« first day (195 days earlier)      last day (4675 days later) » 

1:36 AM
@Mvy Indeed those new PGP/RSA/HSM questions are a dup by the same author within 30 minutes. And for some reason no one even mentioned it on the question until I just did.
4
Q: Use RSA keypair for PGP encryption and decryption

t678Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some keyrings and some pgp keys. And I haven't found anywhere why they are different? Why I am asking...

Can someone merge them?
 
2:18 AM
I was trying to convince myself they were different enough to leave alone. Or pick which one should be closed in favor of the other.
Merging is probably the right solution. I like his second question better, but the first one had the activity.
 
 
5 hours later…
7:04 AM
well @nealmcb I usually just flag them. no comments or downvotes.
@Scott I've doubted 30 seconds. But It's pretty evident that the intention of OP is the same in both questions.
 
 
2 hours later…
9:18 AM
did someone know where I can found a public description of A5/1 cipher? with test vectors?
Found the LFSR configuration, and have neraly done my implementation, but with no tests to verify...
 
 
3 hours later…
12:28 PM
 
 
5 hours later…
5:52 PM
<chirpy cricket>
 
the crickets are because people are writing blog posts
...right? (:
 
6:09 PM
@RebeccaChernoff All I've seen is discussions and cloak-and-dagger references. So what is up? Who has access?
 
@nealmcb blog is up, @RoryAlsop and @AviD have been added as admins.
 
So far, I've spent 4 of my 5 work hours in meetings
/me sighs
 
and writing a blog post is just what you'd like to do now?
I'm so going to get rotten tomatoes thrown at me, aren't I?
 
6:25 PM
@RebeccaChernoff Only until @avid and @RoryAlsop start handing out editor and author accounts, and we start figuring out how to run this thing :)
 
you don't really need an actual account to start writing (:
 
@RebeccaChernoff Excellent point. But there is something so tangible about having a shiny new tool and role to play with at the same time.
 
you have a shiny new toy, tis at security.blogoverflow.com (:
 
@RebeccaChernoff Is there any integration in authn systems between the blog and SE? Or do you just suggest that folks use the same openid that they use now for SE?
 
tis just wordpress, email+password
 
6:30 PM
@RebeccaChernoff Indeed, and I'm the only user to date (via a comment). But that is the limit of my current powers, as I understand it.
 
Ok...so let's say I add your account right this second. You know what post you're going to start writing? Or do you need to think about it?
 
@RebeccaChernoff I plan to start by highlighting some of the password- and authn- related questions.
 
not picking on you of course, just have seen people think they can't do anything until the blog is up and they have accounts...and then they sit and stare wondering where to get started (:
 
@RebeccaChernoff Spot on. Your approach is indeed working, as I struggle to respond to your queries :) Ok, I started sketching it out....
@RebeccaChernoff ....but as I collect things to link to I want to know what markup to use - markdown?
 
the only reason you'd have to sit and twiddle your thumbs is if there isn't going to be a blog (which isn't an issue since I've set it up), or you think the admins won't give you an account (are you on their naughty list? q:). So...you could write post after post after post after... (;
ok that's a fair question...pretty sure the markdown plugin is activated on the network
 
6:44 PM
@RebeccaChernoff That would be nice. I love composing stuff on SE because of the real-time preview. So given compatible markup languages, I could enter it here, then copy/paste.
 
yup, you can use markdown
 
7:01 PM
@nealmcb I2 is doing a webinar on InCommon right now if you're interested.
 
And in particular it is about the certificate service - cheap certs for research organizations and higher ed.
 
Oh yes, for the peanut gallery :)
We moved to them as our provider at the beginning of the year. Nice to see stuff like this to get a better idea of what's available.
 
Posted by Alex Miller on June 29th, 2011

Jeff & Joel are joined by Steve Karantza, better know as Shirlock Homes, our #1 user on the DIY Stack Exchange.  Steve is also our first non-programmer oriented guest on the podcast!

Join us next Tuesday for a special surprise guest!  Not to mention, audio mixing provided by our very own Jason Punyon.

Stack Exchange Podcast – Episode #10 w/ Steve Karantza by Stack Exchange

Name (required)

Mail (will not be published) (required)

Website

 
8:00 PM
@RebeccaChernoff I figure we'll want a q/a place to put "meta" discussions of running SE blogs. Do you recommend anywhere in particular?
 
your meta? example question?
 
I assume the various sites will want to share expertise on wordpress, promotion and management ideas, etc.
ala meta.stackoverflow.com - I guess we could just use that for now
 

Stack Exchange Community Blogs

For anyone wanting to help or participate with the Stack Excha...
 
@RebeccaChernoff Chat is fun, but not good for recording q/a But great for asking this question :)
 
8:34 PM
Good evening
 
Saluton
 
Wordpress theme looks good - will get some content added in. Am I correct in thinking we can add all the folks who have volunteered under the author role?
 
@Rory!
 
8:48 PM
@Scott!
 
Has the theme not been published yet?
 
It matches the blue, and the general stackexchange beta look
 
Ah, ok.
 
we do need to think about sorting out security.se look and feel soon, our numbers are going the right way
 
yeah, the blog is a sketchy theme like the site
@RoryAlsop if you have any suggestions, um, I'd post them quickly.
 
8:50 PM
So when the site has a big boy theme, will the blog be reskinned to match?
 
not saying a thing
 
heard nothing
 
@ScottPack yes. may not happen immediately, but yes.
 
@RebeccaChernoff As a state employee, I can certainly relate to "may not happen immediately" (:
 
@RebeccaChernoff :-) ah - will get a quick meta post up asking for thoughts and graphics...nudge nudge, wink wink, a nods as good as a wink to a blind bat
 
8:52 PM
hums
 
whistles
okay, tries to whistle but instead comes out phhthhb....
 
The band's back together!
@AviD My wife has that problem too.
 
dang never could manage to whistle, since I was a kid...
@ScottPack we're on a mission from god!
howya'll doin?
 
Are you allowed to use that word?
 
lol
@ScottPack cuz the rest of you will stone me for missionizing?
hardly likely.
 
8:54 PM
I'm always game for a good stoning
 
@ScottPack she's a witch!!
 
It's a fair cop
 
:-)
0
Q: In planning for that time when we leave beta, we need a visual identity

Rory AlsopOne of The 7 Essential Questions of Every Beta. This one is pretty straightforward. Solicit contributions, throw out ideas, post preliminary (or finished) designs, and be supportive and respectful of other people’s ideas and creativity. We have designers on staff to come up with site designs bu...

 
have I mentioned to everyone here that I hate fortify?
@RoryAlsop oo, are ya planning a party sometime soon?
oo, we should have a launch party!
 
I concur.
I figure we're all about the shameless lazy promotion here.
 
8:57 PM
@ScottPack I dont think SEI will spring to fly us all to ohio.
London, maybe - but not ohio.
 
@AviD I do have a launch party coming up in August, but that's for my new album :-)
(someone mention shameless promotion?)
 
@RoryAlsop Are there samplers anywhere?
 
@RoryAlsop oo fun. consider my panties tossed your way.
 
@ScottPack I will pop up some of the new mastered stuff somewhere accessible. The old stuff is always aavailable from www.metaltech.me (and we add unofficial stuff in domain/Music)
@AviD nice, thanks!
 
@RoryAlsop Excellent. Do you guys do digital sales or physical only?
 
9:00 PM
mostly digital, but we are doing special deals on physical media goody bags (with CD, t-shirts, badges and stickers :-)
 
@RoryAlsop do groupies still do that....?
 
mine do...
 
@RoryAlsop lol. need a roadie??
 
@RoryAlsop Are you usually doing laundry at the time?
 
@RoryAlsop besides me, right??
 
9:01 PM
@AviD @Scott - hahahaha
the cool thing about my band is we can go on tour with just my car. The stage crew we were assigned at the festivals last year seemed very miffed they didn't have anything to do
we each take a rucksack and a couple of guitars on stage and that's it
I DI straight into venue backline from my pedalboard
 
sorry to go offtopic here, but is this q a dupe?
3
Q: Is vlan considered a security feature?

Dog eat cat worldThis topic came up in a discussion about network infrastructure, where a company had moved from separate physical network zones to virtualized zones using vlan technology. My colleague stated this was a security feature, where they trusted the technology to efficient separate zones the same way ...

dupe of the one the other @rory pointed to...
10
Q: Why do people tell me not to use VLANs for security?

jtnireI've been told to post on here instead of Serverfault, as you guys are security pros As per title, why do people tell me not to use VLANs for security purposes? I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have ma...

 
aye - I reckon it may well be
 
I would have to agree.
 
and thats unanimous.
I gotta say though, the new q is better written.
 
so @AviD - the wordpress does make it easy to set up editors etc, so we can spread the load on that, but I'm off on this charity thing until Monday so I'm thinking I'll add in all the folks who volunteered as Contributors, which means Admins and Editors can review and publish their posts
 
9:08 PM
@RoryAlsop excellent
one thing we didnt clarify, how much guidance / rigidity do we want in topics planning.
 
By the way, I would definitely be willing to review items. With my time being what it has been lately I just don't feel comfortable agreeing to contribute.
And leaving. Ta.
 
@ScottPack ttfn
 
OK, so what is our blog workflow? I'm starting to cobble a post together. I don't know if I'm an author, editor or some combo. Here is the link to my preview:
Who can see that? Can I put it in a queue for approval by someone else?
 
currently Avid, SE admins and I can see it
you are in as an Editor so you can create, publish, edit
 
@AviD have you seen the suggestion on meta from @KronoS ? Question of the week would already be "on topic" anyway.
 
9:16 PM
the other folks I have invited in as Contributors, which means they can create, but a post needs to be reviewed and published
 
@RoryAlsop Can we set it up so everyone requires approval by someone else?
 
having a look at the wordpress rules just now
 
@Ninefingers no? looking now.
@Ninefingers our meta?
 
@RoryAlsop By the way - thanks for that, and keeping things moving!
 
9:18 PM
@nealmcb I don't think there is that sort of workflow. I can't find it in the docs
 
@Ninefingers ah, nice idea.
hmm, I get notified of new meta q's, but not a's.
 
@nealmcb Well, trying to get what I can done before I am on mobile only for the long weekend
I think the editor and admin roles just need to be disciplined - and we can ping each other for a review request on chat, maybe?
 
@RoryAlsop that sounds fine.
am I an admin? Cant seem to figure out how to approve @nealmcb's post.
 
@RebeccaChernoff Oooh - useful. So for contributor roles it is straightforward - I just don't see that functionality for admins/editors
@AviD don't approve it yet - -he has only drafted the first bit:-)
 
9:22 PM
@RoryAlsop well duh :).
but wanted to figure out how.
 
you just go into it in edit mode as you usually would, and publish:-)
 
ahhh, in edit mode? how intuitive.
 
hahahaha
 
hmm, looks like theres a lot of buttons to play with there.
 
Do we want to use categories, tags or both on posts?
 
9:24 PM
okay, i'll bite: whats the difference?
 
@Rebecca et al talking of Wordpress and Security, have you seen Steve Lord's presentation...
 
I'm just blurting questions, not doing research here :/
 
is that like "folders" vs. "labels" (ala in gmail), or something even less spectacular?
 
9:25 PM
I only know about tags:-)
 
@RoryAlsop oo, should we declare openhouse on pentesting the site?? ;)
 
hahahahaha - best not without permission
@Rebecca...?
 
btw @nealmcb, since it looks like yours will be the first real post, can I suggest some "introductory"-ish type text?
 
just how are those passwords hashed anyways...
 
hi @Caleb!
 
9:27 PM
@Ninefingers Right on....
 
Ahhh - now I'm settled. With a nice 12yr old Singleton from Dufftown...
 
@AviD Uh, hey.
 
@AviD Do we want to actually draft an intro post separate to @nealmcb's one and pop it up as the first page, that way we don't dilute a security post:-)
 
@AviD Must be a quiet day on the battle lines, it looks like the security crews are shooting the breeze.
 
9:28 PM
@AviD hahahaha
@Caleb aided and abetted by whisky
shooting the breeze while kicking off our security blog!
 
@RoryAlsop hmm, could be a good idea, but then I dont have much experience with running a blog - it will be basically a content-less post, no?
@Caleb ah, its always like this here - in fact, we're a lot more ontopic today than usual :D
 
I'm sure I can manage a content free, fluffy one. Gimme a few minutes
 
@Ninefingers The theory is "phpass" which is pretty good as I recall: php - How does wordpress password hash work? - Stack Overflow
 
@RoryAlsop Eh? Is there anything to see? We were chatting the other night over at Unix.SE about putting one together.
 
@Caleb not yet, but we are drafting first couple of posts
 
9:30 PM
@Caleb not yet.... no posts, just raised the blog now.
@RoryAlsop so is there consensus, we're doing a first series on passwords?
e.g. from different angles...
"Everything you never wanted to know about passwords"
 
But I don't know if it uses the bcrypt default of phpass or what.
 
we should consider additional subtopics around that.
 
I think one of two possibilities: we do a continuous series - eg 4, or we do password post, other topic, password, other topic etc
 
e.g. a. discussions from the site;
b. interesting crypto bits (maybe get @ThomasP to do that...)
c. social aspects, wrt managing and remembering complex passwords
d. password stealing techniques
e. alternatives
etc....
 
@RoryAlsop Offhand I like the idea and offer of an intro post, but I suggest not going fully live with the intro post until we have another substantive one behind it.
 
9:34 PM
@nealmcb i agree, I think that makes sense. takes the fluff out of the fluff :)
 
@nealmcb oh, absolutely - I just believe in drafting posts in advance so they can be called off when needed...especially as I'll be AFK too much for the next 4 days
 
@nealmcb I was slightly joking, I assume they've got it covered... agreed with the intro post.
 
@RoryAlsop I suggest perhaps even getting at least 2 in the queue before going live, and trying to keep it that way with at least one/week, and no particular organization around having a series. I.e. just encourage folks to get posts in the queue
 
@nealmcb I concur
 
@Ninefingers Joking is good, but in this realm always be ready for an answer as awful as that of minor systems like MySQL....
 
9:38 PM
do we want to have "areas of responsibility", i.e. topics per blogger?
or just go unstructured, and take whatever posts we can get :)
 
At this point I'm more interested in a basic discussion of the goal of the blog - see my update to Rory's post
5
Q: We have approved a blog, now help with topics, logistics and volunteering

Rory AlsopRight - we have enough interested folks, so next steps... First - Logistics: @Rebecca - I have been following the blog chatroom and I think we can make this work, but there are a couple of questions How to we kick off? @Rebecca - when do we go live? Timelines? - had we agreed that a post at le...

scope/purpose/audience etc
 
@AviD Well, I was hoping to get some sort of areas from my meta post on this, but if we have a range of posts I don't think we should worry who the source is
 
right
 
@RoryAlsop right, i meant more a "heres a topic, lets get X to write a post on that"
 
@AviD Oh, that is very likely to work for things like crypto -> Thomas :-)
maybe a bit of both is how it will pan out
 
9:43 PM
@RoryAlsop yeah excatly :)
but on other topics....
 
It might be worth saying "when posting a topic in crypto, it would probably be best if @Thomas had a look at it" - I don't think you need to restrict contributors to specific topics, but arranging the editing/checking it might help?
 
@Ninefingers I didnt mean so much a permissions thing, more a question of likely source. A list of usual suspects, if you will.
 
@AviD ah I see - I didn't mean permissions either, I just meant when calling in reviewers, if we know someone is an expert in a particular area it makes sense to call in their judgement if they're available
 
@Ninefingers yeah -sorry, a bit tongue in cheek, but what @AviD said
 
@Ninefingers that makes sense too.
though I also think that these are blog posts - while an author should of course ensure that what he writes is correct, its not intended to be authoritative, anyway.
so while we should definitely strive for excellent, high-quality, correct and complete posts, I dont think we need to be TOO hysterical about it, either.
we especially dont want to turn the posts into another form of questionless answers - theres a lot more room for speculation, conjecture, and general subjectiveness.
 
9:52 PM
good point
 
I agree. I see having some form of review as a sort of check to say "this is generally a good blog post" and "this is not a downright dangerous recommendation containing no appropriate warning that someone might mistake for being authoritative". Beyond that, I think having a more discussion-y place would be of great benefit.
 
probably should avoid the rants, though.
definitely avoid the rants. At least, I should.
 
:)
I'm off soon for the evening.
 
@Ninefingers right, we shouldnt santize the writing, the tone should stay in the author's "voice" (as long as its readable....). Note to editors.
 
As for reviewing - I figure we want to appoint editors we can trust to know their area of expertise. If anyone doesn't get e.g. Thomas or maybe D.W. to review a crypto post, we have a little talk....
 
9:56 PM
I know I have a tendency of trying to "fix" other peoples writing to fit with the way I would write it...
@nealmcb heh, "a little talk"
 
@nealmcb I heard that in a mobster voice :-)
 
@RoryAlsop actually I heard that in a stereotypical stupid boss' voice
 
eeexcellent
 
like Neo's boss in the first one.
 
@RoryAlsop Well, since talk (and revoke privileges) is about all we can do, I'm not too worried about the old dead horse in the bed approach....
 
9:57 PM
oh, not that boss
 
@RoryAlsop PHB?
 
@AviD Ouch - glad I've avoided that role pretty well.... (at least the boss part)
 
@nealmcb aye - the Internet has done away with that. Until Amazon offer horse/bed delivery options
 
though that boss is kinda mob-like...
 
@AviD I'm sure I'm getting more PHB-like every year
 
9:58 PM
@nealmcb oy! sorry, no I wasnt implying anything...
@RoryAlsop one of the reasons I quit my previous job is cuz I realized I was being forced to be phblike, more and more...
 
@AviD I didn't think so, but as Rory notes, the risk is always around the corner as we get set in our ways....
 
@nealmcb hehe
 
I'm loving my current contract - working with a startup bank for the summer
no PHB's anywhere
 
cool
 
Later....
 
9:59 PM
wait, whats a startup bank??
 
later @neal
 
bye @nealmcb
 
I have the same question as @AviD
 
@AviD a new bank - the Virgin group have offered some white-branded products through bank of america for a while, but now have their own banking licence
fun environment to work
 
@RoryAlsop wow, thats cool.
 
10:02 PM
ah I see. I work at a startup (albeit not a bank) - it's a great environment.
 
not every day you see a new bank, AND one with such backing.
 
in Edinburgh the direct competition is Tesco bank - which basically got hived off from RBS
 
so Virgin really does ANYthing, huh?
robots AND food
 
it is a city full of contractors in IT, Project management and security
 
(friends episode....)
 
10:03 PM
@AviD which is ironic, when you think about it
 
@RoryAlsop LOOOOL
aaaand thats the 3rd favorite topic of this room.
 
mmm - I blame the single malt
 
thats the 2nd.
 
have we covered them all this evening?
already
 
and now its time for my dinner - 1st favorite!
 
10:04 PM
yay - full house. catch you later @Avid
 
we should consider changing the name of the room, its not like we talk security often....
 
actually I gotta head off too - but I think calling the room "our favourite sins" might not be appropriate :-)
 
@RoryAlsop heh. Didnt the romans have a room, food, wine, and women? what was that called?
 
dunno - was it connected to the vomitarium?
or is that just a Metallica song?
 
@RoryAlsop lol
 
10:07 PM
right - goodnight all - may login occasionally over the next few days, but if not, I have a very basic draft intro post ready
 
no.... thats sanitarium. where they take you after youd had too much of the other two.
 
ahhhhhh
 
i guess music is a strong 4th....
gnite! have a great long weekend
 
 
1 hour later…
11:30 PM
Mmm...yeungling
 

« first day (195 days earlier)      last day (4675 days later) »