The DMZ

tylerl

00:19

Working for this company is mildly surreal.

Terry Chia

@tylerl I feel like you have been saying this once a week. :P

tylerl

I post to an internal mailing list about some work being done that is EXT4-specific mentioning that Theo Ts'o (the EXT4 maintainer) said that EXT4 is a stop-gap and btrfs is where things are going, so I ask if what they're doing is portable.

And Theo Ts'o responds to me clarifying his position on ext4.

oh hai, didn't know you worked here.

Terry Chia

@tylerl Hahaha, I knew that. :)

I don't think Google has a large amount of kernel devs?

tylerl

I'd been warned about this sort of thing, of course. One of the older developers mentioned that an intern complained publicly on an internal dev mailing list about how one of the core C APIs was poorly designed.

Terry Chia

@tylerl Oooh that must be fun.

tylerl

00:26

And Rob Pike responds to him saying that back in the 70s when he designed it, the current usage case wasn't what he had in mind.

tylerl

00:43

FWIW: ext4: Not going away any time soon.

Terry Chia

@tylerl Well... yeah. RHEL 6 is supported for another 10 years. :P

tylerl

02:48

@TerryChia i mean, new development, not just "support"

Terry Chia

@tylerl Ahh. Not really surprising. ext4 is a solid choice for typical use cases.

Any vim users in here?

David Freitag

I recently switch to nano because I got fed up with vim.

Terry Chia

@DavidFreitag Pfft. nano is annoying.

David Freitag

@TerryChia Yeah but it's simple and that's all I need when editing conf files over ssh.

Terry Chia

@DavidFreitag Well yeah, I'm using it for development.

Switching from Sublime to vim for the time being.

David Freitag

03:01

@TerryChia Uhh... hm... There must be a really simple explanation for why you suddenly lost all of your sanity

Terry Chia

@DavidFreitag It's actually really nice.

Just wanted some opinions from experienced vim users on some plugins.

Stack Exchange

04:07

A long time in the future, in a galaxy far, far, away, astronomers in the year 2008 sight an unusual gamma-ray burst originating from somewhere far across the universe.

Terry Chia

@StackExchange Looks like Randall had inspiration from collegehumor for this one. :)

►

David Freitag

04:50

@TerryChia Or perhaps great minds think alike?

Terry Chia

05:37

@DavidFreitag I wouldn't exactly consider collegehumor writers "great minds". ;)

David Freitag

@TerryChia I wouldn't know

Kisunminttu

05:49

Morning everyone!

David Freitag

06:00

@Kisunminttu I'm so not a morning person

Kisunminttu

@DavidFreitag I can relate to that a lot. A certain someone can confirm this information.

David Freitag

06:41

lolol. I just saw this message on my tv: "Low batteries detected in remote, replace them soon"

Terry Chia

@DavidFreitag A remote. How quaint. ;)

David Freitag

@TerryChia Yeah I haven't prototyped my telepathic CEC extension yet :b

Before I got it, I used a Logitech revue which had a massive keyboard for a remote.

Lighty

09:44

my boss has a meeting with this guy, about some app, and that guy came to me " youre the intern here?" i reply with a yes ofcourse, and he handed me a google glasses dev model

that is one cool toy

deed02392

11:04

nice @Lighty

Rory Alsop

@TerryChia - couple of flags suggesting things have moved on a bit with this one. Any chance of updating your answer:

32

A: Is Telegram secure?

I'd like to ignore the comparison to WhatsApp because WhatsApp does not advertise itself as a "secure" messaging option. I'd like to instead focus on whether Telegram is secure. Telegram's security is built around their home spun MTProto protocol. We all know that the first rule of Cryptography ...

Lighty

11:17

hehehehehe

Rory Alsop

hehehehehehehe

Good to see others are as childish as me

Lighty

Kisunminttu

@Lighty I c wut u did thar and also give you my hehehe

Lighty

sometimes, being "childish" just means trying not to bore yourself to death by enjoying the little things :3

or just grinning at innapropiate jokes

my teacher sked me a question: "how can you prove an encryption algorithm isn't secure/is broken?", appearantly, the awnsers "wikipedia, and alot of other sites give scripts to decrypt them without a pass in 20 languages" and "OWASPS and hundred other sites state so" isn't valid

what am i missing here? o.o

Rory Alsop

11:36

it is a daft question - ask your teacher to prove an encryption algorithm is secure :-)

Lighty

@RoryAlsop very nice, but he asks for an awnser, not a counter question... i'm still gonna try that one though

he gave me a lsit of questions over the mail, just to check on what i learned by myself past weeks

Arperum

@Iszi someone is making a javascript preprocessor that only uses emojis. So you can "code" in emojis.

github.com/EmoJS

Lighty

@Arperum i doubt that name unpacks well

Arperum

@Lighty Hey, I have nothing to do with that thing, it's all RedRiderX over on The Bridge doing the crazy.

Rory Alsop

@Arperum It's always the Bridge :-)

Arperum

11:51

@RoryAlsop It most certainly is. That's where the crazies gather.

Terry Chia

@RoryAlsop I still stand by the conclusion of my answer. The exact details may have changed somewhat but that does not change my (very low) opinion of Telegram.

@Arperum I'm picturing emojis in node.js code now...

Rory Alsop

@TerryChia Do any of the Telegram devs responses change some of your answer? It appears they could a wee bit. The conclusion may still be just the same, but worth updating if their info is relevant

Lighty

Arperum

@TerryChia You're doing it wrong, you should see node.js code in emojis, no normal text left.

Lighty

y u so big, stoopid picz

Rory Alsop

11:55

@Lighty TWSS

Terry Chia

@RoryAlsop I have not kept up with it much so I can't say for sure. I'll see if I can update it a little this weekends if I have the time and I remember to do so.

raz

Good morning

Kisunminttu

@raz Mornin'

Lighty

@raz 'Murnin

Arperum

12:12

Lighty

hehehe

i know what kind of emoji's im going to hide in my code, if they're gonna be natively supported by everything

Terry Chia

@Arperum I'm sad now.

@ThomasPornin Hey Thomas, I have a question for you. I assume the answer is "no" but I thought it's worth confirming anyway. Does there exist a cryptographic protocol that allows one to verify that some code running on a remote server matches a snapshot (a git commit?) of a codebase? The protocol doesn't have to be practical to implement.

Lighty

great, thanks @Arperum, now my PHP code is literal and methaforical shit :D

Arperum

12:42

@TerryChia I just used a screenshot from the original dev, I didn't and won't make it myself.

Seemeingly Win 7 and Emojis are not best friends.

Thomas Pornin

@TerryChia Run the expected code in a VM. Once it has executed the "version verifying protocol", swap it with something else.

This shows that what you ask for cannot exist, at least not in this form.

What you could do is to use homomorphic encryption so that machine A runs code from machine B without actually knowing what it is running, and this should prevent silent modification.

(However, it is very impractical)

In any case, even if you can verify from the outside that machine A truthfully executes some piece of code, you cannot check that it does not feature an extra CPU that runs something else at the same time.

Terry Chia

@ThomasPornin So, no. Cheers. :)

@Arperum I can't wait till SV startups start looking for people with with 5 years of experience with EmoJS.

raz

13:02

Sad sad day in history

Arperum

@TerryChia That is impossible to meet the first five years. I expect this requirement to pop up in a couple months if this catches on.

deed02392

hey @ManishEarth, you about?

Lighty

crap, new assignment from school

"here's some crappy JScript code, go format and comment it"

everything is minimized (one line), and no comments or logickz

Rory Alsop

13:22

@Lighty ooh fun

(not)

Lighty

no, but i used the JS beautifier site

which clears the problem of minimiation

Terry Chia

@deed02392 Hmm, haven't seen him in a while.

deed02392

ah fair enough @TerryChia

I was just gonna pick his brains on autocomplete=off on FF

Terry Chia

@deed02392 I thought they disabled that?

deed02392

13:41

yeah I wanted to discuss it conversationally though

Terry Chia

> That's because drinking, say, a white wine with steak is the culinary equivalent of attempting to enjoy fine art after having your pupils dilated at the eye doctor. And if you happen to prefer sweet wines? Well, in that case you may as well just go back to drinking mead in between bouts of crushing your enemies and hearing the lamentations of their women with the rest of the barbarians.

Cracked writers, eloquent as always.

Thomas Pornin

14:07

@TerryChia Though the writer indirectly quotes a line from the movie "Conan the barbarian", that line has a much older history; it is first found in the Secret History of Mongols from mid-13th century, and is attributed to none other than Genghis Khan.

The derogatory term "barbarians" is thus inappropriate.

Terry Chia

@ThomasPornin What exactly don't you know?

Thomas Pornin

@TerryChia I don't know.

4

Terry Chia

@ThomasPornin Hahaha!

Terry Chia

14:20

avremu: An AVR Emulator written in pure LaTeX

This is scary.

Arperum

in The Bridge, 1 min ago, by RedRiderX

Quotes are now supported!

raz

@Arperum yay, I love quotes

@TerryChia Wait what now?

CodesInChaos

14:48

@TerryChia Given the state of modern art, dilated pupils are a necessary for enjoyment ;)

@TerryChia Only if you trust a TPM with preloaded keys to do some kind of remote attestation. I think the latest variant is Intel Software Guard Extensions (SGX).

deed02392

anyone here know much about PHP core?

wanna know if there are any security mechanisms in PHP that are bypassed in a PHP extension versus the same thing being implemented in pure PHP?

AviD

15:16

@deed02392 "...are any security mechanisms in PHP" -> NO.

@RоryMcCune when you happen to be around, I want to pick your rubybrain. Any experience with ruby app servers? And what is the relationship between those and Rails?

Terry Chia

@AviD If it's anything like Python, the app servers handles things like concurrent requests.

AviD

umm... thanks?

no no, I want to delve into the pipeline internals.

Terry Chia

@AviD The relationship is pretty similar to something like Spring and Apache Tomcat to use an analogy from Java land.

AviD

that's.... actually helpful.

thanks, despite me being surprised.

Still, I do need to go deeper, with some specifics on the internals mechanics.

Terry Chia

@AviD That's definitely @RоryMcCune territory. :)

AviD

15:28

figured :-)

thanks anyway.

ManishEarth

15:50

@deed02392 Now yes

What's up?

Terry Chia

@ManishEarth His Firefox broke and he wants you to fix it.

ManishEarth

-_-

AviD

@TerryChia no chance, they've been trying to fix it for years.

Terry Chia

@ManishEarth :)

@AviD Maybe they should just reskin Chrome like Opera is doing. ;)

AviD

@TerryChia are they?

Like Netscape did for a while?

Terry Chia

15:54

@AviD Opera gave up on their own engine and switch to Blink.

AviD

Well, they had alternate skins, either for firefox or IE.

Terry Chia

@Ninefingers Wooo, a rare guest.

raz

@TerryChia twss

Terry Chia

@raz That's terrible.

raz

You get what you pay for

Ninefingers

16:02

@TerryChia Indeed, haven't been in here in a while

Terry Chia

@Ninefingers How are you doing?

Ninefingers

@ThomasPornin mind if I ping you a quick question via email? Well it might not be quick actually... but hey. And yes, I'm asking before I ask. I know. I just feel rude if I don't.

@TerryChia Pretty good thanks.

I'm feeling a bit left out though, I haven't had a single bash-script-user-agent in my server logs :(

Terry Chia

@Ninefingers I can soon fix that. ;)

Ninefingers

@TerryChia It won't do anything. But that doesn't stop me feeling left out!

AviD

16:19

@Ninefingers wat. hello!

Rory Alsop

@Ninefingers Afternoon stranger!

Terry Chia

@RoryAlsop @Ninefingers Don't be offended. @RoryAlsop is old and his memory is failing him.

Rory Alsop

@TerryChia eh? who said that?

AviD

@RoryAlsop WAT? WHO IS FRED WATTS?

SPEAK UP, SPEAK UP

Ninefingers

17:18

@RoryAlsop Hello. It has been a while. Cue joke about time moving slowly for ents... ;)

@AviD There is a fabulous fawlty towers episode with a deliberately difficult deaf lady who demands "I want to speak to Watt!"

@TerryChia Don't worry, I'm not. It has indeed been a while.

Lucas Kauffman

17:49

gents

Lucas Kauffman

18:08

got to love out of business hours testing

raz

What's the appropriate action for question like this: security.stackexchange.com/questions/70596/…

Xander

18:41

@raz Questions that ask for book/article/training material recommendations almost always get closed as "product recommendation" questions. Do a quick site search for posts containing "books" and you should see what I mean.

raz

@Xander Cool, thanks

Thomas Pornin

@Ninefingers You might be the only person on Earth who feels the need for prior permission to send me an email.

For instance, this just arrived:

> I want to study an article that has been presented by MARTIN E.HELLMAN and it's name is "A Cryptanalytic Time-Memory trade-off". But my knowledge about cryptography is not enough because I started studying cryptography some days ago and I don't understand the concept of that article. Please introduce me to some good books or articles that can help me understand it well. I have at most three week to understand it. I appreciate your help.

I get that kind of email about twice per week.

Xander

@ThomasPornin Ha ha ha...That also got posted as a question here. @raz just linked to it.

Thomas Pornin

@Ninefingers I guess a question from you would be refreshing.

raz

@ThomasPornin If I got those kinds of emails... man I'd have to setup a spam email account.

Ninefingers

18:49

@ThomasPornin Probably, but it just feels impolite to do anything else. After all, the world is always trying to barge into everyone's inbox.

Right, gimme 20 mins to work out how to ask.

That's not "how to frame a question", that's how to put the information down concisely.

@ThomasPornin Wow

I don't feel quite so bad now

@ThomasPornin So about the same frequency as linkedin delivers you pointless articles stating lists of the obvious and recruiters offer you wildly inappropriate jobs? "Hey Thomas, are you a PHP ninja?"

raz

0

Q: Can I get Past information what I typed in my computer or laptop with my keyboard

I forget my Id's password and I recovered it and cheange it before one month but I forget . Is there any way to get the information about your PC or Laptop key board typing information stored.

password-management

:facepalm:

Thomas Pornin

@Xander Yeah, it appears that when people post stupid questions in security.SE or crypto.SE, they sometimes duplicate it into an email for me.

Ninefingers

@ThomasPornin That's depressing.

Thomas Pornin

@Ninefingers There is a positive sign: it means that these people actually know enough of Google to find my email address (not the hardest task ever, of course).

Ninefingers

@ThomasPornin How does it work though that they can manage that, but not find the solution to their question (or at least resources to help them)?

Thomas Pornin

19:00

@Ninefingers Because of their attention span.

An email address is short enough for them to read it and still remember afterwards why they wanted it.

Simon

It's true, I always remember.

raz

I'm glad I'm not smart enough where people look up my email to email me questions.

Ninefingers

@raz I don't consider myself that smart, but people have emailed me questions from my posts on Stack Overflow (when I had an email on my profile).

raz

19:20

@Ninefingers Yeah, see I would never consider emailing a user. Unless the only post I could find related to my problem was unresolved.

Ninefingers

19:31

@raz As you can see, I tend to ask first if I want to, even when I've emailed said user before.

raz

@Ninefingers Oh yeah I'm not criticizing you. I'm criticizing users who most likely email questions to answers that have already been answered.

Gilles

3

Q: Can the USB standard be altered to prevent the "firmware attack"?

Wired, and others are reporting on a research paper by Karsten Nohl and Jakob Lell. The paper apparently shows how any USB device (not just memory sticks) can be infected with malware at the firmware level. This can then be used to attack any device the USB device is attached to. As the malware r...

malware usb

5

Q: BadUSB exploit - can it be prevented?

Over the past weeks I have become a fan of this stackexchange and started to get interested in computer security. First of all a big thank-you to all of you guys, I learned a lot from reading tons of well written and long answers! Now my question: Recently I read a few things about the BadUSB ex...

exploit usb-drive firmware usb

which one do you think has the better answers?

not that I'm enthused by any of the answers on either question wink wink nudge nudge

Xander

@Gilles The second is a better question, in that it doesn't dictate that the solution be via the USB specification.

raz

@Gilles I'd probably go with the 2nd one, they have more complete answers based on fact. The first one just has an opinionated answer.

Also what @Xander said

Did SE just go down?

Gilles

SE IS DOWN!

Braiam

19:39

PANIC!

raz

runs around screaming

Braiam

pweh we are back... or not

raz

@Braiam phew... now we're back

Not sure I could have handled that

Rоry McCune

@LucasKauffman well if you get overtime you do!

Ninefingers

@raz Yeah I know. I meant me more as an example of - I feel bad enough wanting to email users that I have to ask first!

@raz It's a conspiracy. Gotta be.

raz

19:50

@Ninefingers Are we loose ends!?

Ninefingers

@raz Yes, but the script says we walk blindly into the obvious trap anyway, in spite of the scary sounding music.

raz

@Ninefingers We should definitely go hide behind all those chainsaws, and ignore the fully fueled running vehicle.

Ninefingers

@raz Sounds legit to me. Hold on, need to make a phone call on this line I know is probably going to pinpoint my exact location to the all powerful agents-in-the-highest-level-of-government conspirators.

raz

@Ninefingers Cool, we'll all meet up at the Winchester and wait for this whole thing to blow over.

Ninefingers

@raz Can I invite my mates? They've been infected with some highly contagious disease that turns them into human killing zombies. They're the life and soul of the party, really. Never a dull moment with these guys.

raz

20:00

@Ninefingers Ok, but if they get out of hand bop them on the head that seems to work.

Lucas Kauffman

@RоryMcCune it's a perimeter scan, just nmapping nothing else

raz

You know it's really annoying to have a rep that ends in 9

Rоry McCune

@LucasKauffman sure but if yer working out of hours I'd hope you're getting overtime :)

always takes the sting out of late night work :)

Lucas Kauffman

@RоryMcCune I dont have to work during the day just during the night

and by working it means running the scans sequentially and doing whatever I like doing while they run :p

Rоry McCune

@LucasKauffman ahh see some companies will pay 1.5 times for night work and 2x for weekend..

@LucasKauffman but I know what you mean if it's just scanning it's not too onerous..

Lucas Kauffman

20:09

@RоryMcCune no it's like webapp

it's just scanning on one screen

and me doing some scala on the other

or watching a movie

planned to watch all the austin powers again

Xander

@RоryMcCune That sounds lovely. If I do enough night and weekend work, I'm occasionally entitled to a pat on the back. :-)

Rоry McCune

@Xander youch, one of the upsides of all work being chargeable, if you're charging the client 1.5x it ain't hard to pay 1.5x to the consultant :)

Xander

@RоryMcCune LOL. Yep, though even when I've been chargeable, it would only effect my bonus...Nothing like real overtime. Oh well though. One of the benefits is that that the jobs have been structured so that overtime requirements are relatively rare, and I personally prefer that to overtime with extra pay.

Rоry McCune

@Xander indeed forced overtime is no fun. In our lot it's completely optional (requirements come in and people are asked if they want to take 'em on) so probably best of both worlds, work extra hard if you want the cash, or (as in my case) prefer the free time and don't volunteer..

Xander

@RоryMcCune That's a nice system.

Rоry McCune

20:19

@Xander yeah I think it's a benefit of the style of work , lots of smaller pieces, and a relatively large pool of consultants

Ninefingers

@RоryMcCune Wait, you're not independent any more?

I have missed a bit, clearly!

Rоry McCune

@Ninefingers yeah I'm with NCC now. we moved out to rural argyll, so figured it was a bit risky both being freelance. so the missus is keeping the freelance stuff on and I'm working for one of the bigger co's :)

Ninefingers

@RоryMcCune Ah fair enough, yeah I know who NCC are, used to walk past their head office in Manchester quite a bit :)

Rоry McCune

@Ninefingers bit of a different experience.. we have 150 consultants in the UK + quite a few in the US and Denmark

Ninefingers

@RоryMcCune yeah, they own a few subsidiaries too, iSec, Matasano, plus they have an escrow side

Actually, thinking about it, I had a telephone interview with them. Got no further than that though.

David Freitag

23:02

So earlier today I found out that if I wait one more semester I can graduate with a double major

Transcript for