The DMZ

Scott Pack

00:03

@TildalWave So when you become a 10k user it gets both bigger and longer?

TildalWave

@ScottPack you'll see in about 70 more rep ;)

HamZa

00:26

in PHP on Stack Overflow Chat, yesterday, by ircmaxell

Participate in my study by playing this game! :-D

anorton

04:35

Hey everyone! I'm from over at Math.SE, and I was curious if you guys had any tips on running a good site blog. This site's blog seems to be the most active on the network (from what I can tell), so I was wondering if there was a technique of some kind that you used to keep entries from slowing to a trickle. (We're considering starting a blog, so I figured I'd ask and see if I could learn from people who've done it before.)

Terry Chia

@anorton Heh, our site blog doesn't have much content nowadays actually. :P

We have a "Question of the Week" blog post although it's been mostly ignored recently.

21

Q: Requests for Question of The Week blog posts

Since starting the Security Stack Exchange Blog on 15 July 2011 we have some excellent blog posts, and a large number of these are from our Question of the Week posts. Going forwards, it is probably simplest to post your favourite Questions of the week as answers on this question, and vote for yo...

Terry Chia

05:22

Hmm, this isn't good... allenpike.com/2014/burying-the-url

Rоry McCune

06:56

Mornin' All

@TerryChia s'one of the reasons I use Firefox now (and FF29 is quite shiney) Google's incentives are a bit dodgy when compared to Mozilla...

Terry Chia

@RоryMcCune 2 things stopping me from moving to FF -- 1) Single process browser in 2014, wtf? 2) Chrome sync is incredibly convenient for syncing stuff between three or four machines.

Rоry McCune

@TerryChia FF has FF sync :)

and on the single process thing, well I know what you mean but in practice it doesn't seem to cause a big problem for me...

Terry Chia

@RоryMcCune Don't think it's as convenient as Chrome's sync on iOS and Android devices?

Rоry McCune

@TerryChia hmm not sure about that one. You can definitely get FF for android, haven't seen it on iOS

Terry Chia

@RоryMcCune Yeah, fiddling with this stuff gets stupid after a while. Chrome just works and is good enough for me. :P

Rоry McCune

07:02

@TerryChia hope you'll be ok with losing the ability to see full URLs soon then :op

Terry Chia

@RоryMcCune It looks like there's a flag to turn that off for now.

Rоry McCune

like what you posted

@TerryChia for now.....

I just reckon that google have the incentive of "make the most money out of peoples information as possible"

that's unlikely to be good for me

unless they start charging directly for services

which I'd actually prefer

Terry Chia

@RоryMcCune Well, we will all just move to IE when that day arrives. :P

Terry Chia

07:39

Hmm, looks like syncing an iPhone to a Windows VM works after all.

Scott Pack

13:02

@RоryMcCune Historically it's caused big ole problems for me. A single javascript on a single tab spools a core up to 100% and makes most of the browser unusable.

deed02392

Infosec14 was really good

Scott Pack

@RоryMcCune Also chrome has a built in task manager where I can see which tab is using the most ram or cpu and go take care of it.

@RоryMcCune Katie noticed her mid-2012 MBP was only getting about 2-2.5 hours battery life for the past few months. I look at it last night...FireFox was running at 50-60% cpu all the time. With no way to see what each tab is doing there's no way for me to know which one is the problem.

Terry Chia

@ScottPack Ouch, CPU? I can understand 50-60% of memory but CPU is a little excessive.

Scott Pack

@ThomasPornin I also have a memory that 3DES was designed such that it could be implemented using existing DES hardware by running it 3 times, which you couldn't really get with 2DES. Am I remembering right?

@TerryChia Like I said, a single tab with some bad javascript could easily do it.

deed02392

@DavidFreitag Do these laptops have any endpoint security solutions?

Terry Chia

13:10

@ScottPack I have never heard of that (doesn't mean it isn't right...), I always thought the only reason for 3DES is 2DES not providing the expected security margin thanks to meet-in-the-middle.

David Freitag

@deed02392 I have no idea. They are in Norway and i don't have access to them other than an email.

But even if they did it's not like we can tell our customers that they have to disable it to use our software.

deed02392

@DavidFreitag that kind of software can forcibly close connections that were opened with write ability

@DavidFreitag Why not? If they have software which restricts data flow and they want to use software which requires data flow then they need to configure it so that it doesn't restrict data flow.

David Freitag

@deed02392 But that's just it - other software works perfectly fine. They can use Tera term to send data all day

deed02392

Over the same serial port?

David Freitag

Yes

With the same cable

deed02392

13:14

Then it's unlikely to be that

so your software is not working where tera term is?

David Freitag

Correct

I'm making a test application which disables hardware flow control as per that comment, but otherwise I'm completely out of ideas

deed02392

very frustrating that you don't get an error

i wonder what that in itself implies

wrt where the issue might lie

Terry Chia

Network issues are a bitch to diagnose.

David Freitag

@TerryChia Serial, not network

Terry Chia

@DavidFreitag Well, same concept. :P

Bah, gotta set up my kernel dev VM again. Forgot to save it when reformatting my system.

Scott Pack

13:35

@TerryChia We discussed it in my grad school class on crypto. We worked through the logic to figure out how it actually worked that way. Knowing the prof that's also not to say it was all a sham.

Thomas Pornin

@ScottPack No, you are remembering it wrong, but there is indeed a non-security-related reason for 3DES.

In "normal" 3DES, the middle DES is used in decryption mode.

Thus, if you set the first and second 56-bit chunks of the 3DES key to be equal to each other, they cancel out.

Scott Pack

@ThomasPornin Ok, that's what I was remembering.

Thomas Pornin

This implies that a 3DES system can be used in "degraded" mode which is compatible with simple-DES

You cannot have that with 2DES.

Scott Pack

Said prof described it as a design consideration so existing DES systems could still be used to perform 3DES.

Thomas Pornin

However, that's only a secondary reason (it is the reason why the middle DES is in decryption mode, though).

@ScottPack Well, he said it backwards. It is not for existing DES system to perform 3DES; it is for 3DES systems to perform like existing DES systems.

Scott Pack

13:40

Or rather so that primary systems could be upgraded to use 3DES without having to replace all of the deployed DES systems.

Ok, I think we're all on the same page I'm just describing poorly.

I'm also trying to remember a 1 hour lecture from 2006.

David Freitag

@deed02392 I think i may have had a breakthrough. If you look at their logs it appears that hardware flow control is off. Something tells me that something on their end is forcibly disabling RTS.

deed02392

@DavidFreitag Not all serial devices support flow control which might mean the device can't perform handshaking, I think.

David Freitag

@deed02392 Yeah but they have USB emulation devices that can

deed02392

hmm

Still, it's not critical to implement it

But it's odd that it doesn't work on any of the serial devices on the same system

are there any Windows settings that could affect such a thing

David Freitag

13:56

I'm going to have them check the COM port setting in device manager

I think those settings are overriding my SerialPort settings.

deed02392

Good thinking

Would have thought they are just defaults though

Terry Chia

How do you know you shouldn't be writing crypto code? When you ask questions like this.

3

0

Q: AES encryption do I need to use a Mode?

Hello I am currently working on a file encryption program. I am using Java Cryptography Architecture. My plan is to have a number of encrypted files where each file has a different AES key. To keep track of the encrypted files I also include a metadata file which stores an entry for each encrypte...

aes file-encryption

David Freitag

@deed02392 Yeah looks like it. I tested on my machine and those settings don't really change anything.

AviD

anybody here happen to use the W/WP8 calendar app with google calendar? /cc @Iszi

since google shut off EAS support, havent found a workable workaround.

though I was considering subscribing my gcal to outlook.com calendar, and subscribing the outlook.com calendar to gcal, then just using the outlook.com one from the app. so whereever I am, I would get a unified view, and still be able to add events wherever.

Terry Chia

14:13

@AviD It's called an Android device. :P

David Freitag

@AviD Oh dude that sucks... Now i need a third party email app? WTF Google?!

AviD

only downside is not being able to edit in the app events that were created by gcal.

@TerryChia yeah, but I upgraded :-)

@DavidFreitag I know, right?

Terry Chia

@AviD Well then, write a calendar app. ;)

AviD

actually wait no, its just for calendar. IMAP works just fine for email.

David Freitag

I can't even imagine the amount of corporate drones who will be switched to crackberry or - god forbid - iOS because of this.

AJ Henderson

14:15

@TerryChia hopefully the seething sarcasm didn't show thru too much in my response

AviD

@TerryChia eeeexcept that google explicitly blocks access. unless I want to start parsing the HTML....

deed02392

"Microsoft said it would support newer Google access protocols in Windows Phone"

Terry Chia

@AviD Hey, you could use regex!

deed02392

winsupersite.com/windows-phone/…

AviD

@TerryChia heh.

@deed02392 out of date. Google threw the switch in March '13.

> You may recall that Google infamously declared war on Windows 8/RT and Windows Phone customers in December

Terry Chia

14:16

@AviD And calendar information is pretty good fit for XML. Regex and XML together! Perfect combination.

AviD

@TerryChia google allows readonly view access. its the updating thats a problem.

Terry Chia

@AJHenderson Well, you can encrypt data without a mode of operation with a block cipher. It's just that you will be limited to one block per key.

David Freitag

@AviD I linked my Office365 account for school with my Gmail a while back. All hell broke loose

AJ Henderson

@TerryChia hmm, good point

@TerryChia updated to make the answer more accurate and still dripping with sarcasm

it actually works even better since you technically could encrypt without one

it would just be completely useless

deed02392

I would just export everything from gcal and migrate to outlook @AviD

Thomas Pornin

14:20

@AJHenderson What is the point of sarcasm if it does not show through ?

deed02392

I wouldn't want something as important as my events getting messed up by relying on a hacky sync solution

AJ Henderson

@ThomasPornin well ideally, those who know what I'm talking about see it, but the OP doesn't

ManishEarth

@AviD mine synced , somehow

AviD

@deed02392 hmm. problems with that.... I actually use both, for different reasons. Also, my wife and kids are on gcal - besides hating change, they all have androids. So suffice it to say, not really feasible.... they would sooner just use the gcal web interface.

AJ Henderson

and I was hoping this question would make incompetent question of the day

1

Q: Whenever an unhandled exception somehow makes it into production, is it safe, viable, etc. to print an encrypted stack trace to the end user?

Whenever an unhandled exception makes it into production somehow - whatever the reason - there's generally an option (especially with .NET programs) to print out a stack trace to the end user before the program ends completely. Even though this helps with debugging the program, if the user sends...

encryption hash error-handling

AviD

14:21

@ManishEarth in the last 10 months?

ManishEarth

@AviD /me checks

AviD

@deed02392 yeah, there is that.

AJ Henderson

but I do think the block mode one shot any chance it had

when I saw he was concerned about showing the stack of a client .Net app I literally LOL'd

ManishEarth

@AviD I set it up two months ago. The app knows that I have two calendars on Google

AviD

@ManishEarth is this on W8 or WP?

Iszi

14:23

@AviD Yeah, what's up?

ManishEarth

but I don' see any synced events

WP8

haven't booted W8 in weeks

AviD

@ManishEarth wait, so does that mean its not working?

Iszi

I've got WP8 connected to a Google Calendar, but nearly never actually mess with it.

ManishEarth

not working

AJ Henderson

@AviD doesn't that make them smarter than you? ;)

AviD

14:23

@Iszi r/w or RO?

ManishEarth

@AviD yeah, I have RO

AviD

@AJHenderson to some extent, yes :-)

not the android part...

Iszi

@AviD Pretty sure it's RW, but hasn't been tested in awhile.

AJ Henderson

of course, I suppose I'm one to talk since I still prefer Windows CE

which is also probably why I'm bitter about Windows Phone

David Freitag

I'm going to link this album again 'cause it's so damn good.

►

It's always funny when you buy a CPU from eBay and it says "Programmed" in the title.

kalina

14:42

in fact

@RoryAlsop aren't you in a band

Terry Chia

@kalina It has been a while since you were around.

kalina

yeah I don't use SE much/anymore

however right now my ears are lying to me and I'm hearing vast amounts of unintentional distortion in something I'm doing and need somebody to have a careful listen to it and tell me I'm wrong/my headphones are fucked

Iszi

@kalina frog51.wix.com/metaltech

kalina

yeah this isn't quite the same sort of thing but distortion is distortion at the end of the day

David Freitag

15:05

> IDT74FCT240A 25% faster than FAST

Man that's fast.

AviD

@DavidFreitag TWSS

@kalina whoa. Are my eyes bleeding?

kalina

no

unless you're having an allergic reaction to my presence

FEichinger

@AviD Yes, but that's normal.

Terry Chia

@kalina That would be @Simon.

David Freitag

Daaaaaaayum son. $13 for a configurable register chip? And i need six of them?! Hmmm... Maybe pairing an FPGA with a CPU from 1990 might not be a terrible idea...

deed02392

15:20

@DavidFreitag Of course it isn't, it's an awesome idea

David Freitag

@deed02392 Well i suppose since I'm using E-paper for the console display... why the hell not?

deed02392

what is it you're making again?

David Freitag

A MIPS3000-based computer

deed02392

kewl

Terry Chia

> public string LastSixDigits
{
get
{
if (string.IsNullOrWhiteSpace(this.Number) || this.Number.Length < 6)
return string.Empty;
return this.Number.Reverse().Take(6).Reverse().Aggregate(string.Empty, (s, c) => s += c);
}
}

deed02392

15:22

oh I remember you asking tom about the instruction set being compatible or something

David Freitag

@TerryChia uhhh wat?

Terry Chia

@DavidFreitag I'm reading thedailywtf.com :P

David Freitag

@TerryChia I think i just died a little

deed02392

lol

this is Java right

Terry Chia

@DavidFreitag I think that's the point of the website.

@deed02392 .NET. Those are LINQ functions.

David Freitag

15:25

@deed02392 Looks more like C#

deed02392

or C#

Hm, I meant C# yet I said java

i'm hungover it's fine

kalina

right I think I've exterminated the random distortion in my bassline

David Freitag

@kalina What was the problem?

deed02392

what does Aggregate do?

Terry Chia

146

Q: LINQ Aggregate algorithm explained

This might sound lame, but really - I have not been able to find a really good explanation of Aggregate. Good means - short, descriptive, comprehensive with a small and clear example.

c# .net linq

deed02392

15:28

thanks

you're a pal @TerryChia

kalina

@DavidFreitag my bassline is made up of three parts, two of those parts of EQ'd heavily below 150hz so they don't interfere with the lower bass sound. One of those higher parts had distortion on it which was interacting with the harmonics in the lower bass and causing a particular note to sound really off when played in conjunction with one of the three other sounds playing during that part of the track

David Freitag

@kalina Interesting. Thanks :]

kalina

it's not interesting

that's like the last four hours of my life

David Freitag

It is to me.

kalina

hunting down a single rogue sound

David Freitag

15:30

I love useless (to me) information.

kalina

that you can't even hear on 90% of the speakers I've played it on

David Freitag

@kalina My entire life is spent hunting down and eradicating bugs.

Terry Chia

@DavidFreitag Software or insects?

David Freitag

@TerryChia Depends on the day

deed02392

`public static void setDelay(String delay) {
String yes = "YES";
if ((delay.hashCode()) == yes.hashCode()) Scenario.delay= 10000;
}`

lolol

Adnan

15:37

Happy May Day, everybody!!!

@deed02392 Hyvää vappua!

deed02392

@Adnan moi! kiitoksia

David Freitag

Great. I'm either stuck with a few ridiculous VFSSOP chips or some shitty old 5V FPGA. :\

Rory Alsop

@kalina - yes. WWW.Metaltech.me

Kisunminttu

@Adnan Happy May day :*

Rory Alsop

What can I do for you

Adnan

15:48

Jesus! That's a... dark one.

> Why do they drink Sprite at NASA? Because they couldn't get 7 Up

deed02392

moikka means 'bye' right?

Kisunminttu

@deed02392 It means hi and bye :)

deed02392

aww ok

I met Ivan Ristic yesterday

kalina

@RoryAlsop I need your ears

I say ears, chat goes dead

if I had said literally anything else everybody would be in pervert mode

Simon

16:08

@kalina @AviD != everyone

Scott Pack

It's true. @AviD is, without question, the perviest guy here. I just like to feed it.

5

Simon

You have to understand the guy though. He has 387432 kids which means that his sexual life is nonexistent

Also, he works for Microsoft. It's a known fact that people who work for that company never get laid.

FEichinger

@kalina You mean everybody isn't in pervert mode at all times?

AJ Henderson

@kalina no, we're just still trying to figure out how to make something perverted out of that

FEichinger

There are many ways to make something perverted out of that.

Scott Pack

16:23

@Simon I think you have a misunderstanding how the children happen.

6

AJ Henderson

@Simon except for bill gates

but balmer doesn't, that's why he throws chairs

Rory Alsop

@kalina - can do, in a few hours. Just heading off on a brewery tour...

Simon

@ScottPack hehe

Scott Pack

@RoryAlsop I hate you.

Rory Alsop

Team building

Terry Chia

16:26

@RoryAlsop Righhhhhhhhhhhhht.

That's why you are going.

Simon

@TerryChia Do you even drink beer?

Terry Chia

@Simon Who doesn't?

Scott Pack

@RoryAlsop Wait. Are you flying remote people in for said exercise?

AJ Henderson

@TerryChia either that or he is going because it involves team building... as in, he needs to be drunk to survive the team building

so going to bars for team building kind of makes sense

Simon

@TerryChia 12 years olds.

Terry Chia

16:29

@Simon I'm sorry they didn't teach grammar in Canada. :P

schroeder

I can't stand beer- give me a single malt

although perhaps not at 9:30am ...

Simon

@TerryChia They only taught us how to use our big D /cc: @kalina

Terry Chia

@Simon Flagged as delusional.

kalina

life has taught me that the number of men that know what to do and the number of men who think they know what to do are two wildly different numbers

Scott Pack

@schroeder A nice yummy beer is just as comforting as a well made Manhattan, invigorating as a piney antimalarial, or a glass of Highland single malt.

@schroeder But it definitely takes the right good beer.

schroeder

16:35

@ScottPack Several beer experts have tried to get me to like beer, and I have had some of the best in the world, even special hand-crafted offerings, but I still can't do it. I can't stand the hops.

Scott Pack

@schroeder Me neither.

I tend to stick to porters and stouts for that very reason.

David Freitag

I don't much like beer either. Now hard cider on the other hand.

Simon

I actually learned to like beer, I didn't like it at all at first.

Now it's like BRING ALL DA BEER

kalina

I don't like beer

Terry Chia

@Simon Canadian beer. Does it have maple syrup in it?

3

Simon

16:37

@TerryChia The finest of all maple syrup.

Scott Pack

Mm...I really dig a nice cider.

Terry Chia

(Sorry, you weren't around for a while. :P)

AJ Henderson

@kalina - was that one pushing it to far?

Simon

@TerryChia How dare you to apologize to a Canadian?!?

kalina

@AJHenderson I can't answer that question or the question before it or the next question

Scott Pack

16:38

In the fall when the trees start to turn and you get that slightly sweet smell of decaying leaves in the air...I loves it. It also makes me want cider like none other.

David Freitag

Have you tried Angry Orchard?

kalina

is that the sequel to angry birds?

Scott Pack

@DavidFreitag It's my go to. Reasonably priced and good.

David Freitag

@ScottPack Yes it's be far my favorite as well. I'm partial to the original but every so often i get a bottle of iceman and get tanked.

CodesInChaos

@kalina Reminds me of a friend who spend quite some time editing a sound out of "curse my name" that 90% of people (including me) can't even hear.

Scott Pack

16:41

@DavidFreitag Whatever you do stay away from Red's. That stuff is foul.

David Freitag

@ScottPack Yeah I've had it. It's very tasteless in comparison to a cider

Scott Pack

@DavidFreitag It tastes like a shitty American beer that's had an apple dipped in it.

David Freitag

Isn't that basically the premise behind Reds?

Scott Pack

It might be, I dunno. Katie came home with it once because it was something we hadn't had before and was labeled as cider.

AviD

@ScottPack but am I, really?

in most rooms, I would say, sure. But even here?

David Freitag

16:43

@ScottPack Nah, it's "Apple Ale"

I keep meaning to try their strawberry ale. It might turn out to be delicious. Not likely though

Scott Pack

@DavidFreitag That sounds like a bad idea.

David Freitag

@ScottPack Eh, worst case i have to drink a whole six pack. But that will only be bad for the first three. I won't really care after that

2

Best case scenario i finally find a beer i enjoy.

Xander

@TerryChia Dogfish Head 75 Minute IPA is a fantastic beer with maple syrup in it.

Scott Pack

@Xander There's not a single thing about that that sounds tasty. Except maybe the maple syrup.

Xander

@ScottPack Yeah, but that's because you don't like hops. It's not the beer's fault you have poor taste.

Scott Pack

16:55

This. All of this.

untappd.com/b/zaftig-brewing-co-llc-wee-heavy/577556

Iszi

@ScottPack How is that an "ale"? Looks "stout" to me.

AviD

@Iszi I recently discovered that not all ales are pale ales - there are "dark ales", which are very similar to stouts.

Scott Pack

Isn't stout a type of ale?

AviD

while I too prefer the stouts like @ScottPack, I recently found a local dark ale which I really liked.

@ScottPack dont think so, but I could likely be wrong.

anyone still have that graph of classifications of beer types?

Xander

@ScottPack Mmm...Malty goodness right there.

David Freitag

17:00

Xander

@Iszi "Looks like" (SRMs) is only a single factor in the style. Stouts are indeed always dark, but so are many ales, and even black lagers.

David Freitag

@AviD Looks like a stout is a type of ale

Xander

@ScottPack @AviD Generally beer is divided into ales and lagers, depending on the yeast used and the brewing method. Specifically, lagers require an extended "lagering" peroid at quite cold temperatures. All non-lagered beers are generally classified as ale, at the highest level.

Terry Chia

MICROSOFT FAIL! blogs.technet.com/b/msrc/archive/2014/05/01/…

FEichinger

@TerryChia Aaand they're updating XP as well.

Terry Chia

17:10

So I guess XP will still be somewhat supported when I'm on my deathbed.

FEichinger

Probably.

Rоry McCune

Did I ever mention that onenote is really useful these days

Xander

@RоryMcCune It is, but the notebook structure confuses me. I have a bunch of duplicate pages because I can never figure out how to navigate up and down to the pages I've already created for the same purpose. I probably just need to sit down for a bit one day and get it all cleaned up.

Just too many levels for me to keep straight, it seems.

Rоry McCune

Yeah the section/page metaphor takes a bit of getting used to (but then you can ignore the multiple sections thing and keep everything on one page).

it's v handy now there's a good web client + mac client + ipad client

I think linux is the only one missing and you can use the web client just fine there

Scott Pack

@Xander It smells like a dark molasses raisin bread.

Xander

17:17

@RоryMcCune Yeah, a good Android client too.

@ScottPack That sounds incredibly yummy.

Scott Pack

@Xander I heard rumor of a growler house in town that has it. I'm going to have to stop by.

@Xander Speaking of beautiful beer...you have any trips up this way planned any time soon?

Xander

@ScottPack Nothing planned. Since I've left professional services for our product development team, I haven't been travelling much at all.

Scott Pack

Oh I hadn't heard that.

Xander

@ScottPack Yeah, well, I may have forgotten to mention it. It was a year and a half ago, but I haven't gotten around to updating things my SE bio, or LinkedIn...Or anything else that needs updating for that matter.

Scott Pack

Lame.

Xander

17:23

I know. It's just a bit of a hassle. I'll do it one of these days.

schroeder

I use Evernote for some things, OneNote for others, depending on data structure, love both

Xander

@schroeder Me too, but I'm considering consolidating down to a single tool.

Thomas Pornin

@TerryChia beeradvocate.com/beer/profile/1879/49144

Rоry McCune

@schroeder yeah I use evernote for web clipping would like to get it down to just onenote though if poss. but their web clipping is still a bit lame comparitvely

Thomas Pornin

Remember the rule: if it is not plutonium, then somebody, somewhere, is making a beer which contains some of it.

3

schroeder

17:38

@RоryMcCune agreed

Scott Pack

@ThomasPornin I dunno, I'm sure we'll find a beer somewhere with plutonium

Xander

17:56

I've counted 10 posts in my twitter feed this morning from various people announcing that Microsoft is issuing a XP patch for MS14-021. Including 4 from one person. I have a feeling I'm either going to be annoyed by the end of the day, or taking a break from Twitter. One or the other.

Thomas Pornin

@Xander Or both.

Xander

@ThomasPornin Yes. There is that third way.

TildalWave

18:15

@Xander wasn't me :) but I did retweet a few related posts a few days ago about vulnerabilities linked to the IE bug

Xander

@TildalWave LOL, no wasn't you. Wasn't anybody I know from SE.

CodesInChaos

@Xander Why patch security holes? Anti-virus still work on XP

TildalWave

The most obvious vulnerability related to the IE bug being that there's still people using IE :)

anyway, I didn't notice too many questions about it on the site ... one really obnoxious one asking to explain it like he was a 6 y.o., but I don't remember any others

the heartbleed experience did make me wonder how it would've looked like here if the site was up when the y2k bug was all the rage tho :)

Xander

@CodesInChaos Good point!

Thomas Pornin

18:40

@TildalWave Y2K was not a security hole, though. It was exploited by the year count going to 2000 without any malicious intent anywhere.

Xander

@ThomasPornin It was also exploited by authors to sell many copies of many books explaining how the world was going to end in fire and destruction at midnight, Jan 1, 2000. In which timezone they did not make clear.

CodesInChaos

@Xander The wave of fire sweeps around the world as more and more of it crosses midnight.

TildalWave

@ThomasPornin oh I know that but I still think it would be pretty crazy here (tho perhaps a bit more colorful since we only killed physical security during the last site rename)

Simon

I was 9 in 2000.

Amal Murali

Hello guys.

Xander

18:45

@CodesInChaos That was one possibility I considered. However, many of the theories I read seem to hinge on everything falling apart simultaneously.

TildalWave

@Simon 9 is not too early to appreciate insanity of scared masses

Simon

@TildalWave I was too busy being amazed by how France was already in 2000 and I was still in 1999.

Amal Murali

I'm a security noob and I'm trying to learn more and more every day. And recently I discovered this game where you guess the algorithm used for creating the hash.

TildalWave

@Simon what for those few hours?

Simon

@TildalWave Yep, it's sad I know.

Amal Murali

18:50

I was here yesterday as well, and I think @Xander linked to it. But anyway, I have got a question. How would you "guess" the hashing technique (it probably isn't a standard hashing function) just by looking at the password, salt and the known hash? One way I could think of is by checking the repetition of characters, the length of the output etc. Is there anything else I could use?

Thomas Pornin

@Xander Fun fact: on the Eiffel tower, there was a big electronic display which counted seconds left to year 2000. It turned out that the counter was not Y2K compliant: it ran well for a couple of year, but crashed some time in the afternoon of Dec. 31st.

Xander

@CodesInChaos For instance, I vividly remember one book that described how many car crashes there would be in the US assuming that "only" 10% of cars manufactured before that date would fail catastrophically. He failed to mention that in order to reach his conclusion, he also assumed that all cars in the United States would be on the road and in motion at Midnight, 1/1.

This seems improbable if the people in California have several hours to hear about the calamities that have already occurred on the east coast. I would think that some of them might choose not to drive instead. Perhaps he was also assuming that we're all irrepressible optimists.

@ThomasPornin LOL!

Amal Murali

If I have a list of pass, salt and hash, then I guess I could narrow down the possibilities by checking if the salt is used. But how do I get more useful information out of it? I realize this may be a stupid question, but... I guess this is how you learn :-P

Thomas Pornin

@AmalMurali It is a game. It is not necessarily realistic.

Simon

I feel like you should be looking into plenty of other stuff before analyzing hashes.

Thomas Pornin

18:55

I suppose the point of the game is that you "guess" whatever combination of hash function invocations was used by the game developer, and you test your guess by seeing if it matches the provided hash values.

Amal Murali

@ThomasPornin I know. I'm just trying to solve them for now.

Yeah, exactly. My question is how would be able to "guess" the "hash function invocations used by the developer" just with that much of data?

@Simon Probably. I don't really understand the internals of hashing etc. As I said, I'm a newbie.

Thomas Pornin

@AmalMurali That's what guessing is about: to fill in the blanks. You guess because you don't have any data to build upon.

Amal Murali

So far I've solved 6 of them (most of the easy ones :-P).

Surely, there must be some way to analyse the given data so you can make more meaningful/probable guesses, right?

Thomas Pornin

@AmalMurali No. Wrong. Unless you can actually break the hash functions.

Well, you can take the output length as a hint: e.g. if the length is 20 bytes, then some SHA-1 is probably involved.

TildalWave

at MIT campus

Amal Murali

19:08

@ThomasPornin Yeah, that's the only useful information I was able to get from the output hash. For example, take the case of #3. The known hash is 80 characters of length, which suggests it may be the concatenated result of two SHA-1'd results. How would you proceed from there?

Simon

Fucking Calculus. Had to do 2 classes and I wanted to shoot myself in le head badly.

Amal Murali

I too have integration/differentiation stuff in college. I hate it as well :-(

Lucas Kauffman

schroeder

19:29

I've started to use the line, "assuming that you have done basic research, tell us what you didn't understand about what you've read"

I hope it will focus users on the specifics and encourage them to look at first principles before asking broad questions

trying to provide actionable response without being a jerk

Simon

But being a jerk is fun.

schroeder

unless that response comes of 'jerky' ....

off*

TildalWave

20:34

@schroeder Not a bad line but you should combine it with a close vote (seems either "unclear" or "too broad" should fit). Problem with comments alone is that you often get clarification back in another comment, instead of the question itself.

if you need backup for your line, just use [ask] shorthand for the link to "How to Ask"

might even work here, lets see: How to Ask

yup :)

tylerl

20:50

@schroeder I really like the SF close reason: Questions must demonstrate a minimal understanding of the problem being solved.

It's says "go away, you're not smart enough to sit with us"

schroeder

@tylerl LoL

Transcript for