The DMZ

Gilles

00:00

Firefox 26.0 on Linux is happy

Iszi

What's the SN of the certificates you guys are getting?

Also, is there a user-friendly method of querying something like the SSL Observatory for such information?

Interesting... CTRL+F5 seems to have fixed it.

Gilles

1E:22:C7:37:A3:91:5E:3F:AB:65:C4:B5:A4:1C:AE:46

Iszi

@Gilles Same.

That was weird.

Ah. How convenient that this is recent.

0

A: Is it safe to accept the security certificate from AOL chat?

This is a known issue for Pidgin, related to the root certificates that are trusted, although it looks like it has been resolved: https://developer.pidgin.im/ticket/15850 I'm not certain whether updating Pidgin will therefore fix this, or you have to import a certificate yourself... People ...

Iszi

00:28

Wasn't someone looking for an SSL client test recently?

ssllabs.com/ssltest/viewMyClient.html

Would be nice if that could give you a grade like the server test.

Gilles

00:43

2

Q: TLS browser capability checker

Is there a web application that checks the TLS capabilities of the browser? At least supported protocols and versions certificates It should create a detailed report of the results. There're good tools for checking server configurations but same tools can not be used to check browser implemen...

Iszi

Oh, dear. So I have to post an answer on SR in the same day I had to create an all-lowercase password on a site that will e-mail it to you? Geez - is there anything else I can do to feel just downright dirty and disgusting today?

There. It's done. Now I need a shower. In fire. With bleach.

Iszi

01:02

Weird. Something just now happened to make Twitter throw a mixed content warning again. No popups or anything - just the address bar showing a warning signal where the SSL check used to be green.

CTRL+F5 fixed it again.

KnightOfNi

@Iszi Heh. Burning bleach? Are you sure that's good enough?

Gilles

@Iszi yes :p

KnightOfNi

Perhaps you should make a ritual sacrifice to the computer gods just in case.

Iszi

@Gilles Seriously, you're gonna call me out on answer quality for an LMGTFY question that the asker quite nearly already had answered for himself? Did I not already give enough links?

Gilles

Create 10 passwords, hash them with PBKDF2(bcrypt(scrypt(_))), encrypt the hashes and throw away the key

@Iszi I kinda have to, we're trying to set the example

A sample report should do it. We want answers that demonstrate that they're ok, otherwise it opens the doors to spammers

Iszi

01:08

@Gilles The last link in the answer will take you straight to a report for your browser - just one click away.

tylerl

01:40

@ManishEarth I hadn't seen that question before. But boy do I have 2 cents to add.

ManishEarth

@tylerl on Bugzilla?

tylerl

@ManishEarth naw. I'm not really active on bugzilla

Just this little rant here

2

A: Should websites be allowed to disable autocomplete on forms or fields?

The problem is that this one setting simultaneously controls the behavior of two similar but sufficiently dissimilar functions in the browser such that an optimal result is difficult to achieve. First, we have what you might call "smart" or "naïve" or "automatic" auto-complete. This is the orig...

Iszi

Slick how Microsoft bundles their name change with a features update, so they can make you feel like switching from SkyDrive to OneDrive is an "upgrade".

Update from SkyDrive to OneDrive and enjoy easier file sharing, a new thumbnail view, and more: http://newwp.it/1h6WkTW

Tweeted by windowsphone on February 20, 2014 at 12:00 AM

tylerl

@Iszi OneDrive, now with less Trademark™

Iszi

@tylerl Until King decides they've found an excuse to TM "Drive" or "One".

ManishEarth

01:55

@tylerl totally expected you to recommend the opposite, nice answer though

Iszi

02:10

Should have figured that if I brought an iPhone-related question about an issue that's not actually affecting an iPhone, to Ask Different, I'd end up with a Tumbleweed.

0

Q: Unable to receive SMS from iPhones

My wife just changed from an iPhone to a non-iPhone, and now it seems she can only receive SMS messages from non-iPhone users on her new phone. She can send SMS to anyone fine, it's just receiving SMS from any iPhone users that's the problem. We've tried turning off iMessage on the iPhone and te...

imessage sms

Shame of it is, I think the issue is fixed now but I don't remember what we ended up doing to fix it.

Scott Pack

@adnan Were you able to get your thing handled?

@Adnan I turned in my laptop today so I was making due with my Nexus7 as a computing device all day. Make doing anything more complicated and shooting off a quick email, or reading something, tricksome.

Iszi

@ScottPack Dude, we don't need to know that!

Scott Pack

@Iszi It's only polite to ask.

Iszi

@ScottPack Ew.

Scott Pack

02:42

Thanks to a conversation that started with the Scottish Independence vote I've introduced another poor sap to CGP Grey. Let's see how he responds.

AJ Henderson

04:22

well, I got my laugh for the night

2

Q: What are the steps to take in order to securely transmit credit card information via a standard web form?

I have a client who wants to be able to have new customers who sign up with them online for a delivery service to be able to submit their credit card information as well. Once the information is obtained the client will manually enter this information into their POS system at their retail store....

encryption

I think when we had to implement something like that at my old job it was about 3 developers working for a month and a half full time

plus several new servers

tylerl

05:40

@AJHenderson The very first web app I wrote did something not entirely unlike this. Before payments gateways, before PCI, before e-commerce. It was a Perl CGI that dumped all the customer data, including card number, to a printer connected to the web server.

it was both beautiful and horrible at the same time.

but mostly horrible.

Adnan

06:29

@ScottPack When I go to the dude's profile and click "Ask Jesper about...", LinkedIn says that I used up all my introductions. However, when I go to my LinkedIn settings page, it says that I have 3 more introductions.

I'm waiting for an answer from LinkedIn support.

kiBytes

06:46

morning

Hey @Adnan, is there a way to have a look to removed posts?

Stizzle84

Hi

kiBytes

hi

Stizzle84

Who plays minecraft

I do

kiBytes

I believe that a lot of people play minecraft

Stizzle84

Do u i mean

kiBytes

06:57

Seldom, It's been long since the last time

Stizzle84

O ho bout call of duty

Adnan

@kiBytes Yes, there is. Sadly, you'd have to have 10k reputation points to be able to see them.

kiBytes

no, I am not a big fan of mainstream videogames

@Adnan it would be so great if you send me "that question" I edited

so I can ask it properly

the question I am talking about has been removed today or yesterday

Stizzle84

O what do u play

Adnan

@kiBytes Let me see what I can do.

Stizzle84

06:59

?

kiBytes

@adnan move your right hand one step to the left :P

Stizzle84

Umm

kiBytes

@Stizzle84 I am not playing any game nowadays

the last ones I remember were "Fez" and "The Stanley Parable"

Adnan

@kiBytes Remember anything in the questions' title?

Stizzle84

R u serious r u an adult

kiBytes

07:00

yes

I'm about your age @Stizzle84

Stizzle84

13

?

kiBytes

@adnan "Does existence of an obvious security flaw in design mean that anyone is allow to use it?"

Stizzle84

Use what

kiBytes

@Stizzle84 no, I more than double your age xD

@Stizzle84, do you know were are you? Do you know what is this room about?

Stizzle84

Not really

I am in florida

kiBytes

07:03

This room is about Information Security

not about videogames

you know this is about hackers things

Stizzle84

But it said there is an event here

kiBytes

Which event?

QOTD?

that is "question of the day" not "quest"

QOTW?

Stizzle84

No clue that is what i am trying to figure out

kiBytes

No problem, you can wander around =)

Adnan

@kiBytes Here you go: pastebin.com/GDJaw0Zd

kiBytes

07:07

@Adnan I believe is on topic, do you?

*don't you?

(I hate making those stupid English mistakes)...

Adnan

@kiBytes Yes, I do. However, it's more of a law-related question. So be careful.

kiBytes

A couple of negatives won't hurt my feelings =D

tylerl

Wait... you edited the question to be an entirely different question?

oh, no. I see the original in there. nvm

Adnan

@tylerl He did. We had a discussion with him about it.

tylerl

Yeah. I'd probably close that as OT.

It's about legality, not about security.

a pet peeve of mine. DONT ASK THE INTERNET FOR LEGAL ADVICE

kiBytes

07:10

@tylerl I am changing the "illegal approach"

tylerl

are you asking whether or not something is legal?

kiBytes

no, I will try the "moral" approach

tylerl

sweet jeebus

That's totally subjective.

there's no right or wrong answer.

TildalWave

@kiBytes made me giggle :)

good morning

kiBytes

morning xD

Ok

let's discuss the topic here

TildalWave

07:13

which one?

Adnan

@kiBytes Let's not.

kiBytes

Does the existence of an obvious flaw in security design means that any one is allowed to use it?

tylerl

Yeah. I'm going to have to go with @Adnan

kiBytes

oh guys, you are so rude xD

Adnan

@kiBytes Once you know me in person, you'd know that I'm the only rude one here.

tylerl

07:14

Betcha you'd get plenty of answers on Yahoo

TildalWave

which question are you all talking about? link pls

tylerl

@TildalWave see adnan's pastebin

he re-stated it seconds ago. He wants to know whether it's "allowed" (in whatever context) to exploit a flaw simply because it exists

Adnan

> Can I get pregnant if I swallow my boyfriend's discharge and then later when I poop it touches my vajayjay?

tylerl

@Adnan Ah. They joy of yahoo

TildalWave

hmmm there was a similar question posted yesterday that I agreed with @Adnan that it's asking for legal advice (well actually for us to interpret legality, but that's kinda the same)

2

Q: Legality of downloading leaked hashes / attempt cracking

Note: I realize there is no legally binding talk hereinafter. There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep web" servers. As security yokels, we find it interesting to see how secure (or insecure) these d...

hash legal

it started OK but the ending was a major disappointment

Adnan

07:18

Let's move to a more important topic. Is my avatar too scary to be a LinkedIn photo?

TildalWave

@Adnan no, unless it's across the whole page

next topic

Adnan

@TildalWave Are you sure? I heard that looking right in the camera isn't good.

Or was that for dating sites?

I have no idea.

tylerl

@Adnan are you trying to get a job as an inmate?

Adnan

@tylerl Unfortunately, no.

kiBytes

@Adnan you have taken the picture from too close

Adnan

07:21

and this one, I think it's a bit unprofessional.

TildalWave

@Adnan Well since I actually worked on that photo to some detail when I made that lineup mugshot from it, I'd say it's OK if it's not too small. LinkedIn profile size should be good but the small thumb from lists won't be.

it's also cropped too much

kiBytes

@adnan check out this photo: chat.stackexchange.com/users/13100/mvy

Adnan

@TildalWave That's the actual photo. The whole of it.

@TildalWave Except maybe 5% cropped

kiBytes

that should be ok, but using the same angle you have used in your photo

TildalWave

@Adnan then crop from that mugshot :)

kiBytes

07:23

and without the office behind

Adnan

@kiBytes Yeah, the issue is that I'm not French.

tylerl

@Adnan Do there only exist 2 pictures of you?

Finland has cameras, right?

kiBytes

@Adnan no problem, photos work the same way all around xD

TildalWave

@Adnan M'vy is French? I mean, he might be, but he's in US, no?

Adnan

@tylerl There's a big problem with taking a photo of myself now. I have a sheep-like hair and hobo beard.

@TildalWave I have no idea. I just looked at the photo, it screamed French.

TildalWave

07:25

@Adnan actually, his profile says France

tylerl

@Adnan Uh.. comb? Shave? This isn't rocket surgery.

how do you expect to get a job if your grooming skills are primarily entropy-driven?

kiBytes

@Adnan you have to sell yourself =D

Adnan

@tylerl Shaving is out of the question, at least in the next 2-3 months. Sexual life depends on it.

@kiBytes I already did, several times when I worked in Thailand.

Damn it! I'm slightly worried that I don't have a photo of myself that is taken in the last 3-4 years.

kiBytes

make a selfie xD

*take

tylerl

@Adnan This explains the infrequent bathing thing

suddenly it all makes sense

Adnan

07:34

@tylerl "infrequent"

tylerl

Your girlfriend has a fetish for homeless vagrants. So you cant shave, or comb or bathe.

AviD

@RoryAlsop ohhh!! I am so ashamed!!!

@LucasKauffman never heard the name. probably a 2/3 degree?

Lucas Kauffman

@AviD it's first according to linkedin

AviD

@LucasKauffman hang on, I'll take a look

2nd for me.

Disappointed, actually, I assumed Jody was a lady.

Lucas Kauffman

@AviD ah weird

tylerl

07:46

Morning, @Avi

Lucas Kauffman

probably didn't look correctly then

AviD

@tylerl yes, I'd noticed.

tylerl

@AviD I say that as a culturally idiomatic greeting. Everybody knows it's in the dead of night right now.

AviD

yeah? Then explain the brilliant sunshine we've got going on here.

the scientific instruments claim that it is a mere 16C, but I tell you it feels like a perfect 21C.

Thinking of doing some work outside today.

Iszi

@AviD In English, please?

tylerl

07:48

@AviD Vivid halucination

a comeback you can't argue with

AviD

@tylerl hehe

@Iszi "pleasant"

tylerl

(learned it from watching Dawkins)

AviD

in 'Merkan, that is 60F / 70F

tylerl

That's teh current temperature here.

in the dead of night

Iszi

@AviD Around here, given a fair breeze, 60F can feel downright chilly. 'Course that's mostly the humidity doing its thing.

AviD

07:50

@tylerl really? thought you guys are having winter now?

Adnan

@tylerl When the other person says "but I'm not the only one", you can claim mass hysteria.

tylerl

@AviD Arizona has summer and spring. And that's it.

AviD

@Iszi right, but with the sun and warm breeze, it makes it feel just perfect.

@Adnan haha, nice

@tylerl "but I'm not the only one"

Adnan

@AviD I'm getting hard just thinking of sunny weather.

AviD

@Adnan DUDE!!! TMI!

TildalWave

07:51

wow that's huge :)

Adnan

@TildalWave Jesus Christ!

AviD

@TildalWave wow, that looks almost respectable.

TildalWave

hehe

tylerl

@Adnan Possibly. You've seen the videos with Richard Dawkins debating with religious fanatics. Sooner or later it all comes town to hallucination.

TildalWave

still looks fake

but if it's small enough ...

tylerl

07:52

@TildalWave need to blur up the suit

Iszi

@TildalWave That's what she said!

tylerl

@Adnan And WTF?

AviD

@TildalWave Is this referring to this? ;-)

TildalWave

@tylerl yeah ... I don't have all my toys on this computer

tylerl

This one was just MS Paint

TildalWave

07:53

more or less yes

Adnan

@tylerl Not a big fan or Richard. His debating style leans towards "asshole" a bit too much.

@TildalWave It looks a bit unnatural for some reason. Maybe the neck is too thick?

tylerl

I'm impressed by the skin tone matching

Adnan

@TildalWave Also, whoa! That's freaking good!

AviD

@Adnan no the collar on the left (youre right) looks fake, and digging into your neck just a tad too much.

Iszi

@Adnan <pun cheesy=true> Sure he doesn't just like being a big Dick? </pun>

TildalWave

07:56

@Adnan dunno, it does look odd, but it was just an idea what you could do if you can't get your real face to play nice :P

I'd need to be on my main comp for anything better

Adnan

@TildalWave Yes. Yes, please. How much will it cost me?

Transcript for