is there an authentication scheme where the password never leaves the client (e.g. browser) and only ever exist outside the client hashed or encrypted?

@JohnZhau SCRAM?

@nobody not even in memory?

@ThoriumBR "If all you have is a hammer, everything starts to look like a nail"

The dev probably understood the idea of looping over something and checking if the ID matches, so that's just what he implemented

In case someone was interested. User Goran asked for a vote on "PhishTank" in another room.

Post was removed as "spam" but... maybe they were looking for help in reporting some phishing site.

I don't have any more detail, just thought it was worth to let you folks know.

@JohnZhau TBH I don't understand scram really well. But I think the server only ever has access to a hash of the password, never the password itself. Better double check this though, since I'm not a reliable source.

I swear, I see people here with mod rights that I've never seen before...

@MechMK1 There was a message in my site's chatroom that I was sure was spam and validated flags for, but on further inspection seemed potentially like it could be on-topic here and just extremely off-topic in my room rather than necessarily being spam.

I just joined here to check it out; no reason really otherwise.

@hyper-neutrino Honestly, the DMZ has become a bit dadaist in a sense

Everything's kind of on-topic here

Ah, I see. Well specifically here, I wasn't sure if the user's request was a legitimate thing that could go here or actually just spam, so I unsuspended the user and referred them to this room to see if it would be relevant here, but I don't think they decided to reiterate their request here, so IDK what's really up with what they were asking about.

@hyper-neutrino Was this about the guy who asked to report a site as phishing?

@MechMK1 yes

In that case, generally "calls to action" get ignored here, unless a.) they're really really interesting or b.) they somehow relate to the main site

The reason we generally dislike dealing with "Is this phishing?" kind of questions is because if we would allow them, we'd get flooded by them.

Ah, okay. I haven't a clue about either what they were asking for or what this chat room is about but I will keep that in mind, thanks. Another user recommended that this might be an appropriate place so I checked it out and it didn't seem immediately wrong.

@MechMK1 yeah, that's fair enough

@MechMK1 I think the user was just trying to get more people to look into a report they made on PhishTank. But I don't know the details.

@hyper-neutrino Well, people are free to come here and discuss things. They should just not expect any "action" from us

usually you need an Arduino and a couple jumper cables

bricking things today isn't that easy... unless you gave it more volts than it liked

@J-- You bricked a keyboad?

@JBis Because Dave is real

@ConorMancone Reminds me of the story of the expert beginners

@MechMK1 Continue :)

@ConorMancone So the idea in software development, or really any skill, is that there are several levels of skill

So the Novice barely understands anything he does, and mostly learns by imitation. The typical "I copied this code - no idea what it does, but it seems to work"

As the "Advanced Beginner", you still have no idea about the bigger picture, but you're starting to be able to solve some problems on your own.

The typical "programmer challenges" are aimed at advanced beginners

Once someone is Competent, they begin to see the bigger picture, and begin to understand the rules they have been presented with. Exceptions to rules start to make sense.

The proficient user begins to develop an intuition on how to solve a problem. they're embracing the bigger picture, and can quite often tell when something is wrong, just by "feel"

The Expert completely abandons prior rules and relies almost solely on intuition, which is 99.9% correct

So...the expert beginner...where do we start

As you see, it's a branch from the advanced beginner, slightly above, but below competent

The Expert Beginner doesn't see the bigger picture, and has nowhere left to go. They believed to be experts, believe that there is nothing left to learn, and use their expertise to justify not learning anything

"I know everything that is worth knowing. What I don't know is thus not worth being known."

@MechMK1 Me in every context :)

Well, expert beginners can be an absolute disaster

For example, an expert beginner may be uncomfortable with version control, so they just say "We don't do that here"

@MechMK1 I'm trying to figure out if I'm the expert or advanced beginner

You're nobody

Oh well that's right. I'm nobody. I don't belong on that chart :)

@nobody I keep trying to make a joke off of that, like "Nobody says that..." or "Nobody believes that..."

@MechMK1 Except what nobody says or believes isn't worth anything

Its redundant information

It can still be used as a negative

Oh right. Part of the reason I chose this name is because I wanted to see someone comment "What nobody says is wrong"

But everbody would just write what @nobody says is wrong

So it was a disappointment

@MechMK1 From my perspective, it's crazy how much this is actually an accurate description of a common occurrence, rather than just an oversimplification of a complicated problem (which is what I would normally say to things like this)

Nobody is disappointed!

Damn.

Which then naturally leads you to the question of ... in what areas am I an expert beginner?

Except the problem is that, almost by definition, it's almost impossible to tell if you are!

Once you can tell that you are an expert beginner, you cease to be an expert beginner

This is true!

I don't know anything. I'm constantly surprised when stuff just works for no apparent reason :D

@JourneymanGeek That's the stage that comes after Expert. It's called "Existential Crisis" and comes when you realize just how complicated everything is and the fact that the world doesn't spontaneously light on fire is an unexplainable miracle.

qwant.com/?t=images&q=dunning+kruger

@ConorMancone Ah, that's where I am

Just hear the hottest take that the presumption of innocence until guilt was proven in a court of law is just a tool made by the patriarchy to protect white male rapists

I remember a time where an accusation of a crime was enough to lead to execution. The primary victims were women.

Jesus fucking christ I have to stop listening to insane leftists spouting insanity

@MechMK1 You remember? When was that?

In the 90's

1690's

@MechMK1 lol!

Only 90's kids remember

:D

So you've been around since the 90's... makes sense

Yeah, that's why they call me a millenial

Because I was born in the 90's

Also, what's the difference between left and right?

Sorry, I never cared enough to find out and I feel too lazy to google

@nobody Left is when you're left behind and right is when something is happening right now

The future doesn't exist

It's literally just a meme

:D

See the thing is, people can't tell if I'm high or not because I'm always saying so much bullshit

Well, atleast we know we can always depend on you

@MechMK1 I love that definition just because the left always accuses the right of being stuck in the past :)

Being stuck in the past isn't a bad thing when the journey is going downhill

good point

MechMK1 spouting his far-right extremist ideals again

HE CAN'T KEEP GETTING AWAY WITH IT

@MechMK1 He'll find a way to continue getting away with it. After all, MechMK1 is a hacker :)

Nobody knows for sure

:^)

:D

I'm nobody with a lowercase n though

So you can't be refering to me

Capitalization of the first letter in a sentence

Well, if you can capitalize a name in the middle of sentence, then you can use a lowercase in the beginning of a sentence for name's too

I could

But I choose to remain ambiguous

No you didn't remain ambiguous, because the capital N means you weren't referring to me. Hence you must have meant 'nobody' in the plain sense of the word.

As I said, it's possible that I was

@ConorMancone Hey, are you here?

I have a question I feel you can answer

@MechMK1 I am but I'm off in about 5

(lunch)

@ConorMancone I got someone who uses SVN to deploy stuff on a webserver

Can you recommend any real deployment tools?

Just a namedrop I can put in a comment somewhere

Doesn't matter if you used it, "I've head of it" is enough for me

SVN?

Oof

Yeah big oof

Jenkins supports SVN

I've heard that once or twice before

I would never suggest using Jenkins, but if you're using SVN, that might be the best you git

Oh.... I think bitbucket supports SVN

Thanks, I'll write that down

I'd take their pipelines over Jenkins any day of the week

How is that category of software called?

Deployment Management Software?

I really don't know

Jenkins: sure, that sounds reasonable

Thanks still, I'll see what i can do

Bitbucket does both the code management as well as deployment management, so it's another level up

@ConorMancone I've just written that they should use a real deployment management software and not SVN

TIL if you set swappiness=0 on Linux, OOM killer will have a nice chat with your processes and headshot them when you run out of memory even if you have a petabyte of swap available...

this changed on kernel 3.5 and probably was backported to older versions as well... I learned this when a large Oracle database for a very large customer got a kill -9 because something went wrong and memory was exhausted, even if swap wasn't even touched...

@MechMK1 They definitely shouldn't use SVN for deployment management

@ThoriumBR That sounds exciting!

and as Murphy is in charge of setting downtime, this happened when most people were trying to use the services, which makes sense because a busy database uses more memory than an idle database... and a database hard crash isn't pretty to recover

fortunately this time we got back in less than an hour... but I've seem a 56 hour database recovery once, and that's not my idea of fun. the only info you have if "database is restoring logs", without any indication of progress, any ETA of any time, and the only hint you have that the database is doing anything at all is the iostat showing writing activities on the disk.

and you staring at the screen not knowing if the start will finish in 2 minutes or 2 days...

@ThoriumBR lol! That sounds quite terrible!

My days as a DBA are largely behind me, but I never got into managing gigantic databases and never ran into any severe problems, so I can't really claim that much expertise

Apparently I have just enough expertise to not be an "Expert Novice" :)

it is... specially when the direct manager called his manager, that got a call from his manager and the VP of tech is on site siting besides you asking how long it will take to be back online

and in a room of 30 people, 20 are from management: PR, HR, tech, lawyers...

but this incident from yesterday wasn't bad at all: remote, no manager calling, up in less than an hour