The DMZ

Rоry McCune

09:05

@RoryAlsop not yet.. how do I do that again?

AviD

09:17

@Gilles @ArtOfCode are there any prizes? AviD loves prizes.

@ArtOfCode ooh ewww AviD doesnt touch PHP.

btw that right there is your first finding. Gratis.

Rоry McCune

morning all

AviD

btw @ArtOfCode any reason you rolled your own? special functionality? from the (very) little you've told us, sounds like there are plenty pre-existing packages that would fit you perfectly.

e.g. I'm in lurve with Discourse.

Terry Chia

@AviD Of course you are. It's written in Ruby and JavaScript.

AviD

hahaha

yes but not Angular.

Rоry McCune

@TerryChia Ruby is a bit old-school for him

AviD

09:24

@RоryMcCune that brand new language that some hipster is just starting to think about creating again? That's too old-school for me.

Rоry McCune

@AviD actually if you want some hipster level stuff on Ruby, I'd go for voltframework.com reactive programming and uses OpalRB to compile JavaScript to ruby...

AviD

wat.

Rоry McCune

@AviD if you don't say 'wat' when you first hear about it, it's not hipster enough!

@AviD if you're having fun saying 'wat' this morning, here's another chance ifc0nfig.com/moonpig-vulnerability

AviD

heh yeah, heard of that one from the twatters.

Rоry McCune

for non-UK'ians moonpig are a large provider of customised cards and the like

@AviD apparently they're hiriing for a security officer at the moment!

AviD

09:33

heh. Oooooff COURSE they are.

Rоry McCune

@AviD amusingly the job spec wanted a CISSP qualified person with secure dev, secure networking and secure OS knowledge

'cause that's a really easy skill set to have!

AviD

shure. good luck with that, let us know how that goes for you.

Rory Alsop

@RоryMcCune - will send you the link when I get home this evening

Rоry McCune

@RoryAlsop ta :)

AviD

Storm's coming.

AviD

10:04

@RoryAlsop shame on you for confusing the poor newb with password policies.

Rory Alsop

10:27

@AviD ooops - which one?

oh - yes

the brute force one

AviD

that guy that made up some ridiculously complicated architecture and claimed that is the standard best practice.

Rory Alsop

@AviD heh - I was on mobi, otherwise I'd have found that dupe

AviD

and then asked if its possible to not do it that way.

Rory Alsop

the alpha version of the SE client is pretty good, but some functionality is still crap

AviD

-3

Q: Can I prevent brute forcing of hashed+salted user passwords without a dedicated validation server?

Salted hashes don't seem to offer any real protection for user passwords by itself. So long as a hacker has a quick way to check if a password is right or wrong, it's trivial to brute force it to view the plain-text passwords. Especially if the attacker is using GPUs or an FPGA/ASIC solution. Fr...

@RoryAlsop heh.

@RoryAlsop I'm sure all the special functions, like modding, are not great.

it seemed like he heard a bunch of different terms, didnt really understand them, mixed them all up together, and then puked something into the architecture.

Rory Alsop

10:31

@AviD hahahaha

Stephan Heijl

I'm just wondering what kind of architecture he had in mind when he wants to "validate using secret keys"

Terry Chia

@StephanHeijl I can come up with a pretty good one. :)

Stephan Heijl

I could see some kind of public/private key architecture, but you'd think he would've named it properly.

After all, if all you know is buzzwords, everything looks like a sales meeting.

Terry Chia

@StephanHeijl Not nearly so complex. You just need an air gapped machine (or a HSM) containing the secret key and an implementation of HMAC.

AviD

@TerryChia I think he also wanted to encrypt something.

he also seemed confused with this part:

> So long as a hacker has a quick way to check if a password is right or wrong

Terry Chia

10:38

@AviD Note that I didn't click on the question. :) Just going from what Stephen said.

AviD

@TerryChia and definitely no airgap or hsm.

Stephan Heijl

@TerryChia I don't actually think it's a good idea, but a keypair challenge based solution sound easier than that to me.

Let's just say that the architecture concept is overcomplicated at best and naive at worst.

Terry Chia

@StephanHeijl Asymetric crypto is never "easier" than a simple hmac.

Plus the point here is reducing the surface of attack as much as possible.

Rory Alsop

And the correct answer is a combination of @AviD and my answers

AviD

@RoryAlsop which is why I bothered writing an answer at all :-)

Terry Chia

10:44

I think @tylerl mentioned this in here before. All you need for a secure authentication service is have an airgapped machine communicating over a simple serial protocol.

Stephan Heijl

@RoryAlsop @AviD Correct, you have been upvoted.

AviD

though arguably, your answer should have focused on entropy more than just length and so-called "complexity" ;-)

Terry Chia

Minimal surface area for an attacker to compromise without resorting to something physical.

Stephan Heijl

Frankly, I still prefer having my users call me for access, after which I sent a notarized letter by carrier pidgeon to my data center.

AviD

also, I get a strange perverse satisfaction out of closing bad q's almost immediately after they were asked.

Rory Alsop

10:47

@AviD I know - mobile/typing/almost left mine as a comment

Stephan Heijl

I have been tempted to try smoke signals after I got complaints about latency, but I'm afraid of Indian In The Middle attacks.

Rory Alsop

@AviD heh

AviD

@StephanHeijl thats why it is important to select proper materials to create the smoke.

Rory Alsop

I'd imagine you guys will be interested - links and info on SpaceX's 'interesting' launch over on the Pod Bay

The Pod Bay

General discussion for space.stackexchange.com. Check our sche...

3

launch in half an hour

AviD

depending on whether you are worried more about Little Indian or Big Indian, some greens can make the intercepting agent very hungry.

Stephan Heijl

10:52

@AviD As a Dutch person I can confirm the effectiveness of this specific prevention method.

Rory Alsop

@StephanHeijl :-)

Stephan Heijl

There is also the issue of interference with my secondary data center in Egypt during papal conclaves, but that's an edge case.

ArtOfCode

11:18

@AviD Special functionality. I don't know what this site will become eventually so I want complete freedom to do whatever with it.

Lighty

@Simon img-9gag-ftw.9cache.com/photo/aPy0OQP_460s.jpg

Simon

12:47

Non-embedded pictures are not real pictures.

They don't have feelings.

AviD

youre not a real picture.

Simon

pls

I'm so tired this morning that it seems to require a lot of energy to take a sip of coffee.

TildalWave

in The Pod Bay, 2 hours ago, by Rory Alsop

I'm getting no audio, so am confused

hehehe

if you don't hear anything then you were standing too close to the rocket launch!

Terry Chia

@Poly hasn't been around lately right?

TildalWave

didn't see him no

Terry Chia

12:57

Wanted to tell him his Syscan submission seems to be facing stiff competition. :) 4 crypto-related submissions this year.

TildalWave

last said anything in the DMZ on November 7

Lighty

0

Q: Location of password dumps

I am looking for breached password databases of Sony,Gawker,LinkedIn,Adobe for Research purpose. I tried searching them but with no success. I got Rockyou, Myspace, Hotmail and other password database on https://wiki.skullsecurity.org/index.php?title=Passwords Please help.

passwords

whats up with this?

TildalWave

cc @Polynomial ^^ care to comment? :) And happy new year!

@Lighty LOL "for Research purpose"

AviD

@Lighty familiar with the "Vote to Close" button?

Simon

^ oooohhhh

Lighty

13:01

@AviD I do :3

wait, isnt that done by flagging?

searches around GUI

Terry Chia

@AviD Don't you actually need reputation to do that? ;)

Simon

^

I heard that the VtC button is pretty.

AviD

heh.

Terry Chia

@Simon You are in no position to talk, I'll ensure @kalina has more rep than you by next Christmas.

AviD

apparently you dont need common sense for flagging though.

Simon

13:02

If she doesn't quit 20 times on her way.

AviD

@Lighty wtf was your flag meaning?

Simon

@AviD LOL

TildalWave

@AviD Have you tried the new Google translate for broken English?

Lighty

@AviD that the question is doubtable? :x

.-.

AviD

wat

Simon

13:06

wat

Terry Chia

@TildalWave Parsing @Lighty's speech is an AI-complete problem.

Lighty

the question, do you really think he wants that for "research purposes"? .-.

AviD

heh

Rоry McCune

@TildalWave ya know what the DMZ needs... a "ping on Twitter" feature for people who aren't around much. you could sign people up so a bot sends them a tweet every time they get a mention here

AviD

@Lighty so? thats irrelevant.

Rоry McCune

13:06

I'm sure that it wouldn't be abused at all

AviD

not to mention that the q is already closed.

Simon

@Lighty It doesn't matter if what he says is true. The question is off-topic.

Terry Chia

@RоryMcCune We could probably extend @ManishEarth's chatbot. ;)

TildalWave

@RоryMcCune You mean a PM? Wouldn't work unless they'd also follow the bot's account then

Terry Chia

@TildalWave A public tweet is fine.

TildalWave

13:07

@TerryChia from mentions in DMZ? :)))

Terry Chia

@TildalWave Why not? ;)

Arperum

@TerryChia I can see a tweetocalypse coming your way.

Terry Chia

@Arperum I don't have a public twitter account. shrugs

TildalWave

@TerryChia because @Simon

Lighty

@AviD Since my last few flags weren't as clear and a complete fail, do you have some tips to not raise flags that make your eyes bleed? :P

TildalWave

13:10

@TerryChia what's your twatter handle anyway?

Arperum

@TerryChia SO you'd send tweetocalypses towards other unsuspecting users?

Terry Chia

@TildalWave Seeeeeeeeeeecret. ;)

Actually I own @__ayrx__ but I don't use that much. For now at least.

TildalWave

@TerryChia you're 25?

also, what are you doing in Rome??

@TerryChia dude follow me then

I'm not gonna find you am I?

ok that's it ... I'll just follow everyone from Singapore, how many can there be? :))

Rоry McCune

@TerryChia the kalina bot. I thought he'd de-commisioned that experiment

@TildalWave well PM would be the polite way of doing it, but then it would be boring and opt-in

Simon

@TildalWave Tweetapocalypse sounds like something I could cause.

@ThomasPornin Look at you not being entirely frozen.

TildalWave

13:19

@RоryMcCune Don't you get an email when someone mentions you here? Yes those, you know, that you get about 2 hours after you read them here?

Thomas Pornin

@Simon I am impervious to cold.

Simon

There's a damn limit.

Terry Chia

@TildalWave Heh, I'd prefer to keep my private Twitter account private. Follow @__ayrx__ though, I'll probably start using that more.

@TildalWave You get emails? O_O

Simon

^wat

Thomas Pornin

@Simon Minimum temperature registered in Québec (the city) over the last 150 years is -36⁰C. I know I am fine with -33⁰C (it happened a few years ago) so I believe I could survive -36⁰C.

Simon

13:22

@ThomasPornin That's the "feels like" temperature, right?

Thomas Pornin

@Simon No, the real one.

Simon

Bleeeeeeeeeeeeeeh.

Thomas Pornin

Anyway, this morning there was no wind, so the -27⁰C was both real and "feels like".

Terry Chia

@Simon TWSS

Thomas Pornin

With no wind, there is little problem with cold. You just walk slowly enough to keep your bubble of warm air in your coat/fur.

Simon

13:25

My extremities usually are the problem.

And you're gonna say: "get better boots, gloves and tuque"

To that I'm gonna reply: "you're right, le fu-".

Rоry McCune

@TildalWave nope no emails AFAIK

TildalWave

well I get them if I don't reply or am active in the chat otherwise, dunno where the setting is I'll check

Rоry McCune

@Simon TWSS?

Simon

SHE DID NOT SAY A SINGLE WORD YOU DONUTS.

Terry Chia

So I just finished the two How To Train Your Dragon movies and I'm very confused.

@Simon Of course not, right hands can't talk.

Rоry McCune

13:31

@TerryChia paging @Simon to the burn ward

2

Simon

ffs

TildalWave

your site profile -> preferences

Simon

@TerryChia The last one is a roller coaster of emotions.

TildalWave

I have it set to "every 3 hours"

(TWSS)

Terry Chia

@Simon Was that big dragon at the end of the the first one an Alpha?

TildalWave

13:33

dear lord save us all, @Lighty is fixing posts for grammar and spelling

8

Simon

@TerryChia I don't think so because other dragons were scared of it.

Alphas can control other dragons, it seems.

Well not "it seems", but from what I remember.

Terry Chia

@Simon Yeah, but the one in the first movie was controlling the other dragons to bring it food.

Simon

@TerryChia Through mind control or fear though?

Alphas seem to be mind controlling them.

Terry Chia

@Simon Dunno, I assumed it was mind control. Why else will the dragons not GTFO from the area if otherwise?

Simon

@TerryChia They do at the end when the vikings come though. Maybe the big one ordered them to leave.

So it could be an Alpha.

SO MUCH CONFUSION NOW.

Terry Chia

13:37

@Simon EXACTLY.

I assume there will be a third movie?

Simon

In 2017 I think.

Yep 2017.

Rory Alsop

@TerryChia There's a second one???

coooool

Will buy it

...for my kids

3

actually they probably already have it

Terry Chia

@RoryAlsop Hahahahaha!

Simon

@TerryChia You should ask the Alpha question on SciFi.SE

@RoryAlsop Pffft.

Terry Chia

@Simon Maybe tomorrow.

Lighty

13:40

@RoryAlsop Popcorntime, torrent streaming is totally in now

or "Moviebox" for jailbroken iDevices (popcorntime.cc)

they also have complete series

with subtitles

Simon

WITH SUBTITLES?!?!?

Stephan Heijl

Kids these days with their subtitles

Lighty

actually, we use my laptop and a HDMI cable to watch movies with lé family, my mom whines a lot if there are none ._.

Simon

lé is not a French word.

Lighty

@Simon neither is doughnut

Simon

13:42

You're right, it's a spelling error.

Terry Chia

@Simon Shouldn't you be in the burn ward?

Simon

I told you already that Lucifer brought me back on earth because I annoyed him too much.

Lighty

@Simon really? Maltheal said the same about me :D

Simon

@Lighty That was Cupidon actually and he said "I'll give ya a nice girl but please, don't buy her stickers for Christmas".

Apparently, you didn't follow his advice.

Lighty

@Simon I didn't, bought her a plush, and for her birthday (today infact), i bought her Diablo 3 with the expansion

^^

Terry Chia

13:52

@Simon "But but but... they were really nice stickers... :("

Lighty

@TerryChia He's just jelley I have a someone to buy stickers for that doesn't bark

Simon

wat

AviD

@Lighty what others have already said. Focus on the actual issue, only what is most important.

Simon

You're important.

AviD

yes, yes I am.

awww yeaaaahh this q is legendary.

-3

Q: Strange Fatal errors in PHP

I use apache,PHP and MySql for my site and have got 2 strange Fatal errors in past few days. [06-Jan-2015 13:18:09] PHP Fatal error: Call to undefined function Ť () in on line 112 [02-Jan-2015 21:18:15] PHP Fatal error: Cannot instantiate interface XcX–` in € ûq` on line 654 What could cause t...

php

Terry Chia

14:02

2

@TildalWave You may appreciate that. ;)

TildalWave

hehehe nice one

Terry Chia

Alright, bed. \o

AviD

You use PHP and you are surprised by strange errors, in appropriate crashing, and general cluelessness...? Those are all par for the course. If you want to change that, start by changing language. ;-) — AviD ♦ 7 secs ago

but I put a winkie so he knows I'm being nice!

Simon

@AviD Come on.

AviD

what, too subtle?

Rory Alsop

14:25

@Lighty I don't stream any films.

Simon

^

Rory Alsop

I don't download any, if you exclude Sky's on Demand catch up functionality

main reason is that I'd never get time to watch them

I like the tech, but have other priorities

Simon

Me too, I'm too busy watching cat videos.

Rory Alsop

heh

Stephan Heijl

Is it still piracy if you just leave the file to rot among gigabytes of other, never watched classics?

Simon

14:29

Is it kidnapping if you kidnap an adult?

Arperum

@Simon Adultnapping sounds so stupid.

Simon

naaaaah

Rory Alsop

@StephanHeijl IMO piracy is a stupid term for this, used by the big players specifically for its emotional response. Should be called 'illegal file copying' because that is what it is.

Simon

@RoryAlsop Let's face it, everyone likes the idea of being a pirate.

Rory Alsop

14:44

@Simon well, obviously, but most don't even know how to speak Somalian

Simon

somawat

AviD

@Arperum I love my afternoon adultnap.

Simon

omgawd I gotta type 2015 in da change logs @@@

we no longer in 2014 simoune wake l'up @@@

raz

15:33

ugh, all of DC got stopped by 4 inches of snow.

Simon

rip DC

David Freitag

@raz For a second there I thought you meant your domain controller shit the bed.

Simon

@DavidFreitag Please be polite.

David Freitag

@Simon What, eh?

raz

@DavidFreitag hahaha

Yeah, my domain controller just can't handle the snow.

I should probably build it a house if I plan on having an outdoor domain controller.

AJ Henderson

15:45

@raz if you don't, it may freeze

Simon

QQQQQQQQQQQQQQOOOOOOOOOOOOOOOTTTTTTTTTTTTTTWWWWWWWWWWWWWWWWWWWWWWWW!!!!!!!!!!!!!‌!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

deed02392

who will it be this week :O

lolool @Simon

Simon

Sorry, I couldn't contain my joy.

Xander

@Simon You should write it this week.

Simon

Bleeeeeeeeeeeeeeeeeeeeeeh.

AJ Henderson

15:49

@Xander that sounds... entertaining anyway

Simon

I guess the "forcing to use a strong password" Q could be a decent one.

Rоry McCune

@Simon you should write it up and see how many times you can get your mis-spelling of doughnut into one article

Simon

@RоryMcCune I'd have to be crafty as hell to be able to legitimately use that word in the article.

That sentence was a cluster fuck.

Rоry McCune

@Simon you could line up the first letter of each line to be D, O, N, U, T

Simon

@RоryMcCune Good idea, I like it.

Rоry McCune

15:52

or you could riff on XKCDs correcthorsebatterystaple with donutfloursugarglazing or something :)

Simon

Look at you spelling it right!

Rоry McCune

@Simon I was humouring you :op

Simon

I'll believe what I want.

That's what clueless people do anyway, right?

David Freitag

@Simon Ignorance is bliss

Simon

Mhm.

Xander

16:11

sorry to disturb you with my comment that i will delete, but you look too serious with your profile picture :) — begueradj 56 secs ago

Simon

Says the dude who has a close-up shot of an eye in his gravatar.

TildalWave

16:28

You use PHP and you are surprised by strange errors, inappropriate crashing, and general cluelessness...? Those are all par for the course. If you want to change that, start by changing language. ;-) — AviD ♦ 2 hours ago

@AviD isn't that like "let them eat cake" statement?

Simon

Yeah the donut posted it earlier here.

Rоry McCune

^ $1300 for a taco handbag!

TildalWave

@AviD I believe I speak for all the rest of the programming languages when I beg of you not to send us even more of dem ex-PHP-ers!!!

AJ Henderson

@RоryMcCune for some people, that's small tacos

Xander

@RоryMcCune That is both ridiculous, and bizarre.

TildalWave

16:40

-1 and instead of a reason, I'll just quote Jerry Ehman, the guy that discovered the Wow! signal: I choose not to draw vast conclusions from half-vast data. — TildalWave 41 secs ago

probably my best ever reason for a downvote

Simon

I bet that most people who use the term "script kiddie" are script kiddies.

Stack Exchange

16:55

Blog - Stack Exchange: So long Winter Bash 2014

Jon Ericson on January 06, 2015

While testing hats before the start of Winter Bash 2014, a snowflake notification told me I’d earned the Treasure Hunter hat. After adjusting pirate paraphernalia to fit my head, I tried to remember what triggers this particular hat. As it happens, I’d just received a gold badge on Cooking that I would’ve totally ignored if not for the associated hat. Suddenly I understood why this time of year resonates with our most accomplished users. Earning cosmetic items, as silly as they are, temporarily reminds us of what it was like to begin participating on Stack Exchange months or years ago. Plus, hats look really cool. …

raz

@Simon you're a script kiddie

5

Simon

17:14

@raz 10/10

raz

17:54

You know it's when I have to dynamically allocate multidimensional arrays in C that makes me really appreciate garbage collectors.

Abe Miessler

20:40

anyone else having trouble hitting SO?

Stephan Heijl

downforeveryoneorjustme.com/stackoverflow.com

No problems here

Abe Miessler

interesting - thanks

AviD

@TildalWave so, too subtle?

@TildalWave heh, fair point. better they just stop.

@RоryMcCune @Simon misspells donut now too?

Stephan Heijl

Relevant:
http://img.ctrlv.in/img/4ecd647bc580b.jpg

AviD

@TildalWave yknow he meant like, "in general", even if the logs have nothing to do with it...

The Pod Bay

Transcript for