« first day (222 days earlier)      last day (4956 days later) » 

08:22
Hey @Mana!
Hi guys
08:38
@Mvy Hi
How are you?
I am fine thanks :) Working home office. What about you?
Working too. At the office.
What do you work with?
Security norms
iso27001
Documents review
08:57
Sounds interesting :)
XD
 
2 hours later…
11:25
Morning Gents.
11:45
Hey @ScottPack!
12:10
How do?
posted on July 26, 2011 by roryalsop

Despite the security industry getting ever more professional, with well trained teams, security incidents seem to be increasing. Just look at the news recently: Sony – 23 incidents so far? UK NHS Laptop – over 8 million patient records Citibank – 200,000 customer records lost WordPress platform vulnerabilities (see Steve Lord’s presentations on this) Stuxnet [...]

@RoryAlsop What happened is that you put it in as a code block as a single line, not as a block quote. So it did show up exactly as described (even on FF4 on Linux), as a single line with lots of scrolling.
12:52
greetings peoples. hows things.
@ScottPack interesting - here, using IE7 on Windows XP it showed up exactly as expected.
and hello all
from a bizarrely sunny Scotland - has been gorgeous weather for nearly a week now, I am tanned, and my garden is confused:-)
Ok I think I got my keymap done :P
good thing
Hopefully it's very easy with the xmodmap. Thanks @ThomasPornin :P
@RoryAlsop heh. whats the temp over there?
(give it to me in degC, i can convert it myself)
The week in May that I spent in Edinburgh was gorgeous. Only got, what I would consider, a proper rain one morning. I still maintain they were the bluest skies I've ever seen.
13:08
@TheEvilPhoenix 27 degrees centigrade
I've had 4 tents up in the back garden over the weekend - to keep the kids cool (they pop in there out of the sun)
when it gets over 20 I start melting - I'm much happier in the very rare -15 to zero range:-)
and working is at least okay between 0 and 15 or so
27C and partly cloudy is my preferred temperature.
if I'm in shorts - yep, that works for me - but not in a suit!
@RoryAlsop At that temperature I would probably prefer pants, but could go with shorts.
@RoryAlsop heh... trust me though, that heat you have is NOTHING
its gotten really hot over here the past week
i thinik there were something in the range of 40 deaths US-wide from a massive heat wave
When the dew point is up in the mid to upper 70s, you know there are problems.
13:30
yup
was about 42 degC this past saturday over here
bout the same for 4 days before that
(106degF for US people :P)
Heat index or measured temperature?
measured
HI was over 125
@TheEvilPhoenix I have only ever encountered those temperatures 4 times before. Honeymoon in Greece, Defcon in Vegas in 2006 and two visits to Dubai
actually the HI was over 125 on saturday... it was a peak at 115 the few days before that.
13:32
I don't cope well at those temperatures
@RoryAlsop All places I would expect inhumane temperatures.
@RoryAlsop i know, and its not even supposed to get NEAR this high in my location :P
@ScottPack yup - expected, so counteracted with insane air conditioning
but it did
Yeah, looks like last week we were around 12F above average. I don't think we set any records, though.
13:48
I need coffee.
Back
@RoryAlsop I don't do well in those temperatures either. I hate the heat... I also hate the cold in winter too, so... shrugs
Hum winter is cool :P
It's funny, using the weather.com comparison tool, it actually lists Edinburgh as 2F warmer, on average, than here. Something about more compressed high and low ranges.
@TheEvilPhoenix I don't like wet winter - slush, mud etc., but really cold winter is dry, and the roads are empty.
@ScottPack Hahahaha - Scotland on average is warmer than somewhere? I bet we are wetter than most places, though
i once almost lost a couple toes due to winter cold... except that i was wearing thick insulated boots and i still almost lost a couple toes...
14:02
I had the advantage that my dad used to work in the Antarctic 6 months of the year so would come back with VERY warm clothes, (and really cool sunglasses)
Well I heard cold temperature are not so bad... what is really bad is : wind
yeah - I've got a great photo of my dad taking a bath on a 40 gallen drum on a glacier in Dronning Maud Land in about -20 but strong sunshine and clear skies. He says that 8 hours later the wind chill was -40 degrees and visibility was about a metre.
Better not be out then :P
14:17
the wind we have in central Scotland isn't bad. If it gets up to 80mph it's a bit of a shock, whereas back home it peaks over 180mph and doesn't cause much trouble other than stopping the boats sailing:-)
:P
Hum ... HTC seems to have promoted the #status hashtag...
bad move soldier
#status? haven't seen that used anywhere
Hum ... well I just saw it in the trends
with the yellow promoted box
lot of crap behind it
Oh. Seems they got a sticky tweet for that price
ah - glad tweetdeck doesn't give me any of that:-)
hum yep.
14:27
afternoon @Thomas
Hi @ThomasPornin
@Mvy I can confirm that: in Québec, we can get a -30 which is perfectly tolerable if there is no wind (well, at least you can go walk outside for 20 minutes), but -10 with 40 km/h wind is unbearable
so, do you guys think this question is worth saving? It will be out of date when one is upgraded or a plugin is developed:
0
Q: How do Chrome, Firefox and IE compare in terms of browser security?

aspdotnetuserHow do these browsers compare in terms of browser security? Are there any main differences in terms of how good they are at detecting cross browser scripting, spyware? Would using Firefox with security add-ons be more secure than using Chrome? Any comments or suggestions will be appreciated.

Hum you're probably right @Rory
Too locali[sz]ed
14:30
@RoryAlsop Haven't we seen (and possibly closed) similar questions several times last week ?
I am getting deja-vu
yeah - comparison ones are always going to come in, but I try and see if there is anything salvageable
I think not, but wanted a second opinion
a diamond vote to close is quite sudden, you see:-)
It takes one man to close a question :P
one mod;-P
@nealmcb - are you aware of this bitcoin research:
40
A: Eeeek! How does this question have 28 (and growing!) close votes without being closed?

Won'tPfft. You guys are wimps. It takes a MAN to close this question.

hahaha - excellent
14:39
Yeah I love it :P
Anyone here heard of CyberDefender?
Nope
I've got an odd report from a user claiming that when he went to malwarebytes.org he ended up buying CyberDefender instead.
Uh oh.
From what I can see, there seems to be a legitimate (yet, on some sites, poorly reviewed) anti-malware product called CyberDefender. But, I'm still not sure how he got from Malwarebytes to there.
14:53
@Mana!
@Mvy!
How did you come here from "The Bridge" ?
Oh, I decided to hang around some other rooms for a change.
Right!
Plus we got a nice look&feel now
I'm totally awesome at security, too. Like, I wrote a C program the other day, and it involved some buffers and I made sure that I wasn't putting too much stuff in those buffers!! It was great.
14:57
:P
That's better than many other devs for sure
heh
Interesting. I'm reading in one article, that CyberDefender claims using Google over HTTPS "reduces the risk of being infected from search results."
....:|
What does it take for a tag-specific badge to become available ?
101 score
Normally
15:07
I mean, getting the bronze badge requires 100 upvotes in at least 20 distinct questions
oh
But I have more than that for and
and yet, no badge
so there must be something else
recent?
not really
for I have 240 upvotes over 24 questions, so I crossed the threshold quite some time ago
hm
15:10
my hypothesis is that it is based on the number of distinct questions (site-wide) in which the tag appears
e.g. appears in 98 questions, so I am ready to imagine a threshold at 100
But the 400 kind of bother me
Yes, it is strange because the badge exists, and the top user has less than 400 upvotes for that tag
BTW @ThomasPornin, are you really using a keyboard? Your last answer is 2 screen pages high ... O_o
@Mvy Yeah, I think he's totally got me beat for long-windedness.
@Mvy Yep, it was all old-style handcrafted and I didn't even let my cat jump on the keyboard.
15:15
XD
@Mvy Maybe rules change when the site graduates ?
hm ... that would be unfair wouldn't it?
@Mvy How much unfair, compared to rising the "trusted user" privilege from 4000 to 20000 ?
point taken
I guess you're up to a on Meta Stack Overflow
argh
<strike>what is</strike> the magic link for meta so is [metaso]
15:55
Hummm G+ is really messing up with notifications...
Like, clicking on the notification button and not having the number of notifications reset to 0?
Or just in terms of what notifications they give you?
for example
and sometimes you got notification you already got
yeah, I've had that happen too
I assumed it was to do with my faulty internet
And I hope they get rid of the re-sharing thing!!
heh
15:58
Well resharing is not a bad thing
but displaying it when you already follow the original poster is just useless
16:15
Ah, got the answer. Apparently rules changed last autumn.
And it is really written at some place (albeit not very prominently).
The rule is indeed that a badge is created when there are at least 100 questions for that tag.
I also learned the existence of:
845
Q: FAQ for Stack Exchange sites

Justin StandardCommunity FAQ For sites in the Stack Exchange 2.0 network To see a list of commonly used words and phrases, see the glossary. Content Asking questions How to ask a smart question? How can I get answers fast? Is there a limit on how many questions I can ask? Should I ask a question I kn...

which is not the same than what the "faq" links point to, and that's a shame because this is a very useful link
16:39
Yeah I got that question favorited already
So, @RoryAlsop, is there any part of your life that doesn't make your family sound like some kind of special forces spy group?
17:03
@RoryAlsop I retract my earlier statement. We are both warmer and cooler than Edinburgh, and way wetter. weather.com/outlook/travel/vacationplanner/wxclimatology/…
Anyone know the minimal set of browser features you need to use security.stackexchange.com?
@RoryAlsop Thanks for the newscientist article on bitcoin. I had read it and agree they did a nice job of beginning to apply some interesting tools to the deanonymization problem. Not a surprise to those who had actually looked at the bitcoin web sites rather than relying on clueless press reports or propaganda.
17:20
@thisjosh guess that could be minimalist feature since you can always go to mobile site at last :P
And do you mean full featured?
Apparently, the site is principally usable with ie7
0
Q: What browser features are required to ask a question on security.stackexchange.com?

this.joshWhat is minimal set of browser features required to ask a question on security.stackexchange.com without a user account? Specifically, I use Pale Moon portable as an ephemeral browser (it has no persistant data). I was attempting to post a question on security.stackexchange.com without logging i...

 
1 hour later…
18:52
@Scott - when I get back to a PC I'm starring that:-)
and you're wetter? Than Scotland? Crazy?
Oh, and this site and IE7...not so good
indeed. i brought that up on the AU meta, and staff said "Oh well deal with it" basically.
@RoryAlsop Here in Quebec, we get more "precipitations" than Scotland, but half of it is solid, hence not "wet"
I'm not sure about Ohio, though
@RoryAlsop This is a temperate rain forest, so we tend to get big rainstorms. When it rains, it freaking rains. None of this mild drizzle stuff.
@RoryAlsop According to that link, we get about 13" (33cm) more rain per year than you :)
19:20
heya all
@ThomasPornin thanks for the info on ABE
so, would I be correct in seeing it as a form of ABAC, enforced by encryption?
@ThomasPornin the legend on the badges page clearly(-ish) states: These badges are awarded for participating in non community-wiki questions with particular tags. If enough votes are earned in **a tag with 100+ total questions**, the badge will be automatically created and awarded.
@AviD Yes, that's what I got as answer: apparently, I do not know how to read.
@ThomasPornin lol
no, its not that... no one reads the instructions.
should be coming up shortly. has quite a while.
(not all badges for you, but available in principle.)
@AviD Yes, something like that. You can view this as a tamper-resistant device which grants access to some data only to people who fulfill some characteristics; then, ABE does the same without the device, only keys and a "central authority" which needs not be online (this is where the hairy maths come into play)
and... how does ABE rely on the fact that you dont change your attributes?
ah, the central authority...
but how is it not needs to be online?
@AviD That's the magic of pairings
It is easier to begin with IBE (Identity-Based Encryption); ABE is just an extension of IBE
In IBE you public key is your email address
so there is a central authority who "knows" how to compute your private key from your public key
19:28
so if I understand this correctly, the central authority becomes the weak point in this chain...
the authority gives you your private key
but it is not needed to contact the central authority for actually encrypting or decrypting
I think a core difference, is that in IBE the "key" is only yours; in ABE many users can share the same attributes.
it is a three-party protocol (sender, receiver, authority) so it uses a bilinear pairing
ohhh wait, I think I missed that point.
the attributes are not the actual "key", correct?
19:30
nor is the key "derived" from it.
actually the key is derived from the attribute, by the central authority
and only the authority can do that (mathematically speaking)
but, like with IBE, attributes are a "lookup" mechanism, in the "ca", to retrieve your key?
a simple way to do ABE:
I think I need to learn more about this one.
you take a few attribute names, say attr1, attr2,...
19:32
my main focus is around the area of ABAC (ish), so this is particularly relevant to me...
you assume that the authority computed the private keys for those attributes, and sent the keys to the relevant people
instead of me driving you crazy, do you have a good resource to point me to?
preferably not too math-y.
I just see too many operational questions here, but that might be because I'm looking at this from an access-control pov.
for instance, attributes attr1 and attr3 match me, so I got the keys 1 and 3
so what would happen, if you lose attr1? rekeying for everyone?
If you want to send a message to whoever has attributes 1 and 2, you encrypt it with attr1 (the public key) then re-encrypt the result with attr2
@AviD somehow, yes
19:34
and can ABE not support attribute unions?
I have not read the complete details
so possibly yes
sounds... messy.
What I found was just a scientific article
which actually introduces the terminology
that's really young
have link?
19:37
really? ABE comes from MSR? inneresting...
@ThomasPornin thanks!
will take me a while....
In a business context, Voltage Security Inc. is selling products which use IBE
@ThomasPornin familiar.
One of the founders of Voltage is Dan Boneh, who published the first practical protocol for IBE (with pairings)
first time I'd heard about IBE...
is anyone else selling IBE?
Not to my knowledge, but the World is wide
As you said, the central authority is a single point of failure
IBE is meant to solve the public key distribution problem, which is usually addressed with certificates
it takes a rather specific situation for certificates not being an applicable solution
19:44
I was able to wrap my head around IBE relatively easily, but I'm still not getting ABE too well.
The operational aspects, not the math
not even trying the math on that :$
this is kind of cool: wtfnoway.com
yknow, in a freakish-omigod-wtf-noway, kinda way.... but hey, who doesnt love a good infographic?
 
2 hours later…
21:59
Urks. Second try to answer the browser question failed because it's closed again.
I think the answer is unrestricted JavaScript.
Oh, and a Name and Email, though I am not sure if it requires a valid email address format.
0
Q: What browser features are required to ask a question on security.stackexchange.com?

this.joshWhat is minimal set of browser features required to ask a question on security.stackexchange.com without a user account? Specifically, I use Pale Moon portable as an ephemeral browser (it has no persistant data). I was attempting to post a question on security.stackexchange.com without logging i...


« first day (222 days earlier)      last day (4956 days later) »