@TildalWave As @Xander says, it allows for truncation attacks. This matters for protocols that do not include an inherent end-of-data structure (e.g. very old HTTP, where the end of the downloaded file is marked by the TCP closure). For self-terminated protocols (e.g. modern HTTP, with Content-Length and chunked transfer encoding), truncation attacks do not work.

Yay. Someone is flagging every question that contains the word "tool" as off-topic.

@Xander Looks like someone is stealing my technique, but not cleverly.

@kalina Fine, I'll stop trying to make you laugh.

I told my lady donut that I was heading to the kitchen, where I belong. She didn't comment, or say a single word. I think she believes it's true.

it's been a long time since I've felt this unhappy

Isn't that a positive thing though? I'm not kidding, I'm just saying that death is the worst thing that can happen to someone so if that is the thing that makes you the most unhappy, it means that you usually aren't feeling too bad.

sure, if this wasn't my best friend in the world

at the end of the day, I went home while she was in hospital and I didn't get a chance to say goodbye

Unfortunately, there's not much we can do, other than give yourself some time.

Well, you couldn't know she was gonna pass away.

I am a bad person

Don't blame yourself.

SIGH.

A bad person because you've stayed there all day and went home to rest?

Don't be a damn donut.

home is in a different country

I went home to collect packages

what kind of person does that

Someone's who's very excited about her packages? You were constantly talking about them here.

Once again you couldn't have known.

puts all of that into perspective

How about you expel your bad energy through music production?

Write something for him/her.

i am creatively dead

That'll be your goodbye.

You don't have to do it now, think about it slowly.

@Simon I also tweet original content.

My replies to people are amazing.

@ScottPack Well, usually I don't see your replies.

That's not my fault.

Because you don't also follow awesome people you completely missed a discussion regarding the male version of vajazzling and the existence of urethral beads.

@Xander Do you know who's organizing BSidesCLT ?

@ScottPack Yes, Jon Molesa. He's also the OWASP chapter leader for CLT.

@Xander The little bit I just did with him he seems like a not bad guy.

But. Seriously. Has no one said the words "BSidesCLT" out loud yet?

@ScottPack Yeah, he's a good dude.

This isn't good: t.co/4WSxN9nrPS

@ScottPack Maybe the accent?

@Xander BSides Clit

@ScottPack Ah, yeah, no, that's not how we say it down here. :-)

Do you spell it out or is it pronounced differently?

Yeah, we say See-El-Tee

Although now that I think about it, more commonly we just say "Charlotte" in its entirety.

@ScottPack dude Twitter is NOT having a good influence on you :)

Just bought myself a Kindle at last. :)

@ScottPack - ... Interesting ... These are things, you say? You follow weird people on Twitter

@TerryChia Nice! I'm on my second after my wife upgraded mine for Christmas. I absolutely love them.

@Simon Nice try, I'm taking her to a allyoucaneat sushi restaurant

where are you taking your right hand to?

@kalina moar hugs!

@Xander t'wife and I each have original Kindles. The kids have newer ones, but I kind of like the old ways - none of this touch screen nonsense

@RoryAlsop abacus ftw amiright?

@LucasKauffman pffft - in principle, I like the abacus, but my fingers were never fast enough

Quipu is the way to go

@RoryAlsop I bet you still use a Blackberry.

@TerryChia nokia 3310

@TerryChia only for work - and even then as little as possible

it's still preferable to the ipad they also give us

@RoryAlsop cans with a string between :O?

sorry Im mean :(

@LucasKauffman now that was an okay phone. 6310 was the best of that bunch though

@RoryAlsop my first phone was the 6130

when I was a wee lad

@LucasKauffman :-)

a long time ago, in a galaxy far far away

there were original phones

that you had to wind a handle on

and they didn't move

fixed to the walls they were

@RoryAlsop I think I saw one of those in a museum.

@RoryAlsop madness, so wasnt it really hard to text?

@LucasKauffman It would certainly make it inconvenient to Facetime or Skype...

@LucasKauffman Nah - you just read the telegram contents to the operator and it was sent on

@RoryAlsop so you had someone else do the textign for you?

crazy

@LucasKauffman thems were the days

@RoryAlsop Wouldn't that make sexting very awkward?

@TerryChia Depends how private you were feeling... Euphemisms were much more convoluted back in those days

@RoryAlsop Remember the good ole days of party lines?

@ScottPack they were a bit different here than in the US, but yes - count the rings and pick up if it matched your number

@RoryAlsop That sounds about right. Then if you wanted to make a call you picked up the phone to see if anyone else was using it.

@ScottPack if silent, then you wound the handle and the operator picked up :-)

Or, if not silent, you kept your ass quiet and kept listening!

@RoryAlsop I miss those days :)

people would first finish their lunch before calling in those days

OK I disqualified myself from the chat for an hour for using "those days" two times in a row

GAWD

@TildalWave Yes - a phone wouldn't interrupt a meal

should we change this text:

> Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

to

> Questions asking us to break or bypass the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

or something equiv that would also apply to bypassing site restrictions and alike

this one might also need protection:

two technobabble "answers" already

so I'm trying my hand a bit of hipster this evening, looking at docker

@RoryAlsop I have a Kindle 3 which I loved, but the Kindle Voyager I have now is definitely nicer. I'm not a big touchscreen fan myself, but turning the pages is silent, which my wife appreciates when she's trying to sleep and I'm reading. Even if it were worse, the backlit screen would more than make up for it, as it's a massive improvement over an external light.

@RоryMcCune whyyyyyyyy???

@TildalWave well ya know sometime sooner or later I'm going to get asked to test a environment which uses it, so I'd best know a bit about it :)

if you don't mind the whole "implicity trust the docker people and image authors" it's kinda handy so far

@RоryMcCune hipster!

@TildalWave well yeah I thought it would make @AviD and @TerryChia feel better to know there was another hipster about :)

@RоryMcCune Well yes it would be. If you can make it a standard which it strives to be.

emphasis on "strives"

@RоryMcCune that's a much better reason :)

in other hipster news, I'm contemplating pythonizing web production

done some tests and so far so good

@Xander - my daughter has a backlit paperwhite. I can't think of anything worse, but she likes it

@RоryMcCune - you're a hipster? Oh dear...

@RoryAlsop well I'm not really a hipster, I just play one on TV :op

Ooooh - that's not good (I think - it's a wee bit complex for me)

@RoryAlsop Hint: Bruce Schneier working jointly with Eulclid

@RoryAlsop It may not be as clear from the screenshot as when you read the whole paper though...It's a joke.

mjos.fi/doc/gavekort_kale.pdf (PDF link)

wot?

translate: pbs.twimg.com/media/B8HW9n-IIAAHSFt.jpg

(from English) pbs.twimg.com/media/b8hw9n-iiaahsft.jpg

ah shoot!

funny how translation breaks it :)

anyway, all I see is attack complexity of 2^(one donut less than 128)

how is that "major flaw"?

@Xander Jesus dude there's a reason why nobody ever heard of any good Finnish or Swiss comedians! This isn't even amusing, it's just wasting everyone's time.

I'll take my dog out for a leak then, shall I? :P

@Xander - unfortunately my immediate assumption was that this Euclid was a nom de plume. So I didn't expect any joke

That is funnier with the whole paper, although I have seen valid papers that appeared to make less sense

@RoryAlsop @Xander bloody hell I also didnt catch that it was a joke.

though tbf I was putting kids to sleep at the time, so I didnt try to read in depth.

@ScottPack always. Why?

Because you pinged me lamenting over the fact that I wasn't available.

oh yeah, I had some networking questions. Turns out I pooched my DNS server a bit, which screwed up my DC. All sorted now though

@ScottPack true. I do that often.

Most AD problems fall back to DNS

yeah, I actually had a couple problems around that.

so, effectively, is there any substantial difference between static IP and fixed DHCP?

It Depends. ™

Let's assume you're hosting DNS on Windows. For static DNS, most definitely yes. Every time the IP changes you'll have to update DNS and wait for replication to occur before the record is available on every DNS server.

Then you'll have to wait for all the caches to time out (based on the record's TTL) before the correct IP is available everywhere.

@TildalWave JPA is French, not Swiss, although since he lives in french-speaking CH, I guess it's a moot point.

now I'm wondering which is better.

@ScottPack but the IP shouldnt be changing, in either case.

Oh, so you're doing DHCP reservations. That's good.

I didn't realize it was supposed to be a joke, just thought why are they sharing what looks like a snake oil paper

@ScottPack sorry, thats what I meant by "fixed DHCP".

In your environment, with static DHCP, you're probably fine. In most situations.

The caveat you'll have to consider is what happens if the DHCP provider is unavailable for any length of time.

Do you know how the DHCP protocol works?

so, assuming the IP is not intended to change, and ignoring management overhead (such as a changed NIC) - any change for the network / DC?

@ScottPack -ish. I'd delved into the gritty bitses a few years ago, but I barely remember enough to keep it functional, if it werent for a smart router that does it all well.

At home I use DHCP reservations where ever possible. For two reasons, 1) It acts like an IPAM so I can keep track of which IPs are assigned where. 2) Makes for easier changes to network settings, like DNS servers and the like.

Let's assume you're setting your DHCP lease times to be 12 hours.

@ScottPack if for whatever reason the DHCP wasnt available, that would mean the router was not available. so (a) I would be dealing with that right now anyway (b) th DC would retain the IP for at least the length of time that is set for default (I think 24H) (c) I could still access all my machines locally - I'm all (almost all) on VMs anyway...

@ScottPack well, specifically in this case it would be the IP reservation for the DNS server itself.

which I think could possibly be a more interesting case?

At the 6 hour mark your DC will attempt to renew it's lease. If it gets no response, it'll try again at 9 hours. If still no response again at 10:30.

Then one more time at the 12 hour mark. If it receives no response it may give up it's IP.

anyway I figured its much healthier for the DNS server to have its IP as a static IP, and not rely on DHCP for the DNS server.

It seems reasonable.

k thanks

Wow. New those Crossovers appear to be more expensive than what I had been looking at from Acer or Dell.

wat, really??

Ah, they only come in 27"? I was looking in the 23 range.

oh well sure

yeah, 27" high quality IPS 2760x1440

you scared me, I've been looking forward to getting another one at the same price. Looks like they've even gone down a bit - 300$ including shipping.

The 23-24 size is in the 150-200 range for IPS displays.

27 is just too big for my space.

this is for your home, yes?

yeah if you're not in front of it the whole day I guess its not as critical.

It is. I normally only work at the desk for my weekly game session. I've got a couple of projects in mind that make it more likely to spend more time up here so I want more than this 9 year old 19" :)

In other news. In 2006 the ViewSonic VP930b was clearly the best money I've spent on computing.

ouch. I just replaced one like that for the family. Went with a Dell 23 or 24", very happy with it.

yeah, they used to last back then.

ahhh, they dont make 'em like they used to.

At the Uni we had 23" Dells as well. Damn good displays. I don't know the models but they had a built in 4-port USB hub, DVI, VGA, and Displayport.

@ScottPack same, that seems standard.

From what I'm seeing now that puts it on the top of the line range. :)

though I've spoiled myself now, I expect at least one 27".

I think its almost time to add a 2nd monitor too.

@ScottPack I insisted on IPS. surprisingly TN is still common.

TN?

the old display type.

Which is?

TN

crappy?

I've never much cared about paying attention to this stuff

You're terrible.

neither did I, until I read that codinghorror post.

then I tried it, and BOY can I tell the difference.

I find it uncomfortable now sitting at a TN display, and it is easily noticable.

I would love for someone to buy be a CinemaDisplay

@RоryMcCune heh, I missed that post (the tools list from CX). interestingly, the first section with "Questions to ask yourself when choosing an open-source static code analysis tool" was taken from my answer to your Sec.SE question on the same topic :-)

I had sent them the link shortly before that post came out

hehe. Turns out I didnt miss that post - I had it open in a tab far in the background, hadnt gotten aroudn to reading it yet. Derp.

Jeez

Ooo..here's a 24" Dell P series IPS at a local store for $120.

I'm seeing one of those in my inbox for 130$ t Newegg.

Which one? I'm not finding it.

oof dunno, Ialready delted the email

hang on

going dumpster diving

You're killing me.

You are literally killing me.

ah here it is newegg.com/Product/…-EMC-‌​012415-Index--LCDMonitors-_-24260246-L01A

okay I didnt look closely, its an E series.

dont know the difference between them

I think it's E, S, P.

ah nevermind, that one is TN

Nevermind, S then E

Oh. E == Value. P == Productivity. S == Style

cheapest Dell 23" IPS on Newegg is 145$.

@ScottPack which is better, productivity or style?

and I love how "value" is always a euphemism for "cheapest".

Don't forget U ;p

waiting for airlines to rename the economy / tourist / sardine section to "Value Cabin".

Depends. The Styles look a little slicker and, from what I can tell, are brighter with a lower refresh.

But fewer ports overall. You'd use an S for gaming or watching movies.

The P has a slightly higher refresh but more ports. Designed to be used on a workstation.

@ScottPack I would think performance would be better for that

@JourneymanGeek U == Ultrasharp?

Yup

which would be the ones to get

@AviD Productivity, not Performance.

Heck, at work, we consider them only one step below our fancypants eizos

@ScottPack oh oops

so "work" then

The once or twice I've used a 4k it was beautiful, but nope.

Everything is too small.

@AviD Right.

@ScottPack: windows 10 apparently has better scaling

That's cute.

(and I'll prolly shift my 20 inch, 1200x800 over to my linux box, which suffers from a 10 inch screen of the same resolution)

Which is suprisingly usable, but yanno...

small

I'm also not going to spend ~$500 on a display for my home office. If someone wants to buy me one I'll go for it.

@JourneymanGeek yo momma gonn' be shifting my 20 inches

20, my bad

I don't see a purpose in a monitor smaller than ~23 these days.

@ScottPack: In that case? low cost

It was the best monitor I could get at my budget at the time

Upgrading is a priority for me

Oh, I'll be upgrading no matter what. This is what I have right now.

newegg.com/Product/Product.aspx?Item=N82E16824116365

The cheapest of the U series is also about 4.5 times the cost of other products that meet my needs and don't have the 4k problem.

oh hey. I thought we were commiserating on our 12 year old CRTs.

Oh, the CRT this replaced was a 17" AOC from 1998.

oh okay, fine then.