The DMZ

this.josh

04:53

with 42 ups I'm guessing that its not going away..

M'vy

08:28

@thisjosh We sacrifice a little noise to more visibility I guess.

Wow @JeffAtwood rules @ThomasPornin ...

M'vy

08:51

Ok, and one new edit suggestion!

This question is really poorly phrased

0

Q: Classified information on a unauthorized laptop

Has anyone ever had to deal with an unauthorized laptop accidentally getting TS level data on it. How did you quartine the system. Were you required to turn in the entire laptop or were you able to destroy/ format the hdd? nispom says that incineration or physical destruction of the hdd is req...

M'vy

09:11

5k views for XKCD

Rory Alsop

09:25

@Mvy it might not be our best structured question ever, but it's getting folks in the door:-)

M'vy

The top secret one?

Rory Alsop

LOL - morning @Mvy

M'vy

Or you meant we can better structured the XKCD question?

@RoryAlsop Hi too :P

M'vy

09:40

BTW: we are in the hot topics :P

64 Q:upvote. Half for @JeffA answer.

Rory Alsop

yes, the xkcd one - good to get our profile up in front of the masses at SO

wow - the xkcd question is 140 higher than the next one on the 'hotness' page

M'vy

XD

@RoryAlsop You don't have the "referer" links of visitors in mod-tools?

Rory Alsop

yes, I do :-)

I might not in IE7, which I am currently forced to use - hang on while I go check]

no - can't see that section in IE7

lemme try on android

M'vy

I suspect someone has posted in on the XKCD forum :P

AviD

hello all

Rory Alsop

09:51

@mornin' squire

did we decide whether unicorns were kosher? wast there a 'magical animals' dispensation?

AviD

really never can tell, which q's will really take off, huh?

@RoryAlsop hehe... probably.

Rory Alsop

bizarre, eh

trying to see the stats on my android phone at the moment

AviD

legend has it that there are several magical, prehistoric creatures waiting for the feast in the time of the messiah

Graham Lee

Morning all

Rory Alsop

hahahahaha

@GrahamLee morning

AviD

09:52

@RoryAlsop looking now

Graham Lee

I'm not prehistoric!

AviD

@GrahamLee gmorning

Graham Lee

BTW, check out the epically craptacular attempt to game the voting system embodied in this answer:

AviD

@GrahamLee hehe, well, if anyone here is prehistoric, it would be ol' gramps over there.

Graham Lee

security.stackexchange.com/questions/6077/…

Rory Alsop

09:53

I'm not seeing anything bizarre in stats yet, maybe have to wait till end of day

@AviD thank you very much

I only get fossilised at the weekend

Graham Lee

"I think my answer is wrong, but don't vote it down unless I'll get a badge out of it"

Rory Alsop

I might vote it down. Everyone else leave it:-)

Graham Lee

@RoryAlsop that's "pished". You only get pished at the weekend.

Rory Alsop

oh -its deleted

AviD

@GrahamLee yeah, I think thats a jokhe....

Rory Alsop

09:54

@GrahamLee no, no - not just at the weekend at all :-)

Graham Lee

@AviD it's a fact that any word in English can be used in the past tense to mean drunk.

AviD

@RoryAlsop yeah, I'm curious how often those stats get updated.

Rory Alsop

ain't the English language great

Graham Lee

Example of usage: "I got completely serverfaulted last night"

Rory Alsop

@AviD it is definitely daily, if not more often

AviD

09:55

@GrahamLee thats "in British". For americans, any word can be used for sex.

hmm....

@GrahamLee oh excellent!

gotta go hang out there more....

Rory Alsop

I have actually heard someone use the word "segfaulted" in real life to mean exactly that

Graham Lee

Yeah, come over and we'll get unicycled :)

AviD

@GrahamLee see, for americans you could do: "I had this MILF totally stackoverflow me..."

Rory Alsop

hahahahahahaha

that's just brilliant

Graham Lee

/me sneaks in the obvious "fingered her ports" joke

AviD

09:57

guess it says a lot about priorities... ;-)

Rory Alsop

@GrahamLee portknocker

AviD

@GrahamLee Giggity (stolent from @Scott...)

Graham Lee

@AviD doesn't that upgrade her from "MILF" to "MIHF"?

Rory Alsop

or is that a downgrade...

AviD

@GrahamLee but, for the record, the joke I was referring to was the vote gaming....

Rory Alsop

09:58

so we could use a single phrase that to different nationalities could cover chat topics #1, #2 and #3! Isn't English great

M'vy

Vote gaming?

AviD

@GrahamLee I.... wouldnt know I'm married.

and I'm sticking to my story.

Graham Lee

is that all you're sticking to? :)

AviD

ohhh maaan, and when @ScottPack is not around....

Graham Lee

on second thoughts, I retract the tongue

Rory Alsop

09:59

ewwwww

M'vy

oh man... I'm lost

AviD

@Mvy "Vote gaming" could work for #1 and #3, but I dont see it for #2.

M'vy

#1? #2?

AviD

food.

M'vy

I don't get what you're trying to achieve here.

Rory Alsop

10:01

for the security chat room, topic #1 always seems to be food

AviD

@Mvy okay, lemme bring ya up to speed... we've noticed the the "favorite topics" discussed most often in this room, are rarely security related.

Rory Alsop

topic #2 - drink

topic #3 - well, you can guess

M'vy

oh

AviD

@RoryAlsop oh, I thought that was 2?

Graham Lee

well, the topic is Drambuie-Marinated Zucchini...

AviD

10:02

I seem to have #1 and #2 reversed.

Rory Alsop

hahahahaha

Graham Lee

If you think that is #2 then you may be doing it wrong.

Rory Alsop

damnit - you could be right, I was incredibly unicorned that time

AviD

@GrahamLee no, if you think that is #3, you're doing it VERY wrong.

Rory Alsop

@Mvy - the vote gaming thing was actually just a reference to a since deleted answer by someone

AviD

10:02

@RoryAlsop who was unicorning you???

M'vy

ok right

thanks

Rory Alsop

the chat here is probably the result of too much coffee and xkcd, and not enough button lamp chapter trumpet

2

:-)

AviD

LOL

so, thats the new meme? 4 random words?

Rory Alsop

It certainly should be

Graham Lee

random? That's my root password!

Rory Alsop

10:04

it beats the new google+ meme

AviD

@RoryAlsop which is?

Rory Alsop

@GrahamLee intuitive password hacking

AviD

crikey, that xkcd question got an average of one upclick every 10 minutes, since it was asked.

Rory Alsop

I don't know if I can get a pic in here, but it is a recursive post which says

a G+ meme: share it, with a picture of the previous person's identical comment

AviD

umm.... no?

Rory Alsop

10:06

@AviD the lesson learned is... whenever xkcd do a security comic, jump on it full speed:-)

@AviD exactly

AviD

heh

oooh, we need a xkcd tag!

Rory Alsop

do it

otherwise I will

joke from friend: what do you call the best student at unicorn school?

the 'A' corn

oh dear

AviD

uurrggh

see, unicorn absolutely covers all #1,2, and 3.

Rory Alsop

toldja

AviD

true story, there was almost a unicorn tag on another site.

Rory Alsop

10:10

@GrahamLee - so, you're gonna go ahead and Unicorn?

AviD

5

A: Why are some questions highlighted in blue?

This is highlighting questions with tags that are in your favorite tags. If you haven't manually added any favorite tags, the system will detect when you have a certain level of activity in a tag and infer one for you. If you manually add a favorite tag, the system will not infer a tag for you....

read the comments on @Rebecca's answer...

if they had asked the question, it may have answered your kosher question, too...

Graham Lee

@RoryAlsop yeah, I'm just gonna need you to go right ahead and come in this saturday, OK? Greeeeat.

Also, which one of you took my red Swingline stapler?

Rory Alsop

@GrahamLee hahahaha - it was used to abuse that poor horse battery, wasn't it

@AviD :-)

Graham Lee

I'm not sure which seems sillier: a rabbinical conference to determine whether an animal that they're not about to eat can be eaten, or the fact that I read the whole article.

Rory Alsop

good work sir

AviD

10:23

hahaha

rabbinical conferences love them theoretical discussions...

but, its also about the bigger picture - now they can eat it, some other time.

Rory Alsop

Intersting - a look at all sec.se questions sorted by votes gives How does changing your password every 90 days increase security? in 1st place followed by XKCD #936: Short complex password, or long dictionary passphrase?

the 1st one has been here 2 1/2 months, the 2nd one ... a day!

Graham Lee

Just reminds me of the bit in The Hobbit with the trolls. "'ere, I've never seen one of them before" "Yer, but can yer eats it?"

AviD

I mean, who really wants to eat an animal that died by itself? it needs to be killed with my stomach in mind!

@GrahamLee hehe. Exactly!

Graham Lee

In the mind of the killer or the animal?

AviD

@GrahamLee both! :P

Rory Alsop

10:25

@AviD you are Ted Nugent, AICMFP

(for you youngsters:

Ted Nugent

Theodore Anthony "Ted" Nugent (; born December 13, 1948) is an American guitarist, musician, singer, author, reserve police officer and activist. From Detroit, Michigan, he originally gained fame as the lead guitarist of The Amboy Dukes, before embarking on a lengthy solo career. He is also noted for his conservative political views and his ardent defense of hunting and gun ownership rights. Early life Nugent was born and raised in Detroit, Michigan, the son of Marion Dorothy (née Johnson) and Warren Henry Nugent. He moved to Palatine, Illinois as a teenager, and has two brothers: John an...

AviD

hehe

Graham Lee

wait, America was already colonised in 1948?

I thought Jobs and Ballmer were the founding fathers

Rory Alsop

Nah - they just bought it, didn't they?

AviD

@GrahamLee no, that was Al Gore.

Rory Alsop

didn't he invent electricity

AviD

10:30

hurhurhur, you said inventing...

Graham Lee

no, that was Bruce Wayne

AviD

as long as we're on #2 (or is it #1?) - this sounds veeery interesting

9

Q: How to combine chocolate and garlic in the same dish?

I hosted a potluck dinner some years ago, and I set the theme as "chocolate or garlic" -- guests were to bring one or the other. One person was a wiseacre and bought chocolate covered garlic. (It was hideously unpalatable.) I've since wondered if there's any way to combine chocolate and garlic ...

garlic chocolate

(now @ThomasPornin or @Mvy will jump in and say thats how all chocolate is in France... ;-) )

Rory Alsop

I have tried it and it didn't work. Chocolate works well with ginger and a few other spices, but not garlic

Chili obviously works perfectly - that's what you should use with chocolate

you should see my chili con carne - stacks of venezualan 85% chocolate goes in, along with scotch bonnet chili peppers

mmmmmmm

M'vy

Chocolate + garlic?

What is the point? Repulse vampire with sweetness?

Rory Alsop

it's just wrong isn't it, unless you have a swiss or belgian vampire

AviD

10:37

right, enough fun and games for today... gotta get some work done.

Graham Lee

I make chocolate chilli cakes, too.

AviD

This DFD is turning out to be a lot more complex than I thought...

Rory Alsop

ttfn @AviD

@GrahamLee mmmmmmm

AviD

and I'm having a huge barbie on tonite... :P

Rory Alsop

@AviD DFD?

M'vy

10:38

I need to enforce subject #1. 12:38 -> lunch.

Brb

AviD

@RoryAlsop data flow diagram.

Rory Alsop

I'm only working for the next 40 mins, then off to load in for gig tonight:-)

@AviD of course

AviD

I like using them to start a threat model

Rory Alsop

:-)

AviD

unfortunately, more often than not I need to build it myself. based on partial information.

so, yeah, guessing.

►

Scott Pack

11:35

@AviD Yeah, between timezones and gaming night... And by Gaming, I mean paper/pencil :(

Also, reading Jeff's answer, and the comments, it's funny(?) to see the differences between what I recognize as sec.se users, versus not.

Graham Lee

How do you mean?

AviD

12:03

@ScottPack ymean, how non-secse users see security as fuzzy, and touchy-feely?

this feels secure, so it probably is.

and, gmorning @ScottPack

speaking of, why is Jefafa running around deleting comments?

I could understand getting rid of @RoryAlsop's horse steak comment, but my distinction of ponyhood was important.

Scott Pack

@GrahamLee Pretty much what Avi said. The general statement of "HE SAID BIG ENTROPIES SO IT MUST BE UNICORNIGICANT!"

M'vy

I found the solution to all my security problems yesterday: I bought a blanket

3

AviD

@Mvy lol, excellent

M'vy

^^

AviD

okay, now I'm bothered - he didnt delete just the chatty stuff, he got rid of some actual, important content.

Scott Pack

12:08

Two questions

1) Can you undelete?

2) Did the deleted comments speak negatively to his answer?

M'vy

where? who?

AviD

@ScottPack dont think so

@ScottPack yes, some of them.

Scott Pack

Right, so then we have

Followup 1) If the comments should be reinstated, how does that process work?

And Followup 2) Were the reasons malicious, misguided, or valid?

AviD

ooohh, wait a sec, it looks like he simply consolidated the comments.

:$

Scott Pack

Is that the hoof in mouth emoticon?

AviD

12:13

hehe

M'vy

Which answer it is?

AviD

no, thats trying to eat a unicorn.... LENGTHWISE!

M'vy

Eeeeek

AviD

@Mvy @jeff's, but I was wrong. checking...

nope, I was wrong. false alarm, false accusation.... he was just cleaning up a bit, and getting rid of the funny/chatty stuff....

Scott Pack

Jeez, @AviD!

Lots of downvotes sprinkled liberally throughout that post

AviD

12:21

whaaa?

room topic changed to The DMZ: General discussion for security.stackexchange.com [security]

didja know you could tag the room?

M'vy

Yes

Lot of noise in the Tavern on Meta yesterday

or the day before

BTW, why did you brought up a tag that is neither #1, #2 or #3 topic here?

AviD

@Mvy hehe, you're learning.

M'vy

Another WTF: the twitter account said this is a great answer? Only 3▲ and accepted mark makes that "great"?

Understand that I did not read the content

But I'm asking about the metrics

AviD

ayup, the xkcd q is now the most viewed q on the site.

within 14 hours.

seriously, who viralled it?

M'vy

It's a new record

Waiting for @Rory to tell us :P

need referer stats :P

AviD

12:29

well I could do that

M'vy

But I saw it on twitter / G+

maybe FB?

Plus now it's on hot topic

This would be a remake of the SF auditor question :P

AviD

@Mvy albeit in a much smaller scale.

the stats dont get that granular, but there's nothing different from the usual.

M'vy

hm

AviD

Twitter / google / facebook, etc - they the usual suspects. no per-q info

unless its not updated yet...

M'vy

Oh yeah I recall @rory said something like this too

"probably not updated yet"

Scott Pack

12:33

I saw a couple of people twat the question, that don't normally get involved in the site

AviD

no, I have a feeling thats not it - I dont think we'll see anything different.

M'vy

Hm. Maybe just the SE folks?

Scott Pack

Well, the asker is a big SO user

AviD

we've seen that the tweetererer feed thingie does bring in a lot of views, as does g+/fb I'm sure. plus SE hotness helps

@ScottPack yeah? like who?

Scott Pack

Ah-hah!

The asker twatted it

M'vy

12:35

That makes a nice profile page for him

Scott Pack

Then it got retwatted (how I saw it) by vortaq7

M'vy

2 silver badge, one quesiton

Mortarboard

AviD

hmm, is it just me, or does the asker look like @JeffA?

Scott Pack

Let's see, he's got 150 followers

AviD

Billy ONeal, Northfield, OH

468 2 10

windows antivirus passwords random

Graham Lee

12:36

I'm rapidly coming to the conclusion that "twat" means something different in American English.

Scott Pack

Retweeted by AnonJr and 100+ others

@GrahamLee I don't think it does :)

M'vy

To tweet -> twat?

preterit?

or sort of?

Graham Lee

@ScottPack :P

Scott Pack

@Mvy I use it as a pejorative to describe Twitter

AviD

and those that use it

Scott Pack

12:39

@GrahamLee Oh, round these parts it does not mean "to strike someone". UD seems to indicate that is Northern England usage

AviD

thing that annoys me, its not such a great question, nothing that hasnt been discussed here in various forms (though I couldnt find an actual dupe).

but its a fun question, that is also legit, so it pulls even more in.

hehe, we should close it as a dupe!

now that would be plain funny.

Scott Pack

You want a flag?

I'd flag that

M'vy

We have a variation of :

AviD

@RoryAlsop @GrahamLee - @ScottPack said he'd "flag that" :D

M'vy

Jul 29 at 8:14, by M'vy

Conclusion, popular topic rewards more than technical subjects

2

AviD

12:41

@Mvy but of course.

Scott Pack

@AviD That was a fun conversation to go through

AviD

@ScottPack totally gonna be saying that at the bbq tonite - I love leaving my family with question marks on their faces.

M'vy

XD

M'vy

12:55

Hum I can't link git hub project I'm coauthor but not owner in careers 2.0 :(

\o/ evince got Vim navigation mapping!

Thomas Pornin

13:14

@RoryAlsop Thanks ! This resulted in twice the question on crypto.SE (I had not seen that it had been posted on sec.SE, crypto.SE and SO), and a mod merged them.

Iszi

Okay, whatever they did to the Twitter bot, I'm not sure I like it...

Great answer: WAF equivalent of virustotal? http://bit.ly/pnbxlA #appsec

Tweeted by StackSecurity on August 11, 2011 at 12:21 PM

Really? Only three up-votes and it's a "great answer" now?

Scott Pack

So are we going to start getting badgers for 3 votes?

Thomas Pornin

@ScottPack You really mean "badgers" ?

Scott Pack

Also, I despise reattaching rear views. It's a real pain in my ass.

Thomas Pornin

Awesome !

Iszi

13:17

Hey, maybe we can get badges for having our Qs or As tweeted so many times.

M'vy

@Iszi see chat.stackexchange.com/transcript/message/1594972#1594972 :P

Scott Pack

@ThomasPornin Who wouldn't want a whole passel of badgers?!?

Iszi

@AviD Which XKCD Q?

M'vy

@Iszi THE XKCD question :P

Don't tell me you missed it ?

Iszi

@Mvy It would seem that is... possible.

Scott Pack

13:20

75

Q: XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD from August 10, 2011? XKCD 936: Password Strength I've always been an advocate of long rather than complex passwords, but most security people are against me on that one. (at least that I've talked to) However, XKCD's analysis seems spot on to me. Am I missing someth...

passwords random

I'm looking for a dupe

It's not looking good ):

Iszi

@ScottPack Oh!

Holy crap... I think it might actually happen this time... I may just find myself up-voting Mr. Jeff Atwood.

(Usually, I see his posts on Meta and am not thrilled with the stance he's taken on x subject.)

Scott Pack

Based on his answers, I find that Jeff tends to have the typical developer failing of overly limited scoped.

Iszi

Did anyone ever suggest that comment-thread be taken to chat?

Lots of LONG comments in there.

Scott Pack

@Iszi Not enough unicorns

So, I see that xkcd question as, more than anything else, being a question about measuring entropy. Am I missing something?

Graham Lee

Yeah, the fact that if you refer to a webcomic you get a squillion more views.

Scott Pack

13:33

Especially Randall's work. I just wanted to make sure I didn't somehow miss the point of it

M'vy

@Iszi It should happen automatically now, no?

Thomas Pornin

@Iszi Technically, though, Jeff's answer is wrong. His entropy estimates are way off.

Iszi

@Mvy It gets suggested under some certain circumstances by the system, but then you have to click the link that auto-posts the "let's go to chat" comment.

@ThomasPornin I'm still trying to figure out exactly how XKCD got its entropy estimates - what exactly does each little box represent?

Thomas Pornin

@RoryAlsop Al Gore did not invent electricity, he discovered it. Turns out it was coming out from a hole in his office wall.

Graham Lee

A wall wart? You can get cream for that.

Iszi

13:38

@ThomasPornin Was it one of those simley-face guys, or the bullet-in-the head guys?

Thomas Pornin

@Iszi Each box is a bit. Eleven boxes mean "11 bits of entropy": this means that the word was chosen (randomy and uniformly and independently from the other words) among a list of 2048 possible words.

Iszi

14

Q: Which way is up? (electric outlet)

My house has electric outlets in both orientations. Which one is correct? Should the ground hole be at the bottom or the top? OR

electrical usa

@ThomasPornin Guess I just need to learn more about the maths behind password cracking.

Graham Lee

2048 words? Likely. Choosing words randomly or independently? Unlikely.

Iszi

Like, what exactly does "one bit of entropy" mean, in relation to "one bit of password length"?

Thomas Pornin

@GrahamLee If you do it in your brain, yes, it is unlikely.

0

A: How should I calculate the entropy of a password?

Entropy is a measure of what the password could have been so it does not really relate to the password itself, but to the selection process. We define the entropy as the value S such the best guessing attack will require, on average, S/2 guesses. "Average" here is an important word. We assume th...

I wrote it all down this morning.

@Iszi At home I have some double plugs with one in each direction

@GrahamLee (I did not want to imply anything pejorative about your brain in particular)

Scott Pack

13:43

This is why I just use all un-grounded plugs. No need to worry about directionality.

Graham Lee

@ThomasPornin indeed I didn't think you did ;)

Thomas Pornin

@ScottPack This morning I learned that some people worried about directionality of plugs and kosherness of giraffes. I am close to surrealness overflow.

Iszi

@ScottPack There's polarized un-grounded plugs...

Scott Pack

@Iszi I'll take a picture when I get home :)

I figure, that wiring has worked for the last 73 years, so why jinx it?

Iszi

@ScottPack Wait... your outlets are all un-grounded?

Scott Pack

13:47

Well, fine, no, not all.

Thomas Pornin

@Iszi That's why one of the slots is bigger than the other. In Europe (at least France and I think most of continental Europe), plus are symmetrical because appliances are supposed to deal with both "polarities".

(I am not sure "polarity" is the proper word for AC power.)

Jeff Ferland

@ThomasPornin It does annoy me when people install American-style plugs with the ground prong on the top...

Scott Pack

Back in the last 90s there was some remodeling to the kitchen and finishing of the basement.

Iszi

@ThomasPornin I know. That's why I mentioned it. @ScottPack said without grounding, there's no need to worry about directionality - which is untrue.

Scott Pack

At that time all of the new work and wet rooms got fancy new Romex with ground.

AviD

13:55

gmorning all you late risers

@ScottPack or randomness

@ThomasPornin I blame the Brits.

Thomas Pornin

@AviD Who doesn't ? Even Brits are blaming themselves these days, if TV news are to be believed.

AviD

It's funny, whenever I have a conversation with my scottish neighbor, the topic jumps tangents faster than an olympic rope jumper.

Iszi

Well, I'm off for another wonderful day of vulnerability scanning in the field. See you guys in the afternoon, maybe

AviD

@ThomasPornin @Iszi I actually had to downvote that.

while I often accept his tradeoffs, this time it was just too "fuzzy" to buy.

Thomas Pornin

@AviD It seems that Jeff's answer got 6 downvotes

AviD

13:58

@ScottPack I love that you found a dupe! though I think there's some policy about closing such a popular question, for one that, umm... isnt so much.

Transcript for