« first day (1201 days earlier)      last day (3977 days later) » 

 
4 hours later…
07:39
@RоryMcCune nah, I was at training day yesterday.
hmm. not as exciting, murderous, or drug addled as it sounds.
wait, maybe drugs do explain some of it, there was a lot of AngularJS there.
@StackExchange if this is prelude to neo-Luddism, and before you burn everything, I could use a new laptop
24
Q: How to secure a MongoDB instance?

AaronSDoes anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.

another one that needs some cleaning up ^
@TildalWave Threw a protect on it.
it's an old one, but since it's fairly broad, perhaps protecting it would be useful?
@TerryChia oh cheers
07:54
@TildalWave That 20k privilege is useful for something after all.
Oh no, protect is 15k.
ya know, I think I've spent too many years QA'ing reports
for balance, here's a positive example of how to answer a question when you're associated with a solutions provider / vendor in the field:
1
A: Looking for approach to implement attribute based access control (ABAC)

David BrossardDisclaimer: I work for Axiomatics, the leading ABAC/XACML vendor. I am glad to hear you are sold on the philosophy of ABAC. If you haven't already done so, do check out the following resources (I'll spare you commercial links): NIST ABAC project page and report. OASIS' A brief introduction to...

was reading a technical book and it feels a lot better if I can send errata back to the author
@RоryMcCune how do you ask and answer reports?
@AviD :op Quality Assurance
07:59
@AviD That's Q&A.
heehee
@TildalWave the newer answer there is not completely worthless, it does talk about LUKS. I commented and told him to include the blog comment or be deleted.
weirdly the bits where I found a mistake in the book were potentially more helpful 'cause I had to work out how to fix it..
the other one I deleted.
with a comment.
@TildalWave reading. but doubtful.
starting with the the 2nd part of the question being basically a product recommendation.
which this errant startup is only too happy to provide.
@AviD It's the same one as yesterday, with the same link on a similar topic and possibly identical text. If that's all his contributions will be like, then I'm marking them as spam. Because it is, it's a commercial solutions provider for what there are open source solutions.
oh, that part I agree with. at least this time he pointed to a blog, and not to his product.... but the LUKS explanation saved it from being a non-answer.
now its just a crappy answer.
08:06
@AviD It looks good to me.
@AviD well I tend to delete such "answers" eventually, if the majority of the answer is somewhere else, and not where it was posted as such
otherwise we can all just start linking to our blogs
@TildalWave oh I agree. it's definitely borderline at best.
didnt delete the flag, left a comment, if he doesnt fix soon it will be deleted.
we should start spambinning "I work for X; use our product that fixes this"
08:08
@TerryChia so here is my problem with it.
@AviD there's a mod post annotation option you could use (the one with "we're looking for long answers...")
read how many times he basically says "you should by axiomatics".
trick question, btw.
there are a LOT of hidden, subtle references.
starting from the fairly obvious "DONT BUY IBM / ORACLE!!" and "BUY FROM A STARTUP!".
to be fair IBM and Oracle have pretty pathetic IAM products
but its more than that... the whole "THIS is the way to do ABAC, and of course ABAC is the only thing worth doing!"
@AviD OK, but he actually answers the question, and he made it a CW ... it should be slightly edited so it doesn't look like the community here endorses some specific product, but the rest looks fine to me in that particular case
08:10
"All these analysts say we need better security, they mean ABAC! Which is Axiomatics only!"
@FalconMomot oh, I dont disagree.
FTR, Axiomatics, while being a world better, are not much better.
it's hard!
I used to be a solution architect at hitachi ID systems
@TildalWave CW is irrelevant, he doesnt care about rep - this is a marketing pitch.
@AviD ? The question specifically asks about ABAC. The answer would be off topic if he mentions some other thing.
@FalconMomot ah yeah? cool!
Edit the references out if you like, the first bit of his answer looks to be worth preserving to me.
08:11
@AviD it definitely reads like a white paper yeah
and being "hard" is not an excuse to come out with a crappy solution.
@AviD ...you have heard of them?
@FalconMomot yup
is my area of expertise
and interest
oh awesome
I didn't mind it all that much there, and I definitely liked the product.
@AviD of course it is, but it's not a crap one, that's all I was saying :P
08:12
@TerryChia yes, I agree. There is a LOT of good info there, which is why I was torn, but it is heavily soaked in marketing.
@TildalWave didnt say it was crap. said it was marketing.
as a marketing pitch - its definitely a good one! :-)
indeed; a nice white paper is still a white paper
I am hesitant to edit it, though - since I am biased in a different direction.
but perhaps that's the only reason I am sensitive enough on the details to pick up the whiff of axi-bias.
@AviD Well you did complain it's biased, but he actually mentions there's open source community solutions he should check too, he immediately discloses his association and doesn't use the sales pitch wording too often to be distracting. If all "spam" was like this, I'd have little to no complaints about it.
> Have your colleagues only looked into IBM and Oracle? The main players are definitely not those two but rather the smaller vendors and the open-source community.
I personally have no issues with the answer as it is really.
true, he does kinda sorta mention OS products - which are mostly unusable.
08:17
@AviD Not his fault other products are crappy. ;)
@TildalWave please. the sales pitch permeates every paragraph, its just too subtle to pick up if you dont understand what it is he's selling.
@TerryChia haha, true - but it is his fault that HIS product is crappy.
actually, probably not either.
@AviD Hey, it's less crappy and that's what counts.
@TerryChia Is it?
there are other much more spammy answers I've had spam flags declined on.
@FalconMomot again, I dont disagree.
I wouldnt say that is spam, or a worthless answer.
again, since I have my biases (of which I am well aware), I am more sensitive to it.
think about how if there was a question on web browsers, and someone from MS posted a factual correct answer, through the lens of how awesome IE 11 is.
everyone would be shouting at him.
also btw, re the opensource packages he points to, in case youre not familiar it is worth pointing out that Axiomatics was one of its' main founders....
@AviD Eh, if it is indeed factually correct I won't have a problem with it.
@TildalWave :D
@TildalWave hehe, I.... dont know if that is awesome or gross.
@TerryChia I would have stepped in to clean it up and tone it down, if it went too far - and I use IE.
@AviD "if it went too far" Exactly. That's a fine line.
08:23
@TerryChia of course. My point is, any non-geek would be oblivious of that line.
if you are not "steeped" in AC lore, ABAC alternatives, issues, and etc - you probably are not noticing how slanted his answer is.
@AviD thought you might need a cup or two of coffee ... and no, it's not a Rorschach test, you're supposed to drink it :P
:-)
thass a good idea, actually
aww, niiiice!
to be fair, that random spam does improve @LucasKauffman's answer.
3
I still don't get it why do they consider it useful to enable anonymous users to suggest edits?
should be "you are not logged in, are you sure you still want to submit this edit?" -> "yes" -> "ban!"
Oh wow. 102 messages only in my lunch hour.
@Adnan slow day.
08:40
@AviD moved that comment into the answer and marked comments obsolete, if you wanna clear it up
@TildalWave the spam??
ahhhh
done, ta.
08:51
meh, voted to migrate to SU and it's actually not clear, do I leave my vote and others will override it with a different reason, or retract?
0
Q: My router is opened to the internet

user3412816I typed in my IP into my address bar and my router admin page came up. Is this safe? How can I disable it? It's Linksys Smart Wifi

it's also littered with crap answers, please protect
09:07
I'm torn on that. It's off topic, but its also kinda not. "Is this safe"....
@AviD I know, I pushed the button too fast OK? :P But it is unclear what he's asking and should follow up on the comments.
or she...
@TildalWave good idea. will close as unclear - then when it is clarified we can close as off topic.
@AviD I think it is on-topic. The issue is that it's unclear what he did. Did he access his router from the local network using the local address, or did he access it from an external network.
@AviD hehe that's the spirit!
@AviD Yaay!
09:10
@Adnan it seems that most of the question is "durp wadidido, how done I did fiksh it, durp"
@Adnan That's why all those comments below it. I gave an example of how to check that, plus he/she'll see how it looks like from "the outside" ... end users, you know, they like to visualize things :)
Then, you analyze the problem, analyze existing code and you go work on refactoring current code so it becomes clearer and nicer. And you use a mix of various pattern designs that you really think fits best.
You work on that by yourself, a couple of weeks, building a nice core and some examples of how to work with this base core.
And everything seems nice.
hmm, I think we came in in the middle of that conversation.
Moving forward 6 months
I'm fine with that.
09:15
@TildalWave @AviD Reminds of a story. An IT dude working for an ISP gets a call from a lady who is not able to connect to the Internet. After checking her status, he asked her to press the restart button. She insisted that there's no restart button on the back. Knowing that this is a common mistake, he said "It's under the thumb with which you're holding the router". He heard the phone handset drop on the floor and some running.
The lady came back and said "Sorry, I went to put my robe on. I didn't realize you guys have cameras on those things".
"Sorry for the free show"
You go back and have a look to some code to make a fix. You open that class
And suddenly you find like a hundred different #define
@kiBytes Oh, you are looking at OpenSSL's codebase?
And then you notice that everything you have done is never going to be understood by your development team
And now you can choose
1. Review the code just a bit, to know what is really going on.
@TerryChia no, I think his inner monologue accidentally got out.
2. Never think about it any more. You are going to leave this team and you are into information security
Now, the dilemma
Which one should I choose? Which one will I choose?
Does the chose really matters at all?
[2] ✔
Choosing [1] will only bring me headaches and sadness.
09:26
@AviD bastard
@Adnan Was she? Was she? I bet she dropped that robe as soon as her internet started working... there's only a single "profession" that I know of that calls indecent exposure "a show" lol
@LucasKauffman hehe
tbf I had upvoted that. it was a good answer.
doesnt stop me from mocking you.
@TildalWave Big4 consultants? ;-)
@AviD :D :D :D
Oh, poor @Lucas
09:27
@AviD hehe yeah, @Lucas is the star of the show :)
Fixed it. Moved on.
But I feel a bit depressed...
Haters gonna hate
@kiBytes Prozac
@Adnan what about some Tequila?
@kiBytes you would say that.
09:32
@LucasKauffman But, but,... we love you! Shit, did I say that out loud?
@TildalWave I heard it.
@kiBytes Mix them together for best result.
@Adnan you always hear it.
@AviD Hey man, can't fight it if that's what the people want.
oh yeah, baby, thats what the people want. They want it bad.
{Insert dictatorship joke here}
09:48
It's just exhausting. Why aren't people interested in improving?
I don't really want them to do what I command or to do things the way I suggest.
I just want them to put a bit of will.
I would like to discuss a solution not to teach a solution.
Now I remember why I wanted to move from this work so bad...
- End of complaint -
10:04
@kiBytes Nooo.. why did you stop? Complain more!
This time complain faster, for 2 minutes, then complain slowly for a few more minutes.
@Adnan That reminds me. Haven't seen @kalina in a while.
@Adnan complain harder!
@TerryChia First week of her disappearance, it felt quiet and nice here. Second week, it felt nicer. Then one or two days I sort missed her, but then I learned better. Now it's just nice and quiet.
@Adnan I think you mean "quiet".
@AviD That's alright. I ... don't need the complaining anymore.
@TerryChia Indeed. Thank you. Spelling isn't my strongest points.
10:11
@Adnan speaking of which, is this you @Adnan?
if it was you, I bet you would have got that job. Maybe even twice.
this meth thing - it's a bit destructive, in a very public way, isn't it
sfunny, how the cops dont want to touch him - even with gloves on.
@AviD Nope, and never. Not a big fan of illicit drugs.
@Adnan honestly, would you need drugs to do that?
@AviD To get naked in public? I'd do that without anything. Hell, I do that every winter when i go ice-swimming. To go to a job (interview) naked? I'd never do that under any circumstances.
10:20
Any Ubuntu users around?
@TerryChia Yup
@Adnan So I need to get this package on a Ubuntu machine. packages.ubuntu.com/trusty/libdevel/libscrypt-dev Problem is that the machine is Ubuntu 12.04 and that package appears to be only for the later versions. Any quick fixes?
@TerryChia Download it and dpkg it.
Most of the time, that should work normally.
@Adnan Hmmm. Can I force that through apt-get? I'm not sure if TravisCI allows for dpkg.
@TerryChia I hope I'm not wrong, but I remember doing something similar by just editing sources.list and adding the other repo.
@TerryChia For example, try adding http://us.archive.ubuntu.com/ubuntu/ trusty universe to sources.list and do an apt-get update.
10:27
@Adnan depends on what the job is....
@Adnan that won't work unless apt-dist upgrade
@kiBytes Ummm... no.
@Adnan If that package is for a different ubuntu version it won't work
@kiBytes Done it before. It works.
he will try to install it and the apt-get will say "you will need to upgrade to the XX"
10:29
@kiBytes Is this restriction added on newer versions? I have 12.04 and I can install packages from different version repos.
What @TerryChia needs to find is a repository for their version with the latest version of the libscrypt
@Adnan I can't modify config files, anything that needs to be done has to be done through the CLI. (It's a cloud CI service.)
@Adnan No, I am talking from experience, I have been used debian based distros since 1998
@RoryAlsop two things you love, of course they are better together. games.usvsth3m.com/2048-doctor-who-edition
@TerryChia Then just wget the package, extract it, and copy the files normally.
@kiBytes I'm not saying you're a liar or don't have experience. All I'm saying is that I have done that before with Ubuntu.
Worked like a charm.
Didn't have to upgrade.
10:31
@Adnan but I believe you are referring to a repository for your very same distro
@kiBytes Also, you're wrong with apt-get upgrade that only updates packages. To update the distro version you need apt-get dist-update. That's why I took what you said with a grain of salt.
I said apt-dist upgrade
It's my alias xD
@kiBytes :|
@TerryChia Yup, actually the best thing you can do is extract and copy the files normally. This doesn't have dependencies, so it's pretty straightforward.
@Adnan I am not really sure, but maybe he will need a different version of libc and so on... I think he will better build it himself or find a backport :?
10:46
@kiBytes Yeah, I've just verified you're extremely wrong.
@TerryChia Worked like a charm for me.
@kiBytes I've also verified that I'm 100% right.
As I am, 70% of the time.
@Adnan I'm left handed =)
@Adnan Yes?
@kiBytes The correct response is: "Sorry, I was wrong."
@FEichinger Ha?
ok, great them, it is nice now it is working in that way
@Adnan I'm not caught up on the conversation, what's the matter with that? :P
10:49
(Or maybe it has always been working that way and I have been completely wrong during all my life xD)
@Adnan Maybe you think I am afraid of saying that, I have no problem with being wrong =)
@FEichinger Well, then. @kiBytes claimed that you can't install a package on an Ubuntu version from another version's repository (in our case, a higher version's repo). He insisted on it and pulled his "I've been doing this since 199x" gun.
What I really sorry is having been presumptuous, I really recall doing it this way for a reason
for sure it has been another one =)
@kiBytes Self pity isn't a way to handle being wrong.
@kiBytes No, I don't think you're afraid of saying it. You're just not saying it.
@Adnan is that what he calls it?
Meh, it's not like this is the first time somebody is wrong. Very likely, tomorrow I'll say something wrong and I'll be corrected.
10:51
Isn't "Li'l Captain" so much simpler?
@AviD :D
@Adnan Cheers, that appears to have worked. I'll let you know for sure in 20mins once my test suite finishes running.
@Adnan Oh, of course you can. It's just not necessarily preferable because some packages are made with version-dependency in mind. Especially in the official repos.
Upgrade straight to trusty and enjoy the beautiful lack of stability instead!
@Adnan I added the repo with "sudo add-apt-repository "deb archive.ubuntu.com/ubuntu trusty universe" instead of modifying config files.
@FEichinger I would but I'm not controlling the service.
@TerryChia Yeah, that works as well. Nice.
10:54
@TerryChia I was kidding. I'm forced to run trusty right now and it pains me.
I was wrong, yes, but now I am a bit upset with you. I don't think you are handling this thing right =)
@FEichinger The 14.04 LTS is right around the corner isn't it?
I was planning to use a Debian instead, but I can't for the life of me figure out how to make that efi-compatible.
You can prove yourself right or someone else wrong, but you should keep your manners =)
@TerryChia As the number says, April.
10:54
@FEichinger Oh. Do tell. What's wrong with it? I've never upgraded beyond 12.04
In fact that is what I regret most, being arrogant with that "199X" thing =)
Anyway, is it really that bad? I'm running Fedora 20 rather painlessly and that's supposed to be a more bleeding edge distro.
@kiBytes Not when the other person is indulging in self-pitty.
@Adnan Unity is a bloated mess that killed my installation twice already. Ubuntu development versions are never really all that stable, even the LTS.
@kiBytes Exactly. And that's the ONLY reason why I was slightly rude to you.
10:56
@Adnan You are the one stating that, I don't feel like I am indulging self pitty =)
I'm actually using the Ubuntu GNOME 14.04 image right now, because I can't deal with Unity.
And it still crashes frequently.
All sorts of crazy freezes.
Okok enough, i fixed my problem and we are all friends here.
@kiBytes When arguing something with facts and tests is good. Arguing something with "I've been doing this since 1809s" is bad.
@TerryChia Yeah sure, I am not really upset, most of the problems in chats are because of the chat things =)
@TerryChia Of course we are.
10:57
Heck, I'd be using 13.10 if I could, because that was less of a mess.
@FEichinger Huh, that's nasty. I haven't had a major problem with the recent Fedora releases after the "two weeks after release" hump.
I believe that in person the conversation would have been very different =)
@FEichinger Any reason you can't downgrade?
@kiBytes Now that, I agree with that.
10:57
It was fixed for 14.04, but won't get a backport.
What I really believe is that if you continue mixing repositories you will have problems for sure
I have been wrong, but I have been wrong for a reason xD
@FEichinger Jesus! That's a nasty one.
@Adnan Mind doing my a favor? Clone this branch: github.com/Ayrx/cryptography/tree/libscrypt-bindings
And run "tox -e py27 -- tests/hazmat/primitives/test_scrypt.py" will you?
@Adnan I love how there isn't really an explanation for what's even happening in the discussion there.
I mean, pure kernel upgrade on 13.10 wouldn't be a problem, but I don't even know if that would suffice.
@Adnan hey, dont pick on @RoryAlsop, he started with this late!
11:07
@AviD - I have been playing the doctor who 2048 since the day it came out (my best is two David Tennants, unfortunately separated by a much earlier Doctor). I am close to finalising the graphics for Metaltech 2048 :-)
@TerryChia What's supposed happen?
@Adnan The test should pass. :)
@RoryAlsop hehe, amusing :-)
You should see something like py27: commands succeeded
congratulations :)
@TerryChia I was wondering why it failed. I tested on my Windows box
11:09
@Adnan Ah, was hoping you could test on the Ubuntu one. Nvm, I'm getting some results from my CI builders so it's all good. :)
@TerryChia Alright. Cloning on the Ubuntu box...
> I recently discovered that Microsoft’s VC++ compiler loads mshtml.dll – also known as Internet Explorer. The compiler does this whenever the /analyze option (requesting static code analysis) is used. I’m no compiler architecture expert, but a compiler that loads Internet Explorer seems peculiar.
Wait, what?
@TerryChia whoever wrote that is an idiot.
where in hell did they get the idea that mshtml.dll is IE??
@AviD Dunno. Random HN post I clicked on. randomascii.wordpress.com/2014/03/31/…
IE does use mshtml.dll, but I dont understand how they could possibly think its the same.
11:13
@TerryChia Does tox require any configurations?
I'm getting ERROR: toxini file 'tox.ini' not found
@Adnan It shouldn't. tox.init is in the repo you cloned. Eh, if it isn't working nvm. I was getting a cryptic error earlier and wanted to see if it had anything to do with forcing the package version but I doubt it is now.
@TerryChia Jesus! I thought I was typing on the Ubuntu terminal. I was typing on the Windows one.
ERROR: invocation failed, logfile: /home/adnan/terry-test/cryptography/.tox/log/tox-0.log
ERROR: actionid=tox
msg=packaging
cmdargs=['/usr/bin/python', local('/home/adnan/terry-test/cryptography/setup.py'), 'sdist', '--formats=zip', '-
-dist-dir', local('/home/adnan/terry-test/cryptography/.tox/dist')]
env=None
Package libffi was not found in the pkg-config search path.
Perhaps you should add the directory containing `libffi.pc'
to the PKG_CONFIG_PATH environment variable
No package 'libffi' found
@Adnan Oh blah, forgot you had to install a whole bunch of dependencies. Nvm, thanks anyway!
@TerryChia Uggghhhhghhghghghghghhg!!!!
It appears that my failure is pypy specific, nothing to do with Ubuntu anyway. :)
11:17
exit
God damn it! Now I'm writing commands here!
@Adnan Sorry. :)
Sometimes I hate having multiple monitors.
@TerryChia I am truly sorry, but pypy just sounds too cute to be taken seriously.
@TerryChia Heeey. It's alright. Next week I'll probably ask you test something for me
wink wink
@AviD Hehe, it's a version of Python.
11:18
@TerryChia oh, I know. But that's what I meant.
11:44
@HaukeLaging It has never, ever, happened to you that you've had a question open, been distracted by something, and then posted an answer hours later, without checking if someone else had answered it first? Also, hard links do not "point to the same file". They are the same file. Sym links point to a file. — Jenny D 6 hours ago
Jenny is at it again. (different Jenny this time)
12:16
Unless your definition of "ask" is "CC them on an email you're sending to spamhaus denouncing them for spamming, warcrimes, and spoiling the plot of movies for everyone at your local movie theatre then there's no way that asking them could be rude. — RobM 17 hours ago
12:26
@CodesInChaos I wonder what will happen if I do that. Will the employer be impressed by my sense of humor and give me senior manager position instantly, or will I be blacklisted from the company and of its affiliates forever?
@Adnan depends if you show up to the interview naked.
@AviD Highly dependent on the interviewer
and the specific role you are applying for, I'd guess

« first day (1201 days earlier)      last day (3977 days later) »