The DMZ

AviD

14:00

btw, I'm not so sure that it's just about entropy - in my answer I pointed to the contrast between focusing on entropy, and usability.

Graham Lee

@ThomasPornin @AviD actually we've started blaming social media, apparently. The regime is debating turning off the internet during the riots.

AviD

@GrahamLee oo, another egypt....

Graham Lee

Well, for the moment, they're targeting Twitter, Facebook and BES.

AviD

BES?

M'vy

@AviD BBM exactly

AviD

14:03

Bes

Bes (also spelled as Bisu) was an Egyptian deity worshipped in the later periods of dynastic history as a protector of households and in particular mothers and children. In time he would be regarded as the defender of everything good and the enemy of all that is bad. While past studies identified Bes as a Middle Kingdom import from Nubia, some more recent research believes him to be an Egyptian native. Mentions of Bes can be traced to the southern lands of the Old Kingdom; however his cult did not become widespread until well into the New Kingdom. Iconography Modern scholars such as...

M'vy

BlackBerry Messenger

Thomas Pornin

@GrahamLee Well, we are blaming Twitter for the XKCD/password question. Cameron is also entitled to have a go against the usual scapegoat.

AviD

apropo egypt?

ahh right

Graham Lee

"The government is exploring whether to turn off social networks or stop people texting during times of social unrest."

bbc.co.uk/news/technology-14493497

M'vy

@GrahamLee Why not all communications means

Graham Lee

14:04

@Mvy thanks, Crackberry Messenger not enterprise server

@Mvy because that would lose more votes?

M'vy

humm

There is no point blackouting the internet

people would just turn to SMS

or else

or mail

Graham Lee

@Mvy they said texting, too.

M'vy

Or whatever people used in the old times when they organised in such events

AviD

and, just in case....

7

Q: How can citizens prevent government-led Internet blackouts?

The United Nations now considers Internet access a basic human right. [PDF] Despite the questionable effectiveness of Internet blackouts in silencing a populace and preventing uprisings1, it's worrying that governments can flick a kill switch, as they did in Egypt on 27 January 2011. To that end...

Graham Lee

@Mvy pamphlets

And seriously, there were calls during the English Civil War for printing presses to be controlled or outlawed.

M'vy

14:08

This is going to have bad repercutions...

Graham Lee

Just like all those restrictions of civil liberties in America did?

Or rather, didn't?

AviD

yeah, but are the English people as sheepy as lazy americans?

Graham Lee

They're all out rioting because they saw other people get away with it, so...

M'vy

copycat behavior

AviD

Jul 21 at 13:38, by AviD

well, I for one, am proud to be american, knowing that we are a nation that can waste huge amounts of time and resources watching stupid, but beautiful, stuff like silhouette dancing.

and thats americans for you. no more tea party any time soon...

Scott Pack

14:12

@AviD More than anything else, I thought it would be funny to find a dupe and flag it :)

AviD

@ScottPack oh I agree... and I'm tempted to close it, just for spite.

but, I think I wont, because then my answer wouldn't apply.

;)

Scott Pack

wow

M'vy

"Il ne faut pas jeter le bébé avec l'eau du bain" :P

AviD

hey dont get all entropied up in here!

M'vy

LOL

BTW I found the expression exists in english too : throw the baby out with the bathwater

AviD

14:18

or rather, "Don't throw out the baby with the bath water"

Scott Pack

No, I think Frenchy got it right

M'vy

@AviD Well in this case yes, the negation applies.

Depending if you do it or not :P

AviD

I'm starting to believe that the entropy -> random synonym is overly aggressive.

while it could be said that entropy is a measure of randomness, as a tag I'm thinking they apply to different things.

like, xkcd should be entropy, not random.

M'vy

@AviD I'm inclined to say: please don't

Because lack of entropy is != random

AviD

@Mvy the synonym already exists.

M'vy

14:21

And if entropy is random, then why do we talk about entropy anymore?

hmm

AviD

from looking at the questions in that tag, I'm starting to think: entropy is about measuring it, and random is about creating it.

M'vy

> entropy is a measure of the uncertainty associated with a random variable.

wikipedia

AviD

yes, thats kinda what I said ;)

M'vy

My speed is decreasing yes :P

Scott Pack

I think I'm coming around to Avi's notion

AviD

14:23

now, the random has 14 q's, I think about 4-5 should be entropy, a couple entropy AND random, the rest just random....

Scott Pack

While the two are intrinsically linked, they are not the same thing.

AviD

any entropy-takers, wanna have a look? @ThomasPornin @nealmcb @RoryAlsop

@ScottPack thats what I'm saying...

and, dya thnk I categorized the tags correctly?

Scott Pack

@AviD I was restating so that it was immeasurably more approachable.

And as such, while my statement was sufficiently random, it is not entropic

AviD

:)

hmm, seems @nealmcb agrees with this....

We generate "random" numbers, but we don't generate "entropy", we measure it, e.g. when looking at passwords. – nealmcb Jan 16 at 6:47

in a comment on one of the tagged qs

or rather, it seems it just took a while for me to come around to what he said back then :$

so, yeah? get rid of that synonym?

Scott Pack

AviD

14:39

@ScottPack done!

now, for retagging....

Scott Pack

Wait, did you remove the tag, or revert it back to it's own tag?

AviD

I removed the synonym.

i.e. entropy can be applied as a tag.

e.g. this

80

Q: XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD from August 10, 2011? XKCD 936: Password Strength I've always been an advocate of long rather than complex passwords, but most security people are against me on that one. (at least that I've talked to) However, XKCD's analysis seems spot on to me. Am I missing someth...

passwords entropy

M'vy

Oh they are talking about the chocolate/garlic thing in the podcast :P

Scott Pack

Is there ever anything interesting in those things?

AviD

@ScottPack chocolate/garlic

@Mvy thats where I read about it...

M'vy

14:47

ok ^^

AviD

hhm, I think I just coined another eponymous law...

M'vy

Hey hu?

AviD

AviD's Theory of Usability Dependancy: Security, at the expense of usability, comes at the expense of security.

Or did I hear this somewhere else?

M'vy

hm?

AviD

15:03

here's a random thought, since there is a twatterer bot for the site, does it make sense to have the site automatically post "interesting" questions to google+, too?

take into account I've never been on either (twitter or g+ )

Scott Pack

Be careful for making feature requests to SEI. You'll probably be banned

Iszi

@AviD It would, but from what I've heard it would seem Google wouldn't be too keen on that at this stage.

Right now, it only wants G+ accounts that are associated to actual people and they have to use real names.

Scott Pack

@Iszi They opened it up to businesses a few weeks ago

AviD

@Iszi ah, right, Id heard that.

Iszi

@ScottPack Oh? Wonder when they'll open it up to Apps users?

Holy crap, it is!

...or not.

Looks like they've just made the page saying its not available, prettier.

Scott Pack

15:06

Give it a few years

Iszi

@ScottPack Seeing as I only just recently signed up for Twitter, I don't think I'll be too hurt by doing that. Still, it's damn annoying that they still haven't made this service available to what is probably their most dedicated user base.

Scott Pack

@Iszi That's typical, though

AviD

right, you're already dedicated, they dont need to sell to you.

well, boys.... Topic #2 - its bbq time!

M'vy

XD

AviD

mind you, its not just a couple o' guys slapping some burgers on the grill... fancy 5-star chef's bbq

M'vy

15:17

6.5k view on XKCD :!

AviD

bloody hell

Iszi

@AviD Crap. Now you've given me a craving that I've no chance of resolving in the near future.

AviD

hehe

you have no idea

Iszi

Seems like a great day for Sonny's, but I'm kinda bound to stick nearby my current task.

AviD

its an awesome spread, all-you-can-eat, of course...

Iszi

15:18

@AviD - Shut up and go enjoy your lunch. :-P

AviD

dinner!

Iszi

Whatever.

AviD

no drinking, though - I have to drive back home

Iszi

Only makes me more jealous, because that means you're off work for the day.

AviD

keep an eye on that xkcd question for me, willya?

@Iszi ha! you forget, I work west coast hours.

Iszi

15:20

@AviD Oh, right. Well the west coast has barely gotten into work, let alone thought about the second/third meal of the day. What are you doing on break already?

Scott Pack

I wonder what I have at home. Unlikely to be bbq

Iszi

Well, I'm disconnecting to start another shot at this scan. L8rz!

Scott Pack

good luck

AviD

@ScottPack with the bbq? nah, dont need luck... :P

Thomas Pornin

The XKCD question is spawning offspring:

1

Q: What password cracking software is commonly used?

I am curious to know how secure my passwords are. What password cracking software is commonly used? Preferably open source.

passwords attacks

Scott Pack

15:26

@AviD So when you say bbq, do you mean smoked pork/brisket with some kind of sauce? Or do you generically mean grilled food?

Thomas Pornin

Is there a simple way to search for questions with a specific tag and to which I have not responded ?

M'vy

Yes: this set is empty XD

Seriously I don't think you can do such a search

Thomas Pornin

There are 249 cryptography questions and only 113 of them have been Blessed by my Wisdom. I feel a responsibility towards the 136 others.

4

M'vy

I tried to do something related in the past :

2

Q: Question I am involved in

I was wondering if there is (or is planned) a feature to know when I already posted a comment and/or answer on a question. I mean, I often browse tagged questions and I do not always remember if I gave an answer to a particular question. I think it would be appreciated to have let's say an icon...

feature-request stackexchange user-interface browsing

Maybe I should rewrite the question as a question

may get me more review

Seems the "get straight to the point"-titles are not triggering people

Scott Pack

Bring up unicorns

M'vy

15:33

@ScottPack YEAH!

Jeff Ferland

16:47

XKCD has a 182 score on the stackexchange drop-down

I don't think I've seen anything hit 200

M'vy

It was 207 some hours ago I think

Iszi

17:37

175 now

What generates that score? Some super-secret-sauce?

this.josh

17:54

@Mvy If you need attention use the word password in the title and include a cartoon.

@Iszi I would imagine that a Stack Exchange founder with a very high level of exposure and connectivity has a lot to do with it.

Jeff Ferland

18:21

Check out the up-down votes on this question's answers:

8

Q: How to check each row against another to find possible mySQL row name posssible similarities?

I am having an autosuggest script that suggests products name that are found inside my mySQL DB. The product_name field is indexed, FULLTEXT and the products are from multiple shops entries. Suppose I have those two names below that are the same product but slightly different name because of the...

php mysql

@ThomasPornin only 113 have been Blessed by your Wisdom? Can we force-change his name to Saint Thomas?

Thomas Pornin

@JeffFerland The Vatican can -- but they do so only a few decades after the death of the subject, so I am not too keen on the prospect.

Jeff Ferland

Every answer has a 0 score... because they've all been voted down as mucha s they ahve been up.

Thomas Pornin

Technically a "saint" is someone whose soul is guaranteed to have made it to Heaven (as is demonstrated by miracles: if a saint can grant miraculous healing then this implies that he has God's ear, which cannot logically happen if he is not in Heaven). In particular, a saint is necessarily dead.

Jeff Ferland

Ahhhh the literalism!

this.josh

Old age, it beats the alternative

Thomas Pornin

18:31

However, the "prophet" career path is not incompatible with being alive.

Vineet Reynolds

Ahoy there landlubbers. Anybody here?

Thomas Pornin

@VineetReynolds I am.

Vineet Reynolds

err, any topic to discuss?

this.josh

I am not here.

Scott Pack

18:57

Nor am I.

Iszi

<-- is absent.

Vineet Reynolds

Its quite slow today.

Scott Pack

I don't suppose there exists a programmatic way to convert a network block in cidr notation into a pcre, eh?

Iszi

@ScottPack 1. It's CIDR, not cider. 2. PCRE?

Vineet Reynolds

PCRE=Perl compatible regex

Scott Pack

19:04

Perl Compatible Regular Expression

Iszi

Oh. I remember putting together a regex to accurately search for IP addresses is a bit of a pain in the arse.

Scott Pack

Well, for base network stuff there is a module.

I just have particular network blocks that I need to convert over.

Guess it's the old fashion way

Vineet Reynolds

19:34

0

Q: How can I protect my computer from my potentially malevelous colleagues?

new guy here, hope this is on-topic. So, I work in this small company (10 people) where we do stuff in programming, modelling and web site management. I started recently working there (2 months) right after I graduated. My work is not exactly programming related, but I have enough knowledge to d...

network

How does one answer that? Bordering on paranoia.

Iszi

@VineetReynolds My answer: Physical access PWNS. End of story.

Vineet Reynolds

Yeah, I wish I could put it bluntly that while he's out for lunch, someone could just copy his HDD over.

Iszi

@VineetReynolds Whole disk encryption may defeat that initially. But if Mallory can sneak in a hardware-based keylogger, that's compromised as well.

I think I have an answer to another question that has some relevance here...

Oh, make that a couple answers.

11

A: How can I prevent someone from accessing a Windows XP system via boot disk?

The real issue here is that the attacker only needs physical access to your hard drive in order to read or manipulate the files which contain your password hashes. There is already a thread on SuperUser which has some recommendations, which I will likely repeat here. http://superuser.com/q/2220...

Vineet Reynolds

Trucrypt?

Iszi

11

A: I'm leaving my job and want to erase as many personal details etc. as possible; any tips?

The proper answer for this question is very situational, and dependent upon the policies and procedures in place at your company. Many companies have in place methods of backing up portions of the drive meant for user data, or even the entire drive, across the corporate network. If they've perf...

@VineetReynolds Again, hardware keylogger = PWNED. The only thing TrueCrypt might be able to do to get around that, is to use a key file stored on a thumb drive that he always keeps with him.

Vineet Reynolds

19:46

I just changed all my passwords once I reached home. Most of them have 120-150 bits of entropy. Much simpler.

Iszi

But, now we're talking to major system modifications on company hardware.

Vineet Reynolds

Umm, my previous statement was wrt to your answer on leaving the job.

Iszi

@VineetReynolds Sorry, which? Truecrypt or passwords?

Vineet Reynolds

Yeah, going back to the original question, he'll need a portable disk that is on his body.

Iszi

@VineetReynolds And that's where we get into major modifications to corporate-owned computer systems, or storage of company data on personal hardware... both generally big no-nos.

Vineet Reynolds

19:47

I was referring to this -"I just changed all my passwords once I reached home. Most of them have 120-150 bits of entropy. Much simpler." After I quit, I changed all my passwords on reaching home.

Yes, modifications would be a touchy subject. Sounds like they dont have an IT dept.

Iszi

@VineetReynolds Oh, that's great for your cloud-based accounts. But, anything that is (or ever has been) stored in cache or other parts of the company's hard drive are easily viewable by them.

Vineet Reynolds

I didn't have any personal stuff on company property. Made it much easier.

Iszi

@VineetReynolds Ever access any personal webmail or social networking accounts from there?

Vineet Reynolds

Yes, only through HTTPS, with one particular FF plugin to warn me of cert changes.

I forget the name of that plugin

Iszi

@VineetReynolds That's great to protect the data in transit. But your browser cache still belongs to the company.

Your browser may or may not be keeping those pages in cache, depending on design and configuration.

Vineet Reynolds

19:51

I browse from a VM. Makes it more tough.

And the account was not on AD

Iszi

@VineetReynolds Only slightly

@VineetReynolds Account?

Doesn't matter where the account is. If the hard drive is company-owned, its contents are theirs.

Vineet Reynolds

The OS account on the VM.

Iszi

@VineetReynolds That's just as useful from a data security standpoint as an OS account on a real machine, where Mallory has physical access: It's not.

Vineet Reynolds

I know, it's just that you can reduce the exposure greatly, unless they are get the copies of VMs.

Iszi

@VineetReynolds Is the VHD on company hardware?

Vineet Reynolds

19:55

Yes, but little or no opportunity for copying it.

Iszi

@VineetReynolds They don't do backups of that system?

Vineet Reynolds

No, backups were done only for Appdata or the equivalent on WindowsXP.

Sorry, I meant only for the roaming profiles.

My knowledge in ITsec is waning.

Hey Iszi, do you know of any appsec projects that need volunteers?

Iszi

@VineetReynolds No, but I think @AviD might be a better person to ask.

Vineet Reynolds

Ok, thanks.

I was about to start one on protocol fuzzing, but I figured I'd rather see how existing projects work.

Vineet Reynolds

20:12

@Iszi, D.W.'s answer to that question looks like everything out of our discussion.

Jeff Ferland

21:06

I decided it would be fun to pile on and add more links to the XKCD question

Thomas Pornin

@JeffFerland Are you going after the publicist badge ?

Jeff Ferland

@ThomasPornin So far I've only gotten announcer. Then again, I'm really shocked that 25 people followed a link I put on Twitter. That's news to me.

Gilles

@ThomasPornin I think this query is what you want (warning, not tested much)

Jeff Ferland

Then again, I could always grab 1k Amazon instances in sequence and use them to visit the URL....

Gilles

It returns 122 questions, either my query is off or there 14 cryptography questions since the data dump that you haven't blessed

Thomas Pornin

21:12

@Gilles I might have been slacking

Thanks for the query ! I wasn't aware that anybody could compose queries and run them on their servers.

Gilles

@ThomasPornin It's an SE-run server

There's a public access to a read-only copy of the database (not everything, e.g. you don't get to know who voted for what)

Thomas Pornin

I suppose that they have some failsafe mechanisms to avoid people using their server as free CPU time.

Gilles

Also, I've answered M'vy's question

@ThomasPornin They do. They're mentioned somewhere on Meta Stack Overflow.

That thing is called the Data Explorer

Thomas Pornin

"the data is bimonthly archival"

so the most recent crypto questions are missing, which may explain the 122 != 136

Ninefingers

@roryalsop @grahamlee qotw 6 is in draft. I'll read over what I've written tomorrow but feel free to comment on it. any other bloggers, feel free to chip in.

Gilles

21:59

1

Q: iPhone type login screen?

The person that introduced me to Fedora had somehow made his login screen so that instead of typing in a password he used the "connect the dots" password that's popular on phones. Eg On my touchscreen/stylus laptop, I'm interested in doing this as well. However I can't seem to find the plugin ...

fedora login authentication

Transcript for