The DMZ

Iszi

01:57

So, who knows Chrome around here? Got two questions: 1.) Why does Chrome leave old versions after updating. 2.) Why doesn't it install to Program Files like a real program?

M'vy

08:33

@Iszi because it's Google?

Graham Lee

08:57

I AM DELETOR, DESTROYER OF OFF-TOPIC POSTS

M'vy

@GrahamLee a.k.a. "The Deletator"

Graham Lee

:D

Stack Exchange

09:33

Stack Overflow Blog: Improved Tagging

Posted by Jeff Atwood on August 9th, 2011

Every Stack Exchange question is required to have at least one tag; tags are how we group, order, and find questions. But how do you find the right tags for your question?

When you start typing in the tags field we show you a simple list of existing tags that match what you typed so far, ordered by frequency.

Simple indeed. No explanation, just … activerecord (485).

It became increasingly clear to us that were doing a poor job of educating users about not just which tags to use on a question, but also when to use them. And I believe our old tag completer was a big reason why. …

M'vy

@StackExchange Hummm looks like we have work to do on tags now

Scott Pack

11:26

@Mvy Pretty much. I feel like we've done a pretty reasonable job of getting tags documented, but there are still a lot to go.

M'vy

Yep, did you read the article?

seems the way to do it now is to point the user when and when not to use the tag directly in the excerpt

Scott Pack

12:02

/me sighs

So the tag excerpt is no longer supposed to be a brief summary of the full wiki.

It's now supposed to be an instruction set.

Stack Exchange

Stack Exchange Security Blog: Apple bringing secure email to the masses with iOS 5

posted on August 09, 2011 by rakkhi

One of my worst ever projects was implementing PGP email encryption. Considering I have only worked in large financial services companies, that is saying something. I have reflected on the lessons learnt from this project before, but I felt that PGP was fundamentally flawed. When Apple iOS 5 was unveiled, there was a small feature [...]

AviD

12:43

5

Q: How do researchers "gain control of an attacking PC" and not themselves be considered attackers / criminals?

In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises" The Cliff's Notes to the article is thus: it has been discovered that many countries and large corporations have been the target of long-ter...

uurggh, I dont have energy for this.

the poster of the orginal, merged question is all up in arms in comments on that.

anybody else feel like jumping in?

Graham Lee

will comment on the validity of the merge. Not getting involved in a pissing contest though :)

Rory Alsop

@AviD done

and hello

hi @Graham

Graham Lee

hey

Rory Alsop

how's things down your way - you are outside London, right?

Graham Lee

also done

me? Oxford - we're OK right now, but if Waitrose runs out of hummous there might be unrest

Rory Alsop

12:56

LOL

hey - how did my comment only come through now... puzzling:-)

AviD

thanks guys :)

though i hope it doesnt look like we're diamond-mobbing him...

Graham Lee

What's the point of undemocratic authority if you can't abuse it a little?

Rory Alsop

:-)

AviD

heh

Graham Lee

We just need to be seen to be clamping down shortly before the mod elections. Which reminds me, time to file my expenses claim.

AviD

13:05

though if we're talking about that anyway, I gotta say that SEI is one of the clearest forms of real democracy, not representative democracy, compared to any other government...

@GrahamLee hehe, what?

Graham Lee

sorry, UK satire

Rory Alsop

@GrahamLee blimming politicians - only do something just before an election...then get back to swanning round the Med...

AviD

hmm, democracy with a bit of meritocracy thrown in.

Graham Lee

@avid shortly before the last general election it was discovered that our MPs were (legally, though perhaps unethically) making frivolous expenses claims

AviD

and some safeguards.

ahhh

pretty much same as anywhere...

Rory Alsop

13:07

ey up @Iszi

Graham Lee

ironically the worst abusers were the opposition, though because it happened under the other party's watch they still came off worse

AviD

@GrahamLee added incentive, then

Graham Lee

Public Service Announcement: if you do come across a merged answer that needs rewording, edit it or propose an edit.

Iszi

@RoryAlsop Morn'

M'vy

Hey @Iszi!

Iszi

13:16

@Mvy Howdy

Jeff Ferland

/me collapses

Iszi

I miss anything interesting over the weekend? Was kinda busy with a friend's graduation, wife & daughter coming back into town, and all that jazz.

M'vy

Fine, fine.

Jeff Ferland

@Iszi DEFCON happened. I'm still waking up.

Graham Lee

I spent the weekend hacking on a PDP-11 :-D

Rory Alsop

13:18

@Jeff and @Graham - you need to combine the two PDP hacking at Defcon

Hiya @Mvy

Graham Lee

hehe

M'vy

Hey @Rory!

Oh so we have confirmation today, "blog" replaces "chat" the 2days after a publication

Iszi

@Mvy Wait... huh?

Oh, I see. No chat link on the main.

M'vy

Yep

It was there this morning

Iszi

So, where'd you get confirmation? SEI? Or just observation?

Rory Alsop

13:22

@Iszi blog post went up an hour ago

Iszi

So, observation then.

M'vy

@Iszi observation yes

Iszi

I like the blog post, but I think there's one problem left un-solved.

Secure private key distribution.

M'vy

Distribution of provate key?

Iszi

Provate keys too, I suppose.

(Whatever TF those are.)

Rory Alsop

13:33

Hahahaha

Iszi

Also, the blog is entitled "Apple bringing secure email to the masses with iOS 5" but it reads more like its final section header, "How Apple could solve these fundamental problems with iOS 5" Big difference.

The first says to me "Apple's bringing PGP to iOS 5!". The second says "It'd be really great if Apple put PGP in iOS 5!".

Rory Alsop

talking of blog posts - any takers for QOTW#5

1

Q: Vote for your Question of the Week #5

For QOTW #5, scheduled for publishing to the Security Stack Exchange Blog on 12 August, please post as Answers, and vote for your favorite question from the whole Security Stackexchange site. The question doesn't have to be recent, just discussion-worthy. Please post any question that you feel...

discussion featured qotw

@ninefingers has got QOTW#6 for next week

3

A: Vote for your QOTW #6

Just read this question: When a sysadmin leaves what extra precautions need to be taken? In my opinion and experience, many companies either do not have a written plan for when staff leave, or do not follow it completely every time. Also, sysadmins leaving organisations can do a lot of damage, a...

Graham Lee

Apparently birmingham city centre is being blocked to the public for the afternoon :-O

Rory Alsop

so number 5 is this question:

25

Q: I just discovered major security flaws in my web store!

A little background info here: I'm a self-taught web developer with very little experience outside of html/css, and the company I work for has hired a third party web development team to design us an e-commerce site. Anyway, I was beta testing the site today using the TamperData Firefox add-on, a...

appsec web-application

and associated thoughts

anyone?

Bueller?

Graham Lee

mind you, only according to Twitter.

@RoryAlsop spoke too soon: bbc.co.uk/news/uk-england-oxfordshire-14460959

Iszi

13:45

I'm still trying to figure out what today's blog post is trying to say... Is Apple actually putting PGP in its iOS 5 mail client, or is this just an "It would be a really nice thing if Apple did this" proposition?

Rory Alsop

@GrahamLee jeez - do these people really think

(I was going to add more to that sentence, but it wasn't necessary)

Graham Lee

heh

M'vy

S/MIME @Iszi

Graham Lee

Barton isn't exactly the classiest area of Oxford, if you get my meaning

Rory Alsop

@Iszi I read it as a 'they could and should' - think you are right though that the title may need a minor tweak

Iszi

13:47

@Mvy S/MIME what?

Rory Alsop

@Graham - and "small outbreaks of disorder in Reading overnight." - no change there then:-)

Iszi

And don't tell me it's some mute guy locked in an invisible safe.

Graham Lee

I'd be more interested in minor outbreaks of order in Reading

M'vy

It's an encryption scheme based on certificates

like SSL

Rory Alsop

@Iszi hahahahahaha

@GrahamLee will need to tell Steve Lord that

Iszi

13:49

@Mvy Yes, I get that. But what about it? My issues with the post are: 1.) Blog title/content needs adjusting to be in synch with each other and/or more accurate. and 2.) Blog does not address secure private key distribution.

I'm not sure how S/MIME addresses that.

Rory Alsop

So no interest in QOTW#5? I'll grab it then

Iszi

Perhaps I should be more clear. By "secure private key distribution", I'm really more referring to "properly authenticated private key distribution".

M'vy

@RoryAlsop @GrahamLee Just received a short message, there is on dead now in the riots?

Iszi

@RoryAlsop @GrahamLee - Pardon my ignorance of global events, but what's triggered these riots?

Rory Alsop

@Iszi updated title

M'vy

13:51

@Iszi you should not have to distribute private key

Except if we take the "cloud" thing in consideration. In wich you would be distributing the private key to yourself across multiple devices?

Rory Alsop

well - that depends. There was a peaceful protest around a possible accidental death of a man who may have had a replica gun and was pointing it at police (still at allegations stage at the moment)

Scott Pack

G'day Lady and gents

Rory Alsop

some thugs hijacked the protest and rioted

other bored folks copied it all

g'day bruce

or @Scott

Iszi

@Mvy Exactly. And, how are you authenticating to the cloud?

Rory Alsop

@Iszi (in soviet russia cloud authenticates to you)

:-)

@Graham - izzat you by the Golden Gate Bridge?

Scott Pack

13:54

So I heard that Oxford has been razed and everyone is fleeing to Cheltenham

Graham Lee

@RoryAlsop yeah

M'vy

@Iszi iCloud policies I presume

Rory Alsop

@ScottPack A fate worse than death

Iszi

@RoryAlsop So... some guy may or may not have had a fake/real gun and pointed it at police officers which may have resulted in his accidental/intentional death, and a peaceful protest about that turned to riot? What was the guy doing pointing/not pointing the toy/real gun at the police for in the first place?

Rory Alsop

the doughnut does not provide safety

Graham Lee

13:55

@Mvy presumably using password-protected PKCS#12 or similar?

Rory Alsop

@Iszi exactly

we have laws which say "if you point a fake gun at people, we will treat the crime as if it were a real one"

as they have no way to tell until it is too late

Scott Pack

Good

Iszi

@Mvy I presume it breaks down to username/password - which is not how you properly authenticate a user for distribution of a private key for encryption, let alone signing, purposes.

M'vy

@GrahamLee could be a solution

Graham Lee

And Simple Certificate Enrolment Protocol was invented to solve the rest of the problem.

M'vy

13:57

@Iszi the normal way to do this would be to let the user transfer the key himself

Iszi

@Mvy Right, but we're talking Joe User here - not Joe Crypto.

I'm sure if anyone can make a way for Joe User to intuitively create and manage their key pair, Apple can do it. I just don't really see it addressed in the blog post.

Rory Alsop

@Iszi - is my title edit better?

Iszi

@RoryAlsop It is, thanks.

Still left problematic though is the fact that Joe User needs his key backed up - and how do you authenticate access to the backup?

Graham Lee

@Iszi Apple have a somewhat nice solution to that

AviD

sorry to break in here... but this isnt really much of a question, is it?

Rory Alsop

14:00

...erm...'these are left as an exercise for the reader?...:-)

AviD

3

Q: Is finding vulnerabilities in the major browsers easy or not?

If young hackers can detect them, why can't security analysts get and patch them? Also, I dream of finding a vulnerability in a major software, like IE or Chrome. Is it easy? Is it systematic or is it random? What books do I need to read to detect them in due time? I now know how to program in...

web-browser

Iszi

@AviD Yeah, that's kinda... I dunno whether to classify it as NaRQ or what, but definitely doesn't look right.

Graham Lee

Two parts: local backup, where the key is (I don't know, looks like base 36)-encoded and displayed for the user to write down. And remote backup, where the user provides answers to three secret questions that are used to encrypt the key and upload it to Apple

Rory Alsop

@AviD the question is poor, but I like both @Gilles and @Piskvor's answers

Iszi

@GrahamLee ...and (for remote backup) you're back to passphrase authentication.

Graham Lee

14:03

indeed.

except you don't authenticate the user with the passphrase, so you're not.

Most "secure" key-based systems start to look questionable if you need a helpdesk.

Iszi

@GrahamLee Except you're using (more than likely) either publicly-available, or peer-knowledgeable, or otherwise easily socially-engineered (or key-logged) authenticators.

Graham Lee

No, because there's no authentication involved.

AviD

@RoryAlsop yeah, I agree. but still, the question is not really one.

Iszi

@GrahamLee I'm not following how you're saying "three secret questions" aren't authentication?

Graham Lee

Essentially you're inviting the user to recreate the key they used to protect their data key. If they get it wrong, they get the wrong key back. There's no authentication or even identification implied.

Iszi

14:06

@AviD +1

@GrahamLee I think that point is arguable. Also, I don't believe a proper private key should be so easily re-createable.

Graham Lee

evidently ;)

Rory Alsop

@AviD I'm having a hunt to see if it could be a dupe at all. We might just need to change the question to be betterererer

Graham Lee

Or, to put it another way, you think it should be easier to irretrievably lose a user's data.

Which is where the trade-off comes in.

Iszi

@GrahamLee Given that the cause would be user stupidity/negligence, sure. ;-)

Graham Lee

@Iszi it may surprise you to learn that most users of consumer-grade software don't know what a private key is.

Iszi

14:09

@GrahamLee Not in the least.

Graham Lee

Why punish them because security people don't want to let them recover their data?

Rory Alsop

the eternal dichotomy between security and usability for the non-technical masses

Iszi

Maybe there needs to be certain tiers of PGP certs. Those that Joe User has, managed and recoverable by whatever User-Friendly mechanism Apple puts in place. And then, one or two higher levels which only get signed by certain authorities when they're held to certain management practices. Those higher levels are the only ones used and trusted for the really sensitive stuff, and the lower is the "everyday e-mail" cert.

Graham Lee

@RoryAlsop it shouldn't be a dichotomy at all. The bounds to your system's requirements are "must be accessible to the customers", and you can do whatever you want within those bounds.

Or you can forfeit customers, if making it accessible is too hard.

And let someone else who's willing to put the engineering effort in take those customers :-D

Rory Alsop

very true - the reason it always appears as a dichotomy is that folks tend to do security right in sensitive environments (for certain values of 'right') and generally not bother in consumer environments. I just wish the gap between was more often closed, at least a little.

2

Graham Lee

14:15

not bother, or assume that the reason consumers don't get the same solution correct is that they're stupid or negligent.

Rory Alsop

yeah

Greg

14:34

Hi all

I'm programming an internally used application that needs user authentication - what's the best method for providing the users with password recovery?

Iszi

@Greg - Gonna need some more specifics than that, I think.

Greg

@Iszi I usually do web stuff, so my users usually log in with their email address - the password recovery can be sent to their email. But these users may not use email.

M'vy

14:49

@Greg in one way or the other, you have to decide a communication way to your client that you&they will consider secured enough.

(Provided you have no legal issue to take care of)

Greg

I'm just putting the question out there for some ideas...

M'vy

could be email, mail, face-to-face meeting, challenges, single sing-on, phone... idk what else :P

Greg

I don't want the low-use users coming to me all the time to reset their password, I'm trying to think of the most apt method for it.

Graham Lee

Yeah, if it's an internal app then having them walk over to helpdesk and say "sorry, I forgot my password" might be sufficient

@greg almost by definition low-use users won't do that "all the time" ;-)

Greg

@GrahamLee I didn't mean the same user.

Graham Lee

14:52

no, I understand that.

Greg

If all low-use users forget their password when they come to use the system, there will be different low-use users asking for their password all the time

Jeff Ferland

@Greg Reset-by-email, or even better link to your Domain / SSO / LDAP system.

Graham Lee

Alright, think of it this way: how long would it take you/your support staff to change one forgotten password? How many times per year do you expect to deal with forgotten passwords?

Now is that time greater or less than the time spent on developing and maintaining a different solution?

Jeff Ferland

@Greg you should post that as a question on the site. It'd get more traffic and probably be a good reference for others in the future.

Greg

@JeffFerland ok I will, I thought it may be too broad to be taken as a serious IT Security question...

Jeff Ferland

14:58

I really want to see if the swag I handed out a DEFCON has a measurable impact on site traffic.

@Greg Since this is an internal tool, can you integrate it to authenticate with a system that is already in place?

Rory Alsop

@JeffFerland Sadly we can't share the admin logs, but I'll track 'em over the next week and give a general idea back.

No real way to tie them back to individual activities - what we should do is have business cards with QR codes so people can join through a particular event code or similar

Iszi

Okay, this is weird as hell. My mouse pointer's disappeared. The mouse works, can click on stuff and all, but I just can't see it.

M'vy

9

Q: Eeeek! Where did the chat top navigation link go?

The chat link in the top navigation bar is gone. Instead there is a shiny blog link. Where did the chat link go?

discussion support

Rory Alsop

LOL

Graham Lee

16:00

for some reason I'm getting blue mod flags for other peoples' chat rooms again :(

Scott Pack

@GrahamLee Who better than to take care of unrest?

Graham Lee

do I look like the Big Society?

Iszi

17:19

Query: If I RDP directly to a VM, would/should the remote session be faster or any more responsive than if I RDP to the host instead?

Jeff Ferland

17:40

@Iszi I think no.

Holy crap I have a trending question ^.^

Iszi

@JeffFerland Hey, which?

Jeff Ferland

10

Q: "Real" Salt and "Fake" Salt

During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" as something seen in the original Unix crypt implementation that changed how the algorithm ran, th...

cryptography hash

grumble and I had to boost @Thomas' already insane rep by another 25 points... ;)

Iszi

17:54

@JeffFerland C'mon... you're asking a crypto question. How did you not already plan for this?

this.josh

10

Q: Can anyone provide references for implementing web application self password reset mechanisms properly?

We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I can't find any references to point the developers at around using that technique. Can anyone point m...

appsec web-application password-management

oops, gone

@RoryAlsop You don't know how to leak the admin logs from an open system like Stack Exchange?

Jeff Ferland

@Iszi ;)

I guess I kind of do for PCI and WiFi what Thomas does for crypto...

Iszi

@JeffFerland I dunno. @ThomasPornin just plain PWNS crypto - I'm not sure any of us come near his level on anything else.

Jeff Ferland

18:10

@Iszi I meant more that I usually end up gaining rep off those as a matter of course, but yeah... nobody's ever catching up with that.

Thomas Pornin

@JeffFerland My pleasure.

AviD

18:34

dya guys think this:

3

Q: Using TPM for full disc encryption?

E.g.: Can I make a better full disc encryption with e.g.: LUKS using the TPM? How?

cryptography linux disk-encryption

is a dupe of this:

9

Q: Status of Trusted Computing and Remote Attestation deployment

Hardware support for various client-side controls based on Trusted Computing (Wikipedia) has been evolving over the years, e.g. TCPM, TPM, TXT (LaGrande, DRTM). I've heard of one practical application, for convenient disk encryption via a "Transparent operation mode" of BitLocker. What other ex...

audit trusted-computing remote-attestation

I'm thinking the original question, at least, is pretty much covered by the 2nd one - but then, I realize I probably dont know enough about those terms to really know for sure.

this is weird, all the chatrooms I had starred as favorites have become unfaved. :(

this.josh

TPM is a trusted platform module

AviD

@thisjosh oh I know that much...

this.josh

a hardware device meant to provide a root of trust, set to become standard in motherboard chipsets for PC/intel machines

AviD

but they both seem to be talkign about it, in one way or another.

this.josh

You know LUKS is the Linux Unified Keying System?

a software based mechanism that is often used to provide full disk encryption

AviD

18:48

okaaay.....

this.josh

Trushted Computing and Remote Attestation don't necessarily require full disk encryption

Question 1 is asking if there is a way to use a specific piece of hardware to improve a specific piece of software for full disk encryption

AviD

I think I see what you're saying...

but then take a look at the original, pre-edit question

this.josh

Question 2 is asking about what implementations exist (are deployed) that can be used to achieve the goal of Trusted Computing or Remote Attestation

AviD

security.stackexchange.com/revisions/4426/1

hmm, no onebox love for revisions?

What is exactly TPM - I mean where is it beeing used in reallity?

E.g.: Can I make a better full disc encryption with LUKS safer with using TPM? How?

anyway, I think you're right - similar, some common coverage, but not equivalent.

thanks

this.josh

Intel motherboard chipsets have internal (mostly for server chipsets) or external interfaces to TPM

oh, not your question, tricked me

AviD

18:52

heh. no, they were modflagged as dupes. wanted a 2nd opinion.

Thomas Pornin

@thisjosh Yeah, but it is going to happen ? I have heard tales of impeding TPM-powered-doom since 2004, and Apocalypse is, as always, a bit late.

AviD

@ThomasPornin but they proooomiiissed! and I prepared popcorn, and everything!

this.josh

Yes, I will have to go look it up but I know of at least one Intel server chipset that has internal TPM

Although there are TPM manufacturers and chipsets that support TPM, motherboard manufacturers don't seem interested in producing TPM otherboards

Dell E1910C 1440

oops...

Iszi

Uh-oh: krebsonsecurity.com/2011/08/…

Patco's lost the case vs. Ocean Bank apparently, pending any appeals.

AviD

@rebeccachernoff @rebecca, we call @rebecca right over...

@rebeccachernoff really sorry to keep bugging.... but about the OWASP sponsorship?... Btw, if it matters, I am also a speaker at the conference...

Iszi

18:59

@AviD - I think she'll need the special diamond power summons.

AviD

@JeffA's blog post seems to indicate that it shouldnt be a problem...

this.josh

@ThomasPornin Intel calls it Trusted Execution Technology (TXT) and it is on the Intel 550 Chipset. Which is used on the Intel Server Board S5520HC

AviD

@Iszi ah, but I did that :)

Iszi

@AviD Hrm. Doesn't show on this end.

AviD

@Iszi I know! cool, right?

I just type @@ and then choose a user, which it switches to a userid, which auto-changes back to the user name!

this.josh

19:02

And the Intel S5520HC seems to be commercialy available

Iszi

@AviD ...*and* removes the extra @?

AviD

@Iszi of course...!

hmm, might be because my meta post on the subject didnt garner enough votes...?

4

Q: OWASP Conference Sponsorship

In the spirit of this post, and several others on this site and on the SE blog, I'd like to see if SEI and ITsec can sponsor the upcoming OWASP regional conference, in Israel (in September). A while ago, I had proposed this in a Meta.SO post, but didnt get much response. Now, with the confere...

discussion feature-request conference promotion

anybody thats in favor - go upvote it! (its meta, I dont get rep for it anyway...)

Iszi

@AviD No telling. We've got a couple other well-voted meta issues which are much less costly, that are still un-tended.

this.josh

there ya go AviD

Iszi

@AviD Like this...

8

Q: Should we add #infosec to our Twitter bot's posts, for publicity?

This idea is spawned from @ScottPack's post in the thread about distinguishing blog posts in Twitter: How should we distinguish blog posts in the Twitter feed? I think it could bring a bit of publicity (and, hopefully, more traffic - and, consequently, more users) to the site if we added the #i...

discussion feature-request twitter publicity

And this...

7

Q: IT Security SE Logo Wallpaper

Just wanted to post here, to officially request something that was mentioned in chat: An IT Security StackExchange wallpaper. I think the main site's "banner logo" (including: lion, shield, starburst, wings, "Tron lines", banner) would look great against its current backdrop color, as a full-s...

feature-request design

AviD

19:05

hmm, true nuff... what, you think SEI are ignoring us security folks...?

naaah, they would never do that!! Don't they know what we could do to them??

this.josh

It's hard to see Tigger as threatning..

2

You need a scarier avatar

AviD

hehe

dya really wanna see me bounce your sorry site? ;)

cuz bouncin' is what tiggers do besht!

this.josh

naw, duplicate delay of VoIP to introduce multipath cancel-resistant echo sounds more annoying

Scott Pack

Is mine scary enough?

AviD

very interesting post on a sister blog:

stats.blogoverflow.com/2011/08/04/…

really? no onebox for SEI blogs?

"Does Jon Skeet have mental powers that make us upvote his answers? (The effect of reputation on upvotes)"

I would guess the same applies to our own version (== @ThomasPornin)

Jeff Ferland

19:14

... and that's the first time I've ever seen a link disappear when I tried to click it

AviD

WHAT DID YOU DO???

was just checking if our own blog gets oneboxed.... hehehe

Jeff Ferland

Revisionist bastard!

As an aside, I love truecrypt + keyfiles for sending a client data by USB drive

this.josh

Wholy &^#( is that a real person?

Jeff Ferland

Bring usb with me, send keyfile through our "dropbox" site.

@thisjosh Jon Skeet? Yeah.

AviD

@thisjosh you talkin about @JeffFerland?

this.josh

19:17

Naw Jon Skeet

AviD

@JeffFerland though there used to be rumours that he was a bot.

this.josh

15409 Answers

in 2 years, 10 months

435 answers a month

seems possible

Iszi

@AviD Odd. Don't ours get onebox?

security.blogoverflow.com/2011/08/09/…

No?

AviD

@Iszi nope. thats what I was checking with the disappearing link.

Iszi

@AviD Sorry. Slow catching up.

AviD

19:22

probably find an open meta.so q about it?

Iszi

I think SOFU blogs get oneboxed.

@AviD Find one or make one.

AviD

ours gets oneboxed when it comes in via the feed, though...

nope, something special about feed posts.

Thomas Pornin

19:53

Suppose I want to build rackable appliances, i.e. basically a PC with Linux and some software of mine on it, but with an "appliance" look&feel (e.g. with a "reset to factory" button and a small embedded LCD display to print out current status, IP address, that kind of thing). Do you know an appropriate vendor for the hardware parts ?

this.josh

Generic parts or custom parts?

Gilles

@ThomasPornin PC part vendors with a large inventory

e.g. newegg

Thomas Pornin

@thisjosh We ("we" = "my colleagues in the main company, in France") would like to keep handling costs to a minimum

so we look for something which will decently run a Linux system and a Java VM and has a free PCI port.

this.josh

@ThomasPornin I'm confused, you mean that you want to source in France or you want to use generic parts?

Gilles

@ThomasPornin Ah, you didn't say “available in France”, that's a much harder problem

Thomas Pornin

20:09

my first impulse would be to take just about any generic PC and load it with a custom OS (it is not hard to replace /sbin/init with a script which initializes network with DHCP and then runs a Java VM)

but the result would "look like a PC"

and we do not really want a customer to imagine that he could "customize" it

this.josh

sounds like you want a custome plastic stamped front

Thomas Pornin

we cannot prevent the determined customer from opening the case, but some psychological deterrent would be fine

this.josh

but I'm guessing thats not in your budget

Thomas Pornin

@thisjosh This is for a very small number of units

the PCI slot is for receiving a HSM

those things cost several thousands of dollars each

so we will not sell thousands of appliances (although it would be great)

my trusty friend Google found this: pyramid.de/en/products/varioflex.php

this.josh

Thats nice, I would look for Home Theatre PC (HTP) Cases, those usually have an LCD in front.

Scott Pack

20:14

@ThomasPornin I've had hardware like that in here in the past. I think SuperMicro has some stuff

Though that's not what I've used. Let me see if I can find what it was.

this.josh

Does it need to be rack mountable?

Thomas Pornin

@thisjosh Yes

on the other hand, it needs not be silent

AviD

@ThomasPornin depending on what you're looking for, and how many you need, you can go to one of the standard vendors, and have them prepare a "standard" appliance, customized to your spec.

e.g. I know Dell does that.

this.josh

Good idea AviD.

Does it need to be 4U to accomidate the HSM?

Thomas Pornin

@thisjosh It depends on the HSM model

Those from nCipher are quite small and fit in a 1U server

those from Bull are bigger (full-length PCI card)

AviD

20:25

@ThomasPornin check this content.dell.com/us/en/enterprise/…

this.josh

pc-industrial.com/products/en/cat/…

Thomas Pornin

@AviD Ooh ! Shiny !

I am sending all those links to the colleagues

AviD

@ThomasPornin :)

Thomas Pornin

thanks everybody !

this.josh

Nice AviD

AviD

20:28

though in general, I have a feeling that SF folk would probably have a little more expertise...

@thisjosh I have a feeling that Dell would be more expensive, unless you're sourcing large numbers of boxii...

this.josh

Oh, of course, brain is elsewhere right now...

Iszi

Hey, the bot tweets bounties when they're posted? Cool!

Wonder if ours does that?

Bounty offered: Engel metaplot summary? http://bit.ly/nhMUP3 #engel

Tweeted by StackRPG on August 9, 2011 at 8:28 PM

AviD

@Iszi post a bounty and find out!

Iszi

20:58

@AviD Not me, not for awhile. I'm too close to regaining close-vote privs.

Hendrik Brummermann

21:21

hm, no chat link anymore.

Iszi

@HendrikBrummermann We've determined that it occurs for approx. 2 days after a new blog post - to make room for the "NEW BLOG!" link.

Hendrik Brummermann

Oh perfect, I hate that annoying red bubble anyway.

(especially that it does not go away after clicking on it)

Gilles

22:00

@Iszi 24 hours

Transcript for