« first day (216 days earlier)      last day (4962 days later) » 

00:03
Hmm - 14 members of "anonymous" just jailed?
@Ninefingers - I have just read it again, and I think it does work as it stands. I see what @nealmcb means, but I think rather than take sections out I think you could almost flag them for follow-up at a later date
 
1 hour later…
01:32
@RoryAlsop @nealmcb @blogeditors I just finished the QotW draft. Check it out for me when you get a chance.
@ScottPack Odd - in the preview I'm seeing the text of the <a> elements
Looks like they are quoted with "`" quotes in the raw text.
I like the overall approach and flow - thanks @ScottPack. I wonder if you want to highlight the answers you prefer in addition to the folks that asked the questions (or let the site speak for itself since it will all change over time).
02:17
I'm guessing that this answer of mine somehow slipped by folks:
0
A: Security of passphrase-protected private key

nealmcbProtecting a private key with a passphrase needs to be done carefully, as is usually the case in crypto matters. Generally the approach is to encrypt the private key with a symmetric algorithm using a key derived from the passphrase via a key derivation function. A classic example is PBKDF2 fr...

I was hoping someone else would have already dug further into the code to confirm under what circumstances SSH private keys are vulnerable, and what crackers can crack them.
OpenSSH at least - I don't know about the commercial ssh or others.
 
1 hour later…
03:26
@nealmcb I'll take a look. ssh-keygen...
03:53
@thisjosh Yeah - that is a good place to look. But I also did notice some code in md5crypt.c that does 1000 iterations, perhaps for something quite different. Not a lot of comments in the code....
04:13
RSA v2 is default?
04:35
Ho. Lee. Crap! Just spent 4 hours off and on with HP technical support, and still need to wait on a callback "within 24-48 hours" for a hardware documentation issue!
@thisjosh In what way for what system?
open ssh, current version is 5.8
for the ssh private keys
OP said that defaults were used
question doesn't state system, ssh publisher or version
it's not everyday you see '#ifdef CHARSET_EBCDIC'
 
3 hours later…
07:53
@nealmcb That is odd, I blame it on their editor. I created all of the links the same way, so the fact that some came in correctly and some didn't seems pretty broken.
08:11
openSSH ssh-keygen uses openssl to create a key and IV from the password. It generates an 8 byte salt from random data. then it computes MD5(password || salt).
I've angered the Swedes
0
A: Security of LastPass + YubiKey

jas4711This respone is rather incorrect regarding YubiKey. The AES key never leaves Yubico. Yubico provides an online web service API to validate OTPs, which is what LastPass is using to validate OTPs. There is no sharing of AES keys between YubiKeys, every device has a randomized key. The manual yo...

08:36
@ScottPack I have just added 2 sentences onto your final para and am looking at the html. Seems to be odd single quotes are throwing it off. Gimme 5 minutes to see if I can rectify it
@ScottPack FTFY :-)
09:21
@RoryAlsop F*** that, f*** you?
Fixed that for you :-)
ahhh, oops, just looked it up now... uhh that would be "Fixed that for you....
:$
I'm friendly, not sweary :-)
hehe
you familiar with George Carlin's "Usage of the 'F' Word" ?
pottymouth
howarya?
@AviD not bad - how are you? Had a good ping from a friendly chap at Checkmarx
09:23
heh, I saw
so you looking into it?
definitely worth knowing about the alternatives for any/all clients who may go down this route. It's never a short term thing though, and this current client may not be at the maturity stage required just yet
but yes - if I can compare it to fortify I can be in a good position re recommendations, experience etc
Maty's a good guy. very brilliant.
(yeah, saw it on linkedin ;) )
hahaha
Yeah - I ended up googling a bit, as I do - good reputation
cool
lemme know if you get anywhere with it...
and personal recommendations always good:-)
@AviD will do
09:31
ooo.... mebbe you'll need a checkmarx specialist to implement all those custom rules... :D
never say never
ooh - in case that doesn't translate, that means - not hugely likely, but could happen :-)
hehe
so this is interesting.
I just got an email invite, to join a google+ discussion, for some kinda analyst group.
hey there
I guess g+ is mainstream now, huh...
heya @Mvy
What's up in security chat?
09:40
@Mvy its strange... the past few days chat has been mostly about.... security.
oh the horror. the indecency.
:D
@AviD It has hasn't it - how strange. Hardly any drink, food or other chat
hi @M'vy
@AviD it seems to be getting that way. I am not fully up to speed on it yet, but getting there
will need to add you into a circle
Hum that's funny: @M'vy does not highlight me
ahhh - because it needs four chars :-)
or maybe
@Mvy
did that work?
yep
the ' is not trimmed
09:45
ahh - an inconsistency in how SE treats extraneous chars
is the ' pronounced in your user name?
in Scottish it would be a glottal stop :-)
Well my username is pronounced "hum-vee"
@RoryAlsop im not even on g+ yet....
like the american vehicle.
even if did not related to it in anyway
ahhh - got it
@AviD will invite you:-)
later today - doesn't work from IE7:-)
@RoryAlsop already have a few invites, havent decided to jump in yet...
09:49
looks to be a few useful tools to transition. I just like the idea you can have limited/selected broadcast unlike FB or twatter
it will need critical mass - 10 million using it so far though, not a bad start
@RoryAlsop hehe... if your website had 1 million users, youd consider it a huge hit. for Google, 10 mill is "not a bad start" :D
XD
very true
if my website had 100 I'd be impressed :-)
their fault for setting the bar so high
bar/expectations
Well I'd need a site to enjoy my 1st visitor :P
hahahahaha
09:55
well, with all the increase in traffic, I think its time I stopped trying to read everything posted here.
new questions only, + answers on favorited questions. flags and chat @ mentions. and I guess everything on meta... .
I'm spending way too much time trying to read all the backlog....
hm
same - plus the odd random
when volume too high,everything one page old counts as expired/stale
nowadays, on the active tab, thats about one and a half days....
but theres so much interesting content!
like no.5... "Need info! More info!"
no. 5?
no. 5 is alive
can't get to imdb from here - the film is called Short Circuit
10:00
hmm... no onebox love for imdb?
How. I saw that movie when I was a child... :S
Short Circuit is a 1986 comedy science fiction film starring Ally Sheedy and Steve Guttenberg and directed by John Badham. Fisher Stevens, Austin Pendleton, and G. W. Bailey co-star, with Tim Blaney providing the voice of robot "Number 5." The story revolves around a sentient robot labeled "SAINT Number 5." The acronym SAINT stands for "Strategic Artificially Intelligent Nuclear Transport." The robot later takes the name "Johnny 5". A sequel, Short Circuit 2, was released in 1988. Plot Number 5 (voiced by Tim Blaney) is one of five prototype robots proposed for Cold War use by the U...
how did you get onebox to work?
@Mvy it came out in 1986, so @RoryAlsop must have been in college....
@RoryAlsop wikipedia :D
yeah yeah yeah whatever
ahh - of course
10:01
lol
its funny - compared to some of the other kids here, I'm also one of the oldies.
but I still get to make fun, since I have a couple more years till I turn the corner.
We were laughing - had a final practice with the band last night before our 3 gig tour leading up to album launch, and we are pretty much 20 years older than our audience:-)
but our support band is older than us so it's ok
hehe
our choreography isn't so much Take That dance moves as Iron Maiden classic metal poses:-)
talking of which - Iron Maiden playing tonight and I'm going to miss them again - that's the last 3 times they have played in Scotland!
ohh maaan
they still doing tours??
yep - old metal never dies. Judas Priest were playing last night :-)
or maybe it's tomorrow night - either way, that's two of the heavyweights of NWOBHM right there
of course NWOBHM should now be OWOBHM
10:09
:)
 
1 hour later…
11:31
@RoryAlsop I would like to think that I'm both...?
I've noticed that the visitors to chat seems to be younging as well. Even I'm starting to feel old.
@ScottPack maybe because you wake up at such gadawful hours....
gmorning!
@AviD Tell me about it. I woke up at 3am this morning, laid in bed until 3:45 trying to go to sleep. So I came downstairs, looked at the room, then grabbed a book and went back to bed. Finally fell asleep around 4am. Phaw.
@ScottPack afternoon
Morning, gents
And now it's time to go to the office :)
11:50
so what do you gus think about this one?
2
Q: How do I set up a basic security testing environment?

EricI only have 2 spare machines and both are very old, but I really want to set up an environment so that I can start practicing security. One of these machines has a Pentium 4 processor and 512 MB RAM; the other is older (and I don't know the specs off the top of my head). Is it even possible to se...

I wanted to migrate it out to Super User - and then I saw @thisjosh's answer, which really is relevant here.
@AviD good point, the other two answers are pretty much SU answers, but @this has provided useful input
Yep.
@RoryAlsop so, leave it? but the q itself is really SU material....
from an SE perspective if it is the sort of question someone might ask, and we have a valid security answer I think we leave it, don't we?
it drives traffic and the asker gets some relevant info
Well if the question does only gets answers "SuperUser"-like it's worth migrating. But if someone find on-topic-ness in it, why do that?
Is that question closed??
3
Q: How to perform penetration testing on a Flex application?

p_upadhyay Possible Duplicate: What tools are there to inspect Flash SWF files? I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I just want to be sure that I am not missing anything. It would be helpful, if someone can provide...

11:59
@RoryAlsop I guess you're right... the issue bothering me, is that I dont think its usually healthy to judge a question's quality, by the answers it gets.
There is a "possible duplicate" banner but seems to be still opened?
the question should stand or fall on its own merits - and, if there is good security information to be had, but the question is missing the point, it should be edited.
d'oh! and theres my answer... just edit the question on to topic!
@Mvy ah, I had closed it, but turns out I was wrong....
oh
ok, it's said: I hate php now.
Now back to writing... for science... and cake
You know what they say about science.
It Works Bitches.
isnt that what they say about cake?
12:10
Was the Flex question reopened after being closed?
I've noticed that the duplicate banner sticks around.
Seems so.
May be worth a meta-post
@ScottPack yeah, thats what I sorta said.
Post Reopened by AviD♦
I closed it, realized I was wrong for that, and reopened.
@AviD Is that what your rambling means?
/me sighs
12:12
sometimes it may seem so, but that it turns out that it is in fact not wrong in being the case of the factual correctness
@Mvy left a comment, too ;)
New kernel must have come out last night. I have 100 emails in the folder that receives the statuses from all the linux boxes.
@ScottPack sorry, split attention....
The sigh was for me, not for you :)
@AviD where?
Oh got it
> Sorry @p_upadhyay, I reopened the question. Can you add the elaboration from your comments to the question? – AviD♦ Jun 24 at 6:48
any reason not to close this, as not constructive / s&a ?
1
Q: What is the validity of the article which claimed that IE is more secure than Chrome?

PacerierWhat is the validity of this article which claimed that IE is more secure than Chrome?

only reason I'm hesitating - the phraselogy is not exactly argumentative. "what is the validity..."
hehe @RoryAlsop "comparing apples to wildebeest " luvvit!
12:19
yeah - I had looked at that one, but decided to wait to see how folks voted - was that exact phrasing that made me hesitate
aaaand, we're back on food :)
@AviD well, I wanted something other than oranges, and the first thing that came to mind was suckling pig, but Wildebeest wins over pig, any day
Speaking of which, I don't think I hear the coffee maker any longer.
@RoryAlsop lol
I think we need to make a sign in the sand.... @ScottPack, modhammer please!
@RoryAlsop do you object?
not at all
12:22
going once... twice....
@ScottPack heh, thank you kind sir.
and, BOOM! goes the dynamite
For the record, I should point out that I didn't develop that. It is, in fact, the sigil of Captain Hammer.
"Captain Hammer"?
a friend of the Knifeketeer?
While the Knifeketeer is way less creepy than Omnipresent man, no.
12:25
heh. okay, then I'll look it up.
"you're still looking at me!"
"From *two* different directions!"
Dr. Horrible's Sing-Along Blog is a 2008 musical tragicomedy miniseries in three acts, produced exclusively for Internet distribution. Filmed and set in Los Angeles, the show tells the story of Dr. Horrible, an aspiring supervillain; Captain Hammer, his nemesis; and Penny, their shared love interest. The movie was written by writer/director Joss Whedon, his brothers Zack Whedon (a television writer) and Jed Whedon (a composer), and actress Maurissa Tancharoen. The team wrote the musical during the 2007–2008 Writers Guild of America strike. The idea was to create something small and inex...
how have I never heard of that??
these guys sound like Basic Instructions superheroes
They are
not captain hammer
12:27
@AviD It came out during the 2008 Writer's Strike. Pretty fantastic stuff.
thank god for that - thought I was losing touch wid da kids
It's only about 45 minutes, so it's a quick watch.
really? neal patrick harris, nathan fillion, joss whedon - its on my list as of now!
Let's not forget that it's a Musical!
does the chat screen gets stuck sometimes on your side too?
I guess when images are involved
12:28
@ScottPack best musical I ever saw: Cannibal the Musical
(stuck -> auto-scrolldown mecanism)
@AviD Haven't seen it
Cannibal! The Musical (originally known as Alferd Packer: The Musical) is a 1993 independent film directed by co-creator of South Park, Trey Parker, while studying at the University of Colorado at Boulder. A black comedy, it is loosely based on the true story of Alferd Packer and the sordid details of the trip from Utah to Colorado that left his five fellow travellers dead and partially eaten. Trey Parker (credited as Juan Schwartz) stars as Alferd Packer, with frequent collaborators Matt Stone and Dian Bachar and others playing the supporting roles. In 2001, a stage production was stage...
I never heard of Dr. Horrible or Cannibal
but will need to download them
trey parker, matt stone....
12:29
@Mvy I see some weird stuff like that every now and then. I'll switch chat rooms, and when I come back the scroll bar will have moved up some, instead of resetting at the bottom.
so speaking of musicals, I took the kids to see The Music Man this week.
stupid story, unlikable star character, songs that are too wordy... but great actors (considering its a local production), and enjoyable overall. It just seems to work... dont know why.
maybe its thanks to mathew broderick.
anyway, kids had a great time...
I MEd that show when I was younger.
Never did like doing musicals.
ME?
Master Electrician
The only musicals I have liked so far have been Rocky Horror Show, Blues Brothers, West Side Story, Grease, the Buffy musical episode... think that's about it
My mum kept taking us to 'classics' like Cats, Phantom, Saigon etc - meh
12:35
@RoryAlsop Add in Tommy and now Dr. Horrible's Sing-Along-Blog, and you've got my list as well.
/me never liked working musicals.
Did a musical version of The Hobbit once
shudders
that recommendation works well - I know I will like Tommy, even just for the music
@ScottPack hahahahaa
My lead singer does all the sound production for local pantomimes
not certain they are really his thing but he is good at it
@RoryAlsop umm.... sound product... for mimes??
what does he do, hit the mute button?
hahahaha
lovely mental picture
Or is he an incredeible Foley artist?
have heard him called other kinds of artist... :-)
12:42
Giggity
This is the needle pusher?
Wooow there is a whole proposition on Crypto currencies
@Mvy on Area51? I reckon that will not make it - too narrow.
Unless it ends up part of crypto.se or something
well it's 56% commitment
12:48
but indeed I feels it's very narrow subject...
Some of the area51 proposals are so freaking narrow that it's no wonder they end up failing.
XD
very cool. Quidditch is an official school sport:
By the way, I guess the subject could also be on topic on IT Security or Cryptography
@AviD you're kidding?
@Mvy watch the link. and, no.
12:51
Well I got very poor network here...
so loading video is not part on my plan just now :P
okay, summary: Quidditch is an official school sport :)
and they fly on ... what?
they run around with brooms between their legs, basically its soccer/football + dodgeball + whatever else...
their feet.
oh... god...
its 2-dimensional, not like "real" quidditch.
12:54
is the snitch remote controlled?
XD
I'd want that job
no it's a butterfly
lol
gotta watch them - risk of tsunamis and hurricanes I heard
no, the snitch is... a person. with a ball tied to their belt...
nowhere near as cool as the real one...
@RoryAlsop and programming...
@RoryAlsop you joining the chatcast?
12:55
and they just have to run around randomly - awesome
Is this on topic for security : Q: I've bought a butterfly, how can I protect myself from butterfly effect?
XD
@AviD yep - I reckon. I've missed a few
@Mvy ;-)
Well I guess it will compete with biology :D
still have to write up my owasp talk proposals....

« first day (216 days earlier)      last day (4962 days later) »