« first day (1159 days earlier)      last day (4019 days later) » 

00:00
@TildalWave thanks. That stuff is important, but probably orthogonal to what the user wanted here
Was there ever an idea for some SE site to support scripting? I think it'd be cool if we could at least have some fancy trajectory plotting and orbital mechanics plugin on space. Also, how did they get those YouTube videos to work directly in posts on AVP? Is it possible to request that and have it work only with certain rep levels?
How's SVG security / support in browsers nowadays?
@TildalWave pretty good
SVGs support javascript :p
Youtube is a plugin for SE; make a case for it and it gets enabled
@ManishEarth I'd have to ask our folks what they think about it first. What else could we ask for?
As for an SE site to actually host userscripts that can be included; there isn't one. Wikipedia has native support for adding userscripts to accounts, though
@TildalWave write one.
I plan to integrate ChemDraw into the editor at some point
@ManishEarth there's some already written, we could use most basic stuff like ground track plotting, keplerian orbits and solving two-body problems
that's all pretty basic for SVG
00:11
@TildalWave See, if you can write an editor for it (have a look at the Balsamiq plugin on User Experience and CircuitLab on Electrical Engineering), and a backend that converts it to an image+keeps track of which image contains what (for editability, note that the Balsamiq things on UX are editable afterwards too), then it can be integrated :)
8
Q: Adding online capability to draw orbits within posts

Deer HunterThis is a long-shot question: User Experience SE users can draw Balsamiq mockups in their questions and answers. Electrical Engineering SE users can draw schematics. Maths and physics sites can use MathJax (I suppose it's the easiest thing to do since MathJax is free) - already covered here (Wr...

Cesium would do, so I just have to revive that thread, ask folks about it again
@TildalWave I'll post an answer
cheers!
 
2 hours later…
02:34
arstechnica is teaching people how to run their own mail servers: arstechnica.com/information-technology/2014/02/…
Great.... absolutely nothing can go wrong with that right?
@TerryChia Hey, don't knock it...
It's organizations like that that keep infosec pros in business.
03:22
it's more the other way around really
03:36
I'm going to paraphrase this question for you:
-1
Q: what if ive been hacked and my ip is static?

anonymoushi my computer has a rootkit or some sort so an attacker can see everything that I do now that Im going to do something related to banking I must secure my computer I have a cd of windows 7 64 bits in my hand right now but when I format my computer and install the new windows i know the attacker ...

ohmygod-ohmygod-ohmygod-ohmygod-ohmygod-whatdoido?
@tylerl If I VTC as "This question appears to be off-topic because it doesn't use punctuation and now you're scaring us that there might be something wrong with your breathing too and we're all panicky and don't know what to do so yeah it's off-topic because well it is" would that be too much?
decided on "unclear what you're asking", should suffice
04:08
OK, found time to edit it and retracted my VTC. @tylerl thanks for answering it ;)
@TildalWave np
jeebus I'm tired.
the list of things that I don't want to do right now is surprisingly large.
yeah me too I'm gonna join the pillownaut corp. watch some telly series
@tylerl you still down by the virus?
@TildalWave a bit. Which is to say yes, but I'm getting better.
@tylerl glad to hear
right, night folks
 
3 hours later…
07:55
morning
08:28
Morning
@StackExchange that is all kinds of brilliant.
hmm, this is interesting - @TildalWave that tag numbers region appears when I'm on Chrome, but not when I'm on IE.
Must be just another stupid IE bug. Everything is an IE bug.
@AviD IE is a bug. ;)
But I thought the new IE is pretty solid?
@TerryChia Funny, that is quite ironic.
It is quite clearly NOT an IE bug, but a site feature partially rolled out... some sessions get the new version, some get the old.
but sure, lets blame IE for it anyway ;-)
AFAIK the new IE is actually more standards compliant than FF or Chrome.
Chrome has all that fancy webkit-specific stuff.
@TerryChia yeah, and amazingly solid too.
08:36
@AviD - I didn't get that xkcd at all. I'm guessing that the frequency increases in some direction...?
And it's multiprocess right? Which blows FF out of the water actually.
@TerryChia quite a lot, yes.
But meh, it's still more fun to blame IE for everything.
@RoryAlsop I dont think so. It is a bunch of data points, some of them are related, some not, and some is just interesting to see the relative changes between them.
Read it from left to right, not up-down.
e.g. births/deaths, or car building.
or 5th row, 4 and 5.
So each row is same frequency?
08:39
I am having trouble understanding the relationship between them.
@RoryAlsop I read it as each column is the same frequency
@RoryAlsop no? Ah, did you click on it? It's animated, you dont see that in the onebox.
@kalina you're both wrong. it flashes a lot.
interesting
blame Stack Exchange for the midunderstanding
Haven't seen any animation. So far only looked at it in chrome on my phone, ie on desktop, and the xkcd app on my phone
the 50K bottles pair is particularly interesting.
08:40
Will find an alternative
This certainly explains why I was baffled
@RoryAlsop ah yeah, each rubric flashes in statistical frequency. It's brill.
for example, almost everytime someone buys shoes in Phoenix, they promptly put on a condom.
I am curious if this is celebratory, or part of the sales cycle.
I'm pretty confident that no little league players are currently playing
@kalina it's statistical! Not a live feed.
I know that
but the article is called frequency
08:49
:)
@LucasKauffman That does sound like you.
my brain isn't working
I'm inserting coffee and it's not working
@kalina If you are inserting coffee directly into your brain, maybe that's why it isn't working.
-.-
this weekend needed to be longer
it's not possible to detox from the quantity of drugs I consumed in the time I had available to detox
@kalina Next time you should eat less jelly bears
08:56
I didn't eat any jelly bears
now I want jelly bears
I hate you
@kalina so what drugs did you take?
do you really want to have that particular conversation?
very well
@kalina sure
Friday was mdma and cocaine
Saturday morning was more cocaine with weed to regulate
how much did that cost?
08:59
Saturday night was mdma and cocaine with amphetamines because we were running out of mdma
because cocaine isn't cheap
Sunday morning was ketamine
@kalina No. Definitely - no. Just... no. NO.
Ooooooooooookay. That's about enough.
@LucasKauffman coke is cheap in comparison to mdma
09:00
@kalina I thought you were going to grow up, now that you turned 21?
@AviD I did, I broke my personal best for the amount of water I consumed over a 48 hour period
@kalina how much is mdma for one gram? how come it is more expensive?
@LucasKauffman this conversation feels a bit illegal.
@LucasKauffman coke is ~40 per gram, mdma is ~60
MDMA should be relatively easy to produce
09:01
mdma is more explosive
@LucasKauffman stop encouraging.
so I got home on Sunday at around lunch and I've been in a daze ever since
@AviD I'm not sure this conversation is illegal
no drugs were consumed during this conversation
unless you classify lucozade and water as drugs
It's weird that MDMA is expensive, it's relatively easy to come by all ingredients as opposed to cocaine which needs to grow and smells strongly when producing
Don't know about the UK, but most places selling, buying, and discussing the above is pretty darn illegal.
my dependency on water feels a bit drug-like atm
09:04
@AviD purchase and sales are here, discussing isn't
@LucasKauffman it's expensive normally because it's an active ingredient for something else
it's far more profitable to sell mdma as ecstasy
so mdma by itself is usually marked up
Ecstasy is super easy to make, so a lot more people are producing which means prices will drop due to the availability on the market
well yeah, ecstasy is mdma + random crap through a pill press
I prefer sans random crap
I'm pretty sure I was generally ok until we started on the ketamine
but my memory abruptly ends around the time that started
Can you stop discussing this here? Take it to IRC or something.
@TerryChia yes, this.
09:08
sure, sure, blame @Lucas
I did say this:
10 mins ago, by kalina
do you really want to have that particular conversation?
@kalina I always do. Dammit @lucas!
alright let's stop discussing
It's just interesting, I've never done any drugs except smoked a bit of weed when I was in college and I can count the amount of times on one hand.
I used to smoke weed daily until I moved into a house where I wasn't allowed to
as I said at the start of this conversation though
@LucasKauffman AHEM, "sandwiches".
my brain is misfiring
09:12
@AviD Weed is legal here
@LucasKauffman ah right. But still, HIMYM.
but let's move on
lol @ sandwiches
@kalina but I agree with @AviD you should stop doing them, especially the cocaine, friend of mine is studying the long term of effects of cocaine on people and it's quite bad. Especially the part of your brain that let's you experience happiness is influenced significantly.
@LucasKauffman oh, then @kalina is safe then.
09:17
the chemical which makes you feel happy is produced in lower quantities after exposure to cocaine, which means that you can't become as happy as before
Won't the body regenerate those?
@m1ke not completely apparantly
bla bla bla I'm aware of the research
mdma is no better
there is a reason I don't intend to live past 30
@kalina isn't that a bit sad?
nope, not really
09:22
how old are you now?
21
...and 3 days
that's still quite young
why aren't you in college?
@kalina yeah, screw future-@kalina! That girls just a stupid b---ch!
@LucasKauffman I dropped out, it was boring
09:24
once I get bored of something, I just stop doing it
which is pretty much why I've been inactive on Arqade for the last few weeks
I got bored of it
incidentally, I just happen to still enjoy other parts of stack exchange
otherwise I would simply cease to be here
Morning All
@RоryMcCune a rory morning to you!
@RоryMcCune o/
Quick Q. Do we have a question on "best" SSL ciphersuite for an IIS deploymant already (paging @avid)
@kalina \o
@RоryMcCune hmm. Dunno, that would be a @Thomas question.
09:27
@LucasKauffman Had a 750ml bottle of leffe blonde last night, didn't know those existed...
Or probably @TomLeek.
@RоryMcCune yea, there are even bigger ones
@AviD yeah but it's early in canuck land and I guessed you might have seen it with your interest in all thing Microsoft...
@RоryMcCune hmm, dont remember specifically, though it was mentioned different times (or rather, what NOT to use....)
I think currently if you need to adhere to what is considered completely secure, you can only use TLS 1.3
09:29
@RоryMcCune and I a q for you - are you guys a NITES certified test lab?
which means you will not be able to support XP or a lot of older mobile devices
@LucasKauffman yeah so there's a question on what you can do to improve things without cutting off lots of users.
@AviD what's one of those then (which should effectively answer the Q. :) )
@RоryMcCune dunno, thought it was a UK govt cert thingie, figured you'd know.
ya know we should really ban all SSL questions, 'cause like shopping ones the answers get outdated really quickly..
@AviD nope don't think I've encountered that term before...
@RоryMcCune and the good ones have all been asked already.
@RоryMcCune National IT Evaluation Scheme
09:32
@AviD a quick google suggest that NITES might be a singapore thing (and if so one for @TerryChia)
maybe it's Irish....
@RоryMcCune oh, huh. I didnt see that till just now....
@RоryMcCune hmm, interesting. I might be there sometime in the next months then. Probably not, though.
fourth coffee time
@AviD coolio
@kalina well if you will go not getting enough sleep on a sunday...
Sunday? Interesting
I didn't sleep between Friday and Sunday
that probably has more to do with it
that'll do it
sleep is a good thing(tm)
09:43
indeed
@RоryMcCune What's that?
@TerryChia Singapore governments national IT evaluation scheme
Wooo, just switched from 2.4Ghz wireless to powerline networking.
Lovely speed now.
@TerryChia nice
> sleep is a naturally recurring state characterized by altered consciousness, relatively inhibited sensory activity, and inhibition of nearly all voluntary muscles.
I really miss the days of full duplex gbit
09:47
Direct Ethernet is about 90Mb/s so the quality is better than I expected.
@RоryMcCune Heh, never heard of it actually.
@TerryChia why 90 mbit and not 100?
@LucasKauffman Dunno, that's what I got from speedtest.
It's supposed to be 100 though.
@RоryMcCune I'm worried that your question will be too localized at this point in time.
“Some teams are red,
Others are blue,
I'd share my root
passwords with you”
@TerryChia Rly, I'd have thought that web server SSL configuration is a fairly standard question, what made you think TL, something easily changeable?
@RоryMcCune New attacks against cipher suites, old ones get phased out etc.
For example, RC4 was still considered pretty ok last year.
09:54
Roses are red');
DROP TABLE rhymes;
Learn to sanitise,
Your inputs next time.
@TerryChia yeah but that's my point, you either avoid questions on SSL altogether, which really won't make sense to newbies
or you allow them and acknowledge that the world moves on
@TerryChia it still is, most of the attacks on tls are theoretic and not practically feasible atm
heck pre-snowden advice on avoiding .gov intercepts would be largely different
@RоryMcCune But ciphersuite selection is something that regularly changes as newer/better suites gets introduced into TLS and older ones are broken.
It's the same for every crypto algorithm
@TerryChia indeed but so, I think, does quite a bit of IT security advice... problem with a site like this is if we start saying "well that's changed quite a bit in the last year, so sorry we can't answer it" we significantly reduce our use as a Q/A site
but good point I sense a Meta Q
09:58
we can make a 2013, 2014, 2015, ... edition
I know that's what they sometimes do at SF
or keep one question up to date, which holds the changes per year
The problem is that it needs to be maintained
and someone has to do that maintaining
@AviD Oi AviD! Do your job and weigh in!
@AviD Lazy bum.
buuusssyyyyy
on other machine right now
@AviD What's more important than DMZ?
besides, I am strongly ambivalent about this issue.
I have a case of impressionism - I am seeing both sides, making me lose perspective.
meta q is good idea.
laters
10:02
doing the meta q nows
@AviD Pffft! That's just an excuse! ;)
Lazy bum.
@RоryMcCune link us when you post
a wild moderator appeared
@RоryMcCune I'm actually ok with the question if someone commits to maintaining the answers when it requires changing.
Especially if it's a CW answer.
@OliverSalzburg what can we do you for?
I would just hate for RC4 to be considered a good enough fallback now yet still be in the list when it gets horribly broken 5 years later for example.
10:05
@TerryChia The problem is that in real life you can't do it, people shouldn't be running windows XP, but they are. If you disable RC4 you can have a significant amount of clients which will not be able to connect to your service anymore
I'm not saying you should by default fall back to RC4, but I always advice to use it as the least prefered fallback algorithm
0
Q: Policy on Areas of security where advice changes

Rоry McCuneSo there's a point mentioned in the DMZ in relation to SSL questions, which I think warrants a general discussion. Where we have an area of security where the "best practice" changes regularly, should we be closing/discouraging questions in those areas? The problem with these questions seems si...

@LucasKauffman See: "5 years later."
@TerryChia ah nvm
@RоryMcCune Might want to edit in a link to your question in the meta post.
@TerryChia done :)
@ManishEarth watcha'. is your Chat.SE bot code publicly available or secret squirrel?
I had an idea for a DMZ bot
10:08
@RоryMcCune public, GitHub
@RоryMcCune The code I ran yesterday was here
@ManishEarth cool ta :)
With some extra tweaks for the !!/twss function
The plan is to create this class to make chatbots easily extendable though
It's written in a very good language
I'll port my old irc bot
@LucasKauffman you're in opposites land again aren't you...
@LucasKauffman pyyyython
Would Cloudflare help significally reduce the load on my server due to DDOS and hopefully help my server not get the network automatically cut off by the provider because of the load?
@LucasKauffman I just love how the actual bot code is very short
@Scorpion I believe that's the general goal of their service. It would depend on the type of site you have to some extent
@Scorpion if you've got lots of cacheable static content, I believe it works better than with a site with a lot of dynamic content
personal website; no changing content (so static); and no friends - so only google bots and occasional DDOS attacks will be my only visitors
@RоryMcCune
10:21
@Scorpion purely static, I'd say it should work pretty well
cool - thank you @RоryMcCune
I'd say Amazon S3 + Cloudflare is dirt cheap static site hosting. I'm probably going down that route soon.
hey I have a friends server he lets me borrow for free - I don't want to spend extra money on a server, i mean the domain was $10 alone! what do you think I am, a Subway employee?
I said dirt cheap. Amazon S3 cost like a couple of cents a month for a low volume static site.
oh really? I tried to see their rates but they were confusing @terrychia
10:39
@LucasKauffman Nothing, I just hang out here :P
@TerryChia I'm using cloudflare, reduced my response times with 70%
@OliverSalzburg Lies! Who are you spying for?!
@LucasKauffman Yeah, their free tier looks pretty decent for personal stuff.
@TerryChia it had a nice side effect that they don't support SSL for the free tier, meaning that anyone who is using the cloudflare links can't visit my admin panel
less bruteforce attempts ftw
@LucasKauffman Admin panel? You will see nothing like that on my site! :P
@TerryChia I'm using wordpress for my blog
I could set it up to only allow it from localhost, but meh
10:46
@LucasKauffman Have you considered jekyll?
that's a static one right?
not yet, might be interesting
@LucasKauffman Markdown->HTML generator.
@TerryChia I run a pay-per-view service that lets users see the history for (deleted) posts
@LucasKauffman I love it because GitHub becomes my blog's backup. github.com/Ayrx/infosecstudent
Plus you know... no databases involved so everything is crazy fast.
@TerryChia we use it for the club blog
10:53
@TerryChia recommending ruby products.....
just ordered myself one of these
decent price for a 24-port managed L3 switch
@RоryMcCune About a week ago I was asked to recommend which cipher suites and in which order to support by a client's web server. It took me about 2 days of research until I found something satisfying. I'm thinking about summarizing my work report into an answer to your question, what do you think?
(Note: You're not gonna like it because it doesn't support IE6 on Windows XP with the default configurations)
@Adnan sounds v.cool to me :) I'll upvote you even though it would damage my quest to return to the top 10 :)
@RоryMcCune One thing, though. Are we talking about IE6 with the default configurations?
@Adnan that's cool as long as it's deliniated. I think a good sol. is "here's the support legacy option" and "here's the drop the legacy option"
@Adnan well thinking from the perspective of someone setting up a web server who doesn't want to cut off what could be a relatively common config
so default IE6/XP is still (unfortunately) quite common
I think some sites will choose to drop them
others will want to keep them and shove those ciphers down to the bottom of the list...
@RоryMcCune Woah, neat price.
10:59
either way any info very welcome :)
@TerryChia yeah was looking for 16+port managed gig. there were some cheaper D-Links but yeuchy management
@Adnan Is chacha20+poly1305 in there? I'm not sure how well it's supported yet.
Mikrotik has a decent commandline option
@RоryMcCune Then, sadly, you'll have to settle for SSL 3.0 for IE6
albeit a bit cryptic
I don't think OpenSSL even has the code in master yet.
11:00
@Adnan dems da breaks for people with legacy users. Although for security standards I think it would be tenable after april to drop that support, as the client is already insecure by default
well unless they've paid MS $200 a seat for extended support for a year
@RоryMcCune Probably way overkill for me. :P I might need to pick up something once I revamp my home lab.
@TerryChia they do small 5 port ones too
BTW in an unfunny note on XP support, apparently the health service in the UK has 1 million + XP machines still in use
@RоryMcCune Tbh if I were going that far, I'd build a small x86 box and run pfsense on it.
@TerryChia Nope. Those were completely disregarded. When setting up gigantic servers in a corporate environment, I think that bleeding-edge support is the last thing thought about.
@Adnan Ah pity. I think that's the only secure stream cipher in TLS now.
11:02
@Adnan yeah it's about meld of better security + keeping compatibility I reckon...
@TerryChia Incorrect. There's AES_GCM
@Adnan I said "stream cipher".
@RоryMcCune Alright then. Tonight after I come back I'll mash something on the keyboard.
@Adnan w00, thanks :)
@TerryChia Google AES GCM
11:08
@Adnan crypto burn!
@Adnan AES is still a block cipher even if the mode of operation turns the overall product into a stream cipher... I know what GCM is....
@TerryChia Let's not get into this argument. We all know what you meant.
Clearly you were talking about the weaknesses in RC4
mentioning 'chacha20+poly1305' means you're talking about RC4 alternatives.
AES in GCM mode is very secure alternative
AES in GCM mode is supported by TLS
Therefore, save me.
@Adnan Dude, no one is arguing that.
chacha20+poly1305 support is nice because we need an alternative if a flaw is discovered in GCM.
11:23
@TerryChia Do you really want to argue about this?
AES_GCM is a stream cipher, just like chacha20.
Actually, when it really comes to it, ChaCha20 also looks like a block cipher operating in a mode like CTR.
So, really, arguing whether you meant a cipher that is designed with the full intentions of being a classic stream cipher or not is quite silly.
@Adnan No. I'm not going to waste my time arguing semantics with you. You know what I meant.
@TerryChia Strong words coming from the person who started the semantics argument.
26 mins ago, by Terry Chia
@Adnan I said "stream cipher".
@TerryChia "waste my time". Heh. Let's not get very defensive when we know we're wrong, alright?
Well, actually, that was an unreasonable request. We mostly get defensive when we're wrong and faced with our wrongness.
Oh.. lunch time.
@Adnan Who was the one being a condescending ass implying that I don't know about AES GCM?
11:46
@TerryChia mmmm might check it out then
@Adnan you on skype?
also @Adnan @TerryChia stop fighting
you will upset the Rories
@LucasKauffman que?
those two arguing about crypto is interesting, 'cause I generally learn something about crypto
@TerryChia I heard @Adnan say that AES-GCM actually sucks monkeyballs...
2
fight.
I have my popcorn at the ready
(chilli and lime flavour, apparently)
@RoryAlsop mmm popcorn (although I'm not too sure about the Chilli and Lime bit...)

« first day (1159 days earlier)      last day (4019 days later) »