Damn, that's one long transcript...

@StackExchange evil

Dear newly-registered user: if your gravitar is a guy fawkes mask, then you are an asshat.

bloody hell

WHAT.THE.HELL.HAPPENED.

WHAT did you guys DO here last night???

reading the transcript makes me feel like I woke up pantsless on the couch with a hangover and my arse all sore and sticky.

I've found out that XORed LCGs seem to surprisingly random. [my impl. passes 1 to 14 of the dieharder tests, except for 15 for which the result is "weak".]

I wonder whether it could be cryptographically secure.

[the security relies on find a and b in the equation system a|b = value_1, (constant1×a mod constant2)|(constant3×b mod constant4)

it says 1146 under my username, but my reputation can't be 1146, lemme investigate

oh, that's all my stackexchange account's sum I think

I know how to solve equations with just XOR or just mod, but both in combination seems to be difficult to solve (I don't know any better way than brute force to solve it)

[optimized brute-force = O(2^n), where n is the number of bits of a]

@RamchandraApte Are you joking or serious?

I'm serious.

You said it doesn't even pass dieharder, so it can't be secure

? I said it passes 1 to 14 of the dieharder tests, except for 15, for which result is "weak" (I only did 1-15 of the tests)

A secure stream cipher must by definition be indistinguishable from perfectly random data.

passing all statistical tests (like dieharder) is a necessary but not sufficient criterion

correct

so basically I want help from you people to crack it

[break]

you said that it fails at least one statistic test, so you broke it yourself already

it doesn't fail, the result is "weak" [quoting the output]

could be because I didn't give dieharder enough input

then give it more input.

[I gave it 50million 32-bit integers]

shall I pastebin the ugly implementation?

g2g lunch °͜☺°͜

hi

I'm revamping our CRM system that we wrote with LAMP. One thing we are rethinking is the permissions and roles system. Every user has specific privileges to access certain pages and see certain things. In some instances, certain page subelements are restricted by roles as well. What is a good authentication system design that is suitable for this type of usage?

@lamp_scaler zend_acl may be worth putting on you research-list for consideration

@lamp_scaler the simplest way, with best support in the frameworks you're likely using, would probably be a mix of DAC and RBAC. not exactly my favorite, but simple.

@Cheekysoft @AviD I'm using CodeIgniter right now

@AviD a mix of DAC and RBAC?

@AviD what's wrong with pure RBAC?

@Cheekysoft is zend_acl a pure ACL or is it RBAC?

@lamp_scaler well it sounds like there are sections that are permissions per-user. Obviously RBAC wont cover that...

familiar with this:

@AviD I dont think there will be. Everyone must be assigned a role.

@lamp_scaler assigned a role, sure. But do all privileges flow from that?

@AviD but roles have hierarchy though. Like a sales director can see certain things that sales manager cannot, but there is an inheritance going on.

@AviD what do you mean by if all privileges flow from that?

you said "Every user has specific privileges to access certain pages and see certain things." I assumed thats what you meant...

@avid oh sorry to confuse. what i meant was these users have roles and each role have specific privileges.

@lamp_scaler is it ever the case that a specific page or element has a list of named users that can access it? Or even a list of named roles?

@lamp_scaler okay, so if thats the case, the simplest form would be straight RBAC. Or, if you dont mind some increased complexity, Hierarchical RBAC...

yes. for example the customer information page for certain types of customers can only be accessed by the sales rep role and anyone managing the sales rep (i.e. managers and directors), but not anyone else from other departments.

@AviD is it better to define these roles and permissions hardcoded into the source or put into a database?

@lamp_scaler definitely not hardcoded. These things will change, they always change.

there will be some overhead - both in performance and in administration (not even counting development) - to keep it dynamic, but it is almost always definitively worth it.

now the question is - in the database, or some external system.

That depends a great deal on a lot more context.

external system e.g. an IdM platform, or XACML product, or custom LDAP schema, or "entitlements management" product (aka EAM), or something else... etc

lol LDAP

every time I see someone use LDAP for webapp auth, I break it somehow.

@Polynomial of course. Because programmers dont understand LDAP.

/* The weird feeling you get when you step in a room full of strangers and don't know what to say. */

but then, I usually manage to break the webapp auth, no matter what tech they use.

LDAP does have some good charateristics, depending on context, especially for auth.

> Of course, I'm not wearing any underwear.

Works every time. Of course, the question is what it is that you want to work...

@e-sushi story of my life

@AviD the other story of my life

@e-sushi We're all naked, so you should feel even more awkward.

@Polynomial dang! how did you know

@Polynomial At least we're all naked in the same room then. #rofl

@UV-D I always know.

@Polynomial I wondered who owned that camera floating around me

@UV-D Oh sorry, that cam is mine. ;)

@UV-D Sam Fisher. It's his TriRotor.

boys, try not to let the chat get too weird again. Yesterday was really more than enough.

@AviD now I am intrigued

@AviD First time here, so if there are any "rules of conduct", this would be the perfect time to stop me from making a fool of myself. 8]

@e-sushi oh no, not at all. Making a fool of yourself is practically required by our rules of conduct.

@e-sushi Rule no. 1 Don't speak of the DMZ

Note the room's tags...

Rule no. 2 Don't speak of the DMZ

of course, there is the common SEI rule of "Be Nice", that some folks here need to be reminded of once in a while...

Problem is lately some of the kids here have been taking it a bit too far.

Rule of thumb: Keep it in good taste.

kids? how are baby goats posting???

Talk about @Simon's mom all you want, but dont share intimate details from your evening with your girlfriend.

Unless your girlfriend happens to be @Simon's mom.... ;-)

@AviD so no nudity seeking flying trirotor cameras?

@avid Right... so, aside the usual "keep it friendly" netiquette I can dump anything from securing my food resources up to libations (Geez, being German... I actually need to go translate that one).

;)

@UV-D thats fine, with the NSFW warning of course, but dont get personal...

@e-sushi those are actually pretty close...

@AviD no problems with that, the UN has already banned me from swimming topless

and we tend to keep it questionable on the friendly part, too... ;-)

@AviD so what happened yesterday?

@lynks read the transcript....

@AviD Sounds like an average infosec day at work. ;)

@e-sushi oh yeah, exactly.

@AviD I thought I had done. Before or after the brief hour or so I was here?

dunno. Came back this morning and... well, see the starwall.

I guess now I truly have seen the gates of hell... people actually talk about "XORed LCGs" being cryptographically secure around here? This place is intriguingly scary and inviting at the same time.

I see some interlopers come and flag everything, a brief religious conversation, but nothing out of the ordinary..

maybe Im just numb to this room

I thought you should all be aware that I am currently stuffing my face with bacon

@kalina pony bacon???

no, real bacon

I think I would love bacon. Good thing I cant eat it - I dont think I would eat anything else. Ever.

I am only a part time vegetarian

I eat bacon and chicken infrequently, and steak once in a blue moon

@LucasKauffman A tad expensive? Christ!

Going there with someone 4 times is basically my salary

That's very expensive

Then again, Paris.

mmh Paris

south of France is better anyway

@AviD What? What does that even mean? looks left and right

@kalina South everything is better anyway.

@e-sushi Whoa! You're here!

Many times I wanted to invite you here

so, about ponies

@e-sushi You're the guy who had that smiling photo.

@kalina Yeah, sweetie. What about them?

I am right in thinking that posting ponies to chat is a flaggable offensive in here, yet posting walls of ascii art is perfectly ok, right?

so what if I posted an ascii pony?

@David Everything was up and running in 30 minutes. Though it was a bit strange the whole night.

@kalina It does constitute as posting a pony. So, flag.

@Adnan Hi there. Yeah, I finally managed to dive into the chat... and so far, I survived (at least that's what they tell me).

@e-sushi you still seem to be polite, give it time

@e-sushi Are you on a PC right now?

@kalina Oh, come on! We're all polite here. Especially me.

@Adnan hah!

@Adnan what if it is ascii art of a pony's genitalia?

actually, in fairness, this is hardly the comm room

@AviD GTFO!

I regret saying it already

lol

@Adnan Yep - PC.

Why? Wanna hack me? ;)

Let me shut down my firewall first...

@e-sushi Here's a tip. When you hover over a message, a little arrow will appear. Click it, and then choose "Reply". That way the other person knows to which message you're replying.

I don't think it can be done on mobile, so that's why I asked you if you were on a PC

@Adnan Great tip. Thanks!

@e-sushi TWSS

rolleyes

@Adnan Oh great, now I feel like a noob. What does TWSS stand for? (I've learned Twitter-Speak etc., but that one is new to me.)

that's what she said

someone teleport a cheeseburger to me

I'm hungry.

connection timed out

guess I'll eat it myself

@lamp_scaler @lamp_scaler excuse super-slow reply; zend_acl does support taking a role-based approach.

@Cheekysoft needs more lamp_scaler

@kalina :-D

@Adnan I mean, "That's What She Said" wouldn't really make sense. ;)

@e-sushi Awww.. you're so pure and innocent.

@Adnan Yeah right, but now please don't try to rape me as a consequence. #rofl

@e-sushi I'll have to be honest with you, I don't think rape constitutes as a joke in any way shape or form.

@Adnan Didn't want to step on any toes... it was merely my cynical attempt to describe that I feel like a DMZ virgin.

@Adnan what if it is a pony being raped?

@kalina you're right, ponies do make everything funnier.

@AviD Pink-tailed or regular pony?

@e-sushi does it matter????

@AviD Depends on how much plastic one can handle. ;)

okay, yknow what, I am taking back my comment. You have shown me how horribly misplaced it was. My apologies to the rest of you.

@AviD Same here... please think of me as yet-to-be-adjusted with a sprinkle of too much optimism.

Wife home, gotta go... best to all. I'll be sure to check back in frequently. /* As if anyone would care. ;) */

@e-sushi "check back, infrequently" or "check back in, frequently"?

Big difference.

@AviD The later... unless you would rather see me check in "infrequently". ;)

couldnt care....

@AviD Couldn't or wouldn't?

@AviD /* pushing the limits */

well, if I could, I might...

couldnt even if I tried, which I wouldnt, cuz I cant.

@e-sushi at least you have an understanding of the subject matter

@AviD Something tells me I desperately need my coffee now…

@e-sushi ooo coffee.

cream soda is best coffee

@kalina oo cream soda

Man, I enter The DMZ and there's talk about raping ponies. Typical.

@kalina Elaborate, please.

@TerryChia What did you expect from such perverts?