The DMZ

Adnan

4:01 PM

@GreenFly What do you think of DreamHost, as a VPS provider?

I smell a rep-train!!

@Simon Hop on it! QUICK!

You might finally get your first 200/day

CodesInChaos

@ManishEarth Those are harmless once you get used to them.

Simon

Wait, what? WHERE?

Ugh, I see it.

You know what? I was one of the first to see that question and I could have answered it. I was just too lazy.

CodesInChaos

But my particle physics prof managed to used the index μ with three different meanings in a single expression

Simon

I left a comment instead.

ManishEarth

@CodesInChaos Yep. So what were you talking about?

@CodesInChaos Lolwut?

CodesInChaos

4:06 PM

Once identifying a muon, two occurrences of one implicitly summed four-index(thanks to Einstein's sum convention) and once as another four-index that's not summed over

or x being both an operator and a variable within the same quantum mechanical formula is pretty confusing as well

Simon

Aren't most phishing and other illegal websites hosted in China?

Adnan

@Simon Just post a freakin' answer and express what you think

lynks

@Simon it really depends on where why are targeting, and on how liberal the laws are. Many eastern european countries have a lot of evil servers.

Adnan

You'll say something stupid, you'll be corrected, and you'll learn something new. That's what I do

lynks

Of course, the Cameroon tld .cm is the most evil tld.

Adnan

4:16 PM

@CodesInChaos But really, why don't you run for mod positions?

Simon

@Adnan Too late. Everything I thought was posted.

@lynks I love Europe.

Adnan

@Simon Oh come on, do you really have nothing more to add?

Not even a small thing?

Simon

Other than he could rent a VPS with a pre-paid CC, setup a VPN on it and not provide any personal information, nothing really.

I'm not sure if he wants to do this though.

Adnan

@Simon Then write that with some links stuff

Simon

I'm so lazy, you have no idea.

Adnan

4:21 PM

@Simon Who cares about him? The OP himself isn't exactly the main reason we write the answers.

We write them for future visitors as well

Simon

True.

Adnan

@Simon Write a sensible answer and if it's good, you'll get the first +1 from me in a blink of an eye

Simon

Alright, alright. Give me 5 mins.

Adnan

@Simon That's what I said.

Simon

Dayum.

ManishEarth

4:25 PM

@CodesInChaos O_0. Indices are confusing

Adnan

4:35 PM

Ah! I feel hurt! Someone -1 my answer

David Freitag

Boar's head; why you so good.

Simon

@Adnan I posted something, let me know if it makes sense.

CodesInChaos

@Adnan I don't want to be on SO, I'm not active enough on security, and crypto didn't have an election yet (and I didn't read the pro-tem invitation in time XD)

Adnan

@Simon Makes sense to me

Simon

Good, thanks for the +1

tylerl

4:50 PM

This annoys me: I post an answer like this:

2

A: Is mt_rand() suitable for generating a salt?

Under most conditions, a salt needs only to be unique, not cryptographically unpredictable. So in that case, yes as long as your RNG is properly seeded. Another common technique to improve salt quality is to concatenate a random number to the current time, then hash that (e.g. SHA1), textually e...

And then this kid comes along and posts a bloody stupid comment about how you shouldn't use SHA1 because it products a birthday collision on 2^80 itnerations.

DO YOU EVEN KNOW WHAT THE HELL YOU ARE TALKING ABOUT?

Simon

Well, he apologized.

tylerl

It's like people read something on a blog somewhere and go on a crusade to demonstrate their knowledge.

CodesInChaos

I crusade a lot

tylerl

Yeah... did you see his apology?

He goes on to talk about using enough rounds and that's not available in PHP or whatever. Cluelessness persists.

CodesInChaos

I think half my downvotes on SO are for hashing related questions

Simon

4:53 PM

Well, you know, maybe he likes turtles.

lynks

I feel like SE sites do get quite a lot of crusading. It's often obvious that someone has just paraphrased wikipedia. I mean sometimes thats ok - an expert might be able to digest something highly complex and give the gist in an answer, but on smaller sites like ours, I feel like our signal to bullsh1t ratio is sometimes in danger.

tylerl

@Simon ?

Simon

@tylerl Success. When you have nothing to reply, confuse the hell out of the person.

tylerl

@lynks I don't mind if you take a stand on one viewpoint or another. But do the world a courtesy by understanding what you're explaining.

@Simon Touché. I am thoroughly baffled.

lynks

@Simon I do like turtles.

Simon

4:56 PM

@lynks So do I, they're so cute.

CodesInChaos

@lynks I'm fine with wikipedia paraphrased answer as long as it fits the question

David Freitag

Half the problem is that people on SO think that they are experts, so they spout what they think is right whether they read it from some random blog or not, regardless of how wrong they actually are.

That's not to say that there are a lot of seriously knowledgeable folks around.

CodesInChaos

I seriously offended a high rep user on SO for downvoting bad crypto answers of his

tylerl

@DavidFreitag There are a few users I wouldn't ague with just because I know that they've researched more thoroughly than I have, no matter what the question or answer (well, maybe just one user with two accounts).

David Freitag

@tylerl Yeah, i mean don't get me wrong, SO has been a learning experience for me. There are some occasions where i stumble onto a question and think, "hmm... you make a good point..." so i end up researching it and posting what i find. That's not to say that this method hasn't backfired.

or rather, the whole exchange, not just SO.

Thomas Pornin

5:05 PM

@tylerl Hey, you should not refrain yourself. Every Whiteface needs an Auguste, if only for plot exposition purposes.

CodesInChaos

@tylerl I occasionally do disagree with bears

Simon

Did he just say that while one of them is around? Oh god.

tylerl

@ThomasPornin OK. How about this: Your expository drama on the lack of email authentication lacked proper character development. You should redo it.

Now I'm an editor!

CodesInChaos

@Simon We had a pretty long argument about DNSSEC and CAs. Fluffy parts of security are much easier to argue about than the technical parts

Simon

@CodesInChaos And you're still alive?

lynks

5:15 PM

heh, nearly a month since I wrote an answer. maybe I'm rusty

anyway, home time. gentlemen o7.

tylerl

@lynks or maybe all the questions people ask now are varaitions on "HOW DOES TEH HACKING WERK?"

Adnan

@lynks See ya

Simon

OMGAWD I'M CLOSE TO 500 REP

Adnan

@Simon See? Hopping on the train wasn't so bad after all

Simon

<3

tylerl

5:19 PM

Aw well. Guess I should start working. :(

Adnan

@tylerl Good luck

@Simon Welcome to the awesome review queue!

tylerl

@Adnan It's a great place to go to lose your faith in humanity!

Woohoo! Thanks!

I'm gonna fall asleep at work if I keep listening to that.

Adnan

5:29 PM

@Simon This should keep you up youtube.com/watch?v=BFtv5qe5o3c

Hava neranenah!!

Simon

Jesus. I open it, view the top comments and it's a religion war. Great.

Adnan

@Simon Doesn't seem like that to me. Have you actually read the top comments?

Simon

The first one is fine, the second one isn't.

He's complaining about people fighting, which sucks.

Adnan

@Simon And now you're complaining about people complaining about people fighting!

Just listen to the freakin' song!

Simon

Doh.

I did!

Adnan

5:33 PM

@Simon Now go back to work!

Yes sir.

Stupid encoding thing.

David Freitag

That should keep you awake

Adnan

@DavidFreitag Damn! Good stuff

David Freitag

5:34 PM

Indeed. It's a shame that google doesn't have it in the play store /sigh

That whole playlist is just... great. There are one or two songs i avoid though.

tylerl

 $ time sync
 real 0m20.800s

well, there's the problem...

Adnan

5:47 PM

Anybody knows how synchronization with a time server works?

If you try to sync and there's a latency, then the syncing won't be accurate

If you try to calculate the latency first, you can't calculate it accurately because the two machines are out of sync

Simon

OH MY FUCKING GOD.

My problem was caused by htmlspecialchars

David Freitag

@Adnan, The time server compensates for latency

Adnan

@Simon This just needs @Terry to tell you something about PHP

Simon

@Adnan Fuck, I despise PHP now.

Adnan

@DavidFreitag How?

tylerl

5:50 PM

@Adnan Yes.

Adnan

@tylerl Would you please recommend some article/paper/book so I can learn about it?

tylerl

@Adnan Divide the RTT in half and you have your average latency. It's not perfect, but it's close enough.

@Adnan ietf.org/rfc/rfc1305.txt

David Freitag

I can only assume by using a request/response cycle, then divide the total time in have and you get a rough guess at what the latenct is

tylerl

Good ol 1992

There's a LOT of math that goes into NTP to get better accuracy than what I just described.

Simon

If I don't get too lazy, I'm gonna look into Python tonight.

tylerl

5:53 PM

OH, look, a newer RFC: eecis.udel.edu/~mills/database/rfc/rfc5905.txt

@Simon One of python's strenghts is that it is remarkably simple to learn. Probably one of the easiest languages. It's "compact", i think is the word

Very Few basic principles

David Freitag

Python? Swiss-army knife.

Simon

Good, that's what I need.

Adnan

@Simon If the language is doing what you want, then it's a good language for the job.

Simon

Even if it's PHP?

Adnan

It's your fault that you don't know how htmlspecialchars() works.

David Freitag

5:55 PM

I don't know if i'll ever get into php. I think i might stick to node.js or python. But you never know.

tylerl

I taught my sister python in an hour. She's a painter with a degree in literature.

Simon

@tylerl I'm no painter though, do you think I can do it?

David Freitag

Lol, sounds about right. Python is nearly as easy as VB.Net. If you couldn't understand python i would be amazed.

Adnan

@Simon Ahhh.. once you've been engaging in head-to-keyboard programming for long enough, you'll now what I mean.

tylerl

@DavidFreitag While Python is one of the easiest languages, JS is one of the most difficult. Not because it's complex but because it's design is horrible.

Adnan

5:57 PM

@tylerl Brilliant! Exactly what I was looking for. Thanks.

David Freitag

@tylerl Yeah, i know javascript isn't great, but i really like tinkering with it. Even though js has a lot of flaws, i (for whatever reason) think it's inherently better than php.

Or rather, i think php is inherently worse than anything else.

Adnan

@DavidFreitag An incompetent developer will produce bad code and bad product no matter what the language is.

tylerl

@DavidFreitag It's not quite the same: JS is crappy because it was rushed, influenced by silly corporate objectives, and targetted specifically at simple scripting. PHP is crappy because it was created by stupid people.

David Freitag

@Adnan While that's certainly true, i think i read some horror stories somewhere about PHP forever ago, now i don't want to go near it with a 10 foot pole.

tylerl

@DavidFreitag It's certainly worth learning. I use it on my own site for a few things, and if you do security you'll absolutely certainly have to read lots of PHP code. But I wouldn't build my business on it.

Adnan

6:04 PM

@DavidFreitag Guess what? I've read horror stories about gun accidents and motorbike accidents. I still ride and shoot (not at the same time).

David Freitag

@tylerl Good to know.

Adnan

I wouldn't give my gun to a SWAGer teenager

I wouldn't give my project to a punk developer

You can screw things up with JavaScript, .Net, Java, or Python, as much as you can with PHP

Simon

So, I can love PHP forever and it will be alright?

David Freitag

@Adnan Yeah, i suppose that's true. Although somehow i got the idea in my head that PHP is an unstable heap held together with duct tape and tears. More or less i think that any problems will be in the language, rather than my code. Which is just naive.

tylerl

@Adnan A major difference is that the way nearly everyone learns to use PHP is directly at odds with security practices. The same is not true with other languages.

Adnan

6:07 PM

@Simon Learn it well, read good code, follow best practice and not W3Schools and their likes, and you'll be fine.

tylerl

You have to fight with PHP to get security. Other frameworks gently encourage security instead.

Simon

@Adnan Well, according to Tyler, 99.9997% or so are bad PHP programmer, do you think I can be the 0.0003%?

Adnan

@Simon If were a bad programmer, you'll write bad code no matter what language you use.

Simon

@Adnan True.

tylerl

@Simon My point was the everyone who wants to learn to code learns PHP first. And they suck at it. And then people pay them to write code and don't know any better.

Adnan

6:09 PM

@tylerl PHP has gazzilions of fameworks to choose from. Database manipulation, security-related stuff, etc.

@tylerl And that's PHP's fault because?

It's an easy language, people learn it first. Well fuck PHP then!

tylerl

@Adnan I didn't blame PHP for that. PHP has plenty to blame for other things. Like for example mysql_real_escape_string

Adnan

@tylerl You probably have to fight with PHP to get security, I don't.

David Freitag

@Adnan Which is funny, because despite my feelings about PHP i still regard it as one of the most mature server side language.

Simon

@tylerl What's wrong with my favorite super SQL injection-proof function?

Adnan

@tylerl PDO has been around for years, it's your fault for not learning about it.

tylerl

6:12 PM

@DavidFreitag The maturity may be be part of the problem. Same goes for perl, which is more mature still.

Adnan

@tylerl Aha, great. Now we're getting somewhere. In that, I agree with you.

David Freitag

@tylerl Yeah, but i think to some extent people think that maturity and stability, reliability, and security come hand-in-hand.

Adnan

But just strawmanning (aunt sallying) the issue isn't really fair.

tylerl

If you're looking for a mature programming language, do your web development in C.

Simon

I'm not suicidal.

tylerl

6:14 PM

It's older than you.

Simon

@Adnan One day, we're gonna rule the world with PHP.

David Freitag

This is true, although saying something is older than me isn't really fair. Pretty much every language has been around since before 1992.

tylerl

@DavidFreitag Not PHP

Adnan

First things we teach interns here is security-ware programming. Regardless of the language, you can still append parameters to your SQL query strings

Simon

It's also one of the first things they should teach you at school.

Adnan

6:16 PM

@Simon Nah, no need to. Let's just teach people Perl and Python.

Security comes built-in with those

Jesus!

Simon

Built-in security? Just like Windows?

Wow!

David Freitag

@Adnan I'm a fan of teaching everyone python. It's simple enough to understand, and it build a great knowledge of problem-solving. The average person is so computer illiterate it's ridiculous.

Simon

I'm gonna have to find a SQL masterclass in Python though. There's no way I'm going back to mysql_fetch_query and stuff like that.

tylerl

@DavidFreitag Oh. Just realized this: Python and Ruby are both older than PHP. And of course so is Perl, since PHP was first written in Perl.

Simon

Or maybe I should just make my own, that'd be a great way to introduce me to the language.

tylerl

6:19 PM

@Simon make your own language?

Simon

@tylerl Haha, no. My own SQL superclass.

tylerl

@Simon Aw. I was going to give you some pointers.

Adnan

When you write a = "SELECT * FROM table WHERE id = " + request.GET['id']

In Python, it automatically converts it to a prepared statement with parametrized queries

David Freitag

@tylerl I knew ruby was older than PHP, but i didn't know about python. I guess i have a lot of wrong information about PHP in my head. Maybe i should learn PHP after all (if not for just security i mean).

CodesInChaos

I don't really like any language I've learned so far

Simon

6:20 PM

@tylerl Like "don't do it"?

CodesInChaos

too many sucky type systems

David Freitag

@CodesInChaos Use a language that isn't strongly typed.

tylerl

@Simon Well, I was going to mention looking at Rust as a good example of how to get started quickly. They use LLVM for code generation which does a lot of hte heavy-lifting for you.

Simon

@Adnan Really? That's neat.

CodesInChaos

@DavidFreitag Weak and strong typing are very ambiguous terms. What do you mean with them?

tylerl

6:22 PM

@Adnan Which framework? Certainly not just straight Python strings.

Adnan

@Simon Of course, it also automatically prevents XSS and it even handles your password hashing

CodesInChaos

i certainly want static typing

Adnan

@tylerl What? It doesn't? Really? It's just like PHP? Nooooo

and if you combine Python and Perl, they even automatically setup your server and install all the patches

tylerl

@Adnan Maybe one of the ORM frameworks does it. It's certainly well within the capabilities of the language.

Simon

@Adnan Man, Python is so strong. I bet that when a newer hashing algorithm comes up, it converts all the hashes into a new one without the original password.

tylerl

6:23 PM

You just overload concatenation

David Freitag

@CodesInChaos Weak and strong type aren't ambiguous i just don't think you understand what it means. A strongly typed language (C, for example) each variable has to be explicitly defined using a data type. A language without strong typing (javascript for example) you don't need to define a variable with a type, it does it on the fly.

Adnan

@Simon The code even automatically converts itself into encrypted strings to prevent reverse engineering

and if you try to use some advanced debugger, Python code just removes itself

David Freitag

Just because a language isn't strongly typed, doesn't mean that there aren't static data types behind the scenes.

Simon

@Adnan Wow, just wow.

I gotta learn Perl and Python then.

Could they take over the world though?

David Freitag

@Simon Lol, do them all at once, make it fun =]

CodesInChaos

6:25 PM

@DavidFreitag I've heard many definitions for strong and weak. I prefer "dynamic", "implicit static" and "explicit static" in that context

Adnan

@Simon Oh you have to. Once you learn them, you automatically become Like become a security expert.

Simon

Like they could update themselves and turn your server into a robot, literally.

tylerl

Python first. It's easier. Perl is write-only. Reading someone else's perl code is like reading hieroglyphics.

CodesInChaos

then there is what kind of implicit conversions are allowed

Adnan

@Simon No, of course not. Because there's a conspiracy by the bad people to keep the good languages unknown and weak.

They're being paid with baby blood by the PHP dev team

Simon

6:26 PM

@Adnan And I thought reading WAHH would help me to understand security more. All I needed to do was to learn those languages!

Adnan

Well, that last one might be true. I really don't like the PHP dev team

CodesInChaos

While c uses explicit static typing, it's pretty weakly typed IMO

David Freitag

@CodesInChaos I suppose, but you get what i mean. Try messing around with JavaScript (If you haven't already) Its a bunch of fun not having to deal with types. Obviously use common programming sense though...

Simon

@Adnan Haha.

tylerl

@Adnan You'd like them less if you tried to work with them ;)

CodesInChaos

6:27 PM

javascript is lua gone wrong

Adnan

@tylerl I have made many patches for PHP throughout the years. Trying to collaborate with those people is a PAAAAIN.

David Freitag

Speaking of languages that seem intriguing, anyone ever delve into F#?

tylerl

@CodesInChaos Javascript was designed, implemented, and released in only 10 days to head of Microsoft from making something worse.

CodesInChaos

F# is next on my list of to-learn languages

it's probably a bit better than C#, but not good enough

Adnan

@tylerl and heaven is real.

David Freitag

6:29 PM

@tylerl But, despite JS's flaws, its still pretty fun to mess with. I wrote a few Chrome extensions to adjust websites that i didn't like by mangling their html with js.

F# is... weird... the notation is like nothing i've ever seen before.

CodesInChaos

IMO golang has some interesting ideas, but static typing without generics/templates isn't nice

in particular I like golangs mix of duck typing and static typing

tylerl

@Adnan You don't believe me?

Adnan

@tylerl Source?

tylerl

Brendan Eich, the guy who did it

jwz.org/blog/2010/10/every-day-i-learn-something-new-and-stupid/…

David Freitag

You should learn brainf*ck, you will never have to worry about types again =]

CodesInChaos

6:32 PM

One day I'll design my own language

but before that, there are still some languages I need to learn

David Freitag

That would be an insane undertaking.

CodesInChaos

sanity is for the weak

Thomas Pornin

@DavidFreitag It is just a descendent of SML / OCaml with a side dish of .NET.

tylerl

@Adnan jwz, by the way, is Jamie Zawinski -- one of the other guys who was there. That's why Brendan reads his blog.

David Freitag

@ThomasPornin Yeah, but my background is native C/C++ that looks like gibberish to me. I think it would be an interesting language to learn.

CodesInChaos

6:34 PM

I managed to get one of my friends into F#, but didn't get around to really learning it myself

Thomas Pornin

@DavidFreitag It has been said that Scheme is "the Lisp which wants to be like SML" so you could learn Scheme to have some notions of SML.

tylerl

@CodesInChaos I agree. I really like what Go has done with typing and interfaces. There's some implementation details that get in the way of me using it for anything serious, but the idea is very strong

Thomas Pornin

The main idea behind SML and its ilk was to support a mathematical construct called the Curry-Howard isomorphism.

David Freitag

Sounds very application-specific.

Thomas Pornin

This allows for static typing with type inference, which is neat and powerful until the moment you realize that it does not really exist.

Of course, when there are objects dynamic typing enters the room again, and you lost the practical advantage of static types (namely, the ability to have strong, unescapable types without needing corresponding runtime information).

tylerl

6:39 PM

@Adnan Oh, and this has to be quoted for posterity. The way he talks about the language he himself developed is funny as hell:

> Yes, it was there from the start. But bignums were not in the cards. JS had to "look like Java" only less so, be Java's dumb kid brother or boy-hostage sidekick. Plus, I had to be done in ten days or something worse than JS would have happened.

Thomas Pornin

So do F# for learning, but it has little advantage over C# for production.

Adnan

@tylerl Nice conversation they have there. Thanks for the link

CodesInChaos

it's a bit more terse, especially when you like immutability

and it has some useful types like discriminate unions

David Freitag

@ThomasPornin I thought F#'s major advantage was parallel processing? IE: graphics card manipulation.

CodesInChaos

interactive use of F# is nicer than interactive C# as well

Thomas Pornin

6:41 PM

@DavidFreitag You get possibilities for parallel processing when you have strong types, but that's not really tied to a specific language. I have seen it done with Fortran.

tylerl

@DavidFreitag You can get parallel processing anywhere. The advantage with functional programming is that it's declarative, which means that the framework can decide how to run it. Parallel or otherwise.

kinda like SQL for progamming

David Freitag

But i thought the literal purpose for F#'s existence was as a framework to make parallel processing easier..

Simon

One day, I'm gonna be a huge nerd and will understand all this stuff.

David Freitag

For example, write an F# DLL to manage the parallel calculations then import it into an application.

tylerl

@DavidFreitag I think it was a stated goal, yes.

CodesInChaos

6:42 PM

IMO the main point of F# is that it's a functional language with type inference that integrates well into .net

David Freitag

I see. Besides if i had some huge brainpower necessary project, i would use OpenCL or the like.

nealmcb

20

A: How to securely hash passwords?

Update 2: In 2013, several experts initiated a Password Hashing Competition which should result in improved and more usable methods, with winners selected by 2015. For excellent background on the need for that, and good advice in the interim, see Password security: past, present, future from Pas...

CodesInChaos

for high performance computing, the rather weak .net JIT is certainly a handicap.

nealmcb

News on the password hashing front. Can someone approve my tag entry? security.stackexchange.com/tags/passwords/info

tylerl

@DavidFreitag F# came into existance when functional was making a big resurgance. goopy-functional was just released, scala was getting traction, erlang was touted at conferences. Microsoft needed a functional language.

David Freitag

6:46 PM

That makes sense. If there is something Microsoft doesn't have, they either make it or buy it.

Simon

Have you guys ever run into a PHP exploit that displays the code of the page instead of the result of the script?

David Freitag

Someone should bring Microsoft up on a lawsuit for false advertising. Their software is hardly Micro

CodesInChaos

@Simon yeah, ran into that a few years ago

some browser game spat out its source code one day

ManishEarth

@Simon echo file_get_contents(__FILE__);?

tylerl

@DavidFreitag The goopy-functional bit was more important than it sounds. The undertone was the Google was powerful because they understood functional. They invented distributed map-reduce which was something of a secret weapon and showed just how much smarter Google people were than Microsoft peole

Thomas Pornin

6:49 PM

@nealmcb This reminds me that I have an article to write and to submit there.

Simon

@CodesInChaos Cool. My boss keeps talking about it and uses the exploit as an argument to store credentials somewhere else on the server, which makes sense.

CodesInChaos

Luckily LINQ gets the sequence transformation part of functional programming into C#

Simon

@ManishEarth Nah, you would browse the webpage and the code would be displayed.

ManishEarth

@Simon as in?

nealmcb

@Simon Howdy! "There" being the conference? Competition?

David Freitag

6:50 PM

@tylerl I see, it wasn't necessarily about market dominance, more or less Google was 1-upping Microsoft. Good work Google.

ManishEarth

But once you have the code you can get the creds anyway.

CodesInChaos

@ManishEarth The server suddenly decides to treat php files like it'd treat html files

ManishEarth

@CodesInChaos oh that. I thought PHP injection

nealmcb

@ThomasPornin Oops - meant that for Thomas....

Simon

@nealmcb Yeah, you got me thinking for a sec.

ManishEarth

6:51 PM

Well, won't that require you to bork the .htaccess?

CodesInChaos

that's why you should store your credentials in a php file outside the directories accessible through http

Thomas Pornin

@nealmcb The competition. I have imagine a conceptual thing for a way to hash passwords and I think I have an idea about a practical realization.

Simon

@CodesInChaos Yup, that's what I'm doing right now.

CodesInChaos

Another important part is to ensure that the database access the application uses isn't exposed to outside hosts

for example with a single sever php+mysql installation you can simply deactivate remote login for that mysql user

David Freitag

@CodesInChaos Doesn't mysql have remote login disabled by default?

Simon

6:55 PM

@CodesInChaos Localhost as the host, yes.

ManishEarth

@DavidFreitag usually you make users as username@host, where host is localhost

CodesInChaos

it has been a few years since I used mysql, so I don't remember the details

only that we had some users for manual remote access, and a local only user for the application

David Freitag

Right, there is no remote login by default, because it listens to localhost by default, but once you change what mysql is listening on... I see.

ManishEarth

@DavidFreitag Hmm, I'm not sure if creating a user manish@* or manish@ipaddress would automatically make it listen

CodesInChaos

I think there was a per-user flag to allow remote login

David Freitag

7:00 PM

@ManishEarth It wouldn't, iirc when you install MySQL it adds the "mysql" user, then you can flag each user for remote access. I just meant that while MySQL is listening on localhost there shouldn't be any remote access..

Simon

@CodesInChaos Yes, you can set user@'%' to allow any host.

David Freitag

You should be able to whitelist/blacklist for access with mysql.

tylerl

8:33 PM

sigh. Running Windows on a server is a weird combination of "saving costs by not having to learn anything new" and "spending vastly more by not using the most efficient tool for the job". It's a weird bit of corporate-think.

I wish my customers would quit it.

In the mean time, my cell phone is more capable then half the things i see racked in datacenters.

David Freitag

9:21 PM

I don't think i would ever use Windows Server unless i had to. It just seems like a bot waiting to happen.

David Freitag

9:36 PM

►

Listen to all of it, let your ears thank me later.

tylerl

9:48 PM

@DavidFreitag Very nearly 100% of the cases when I see people using Windows server is when they have an app written in .NET that they want to host. There doesn't appear to be any other excusable reason.

David Freitag

Well, at school we use it to understand how things work, but that's only because we get it for free through MSDNAA. We don't only use linux.

But other than that i don't see the point, linux is easier to deploy, update, secure, configure... you name it... linux is easier. (You know... accept getting an infection).

TildalWave

So we again had an easy pickings rep train and I again missed it... I see a pattern forming here :))

Transcript for