The DMZ

Rory Alsop

14:04

@TerryChia Any more than half a rack is overkill for most folks at home anyway

Adnan

Is this loading for you? jsfiddle.net/gh/get/jquery/1.7.2/highslide-software/…

Terry Chia

@Adnan Nope. HTTP 500.

Adnan

@TerryChia Thanks

Terry Chia

@RoryAlsop Any rack is overkill for most folks at home.

Adnan

oh, damn and blast it all

Rory Alsop

14:06

FTFY @Adnan :-)

Adnan

What the shizzle is wrong with JSFiddle today?

I need that example

Rory Alsop

@Adnan Made that one rhyme and all

:-)

Adnan

@RoryAlsop Jesus, Rory! :D

Rory Alsop

@Adnan Drink!

and my work here is done :-)

Adnan

@RoryAlsop bbye

I'll play ShellShock Live while JSFiddle goes back to normal

Rory Alsop

14:09

@Adnan heh - oh, I'm not going anywhere for a bit. It was just my work that is done :-)

Xander

14:20

So, I know scary breach announcements can be a big marketing bonanza for security firms, but Hold Security seems to be getting it wrong, just a bit.

forbes.com/sites/kashmirhill/2014/08/05/…

I saw the service they speak of explained on the site, and apparently after you sign up you have to send them an "encrypted" version of your passwords (which they let you know they can't crack!) and they'll compare them to whatever it is that they have in their database to determine if you've been p0wned.

No thanks.

Rory Alsop

wow - epic fail

Simon

So, you're supposed to send them a sql dump of your users' passwords?

Xander

Ah ha! They've changed it. They no longer require an "encrypted" password, but: We have developed a secure methodology for you to share with us a very strong (SHA512) cryptographic representation of your passwords for verification.

@Simon Yes, apparently. Along with $120.

Simon

So, it means that they somehow managed to get the attackers' database?

Or was there a leak that I'm not aware of?

Rory Alsop

@Simon which is clever of them

some might find that suspicious

Simon

14:26

@RoryAlsop Very.

Terry Chia

@RоryMcCune Huh, didn't realize that malware you linked was open source.

Simon

It could also be a great way for them to build their own database if enough people trust them.

I need an idea for an app to code in django.

I'm almost done with the login, it's all embedded anyway.

Xander

14:42

@Simon Make a Facebook clone.

Simon

@Xander It would actually be a very good exercise. I'm thinking of something smaller though, I wanna build some sort of portfolio.

AviD

@Xander And get sued by any twins that come along??

Simon

@AviD Lawl.

Xander

@Simon Ok, smaller project. A Twitter clone then.

Simon

@Xander I had to concentrate very hard to not laugh outloud.

I guess I could do that and call it Twitbook.

AviD

14:51

Or FaceTwit.

Isn't that what people call you now?

Xander

Oh, they do still say "encrypted passwords." It's just on another page.

Simon

@AviD No, they call me the Donutator.

2

Rory Alsop

@Simon Donut Eater

Simon

@RoryAlsop How did you read through my obfuscation?!?

Clearly my DOfcuscation v0.1 algorithm needs a fix.

CodesInChaos

15:10

@Xander Still harmless compared to the new Russian hack which exposed OVER 800 BILLION emails+hashes.

group of Russian hackers steals 800 billion emails+password hashes http://pastebin.com/Exsxz6cM #BreakingNews #DamnRussians

Tweeted by veorq on August 6, 2014 at 2:41 PM

Xander

@CodesInChaos Ha ha ha. I wonder if they'll offer to let you send them your passwords for $120 too? This market is heating up!

Rory Alsop

@CodesInChaos and we'll get panicked calls from users and customers. The media will have a field day

I like the answer @Thomas gave to one of these questions. It was along the lines of "Yes. You do need to change your password. The same as you need to every time"

Simon

How about we pretend that we stole an outrageous amount of passwords and try to make some money out of it too?

Xander

@RoryAlsop Oh yeah, I'd forgotten about that. That was a great answer.

Rory Alsop

@Simon For $560 I will check to see if I have your password

Xander

15:12

I think it was after the Adobe hack, perhaps.

Rory Alsop

that's US dollars

Simon

"Us, InfoSec.SE users, stole over 239784234823423743278462343287324234 passwords from various websites, essential websites, including Hello Kitty Online."

2

Rory Alsop

@Xander yeah - trying to find it

Xander

@RoryAlsop Yeah, none of that Canadian crap.

Rory Alsop

ebola more popular than Miley Cyrus and Justin Bieber combined: google.com/trends/…

Simon

15:13

@RoryAlsop Yes and our passwords are in clear text because we can decrypt any hash so you must send your password in plain text.

Make sure to say where you're using it too!

Rory Alsop

Hmmm - I need to answer some questions. I've been sitting at around 39.8k for a long time. 40k seems like a fun meaningless milestone

Xander

@Simon We could go the extra mile and have them encrypt them using v. strong salt-free MD5 which will make them unreadable by us or even the NSA.

Simon

@Xander Which was developed by Steve Jobs himself. It is also the reason of his death, the NSA didn't want this to be released so they killed him. However, we managed to get our hands on it.

Terry Chia

@RoryAlsop Just wait and get that passively.

kalina

So... iVibe is an actual thing that exists

Terry Chia

15:23

@kalina Does it have iCloud integration?

kalina

I don't know

Nor want to

FEichinger

@kalina ... And now we know what you're going to do for the next few hours ... or days.

kalina

I don't own an iPhone

Well I do

But I wouldn't ever touch it again

Simon

This is so damn creepy. @FEichinger is silent and as soon as @kalina says something, he talks. kalina-alarm.js?

FEichinger

@kalina ... Because you did things with it.

Come on, you're making this too easy for me.

kalina

15:26

I'm making what easy?

FEichinger

@Simon It was actually @Terry's message that pinged me.

Otherwise I wouldn't even have noticed anything.

kalina

I wouldn't use a multi function device for that

I have dedicated hardware

Rory Alsop

Hehehehe - check out the room description:

The Base Camp

Nothing running?

2

@kalina quite right too

@kalina and software.... (sorry)

Terry Chia

@kalina I don't think @FEichinger qualifies as hardware.

kalina

There is no software involved in my hardware solution

FEichinger

15:28

@TerryChia Last I recall, I was mostly software controlling the hardware.

Xander

Found it! // CC: @RoryAlsop

21

A: Should I change all my passwords due to heartbleed

No. You do not have to change all your passwords due to heartbleed. You have to change all your passwords because everybody seems to have become a huge herd of panicking sheep; changing your passwords will give you a warm feeling of doing something useful while you are running to your ultimate de...

Terry Chia

@FEichinger I don't think PHP qualifies as software either.

FEichinger

@TerryChia OH SHUDDUP.

kalina

@TerryChia you keep saying things like this but the truth is you all know exactly the same amount when it comes to this subject

Rory Alsop

@FEichinger TMI :-)

@Xander that was the one!

kalina

15:29

I was merely reading the register

not because I am geeky but for some other reason I haven't yet made up yet

Terry Chia

@Xander How did that only get 21 votes?

kalina

and there was an article about iVibe

and then a comments section which goes downhill slightly from there

Terry Chia

@kalina Did you push or did you pop?

2

Xander

@TerryChia It has five downvotes for not being patronizing enough.

kalina

@TerryChia I'm sorry I don't understand your geeky joke

Simon

15:31

nerdy*

FEichinger

@kalina And, as always, I'm the exception to your generalization.

Simon

Or even nurdy**

kalina

@Simon I'm sorry I can't be seen to be agreeing with you

Terry Chia

Someone should name a major exploit "panicking sheep".

kalina

@FEichinger I'm sorry you spelt generalisation with a z

in all honesty, the article was called iphone user shamegasm

and I saw the "-gasm" and got curious

3

FEichinger

15:32

@kalina Which is not an incorrect spelling.

Xander

@TerryChia Graham Cluley said something similar earlier today.

I can't take seriously infosec folks who say things like "Operation Poisoned Hurricane"... Get a sense of humour. Call it "Lumpy Trousers"

Tweeted by gcluley on August 6, 2014 at 2:42 PM

Not sheep specific of course.

But that we needed better names.

Simon

Lumpy Trousers is amazing.

3

Terry Chia

@Xander @Thomas can probably come up with a 100 awesome names.

kalina

I'm scared

Simon is talking about how he loves lumpy trousers

Adnan

@CodesInChaos Shit! They even posted a proof!

kalina

15:36

anyway

I

hungry

am

Simon

@Adnan Is it me or that's the most ridiculous proof I've ever seen?

kalina

stupid flood protection

Rory Alsop

@kalina you

Simon

Hungry for D?

Rory Alsop

yoda

aren't

FEichinger

15:37

@RoryAlsop Wouldn't yoda be more like "Hungry, I am"?

kalina

@Simon you're so immature

Simon

... ok?

You're such a donut.

kalina

right, wasn't even an insult

Simon

I hate developing in ASP.NET, I feel like a mini @AviD

AviD

@Simon ymean, like a real programmer?

> I WISH I WAS A REEEAAAAL BOY!

Rory Alsop

15:46

@FEichinger yes. But I wasn't paying attention

And @Simon got his D in the way

2

Simon

@AviD Oh yeah, adding runat="server" everywhere makes me feel like a pretty amazing kinda guy!

Xander

@Simon Why aren't you using MVC you little donuthead?

FEichinger

@RoryAlsop How can @Simon's D get in the way? It's practically non-existent.

AviD

@Simon umm.... that's not programming! #simon

Rory Alsop

fixed that for you Simon

kalina

15:47

@RoryAlsop I doubt Simon's "D" has enough mass to get in the way of anything.

FEichinger

@kalina inb4. Sorry.

kalina

you can't inb4 and also be sorry

FEichinger

No, but I can pretend to be sorry!

kalina

typical german

Rory Alsop

s/german/canadian

Simon

15:48

@Xander Meh, the project is not big enough to bother. I'd have to learn how ASP handles it and I'm not sure if it's worth it at this point.

@RoryAlsop Thanks, it's probably better that way.

FEichinger

@RoryAlsop No, no, a Canadian would actually be sorry.

AviD

@Xander no, that was on heartbleed.

Xander

@AviD Yes.

22 mins ago, by Xander

21

A: Should I change all my passwords due to heartbleed

No. You do not have to change all your passwords due to heartbleed. You have to change all your passwords because everybody seems to have become a huge herd of panicking sheep; changing your passwords will give you a warm feeling of doing something useful while you are running to your ultimate de...

Simon

@AviD Yes.

27 secs ago, by Xander

22 mins ago, by Xander

21

A: Should I change all my passwords due to heartbleed

No. You do not have to change all your passwords due to heartbleed. You have to change all your passwords because everybody seems to have become a huge herd of panicking sheep; changing your passwords will give you a warm feeling of doing something useful while you are running to your ultimate de...

AviD

yes, yes, sorry sorry. Transcript be delayed.

FEichinger

15:53

Delayed by 22 minutes?

AviD

its me, man

juggling too many windows

kalina

he says juggling too many windows

Simon

Why don't we replace every starting letter followed by a vowel by "D"?

kalina

he means "brain just start working again"

Xander

@AviD Better than juggling a bunch of linuxes.

Simon

15:54

Dimon sounds awesome.

AviD

okay, juggling too many machines.

Terry Chia

@AviD Netbooks, notebooks or servers?

kalina

@Simon and yet you fail to fulfil the requirements of your rule

AviD

only most of them VMs. one is a #ShinyMac.

FEichinger

... I'm too tired for this.

AviD

15:54

such a piece of clunky crap.

Terry Chia

@AviD Either way juggling computers are an expensive idea.

@AviD Send it my way. I'll even pay for shipping!

AviD

@TerryChia derp. not physically, duuuh

Journeyman Geek

lol

Simon

@kalina How?

kalina

@Simon surely it would be "Didon ddunds adedode"

AviD

15:55

@TerryChia no! its shiney!

Terry Chia

@AviD Hipster.

Simon

@kalina You're somewhat right except that I said "starting letter"

My sentence was fine.

Just like my D.

kalina

@Simon nope, it would still be "dimon dounds awesome"

stop talking about your D, it is insignificant and a waste of everybody else's time

3

the only time a man is allowed to talk about his D as much as you do is when it's 10 inches long and as thick as my arm.

Simon

@kalina Oh yeah, that sounds like good times. Or not.

AviD

@kalina why, is that rare?

kalina

15:58

@Simon oh no, it wouldn't be good times

but at least it would be something worth talking about, rather than the waste of breath that yours is

Terry Chia

@AviD What exactly are you implying? ;)

Simon

Look everybody, it's the daily @kalina rage!

kalina

@TerryChia do you really have to ask?

Simon

Hourly might be more appropriate though.

kalina

@Simon I'm not raging, would you like to see raging?

Simon

15:59

@kalina No, I have better things to do like mentioning stuff about my D.

Terry Chia

@kalina Well, no. :P

kalina

here is Simon spreading more misconceptions

something he does literally every time a thought crosses his mind

Simon

madmadmadmad

kalina

sigh

I'm not mad, I am wearing a smile

Terry Chia

@kalina The chat I'm looking at is pleasantly absent of stupid.

Simon

16:01

Simply because you're thinking about my D.

FEichinger

This is fun to watch, but, yeh, I'm going to take a nap. o/

AviD

@TerryChia oh? which room are you in?

Terry Chia

@AviD This one. With a filter in place to cut out 80% of the crap. :)

Simon

Yeah yeah, we know. A filter that ignores me; "ha ha ha".

AviD

@TerryChia ah, you have @Simon and @kalina on ignore. cool cool.

Terry Chia

16:15

@AviD Well, only one so far.

AviD

hahaha

#Simon

Terry Chia

If I block @kalina I'll be missing out on great iOS app recommendations.

AviD

ah okay, speaking of which - Mac calendar isnt showing me event contents. e.g. a link to google hangout. how do I get it to give me that?

Terry Chia

@AviD I have literally no idea. I don't use calendars in general.

@Scott can help you out there probably.

AviD

okaaaaay... is this one of your weird anti-populist beliefs?

Terry Chia

16:18

@AviD Nah, I'm just incredibly disorganized.

AviD

ah

Simon

How to get Terry mad:

Step 1: Tell him that he's gotta learn that sometimes he's wrong

Step 2: Sit back and relax.

Terry Chia

> After years of trying to force things in various languages and frameworks (like MVC ala Struts on top of WebForms), I've learned this simple thought: don't kick against the bricks; they don't care and you'll get hurt. If you're in Ruby, program idiomatic Ruby. If you're in Python, program idiomatic Python. If you're in PHP, get a new language.

5

news.ycombinator.com/item?id=8143122

/cc @FEichinger

CodesInChaos

17:10

If you use WebForms get a new framework. It's worse than php. At least php doesn't try to hide you're writing a web application.

Gilles

40

Q: What is your way to create good passwords that can actually be remembered?

What are the methodologies which can be used to generate "human" good quality password? They have to ensure a good strength and also easy to remember for a human being.

yeech

went through the list, cast 5 upvotes and 12 downvotes, and I was pretty generous

started flagging dupes but got tired of it

Xander

@Gilles Yeah, it's pretty awful.

Gilles

at least the top-voted answer is the best one @AviD

and with just a few more votes we can rank xkcd above bad and worse

c'mon guys!

CodesInChaos

17:26

I like that one:

> Klingon Folk Songs are even better.

Xander

@CodesInChaos I dread the thought of living an existence in which I believe that memorizing Klingon Folks Songs is a good or reasonable pastime.

CodesInChaos

Wow the documentation for Crypt:RandPasswd says "Instead, it uses perl's built-in rand() function, which in turn is (usually) built on the pseudo-random number generator functions of the underlying C library. "

Proudly documenting that your password generator uses one of the shittiest PRNGs in existence.

That tops even Microsoft's documentation for System.Random where they explain at length with an example that the default constructor uses a bad seed instead of simply fixing the seeding.

That question is a gold mine:

> I found KeepAss pretty useful.

3

David Freitag

19:13

►

I like those guys. I'm not really sure why either. It's oddly upbeat... but not at the same time.

In case you are weary about clicking, it's not my usual genre hence the missing cc to simon.

kalina

19:42

Awww @terry didn't have me on ignore and he thought the chat had any stupid in it

How adorkable

Why auto correct chose adorkable instead of adorable I don't know

Xander

19:55

@kalina You have to admit it kinda works.

David Freitag

21:23

Iszi

21:50

Anyone around here play nice with Windows Updates? Beating my head against the wall with this one.

0

Q: MS13-081 doesn't update Usbser.sys on Win7 Embedded

When deploying updates for MS13-081, on multiple systems running Windows 7 Embedded SP1 x64, Usbser.sys is not being updated as it should be according to the KB Article. An affected system reports the update as installed, and will not let me run the installer again without uninstalling first, bu...

windows-update windows-embedded-7

M'vy

not a clue

David Freitag

@Iszi Did you try turning it off and back on again?

Iszi

@DavidFreitag How about I turn you off?

David Freitag

@Iszi Bring it

Xander

@Iszi That sound like something that might be worth opening a support ticket with Microsoft to resolve.

Iszi

21:57

@Xander Conceivapossibly. Not my call though.

Unfortunately, I'm actually a bit of the middle-man on this one. I'm allowed to poke around the system when I want to look, but other people are the ones to actually do the work. And it would be rather unpleasant for me to suggest that I need to personally supervise them to make sure it's being done right. (A piece of me can't help but feeling that if I was the one to do it, we'd be done already.)

Xander

@Iszi Ugh. I know the feeling.

Iszi

What's really fun is when they say "Okay, I tried XYZ to fix the problem. Can you verify it's fixed?" after I've told them at least three times how they can check themselves.

In the end, my validation is the authoritative one. But at least they could look for themselves instead of wasting time passing it off to me every time.

David Freitag

22:57

Well, there goes $350 on books...

The Base Camp

Transcript for