? All I could find was usage data for HSTS

Or is that synonymous?

@MechMK1 I really didn't. I just picked a random country that seemed unlikely to be conducting mass surveillance of their citizens. Based on his response though I was wondering if I had accidentally picked the only country in South America that actually did do lots of surveillance.

I don't know. All my political knowledge of south america is very limited

Though I imagine if you moved to the highlands of rural southern Chile, surveillance might be a bit tougher

You know, i really like Chrome, but their .webp fetish is really annoying me

10:31 AM

@MechMK1 You probably already found this, but the best info I've ever seen about that is here hstspreload.org which (I think) is actually run by google. While I'm not sure, I personally suspect that google is the one that decided to run a preload list and started the whole submission thing, and other browsers just steal their list with their own personal additions.

hstspreload.org

@ConorMancone I'm just happy you didn't tell the German guy to move to Argentina! :-)

Either way, I don't think that HSTS and HSTS preload are synonymous.

@Anders Yeah, I know enough not to suggest Argentina. That sounds like a bad place to live, and also seems to be a good way to start a political argument, lol!

In all honesty, most of Southern America doesn't sound like such a good place to live

@MechMK1 hi

Don't mention ze war!

10:34 AM

@Derpy Hey, what's up?

@MechMK1 I'd include North America up to the Canadian border, to be honest.

@Anders I wouldn't know. I live in a rich european country

@Anders What! USA is the best! I say that non-sarcastically... although we are trying too hard to turn into Europe, and that really ticks me off...

@MechMK1 just dropping by. I though you would like to see the follow ups to that old rant about AC we had

Mobile Games are still mobile games. I have abandoned all hope.

Though I wish there was a repository of "good" mobile games

You know: Things that are actually creative and interesting, and not designed to sell you a pack of diamonds for just 99.99 $

10:38 AM

@MechMK1 see here ... They were forced to go back to how it was before ^_^'

Oh, so they are now in full damage control mode?

basically

"here are 250 free diamonds for your patience"

@ConorMancone Oh shit, I forgot the whole "let's not start a political argument". My bad! :-)

@Derpy Not the worst move

I assume you were here when we spoke about what Bungie did in Destiny 2 with the silent XP nerf?

@Anders @ConorMancone I don't mind. I am basically "Political Argument - The User"

@MechMK1 yep, you told me about that one

10:45 AM

@Derpy As I said, not the worst move. At least players have some sort of way to show developers that they are pushing it too far

That's also why I really didn't like when Steam tried to fight against "reviewbombing"

@MechMK1 oh, I was just looking at the game reddit...

Because reviews are basically the only way that players can reach the developers or publishers

Seems many did indeed fall for the bait

now everyone is glad. Untill next bad thing comes

One could be cynical though

How to make lots of money:
1.) Implement something extremely greedy
2.) Wait for backlash
3.) Change it to something less greedy
4.) Let players argue that the new system is so much better and that you should be thankful

oh wait, there is something I was missing.

The fix isn't up yet

They just announced it will be fixed NEXT UPDATE

and gave the free 250 tickets in the meantime to keep people playing

10:49 AM

Would you be surprized?

Man, I really have to make a repository like "Actually Playable Mobile Games"

> Within the next several months

"Give us the props now, and also your money"

"B-But the devs said they'd fix it! W-Why are you upset!?"

@MechMK1 Junk Jack is fine, at least it has some purchases but they are just cosmetic add-on. Other than that, it is just a Terraria clone with better mobile controls.

I like "Really Bad Chess"

It's chess, but with random starting pieces

And depending on how good you play, your pieces get worse and the opponent gets better pieces

Brb, lunch

tungsten

11:19 AM

@ConorMancone well las vegas has made a good start with cloning paris, mentality is coming later as always

Q: How to check if a connection between a server and an app is encrypted?

Can someone sanity check my comments here?

0

I have a Corona SDK sample project that contains only the following code: -- The following sample code contacts Google's encrypted search over SSL -- and prints the response (in this case, the HTML source of the home page) -- to the Corona terminal. local function networkListener( event ) ...

tls

The OP wants to make sure that his HTTPS request is actually encrypted. I'm 99% sure that it is impossible to request HTTPS and end up with an unencrypted request

But I'm not 100%. Am I wrong?

@ConorMancone You are wrong, actually.

A server can use the NULL cipher, where the request is not encrypted at all

The idea of NULL ciphers originally was that they are supposed to be for payloads that are already encrypted, so further encryption would only bring performance problems

However, in this day and age, the overhead of double encryption is usually negligible

And you, as the client, can disable support for NULL ciphers, as well as weak ciphers in general

So if my client says "I only support strong ciphers. Offer me what you have", and you get a connection, then you are guaranteed that you are encrypted

@MechMK1 Interesting, thanks!

@ConorMancone You're welcome. I should mention that null ciphers are very, very rare these days

That sounds like very helpful info. If you wanted to add and answer to that effect I would definitely give it an upvote

Q: What is the concept called that is all about moving digital info back to analog equivalents?

11:32 AM

I don't think it merits its own answer, but I will see what I can come up with

Also, there are so-called "Anonymous NULL Ciphers", which contrary to the name, do encrypt the payload

But anonymous NULL ciphers don't do any kind of authentication

So it's basically "What if you just accept any certificate"

0

A while ago I was reading an article on a concept which was essentially determining what information or processes are too risky to be digital or online and keeping them or moving them back to their analog equivalent. I wanted to read more on it, but I can’t remember what the concept was called. D...

terminology risk-analysis

This is such a weird question to ask

@MechMK1 Those are my favorite kinds of answers. The OP wants to verify that his HTTPS connection is encrypted. An answer that says "it has to be encrypted" is the best answer because it tells him what he really wants to know

"If either client or server demand encryption, and a connection attempt succeeds, then you are guaranteed to be encrypted"

11:51 AM

Yup, and I find that to be more helpful as an answer because instead of wasting time checking for encryption that is definitely there the OP learns about specifying a list of allowed ciphers which actually can protect against some attacks

I wonder if there are any clients today that still allow the null cipher?

A: How to check if a connection between a server and an app is encrypted?

Yes, Microsoft DirectAccess

And, if you are willing to include it, openssl

0

Steffen Ullrich's answer correctly describes how you can check if a communication was encrypted or not. However, you have another option to ensure that TLS communication is indeed encrypted. First of all, I am going to assume that you control the client, and that you will be acting in good faith...

So strange... https request with a null cipher.... Still seems crazy to me

Yes, because NULL ciphers were done for performance reasons

Back when "encrypting data" seemed extremely expensive and the word "cipher" was written as "cypher" to look cooler

You can always use testssl.sh to test if null ciphers or other weak ciphers are supported. As I said before, a while ago, I saw some anonymous null ciphers in a prod environment

Wow, the politics.se chat is D E A D

Who would have guessed?

12:08 PM

This is the only site I have ever used chat on, but the politics one sounds like it should be FUN!

Absolutely

I would love to get into political arguments

All day long, if could

But the people I am arguing with either agree with me to some degree, or stopped arguing with me "Because arguing is pointless if I don't agree with them" (literal quote, btw)

In college I had a job working as an assistant at a computer lab. It was extremely boring (we were rarely asked questions). I was allowed to surf the internet, but not to do homework/read books. So I spent large amounts of time arguing religion online. It was usually a lot of fun, but I was generally very bored all day long...

I get that feeling

Given that I am not a religious person, I don't have much to argue

What! Whether or not God exists is possibly the most important question to make any sense of life. My favorite analogy is to consider if God was an all powerful cat who put us on this earth solely to take care of cats, and our conditions for all of eternity will depend on how we treat cats in this life. If that was the case then you better well quit your job and start up a cat rescue...

Although I've always had a large philosophical bend... my favorite online comic ever

existentialcomics.com

lol, I hadn't read this week's comic yet. Best comic ever

12:25 PM

That's great, I like it

My personal stance on religion is that I have no way of inferring if there is such a thing as a god or not.

Bah! I'll let that slide just because this is a bad place to start a religious discussion (and I have to do work) :)

The reason why I act the way I do is because I believe that acting "good" will generate a better society around us, which will in turn be better for me and my offspring

No, you started it!

I had my hopes up already :(

My favourite comic these days is stonetoss.com
Warning! VERY Political, VERY incorrect

Q: Which is the Best Option for Instant Messaging app for Business

1:04 PM

-2

With the increasing popularity of smartphone Messaging app for Business, there is a good chance that your customers who are already looking forward to connect with your business, but you simply do not realize it. All the queries, feedback, comments, and sales are not going anywhere… Do you realiz...

privacy

Spam without spam, wow.

@MechMK1 One of the things I like about stack overflow: such things get cleaned up by mods very quickly. Flag for admin! So much less junk here...

But I don't understand...

@MechMK1 chances are they will post an answer or edit later

Why would you create spam...and not link to what you are spamming for?

@JourneymanGeek Most likely

Man, I never understood businesses that did that

Also checked for a single . With a hidden link

1:10 PM

"You know, I was just looking at Sec.SE, when suddenly there was a spam post about IM apps for businesses. I rushed to my boss, showed it to him, and we immediately knew we were in good hands"

Like, is this how they think it works? Or is this purely for SEO reasons?

My guess was that it is somehow SEO related. It's equally possible though that whoever posted that is just trying to build brand recognition for Signal. Obviously I'm just guessing though - there are plenty of people who are just bad at business...

But why?

I doubt that Signal themselves would do this (at least I hope so)

And if it were a shady PR company, I'd immediately sue for such behaviour

If anything, this damages the brand

Because the person is crazy?

It didn't seem crazy

I have worked in a mental hospital, I know what insane people sound like

The post was rather coherent, filled to the brim with "buzzwords" for businesses

Just too perfectly like spam

1:30 PM

Listen, if you're going to expect me to use words in a manner which is consistent with their meaning, then I don't know how we're going to have an actual conversation here, lol

And schroder already deleted it. Go stackexchange! Obviously whoever did that mistook this for a typical forum, where such things stick around forever. Which is also why I don't think they were planning on coming back and editing it later - most typical forums don't have that option.

I really don't know what the point was

lol, we get requests to hack websites now?

0

Q: Ethical Hack of Gallery

I have wedding pictures in an old wedding gallery Windows application. The album is here: https://drive.google.com/file/d/1K4-EmCCutiuUhZW3p5YB0QG5sNzvcY4-/view?usp=sharing The original developer of the album software died in 2007 and the software is no longer maintained. See here: https://a...

encryption windows

In all honesty, I'd give it a shot if I had the time

1:49 PM

Oh, it's apparently a .exe file and not a website. The images apparently are encrypted in it. Definitely outside of my area of expertise

As if I would execute an executable file provided by a stranger on the internet. My parents raised me better than this.

@MechMK1 lol, that was my first thought too. I briefly considered downloading it and then thought, "Waaaaaait a minute here..." Not that I could run it anyway...

@ConorMancone And this is how you get social engineered

3:05 PM

@MechMK1 or how the original question asker will , if someone manages to find a still working image-based exploit and send him some crafted pictures claiming to have reverse engineered the album

@Derpy lol, nice!

@Derpy We're all terrible people. The guy probably just wants his damn wedding pictures

But to be honest, his own fault for not demanding JPEG's

Or, even easier, just send him a "new" .exe file with "the export option enabled"

While I kind of understand it, I'm not a fan of the way photographers handle their business. I'll pay you a premium even, but can you just send me all the original photos you took? If you asked someone that I'm pretty sure the premium would be like $10K...

That's why you should negotiate these things in advance

@MechMK1 That's okay, I've known that I'm a terrible person for a long time. Everyone is. Some of us are just better at hiding it.

3:11 PM

@ConorMancone Don't get me started.

By the way, what happened to @forest ?

@MechMK1 Absolutely. Then again I had a friend do the photos for my wedding and the whole wedding cost me $1000, so I obviously did it a different way...

If I do any business, I need to know what my obligations are and what I get in return

And my wedding pictures will be delivered to me in JPEG, native resolution, no watermark

This is not negotiable

If the photographer does not do that, I get a different photographer

@MechMK1 no, please, no. No .jpeg.

Either ask for the original raw files or if that is not possible something less worse than jpeg :P

At least .png

@Derpy PNG for photography is not really feasible

I know JPEG is horrible for any networking stuff, but for photography it's perfectly fine

lol

PNG is efficient for 'simple' images with clean colours

@MechMK1 also - you should ask for raws too ;p

3:18 PM

Furthermore, the original RAWs are completely unprocessed, so I would need the camera profile, and I would need to do all the editing too

@JourneymanGeek Yes, I could, but it's really not that important to me

A well-developed JPEG is what I pay for

Works for me

asking for PNGs of photos however is dumb

PNGs really don't work for photography

Reminds me of an old question: "Why do cameras not use SVG for pictures?"
Answer: Because cameras don't work based on vectors

snort

I can't image how a device that images as vectors would even work

Not at all with current technology

Well not without a ton of processing ;p

3:22 PM

Even then it would just be a ton of approximations

I could imagine something like that if you work in a virtual space and already had all vectors and such

E.g. exporting an SVG from a camera viewpoint in a blender scene

But even then, I would not want to have to render that

Because on a complex scene, you would basically have to render the whole scene every time

@MechMK1 .tiff? Something that isn't lossy?

A: What does an unprocessed RAW file look like?

@Derpy RAW is lossless, but needs processing

183

There is a tool called dcraw which reads various RAW file types and extracts pixel data from them — it's actually the original code at the very bottom of a lot of open source and even commercial RAW conversion software. I have a RAW file from my camera, and I've used dcraw in a mode which tells ...

@MechMK1 Oh, is RAW an actual image format? I was just wondering what image format comes off of modern CCD cameras. I did a lot of image processing myself (I have a PhD in astronomy), but our cameras always made images in FITS format. That is specific to astronomy, so I didn't figure that's what professional cameras used

@MechMK1 Oh, I know that, but since you already said you wouldn't go that far... I was suggesting the next "best" thing that would still be lossless.

@Derpy The artifacts wouldn't be visible anyways

The perceived loss of quality is similar to that of raw PCM vs 320 CBR mp3

It exists, but unless you use tools to go hunt for it you won't notice it

3:30 PM

I guess it all matters to what you want to do with the photos. I will keep my landscapes shoots in RAW, thanks ^_^' But I guess that the asker could live with just the JPG

I mean, it would be better than an .exe still.

If you're serious about photography, I would absolutely agree

But all I want are pictures I can hang on my wall to remind me of my marriage

There, much better :^D

Anyways, I have to go now and go home

Have a good day, y'all

tungsten

4:21 PM

Does anyone know how to copy very large amounts of data from a DBMS system as fast as possible? (tricks)

I'm lacking experience at this

4:41 PM

@tungsten what DBMS? What kind of access do you have? With mysql I usually just mysqldump, or I dump the results of a select from the command line into a file and parse from there

tungsten

cassandra

@ConorMancone nosql is the main thing but it's about a few hundred gb