The DMZ

Terry Chia

16:03

FYI: hynek.me/articles/apple-openssl-verification-surprises

Thomas Pornin

@TerryChia In any case you really want to include your own OpenSSL in your Mac applications rather than using the OS one, because the one from the OS is quite old and misses on newer functionalities and fixes.

Also, newer OpenSSL are like five times faster for RSA.

(At least on my machine)

Terry Chia

@ThomasPornin Yup. Apple has basically deprecated their OpenSSL in favour of their own TLS stack anyway.

Thomas Pornin

@TerryChia To their defence, OpenSSL does a poor job at maintaining binary compatibility, precluding transparent import of newer versions.

Which is a rather good reason for deprecating and replacing it.

Terry Chia

@ThomasPornin Oh, no arguments there. Sadly it's still the best available so far.

PolarSSL has awesome code quality but I don't think anything can compare to OpenSSL in terms of optimization yet?

Thomas Pornin

@TerryChia I have not checked. Optimization is overrated anyway.

AviD

16:10

@ThomasPornin in, say, 97% of the time.

Thomas Pornin

What makes OpenSSL unavoidable is that it often is already there.

AviD

@ThomasPornin Like PHP. and VD.

3

Terry Chia

@AviD And your face.

AviD

@TerryChia ah, better.

AJ Henderson

@TerryChia well hey, Bart grew up to be famous

AviD

16:13

@AJHenderson so did the Unabomber.

famous is overrated.

Terry Chia

@AviD Your face is overrated.

;)

AviD

@TerryChia see, now you're learning!

Thomas Pornin

@AviD He. I got a Google email on my gmail account this morning, linking to the "most popular Google+ posts this week", including that one: plus.google.com/u/0/112064634309032136529/posts/…

AviD

(this is where you jump in to: "now your mom is learning" ;-) )

@ThomasPornin hahahaha, oyy that is sick in so many ways.

Terry Chia

@AviD Did someone tell you that? ;)

AviD

16:17

> Niall+Me=♥♥♥ (Mohona+Harry #HaronaForever) Mohona was here,Bitches :P
Niall Horan's Wifey ♥♥
Niall's bed in London

So this is disappointing. While Hyper-V's RemoteFX technology works beautifully in my VDI setup, apparently the vGPU part doesnt really work unless the hosted OS is Win8 Enterprise. Whereas I set it all up with Win8 Pro.

I do have a an enterprise license, but the only enterprise ISO I have is unfortunately x86, not x64.

Rоry McCune

@AviD ahh win8 enterprise that unicorn... can't be bought (by ordinary mortals), ain't on MAPS...

Thomas Pornin

@AviD I am sure you can download an ISO through your MSDN subscription.

If you are worthy enough, of course.

AviD

@ThomasPornin so here is the odd part. my subscription expired, but they granted me permanent licenses. and before it expired, I accidentally downloaded the wrong ISO (apparently).

Iszi

@AviD I swear, there are some cases where certain choices of children's names (or the spellings thereof) should be punishable by public flogging.

AviD

not gonna renew, at least not for a while now...

@Iszi which one there?

I dont disagree, but you know what they say about glass houses.

Iszi

16:21

@AviD All of the above, I suppose - but especially Niall.

AviD

@Iszi well, he's dutch. or swedish. or something like that.

Terry Chia

@AviD Ouch. nasty licensing problems...

AviD

yknow, from the ~~menudo~~ one direction.

Iszi

@AviD Irish.

AviD

@TerryChia supposedly thats not a licensing issue, but a technical / feature support issue.

@Iszi yeah, okay, that.

shame on you for knowing.

Iszi

16:22

@AviD No, I Wiki'd. Though I will accept the shame for knowing who "Niall" is.

AviD

so, anyone know a way to swap the edition? Other than simply putting in the new license, of course (did that, didnt change the edition). Or does it need to be reinstalled?

and no, the evaluation ISO freely downloadable on MS site won't work - it's not upgradable to full license.

TildalWave

@AviD OP of this one: security.stackexchange.com/q/52605/20074 agreed to migrate it to Network Engineering, wanna migrate?

Iszi

@AviD I wouldn't be surprised if Enterprise was specifically excluded from eligibility in Anytime Upgrade.

AviD

@TildalWave Network Engineering?? WTF is that??

Terry Chia

@AviD Network voodoo?

TildalWave

16:32

@AviD hehehe

AviD

@Iszi arggh.

TildalWave

it's the site to migrate all our CISCO questions to, you should be grateful :)

AviD

@Iszi okay, so say I'm willing to just reinstall - the pro ISO wont help with that, will it.

Thomas Pornin

@AviD It is for the "network people", who are not on speaking terms with the "systems people".

Iszi

@AviD Probably not.

Terry Chia

16:34

@ThomasPornin At least they aren't "developers".

AviD

hmm, should I just install x86?

@ThomasPornin it's the same thing!

TildalWave

@AviD is not!

Thomas Pornin

@AviD Ah ! Not around here.

David Freitag

@AviD Yeah but you would think "systems people" would handle a bit of hardware and software like firewalls etc. whereas "network people" really only handle the physical aspects

AviD

@TildalWave of course it is! They are both "not applications".

Thomas Pornin

16:35

There are several chapels, and each of them makes it heresy to even suggest that any other chapel actually exists.

TildalWave

@AviD rofl

AviD

@DavidFreitag and router config, switches, etc

Iszi

@AviD Looks like I was right. answers.microsoft.com/en-us/windows/forum/…

AviD

@ThomasPornin hahaha, yeah.... at least devs are aware of others' existence.

Iszi

> Sorry, but you cannot do in place upgrades from Windows 7 Professional to Enterprise. ...

> The only other option is to purchase a retail Windows 7 Ultimate upgrade license use the key to do an Anytime Upgrade from Windows 7 Professional to Ultimate.

AviD

16:37

@Iszi arggh. Well, thanks for that. I've been searching, my fu was failing.

David Freitag

Why would Microsoft do such a thing? Surely there can't be such a difference between Pro and Enterprise that they can't do in-place upgrades...

AviD

what if I hack it...?

> I managed to upgrade from professional to Enterprise with a little trick.
1) regedit - hot_key_local_Machine ... WindowsNT - change the version "professional" to "Enterprise"
2) Start Windows 7 Enterprise Setup from installation dvd and choose upgrade.
3) After Upgrade I change my OEM 7 Proffesional preregistration key to licensed Enterpirse key and register trough KMS server.

Iszi

@AviD Hey, if Windows Media Center Edition can be made to join a domain, I'm sure it's possible.

Thomas Pornin

@DavidFreitag Well, they state it plainly, no ? If you want to do an in-place upgrade, you need to pay for the "Ultimate" upgrade. That's clear enough. Things work as you expect only as long as you throw money at it.

Iszi

(Been there, done that. Not fun.)

TildalWave

16:39

@AviD actually, I've seen some pirated versions that did almost exactly that

AviD

@ThomasPornin well in this case I have all the licenses. its just a question of getting it to recognize it.

@TildalWave hmm. my problem is I still dont have the enterprise ISO.

David Freitag

@ThomasPornin One would be lead to assume that someone had already paid for the Enterprise license that you are attempting to upgrade to.

Gilles

@TildalWave which shows the technical superiority of pirated copies over genuine copies, which shows how deeply the whole commercial software model is flawed

AviD

also, win8 doesnt have an "ultimate" version.

Gilles

pay more for less

AviD

16:41

@Gilles Heresy.

Iszi

@AviD 8? I thought we were talking about 7? WTF are you doing on that pile of crap?

Terry Chia

@Iszi He's @AviD.... Need we say more?

AviD

@Iszi seriously? it's a sweet-ass OS.

David Freitag

@AviD It is, right up until you try to make it play nice with AD

TildalWave

@Gilles well, MS used to make it simple for them with MSDN copies

Gilles

16:42

@AviD sweet crap is still crap. Plus how do you know it's sweet? Ewww.

AviD

really dont know why it got such a bad name, even with otherwise sensible people.

Change is different. Different is baaaad.

Thomas Pornin

@Gilles I don't agree with "flawed". Microsoft's commercial model aims at allowing Microsoft to make a lot of money, and, as far as I can tell, it works beautifully.

Iszi

@DavidFreitag I presume your AD is based on 2k8? Had similar issues back when Vista came out and the company I worked for was running a 2k3-based domain.

AviD

@DavidFreitag I have zero problems with it and AD.

Gilles

@ThomasPornin I was thinking of the flaw in buyers here

David Freitag

16:42

@Iszi I think it's 2k8

AviD

@Iszi 2012, actually.

Gilles

similarly, the only industry that profits from DRM is the security industry

AviD

ah oops, that was to him, not me.

David Freitag

@AviD That's probably why you haven't had any issues with AD

Iszi

@DavidFreitag Yeah, the latest workstation edition of Windows really only tends to play nice with the latest server edition.

AviD

16:43

well, there ya go.

David Freitag

Our win8 boxes also absolutely refuse to accept updates from our WSUS

TildalWave

@AviD I'm not even sure you need it, I think it's all on the "professional" copies just as well, it's just the key and setup that are different (or something like that, but should be a way to make one version out of another, if pirates managed to do it)

AviD

must be the eyepatch.

other downside: enterprise is not "professional + other stuff". there is some stuff you cant get on enterprise, like e.g. media center.

TildalWave

meh that's just a GUI innit?

AviD

great for watching on a big screen.

kinda a TV-like interface.

TildalWave

16:47

dunno, never tried it I just stream from VOD or PS

AviD

@TildalWave yeah, and that works fine. but media center is betterrer, somehow.

TildalWave

I wouldn't know :P Plus, I have to beg to have access to telly, so ... no way

bad @AviD bad, you didn't purge comments before migration!! bad diamond LOL

AviD

@TildalWave urrps.

TildalWave

I ALWAYS forget

luckily, most stuff is migrated from space to astro, so I know who to annoy for it :)

kiBytes

17:17

If you earn a badge and then somebody just downvotes the question

do you lose your badge?

Terry Chia

@kiBytes No.

Badges are forever. Just like @RoryAlsop.

3

kiBytes

@TerryChia I know you have downvoted my answer =P

(just kidding)

Terry Chia

@kiBytes What? No.

kiBytes

It was a doubt anyway =)

TildalWave

@TerryChia I can't remember which ones, but IIRC some badges are revocable

might be the tag badges? don't remember ...

yup...

> ... unlike other badges, tag badges are revocable, if any of the pre-reqs are not met we will remove the badge.

4

A: Why do you require 100 questions in a tag before its badges are awarded?

This was part of a large scale anti-gaming implementation that protected us against abuse, for a bronze tag badge to apply we require: The tag appears on 100 questions You have at least 20 non-wiki answers You have a total score of 100 on non-wiki questions Additionally, unlike other badges,...

FEichinger

17:33

@TildalWave Still royally screws over Arqade.

David Freitag

@TerryChia And Wurtzite boron nitride, bitches love Wurtzite boron nitride.

TildalWave

@FEichinger on space, it's only possible to get one tag badge so far, and I have it so ... yeah, waiting for another tag to reach 100 questions :)

FEichinger

@TildalWave (Yes, but space is a "small" site :P)

TildalWave

I got the first Sportsmanship badge today tho

@FEichinger that's a bit paradoxical, space cannot be "small" :P

FEichinger

Didn't say the site subject was small, you pedant.

TildalWave

17:40

:P

what are you complaining anyway, Arqade has 80 tags for which it's possible to earn badges

that's more than sec.se

and we all know that sec.se tag badge > arqade.se tag badge

FEichinger

"arqade.SE" is redundant.

TildalWave

careful, @kalina might set you on fire! :)

FEichinger

I'm not authorized to reply to this.

Iszi

Random thought: Has anyone ever considered that STEM was probably, at some point in history, just S&M?

Wow. Why pythons wouldn't get "one bite at a time" jokes.

This is what it looks like when a python eats a crocodile. http://t.co/127NNIuDWl

Tweeted by AsapSCIENCE on March 3, 2014 at 5:40 PM

Iszi

18:11

I should read Jack Daniels' blog more often, I think. I love this little tid-bit:

> Forgive me for not addressing air-gapped systems here, but you will note I am not addressing unicorns, either

kiBytes

Now go and try to make them installing an AV liveleak.com/view?i=689_1393758243

David Freitag

18:35

@kiBytes Lol, that's ridiculous

TildalWave

18:51

@Iszi bbc.com/news/world-asia-26413101

blimey

AviD

19:45

@Iszi I sense a Michael Bay movie on the horizon.

but dinner? not so much. That made me lose my appetite.

Stack Exchange

Blog - Stack Exchange: Your communities list is now customizable

Jeremy Tunnell on March 03, 2014

A few months ago, we rolled out a new top bar for all of the Stack Exchange communities. The mission was consistency: Every community gets the same Stack Exchange brand at the top, the same navigation between sites, and the same live updates about new inbox items and reputation changes

But we realize that not everybody uses Stack Exchange the same way. Some people focus on one community, others participate in several, and more than a few spend a lot of time lurking now that we have 116 different sites to choose from. …

theGreenCabbage

20:18

What are your thoughts on Mt Gox' PHP source code release?

AviD

@theGreenCabbage Shameful. A real travesty.

PHP for a financial application??!? Shocking.

FEichinger

@AviD Could be worse.

Could be JSP.

AviD

@FEichinger arguable.

Rоry McCune

@AviD if you read this wired.com/wiredenterprise/2014/03/bitcoin-exchange

sounds like PHP wasn't event the worst of their problems

AviD

now while there may not be The One True Language, there are Many Wrong Languages.

@RоryMcCune I did not.

Not enough interest to bump it to the top of my To Read list.

Rоry McCune

20:28

no source code control sounded like it could be a bit of an issue...

AviD

@RоryMcCune wat.

Rоry McCune

"Mt. Gox, he says, didn’t use any type of version control software — a standard tool in any professional software development environment."

theGreenCabbage

Well, how they even got the source is scary

Indicating access to the servers

AviD

@RоryMcCune and in most non-professional.

obviously they are neither.

well, were.

Rоry McCune

a stunning level of money to lose with that level of un-professionalism

AviD

20:38

what actually happened? how much was lost, and how?

short-short-short version....

Gilles

@AviD $½B, “hackers”

AviD

heh

thass a lotta munney

Gilles

and if you're willing to double that: gross negligence

@AviD highbrow traders routinely lose more than that

theGreenCabbage

470 million USD IIRC

Our start up has ~200 users in our DB, and even then we're paranoid about security

Don't understand how they can sleep at night with that much money and that many users at line

AviD

Simple.

> "I'm a developer so obviously I dont know (or care) a lot about security".

FEichinger

20:44

9 hours ago, by FEichinger

> I am a developer and I therefor I have very little knowledge on security.

AviD

@FEichinger yeah, I got the quote wrong. Shoe me.

theGreenCabbage

Funny how I read that somewhere today on StackExchange Information Security

FEichinger

@AviD throws a shoe

AviD

I WAS QUOTING IT.

FEichinger

throws another shoe

AviD

20:45

haha, now you're barefoot.

We need a shoe page.

FEichinger

... No.

AviD

@theGreenCabbage that's the problem. that attitude is way too prevalent.

FEichinger

(For that matter, I actually do have three pairs of shoes in my immediate vicinity right now.)

AJ Henderson

hey now, I'm a developer

@FEichinger hey, we have another woman in the chat

;)

theGreenCabbage

Guys it's a lady can we not be creepy please act cool

FEichinger

20:46

@AJHenderson It's almost as if I was shoe-ting for such a reply.

AJ Henderson

@FEichinger wow, and I thought I had a bad sense of humor...

;)

FEichinger

:P

AJ Henderson

@theGreenCabbage this is me being not creepy, you should see what creepy looks like

theGreenCabbage

I'm currently studying computer engineering at a college in the States

AviD

@AJHenderson welcome to the dmz.

theGreenCabbage

20:48

How do I learn, alongside my college career, in IS?

AJ Henderson

@theGreenCabbage huh?

ManishEarth

21:19

So, it looks like I engineered myself a rep train (with some @TildalWave help)

25

A: Is there a Chrome extension that I can use to note why I've opened a tab?

So I just created a quick extension that does this: AnnoTabe For now, you have to install it by downloading a crx from here. Since Chrome doesn't allow directly installing crx files, you'll have to drag-drop the downloaded file to the extensions settings page (chrome://extensions). Alternativel...

theGreenCabbage

Hey Manish

Are developing Chrome Extensions at its core just HTML and CSS?

ManishEarth

yeah

and JS

Iszi

@ManishEarth Why the "e" at the end of the name?

ManishEarth

@Iszi AnnoTate

Iszi

Ah, right. I see what you did there. Just not what I'd have done.

ManishEarth

21:33

Yeah, I was thinking of AnnoTab too

theGreenCabbage

Manish want a better icon?

ManishEarth

@theGreenCabbage I like Tildal's icon though :)

theGreenCabbage

21:50

It doesn't have the BANG

Do you have any good tutorials for making Chrome extensions?

Or are they just your innate web dev knowledge

Iszi

22:02

@theGreenCabbage What's 802.11 got to do with it?

theGreenCabbage

Huh

Iszi

22:33

Sometimes, I'm ashamed of the questions that get tweeted.

Is storing plaintext passwords for email accounts any less bad? http://security.stackexchange.com/q/52622?atw=1 #passwords

Tweeted by StackSecurity on March 3, 2014 at 10:30 PM

Some accounts I can see asking "Is storing plaintext passwords for X less bad?" but e-mail accounts?! Really?!

Great. Just what we need. Microsoft feeding more bait to the phishers.

Microsoft will use pop-ups to warn Windows XP users to upgrade http://vrge.co/1luvMBD http://t.co/bVdV2av9tD

Tweeted by verge on March 3, 2014 at 10:39 PM

Gilles

22:48

23

A: Community Promotion Ads - 2014

Rory Alsop

@Gilles I upvoted that one ages ago :-)

Iszi

@Gilles Dude, I totally want one for here now!

Gilles

@Iszi feel free to make one

Iszi

@Gilles I said I wanted one. Not that I'm not too lazy to make one.

Rory Alsop

I want to close this as off topic. Anyone see a reason I shouldn't?

0

Q: Which versions of TLS are supported by which Android version?

I believe Android 4.2.2 supports TLS v1.2. What version of TLS does Android 2.3 support? What version of TLS does Android 3.x support? What version of TLS does Android 4.0 to 4.1 to 4.2.1 support?

Anonymous

22:51

@Iszi confirmed for microsoft botnet

Anonymous

somebody should make a countdown till windows xp support drops

Gilles

but sec.se actually likes its twitter bot, unlike U&L (which hates it almost as much as SF)

Rory Alsop

@Gilles the ad just under yours is scary :-)

Iszi

@RoryAlsop I... uh... what?!

I really want to say close it, but I can't really think of a reason that strictly fits.

Rory Alsop

localised, time bound, meh

Gilles

22:53

@RoryAlsop this guy can log into all your machines, he is scary

Rory Alsop

@Gilles Exactly

Iszi

@RoryAlsop TL is a dodo.

Rory Alsop

@Iszi I know. I want to migrate to Android, but they may not be pleased. I'll go and ask

Gilles

As much as I hate cybersquatters, I'm thinking of acquiring a parked domain, if I don't have to pay too much for it. How can I estimate the price at which the seller will let go?

Iszi

@Gilles Tell us the domain name, and we'll give you some ideas. ;-)

Anonymous

22:55

java-0day.com

Rory Alsop

@Gilles that's a hard one

Anonymous

228 since the last known 0day exploit

Anonymous

what's wrong with the hacker community

Iszi

@PatoSáinz Seriously? Sounds fishy.

Gilles

@Iszi is it a good idea to post it in public? (I'm not worried about the TL crowd, but I am worried about Google trawlers)

Iszi

22:56

@Gilles I was kidding - hence the wink. I wouldn't.

Gilles

> Visitors to this domain’s website: 19 (previous 31 days)

that doesn't sound much

Rory Alsop

23:11

@Iszi can I use Just Google it here? Google will know :-)

Iszi

@RoryAlsop I think that's called "General Reference" and usually ends up being abolished on any sites where it's ever implemented.

Rory Alsop

@Iszi darn it - it were a joke. Hence the smiley :-)

Iszi

Bah. So many SOHO router exploits these days. It seems the only safe thing to do is set yourself up behind as many different manufacturers' routers as you can.

Transcript for