The DMZ

David Freitag

01:25

imgur.com/gallery/IjzhVTa

cc:\ @Simon

Stack Exchange

05:00

At this point, if we're going to keep insisting on portraying dinosaurs as featherless because it's "cooler", it's time to apply that same logic to art involving bald eagles.

Rоry McCune

07:45

@LucasKauffman nice! which Model did you go for?

Lucas Kauffman

08:29

@RоryMcCune i5-4300U 128GB

Rory Alsop

08:51

folks - opinion wanted:

20

Q: If we built two-factor authentication for Stack Exchange OpenID, would you use it?

[Related: Two factor authentication for Stack Exchange] So, over the last couple of weeks, I built a bare-bones two-factor authentication system for Stack Exchange OpenID. Currently, it only supports: Logging in via Stack Exchange OpenID Google Authenticator-style code generation Recovery code...

Tinned_Tuna

@RoryAlsop hm, fair question. StackExchange is an OpenID provider, right? Meaning that they are relied on to assert the identity of users to sites beyond the StackExchange network? If so, it depends on the requirements of the external sites, unless I've mis-understood something?

Steve DL

09:15

And what exactly is gonna happen if someone steals my account? They'll post stupider and angrier replies than I do, or give donuts to @Simon?

The only actual reason I spend time on SE is I don't have any effort to do to authenticate :-)

Rory Alsop

@SteveDL See Deer Hunter's comment there :-)

Steve DL

yup, i saw i'm not concerned :-)

M'vy

09:37

2FA is good. But depends what for

Rory Alsop

@M'vy exactly.

M'vy

If it turns they want to be a fully-fleged OpenID provider, then I'd be wanting 2FA

If it's just for SE network... well

Tinned_Tuna

Has anyone used nmap's ssl-enum-ciphers?

M'vy

I'd probably use it if it's there, but I won't be asking for it

Steve DL

10:18

security.stackexchange.com/questions/89658/… I can fix it if I get a month's salary :|

raz

11:19

@SteveDL It'd take you a month? I'd do it in a week.

M'vy

@raz no, he said he would fix it for a month worth of salary.

raz

@M'vy Ah, a small but important detail

Tinned_Tuna

... isn't it just locate and upgrade the 2 affected servers?

Although, I suppose, comms, downtime management, change control, etc. could easily spiral.

raz

For those types of upgrades, would you need to reboot the server?

Simon

11:35

@SteveDL My name was in the same sentence as the word "stupider" and it wasn't directed towards me? Today is gonna be a good day.

@DavidFreitag I miss that dance, I don't get to do it now that I'm with my donut.

Steve DL

@raz I ask for payment inversely proportionally to my intellectual interest in a piece of work.

I'm not very interested in configuring IIS for a lazy sysadmin. :p

Simon

@SteveDL Oh stop it, I'm sure you love IIS' interface.

Steve DL

@Simon familiar with the concept of tautonomies? ;-)

raz

@SteveDL You're not?! But it's so interesting

I've heard of topologies

Steve DL

@Simon I don't know what it even looks like.

hm pretty sure i mispelt it

Simon

11:39

It looks like a cluster. Of fucks.

Steve DL

and pretty sure the word's also different in English

raz

@SteveDL Imagine a Windows Application... with all your server needs in a single window

Steve DL

<- silly

Simon

@SteveDL Yeah, google didn't help me out on this one.

What's your main language you donut?

Steve DL

right, im an idiot. Tautologies.

raz

11:41

What's not to love!?

Simon

lolololol

Steve DL

@raz to be fair I can't see how that'd be worse than tinkering with postfix's many mysterious files...

/me doesn't do printers or mail servers any more...

Simon

Unless you're super paranoid about privacy, paying to use a mail service is definitely worth it.

raz

@SteveDL Valid argument. I just think Linux is more straightforward. Maybe it just makes more sense to me than a GUI setup.

Simon

@raz Command line makes more sense to me than most GUI usually.

to me to me to me

Steve DL

11:50

@Simon I needed one set up for the remote study management website i'm developing for my group

our current site is a collection of perl scripts (or something similar) running on some solaris server from the 80's or 90's

apparently our samba server is currently hosted on the machine that was originally processing DNS requests for .uk, too...

Simon

That's old school.

Steve DL

we have badass sysadmins, but they dont use the same technologies as our students... makes it hard to do in-house development :|

TildalWave

@RoryAlsop I just saw it now (too busy with enforcers of prior research elsewhere on a site that goes to enthusiast level ...) but why did you delete your answer on SEx.SE? You're not wrong you know?

Rory Alsop

@TildalWave I figured I wasn't wrong, but mine was a cheap throwaway answer with almost no research effort - yours was excellent

TildalWave

@RoryAlsop wait, I thought we ask of those asking questions to do research, not of those answering them? :D

I mean, look at @LucasKauffman's answers :)))

:P

Lucas Kauffman

11:54

:O

@TildalWave :'( you broke my heart

Simon

Donuts fired.

TildalWave

@LucasKauffman What again? How many times can it be broken? :O

Thomas Pornin

@TildalWave I totally concur. There is no need for extra research if you already know the answer.

TildalWave

exactly

@Simon dude, too much information!

@SteveDL tautonomy kinda makes sense too, you sure it's not a real word?

Thomas Pornin

The "new attack" on TLS is called "Logjam".

weakdh.org

Steve DL

12:07

@TidalWave i can't find traces of it existing and I'm confused as to why I used that word

Thomas Pornin

It has actually no relation with POODLE.

They claim it to be a protocol flaw, which is a bit of a stretch.

TildalWave

@SteveDL Because you were replying to @Simon? :)

Thomas Pornin

In a nutshell, if the client and server accept to use weak crypto (DH with a 512-bit modulus), well, it's weak and can be broken.

TildalWave

Tautonym

A tautonym is a scientific name of a species in which both parts of the name have the same spelling, for example Bison bison. The first part of the name is the name of the genus and the second part is referred to as the specific epithet in the International Code of Nomenclature for algae, fungi, and plants and the specific name in the International Code of Zoological Nomenclature. Tautonymy (i.e., the usage of tautonymous names) is permissible in zoological nomenclature (see List of tautonyms for examples). In past editions of the zoological Code the term tautonym was used, but it has now been...

Steve DL

@ThomasPornin so now all protocol downgrade mechanisms are a design flaw regardless of context?

TildalWave

12:09

@ThomasPornin and here is how it works vuln.name/?q=Logjam :D

Simon

@TildalWave pls

TildalWave

@Simon you're saying you're not a donut donut?

Simon

No, I'm a donut donut donut.

Thomas Pornin

@SteveDL There is an interesting point, in that the ServerKeyExchange message for a DHE_EXPORT suite and for a plain DHE suite are interchangeable.

Rhino

> Test Failed Your web browser doesn't look to support Javascript. Please enable Javascript for this test.

Thomas Pornin

12:11

So the client still believes to do plain DHE and not export DHE.

Rhino

Well that sucks as an exploit

Thomas Pornin

However, the main problem is still that the client and the server accept to use a 512-bit modulus, which is weak, regardless of how you look at it.

When SSL was designed, it was hoped that client and server could opportunistically select a strong cipher suite if they both support it, fallbacking to weak crypto only if there is nothing better available.

The hope was that attackers could not force a downgrade.

Steve DL

What I don't understand is why the only mechanism through which we expect these problems to be solved is for every sysadmin and user in the world to watch crypto crypto mailing lists to figure out they're using a "weak" cypher

Thomas Pornin

That hope relies on the weak crypto not to be completely weak, though.

Steve DL

@ThomasPornin in practice everyone picked the same primes because that allowed for HW optimisations, right?

and then the hardware stays on and nobody wants to switch, or is there something else I'm missing?

Thomas Pornin

12:14

@SteveDL Oh no. In practice everyone picked the same primes because they come with the implementation.

3

Rhino

@SteveDL Since most people just copy the cipher suite list from the web somewhere the reality is probably a bit worse than that.

Thomas Pornin

These 512-bit primes for DH are not better for hardware than any other.

Simon

@Rhino I'd never do a such thing. Cough cough.

Thomas Pornin

The logjam creator also add a fair sprinkle of FUD, by suggesting that 1024-bit DH is also vulnerable to "attackers with nation-state resources".

Rhino

Although I should take the time now to announce my new TLS vulnerability: if you can downgrade TLS symmetric encryption to the vigenere cipher, then you're in trouble. 11.8% of web servers affected.

Steve DL

12:16

@ThomasPornin ok, i've heard in the past that some people chose specific primes because it allowed optimising hardware implementations for that prime (but maybe it was software, I dont usually listen fully in classrooms :x)

Thomas Pornin

@SteveDL That was for the base field for elliptic curves. Not the same animal.

Steve DL

ah right!

/me feels like a donut.

Thomas Pornin

Although some people have indeed tried the same with plain DH, and it lead to disaster, because the "special primes" allowed for much faster attacks (SNFS vs GNFS). But these do not apply to elliptic curves.

Simon

10/10

Rhino

There's also

17

A: Impacts of not using RSA exponent of 65537

Using $e\ne65537$ would reduce compatibility with existing hardware or software, and break conformance to some standards or prescriptions of security authorities. Any higher $e$ would make the public RSA operation (used for encryption, or signature verification) slower. Some lower $e$, in particu...

that is, e=65537 often in RSA

@ThomasPornin @SteveDL wasn't that binary extension fields (GF(2^x)) and didn't Joux work out they're not great, security wise?

Thomas Pornin

12:21

@Rhino That one is yet another subject

Rhino

@ThomasPornin That and the small characteristic fields.

Thomas Pornin

Plain DH in field GF(2^m) was already known to be slightly weak, but Joux showed it is much weaker than previously assumed.

Steve DL

/me goes back to his psychology papers... O_o

Simon

I wish I could go back to my psychology papers too.

Thomas Pornin

There again, it does not impact use of GF(2^m) for elliptic curves, except if you try to use these special, "weakened" curves for pairings.

A pairing can turn DH over a curve in a field of size q into plain DH in a field of size q^k for some integer k (called the "embedding degree"). For normal curves, k is astronomically high and there is no issue.

In order to use pairings, some people use special curves where k is very small.

Joux's research shows that this is a bad idea to do that if you use binary fields, because the "weakened curve for pairing" turns into a curve which is too weak.

Rhino

12:26

@ThomasPornin I see. Ok thanks! When I first read the papers I realized I didn't know enough about EC. A year on I'm realizing it's a massive field... no pun intended.

TildalWave

@Simon for a reevaluation?

Simon

pls

Everyone needs to reevaluate at some point, you know.

If not constantly.

Thomas Pornin

As for the logjam, it is unrealistic to believe that sysadmins will try to select their ciphersuites and generate their own DH parameters.

Instead, clients will be patched to simply refuse to use a 512-bit modulus.

And servers will be patched to stop using "export" cipher suites by default.

Rhino

@ThomasPornin I thought !export was quite normal in TLS configs - I've added it to every one of mine since forever.

Thomas Pornin

Another possible mitigation, which cures the symptom, not the actual issue, is to generate a new DH modulus upon server startup.

@Rhino You added it. Most sysadmins don't know or care enough to change anything to the default config.

TildalWave

12:31

@Simon dude my missus has master's degree in psychology... tell me about it :)

Rhino

@ThomasPornin True.

Simon

@TildalWave Nice! I believe that's what I would have done if I didn't like CS.

Gilles

@ThomasPornin most sysadmins shouldn't need to care. If most sysadmins need to change the defaults, the defaults are bad.

Are export ciphers still in the defaults for typical web servers‽

I thought that ship had sunk

Rhino

@Gilles I was hoping most people were copying from here: wiki.mozilla.org/Security/Server_Side_TLS

Rory Alsop

@TildalWave the one I really like is Troglodytes troglodytes

Rhino

12:34

or using qualys ssl labs

Gilles

@Rhino “most people” being web server vendors? Because there's no reason why website administrators would read this page

Install Apache, add your domain name and the path to the files you want to serve

if you need to do more then your vendor hasn't done their job

Thomas Pornin

There is a known protocol flaw in TLS with regards to DHE: there is no method for the client to indicate supported modulus sizes.

That flaw is not new but has lead to some issues. E.g. servers tend not to dare use DH modulus larger than 1024 bits for fear that it would break some clients.

Recent Apache version has finally switched to a larger modulus, but it is known to break Java-based clients (up to and including Java 7, which is pathetic).

TildalWave

@RoryAlsop mine is piri piri (or peri peri), mostly because I have it on my windowsill and it's crazy full of pods already :)

Rory Alsop

12:59

@TildalWave oooh - that's much more edible than a wren

Simon

Lovely, thank you VS 2012! Even though I modified a class, it's like if it would compile the previous version. The solution was to "clean" the project.

Sigh, sigh, sigh.

MY PHP DOESN'T DO THIS

Rhino

@Simon Precompiled headers. If you're using pch, you need to clean. builds won't rebuild pch.

That's if you're using C++ anyway

Simon

Nah, VB.NET.

I did import the file from a previous project, that may have to do with it.

Steve DL

Well, use less shitty build tools then :p

Simon

QQ

Rhino

13:04

@Simon I've not used VB in nearly 15 years, so I have no idea what the latest state of it is.

Steve DL

@Rhino it's good that you can open up about it now... Stay strong!

Braiam

waiting for the hot question about how to mitigate the latest new vulnerability

Terry Chia

@SteveDL make? :P

Rhino

@SteveDL Well first I went to VB users anonymous. After they decided to add VB to .net I was like... man this is ruining my life. So I worked through my problems and got a lot of support, particularly during those hard times I had to work on VBA macros in summer jobs. But, I made it. I've been VB-free for a long time now and never felt better!

3

Steve DL

@TerryChia some IDEs like QtCreator have ways to tell when they need to re qmake

I expect autotools can deal with this kind of situations in C projects, too

@Rhino is your hair more shiny and are your teeth stronger, and do you sleep better now that you've moved on!?

Did it bring back your loved ones?

Terry Chia

13:10

@SteveDL autotools can do a lot of things. That doesn't make it not a shitty build tool. :D

Steve DL

@TerryChia unfortunately I have to agree on this one...

Rhino

@SteveDL Yes definitely. I have the occasional nightmare about whether I should use "option explicit" and whether arguments need a "ByRef" prefix but aside from that, I find myself starting each day like it was my last!

Steve DL

Still haven't figured how to configure glibc without disabling all the silly checks...

Terry Chia

@SteveDL Honestly I have not seen a build tool that does not suck in one way or another.

Simon

@Rhino You're a courageous man.

Rhino

13:12

@Simon Well, actually a Rhino.

Steve DL

yup...

they should hire HCI people to design build tools :D

Simon

@Rhino On the Internet, nobody knows that you're a rhino.

Rhino

@Simon But it says so in my username and picture. Are you implying content on the internet is inaccurate?

Please tell me no! I learnt everything I know from the internet.

Simon

@Rhino Want some proof? Personally, I've learned that the past tense of learn is "learned" on the Internet.

Rhino

@SteveDL I like to do my bit to help other poor souls who are having trouble with VB, y'know. I mean I'm not special, not a role model or anything, just some guy who learnt to program with VB and overcame those odds.

Simon

13:21

@TerryChia ONE WAY OR ANOTHER

Rhino

I mean, everyone has their moment of weakness where they just want to drag and drop UI components in RAD fashion.

@Simon learnt is English English past tense.

Simon

@Rhino Personally, I'm a big fan of Dreamweaver.

I'M KIDDING, EVEN I WOULDN'T USE DREAMWEAVER

Alright, alright, I'm sorry. I didn't mean to kill the chat.

raz

13:42

GAWD SIMON

Simon

soz

Rory Alsop

14:05

@Simon is it even still a thing?

Simon

@RoryAlsop No idea, let's hope not!

Oh lawd, Adobe owns it now.

M'vy

@Simon still charges for more than 4000 I guess?

Simon

@M'vy Probably, what a piece of crap.

Thomas Pornin

14:21

Mmh... nobody is rushing to stackexchange.SE to ask about Logjam

Either the news have not circulated enough, or people are just fed up with SSL, or (worryingly) sec.SE is no longer considered the right place to panic about vulnerabilities.

Barry Carlyon

Nah we all got bit by a VIPER and we haven't realised we are dead yet… And our immortal souls live on in StackChat

Arperum

@ThomasPornin I could go and ask a question, but it would lack any and all research. It would basically be "I heard there is a new TLS vulnerability named Logjam, what does it do and how do I prevent it?"

As in: that would literrally be the question body.

Simon

@ThomasPornin It's almost summer, people are less attracted to drama right now.

Steve DL

14:39

@Arperum I heard there is a new TLS vulnerability named Logjam, is my log house vulnerable? Hasn't been patched in 20 years.

raz

@Simon Ain't no vulns on the beach!

Arperum

@SteveDL *that would be flat out trolling, mine is just being a dumb unknowing idiot.

raz

@SteveDL Your mom got patched by a log jam

Simon

@raz Exactly.

@raz dayum

raz

14:51

chat bombs

Simon

:'(

Steve DL

http://security.stackexchange.com/questions/89642/web-developers-responsibility-for-ddos?noredirect=1

Hmm this thread... people speaking about legal responsibilities with no clue and no reference to law books or court decisions

Simon

Looks like you were the final decision needed to put it on hold.

raz

It's off topic, but the advice isn't wrong.

Steve DL

yup, though my decision is "opinion-based"

@raz it really depends on what contract you sign and where

raz

14:59

@SteveDL I believe I marked opinion-based as well. They just take the majority as the reason.

Steve DL

if there is a glaring fault in your software and that makes a DDoS very practical (to the point of reducing the efficiency of hosters' DDoS protections) you could be liable to repair if you haven't taken reasonable precautions to limit the risk during development

raz

@SteveDL You can always downvote. I'm actually surprised that it got 42 votes.

Simon

Like inserting strings with almost no maximum size constantly.

raz

I'm still trying to figure out the issue with this guy. His english isn't so great, so it's tough to determine his problem.

-2

Q: Connecting to SSL server with openSSL client

I am trying to establish SSL server connection. I just want to understand what are all the parameters i should make sure for proper connection establishment. From server side they give certificate file : "foo.crt". Since , I am using OpenSSL I just rename the file to PEM format : "FOO.PEM" In E...

tls openssl server client-side

Simon

Limit your varchars, kids!

raz

15:04

varchar... isn't that a database thing

Steve DL

@raz me too... a lot of the voters vote for what looks like a correct / complete answer rather than what actually is correct

raz

@SteveDL The answer's not wrong, it's just not complete

Thomas Pornin

@Arperum I think it would be a good idea to ask that question, yes.

So that I may push an answer right away.

Steve DL

@raz as far as I'm concerned it lulls OP into not caring about doing her job right

in most cases that won't be a problem. In some contexts (critical-safety systems, contracts with liability for preventable errors) it might be

I don't know anything about the exact legal obligations of OP, so I don't answer "oh, you'll be fine". I tell OP to talk to lawyers :-)

Arperum

@ThomasPornin I'll ask it, but be aware that it'll be a very basic question (as said before, I have a pretty extreme lack of knowledge on the area)

raz

15:14

@ThomasPornin does it for the reps

Simon

@raz Some say he's the whore kind of rep gainer.

Thomas Pornin

@Arperum Basic questions are not an issue; basic answers may be, though.

Arperum

@ThomasPornin That's why I'm not answering anything on sec.SE

Thomas Pornin

I'd prefer the first answer on the site not to be of the OMG-the-NSA-can-decrypt-everything kind, which is why I'll do it myself.

Simon

@Arperum Oh come on, if I can do it once in a while, you can do it too.

raz

15:16

You just have to be thorough, it's really not that bad.

This question has me confused

0

Q: Best Cipher for Client Application to Web Server

I am making a Application that requires a login. I'm using a HTTP Server for accounts. My question is, what is the best Encryption/Hashing/Cipher to use in this case ? I know that SSL/TLS won't cut it, as they are pretty weak on their own. What's the best to use ? I use C# (Client) and PHP (WebSe...

encryption .net

Arperum

@ThomasPornin Question will be up in a bit, I want to add something more to it than just that one sentence but I'm strugling with wording my thoughts.

Thomas Pornin

@Arperum I'd prefer you do not wait for too long because I'll go for dinner in 30 minutes or so.

raz

@Arperum Ask the question!

Arperum

@ThomasPornin I'll post it in 5-10 minutes. Just busy smacking my brain for a bit.

Simon

@ThomasPornin It's called lunch you donut.

Thomas Pornin

15:20

@Simon I eat dinner as I see fit !

Simon

Fine.

Arperum

fuckit, posted as is. brain is down after a day of fixing mindnumbingly stupidities.

raz

Bears eat meals, they don't make yuppy distinctions in name conventions.

Simon

1

Q: What is Logjam and how do I prevent it?

I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?

tls

raz

OMG I'M VULNERABLE TO LOGJAM RUNS AROUND SCREAMING

Simon

15:23

Is my iPod shuffle vulnerable to Logjam?

Arperum

@Simon More importantly: is your donut vulnerable to Logjam?

Simon

@Arperum IS SHE?

Arperum

@Simon I don't know.

Simon

Hopefully, Pornin will let us know if she is or not.

raz

Also, Chrome hasn't rolled out a fix yet. Since I just updated and I'm still vulnerable

Tinned_Tuna

15:30

ehn, I just uni-laterally disabled DH in favour of elliptic curve DH.

Also took the opportunity to put AES-128-GCM as the preferred mode because I likes me some tiny improvement in performance.

Simon

@Tinned_Tuna No, no, no. Stop it. We were having a nice non-technical conversation that I was able to understand.

Tinned_Tuna

@raz that question is quite bizarre

raz

@Tinned_Tuna which question?

Tinned_Tuna

0

Q: Best Cipher for Client Application to Web Server

I am making a Application that requires a login. I'm using a HTTP Server for accounts. My question is, what is the best Encryption/Hashing/Cipher to use in this case ? I know that SSL/TLS won't cut it, as they are pretty weak on their own. What's the best to use ? I use C# (Client) and PHP (WebSe...

encryption .net

> SSL/TLS won't cut it

raz

haha

nope

Arperum

15:35

Wooo! Enough rep to downvote! FEAR MY POWER!

Tinned_Tuna

I mean, I know it's pretty bad, but I doubt that the (in)security of TLS is a serious threat, as opposed to say, the developer themselves.

raz

Also that Logjam vulnerability basically depends upon keeping the handshake open for 90 seconds.

M'vy

BTW: new user profiles?? have we been forgotten?

raz

@M'vy We're always forgotten

Also, whoever thought that TLS False Start would be a good idea?

Simon

The link you've provided is a pretty complete answer to your question, including the "What should I do?" section. — gowenfawr 1 min ago

He's trying to stop us from having fun!

@ThomasPornin You're so slow that @Polynomial posted an answer before you.

Rhino

15:47

@raz They're trying to get to 0-RTT in terms of TLS handshakes. In theory it isn't a bad idea - if you want to serve lots of images on a https cdn, for example, you want minimal round trips to the server. Right now, it takes 2 just to get talking.

That's before you've sent any data. HTTP/2 will help this in some respects, by allowing multiplexing of the connection.

So session establishment needs to only happen once and you can request multiple http resources.

But essentially they want to minimize the cost of establishing a session in tls.

ietf.org/mail-archive/web/tls/current/msg14645.html and others

Thomas Pornin

@Arperum My answer is up: security.stackexchange.com/a/89702/655

Rhino

perhaps I shouldn't have said session establishment. 0-RTT allows you to start sending encrypted records straight away, but doesn't necessarily mean the session will be established.

the idea being if the connection does get set up, damn that was fast

Steve DL

damn beaten by a few minutes security.stackexchange.com/questions/89690/…

Simon

@SteveDL I feel like there are too many bolded parts in your answer here: security.stackexchange.com/questions/89605/…

Steve DL

@Simon allows for quick reading.. better?

Simon

15:57

Yes, it's a tad less clustered now.

Steve DL

IM VERY HAPPY TO READ THIS YOU DONUT

Simon

oh you le didn't**!!!!!**

Oh come on, it was bolded for a sec and then it de-bolded (did anyone ever use the word "de-bolded" before me?)

Steve DL

your last partner?

jajaja

Simon

wat

I'm sorry everyone, I think I broke @SteveDL.

Steve DL

starts grazing his office carpet

Simon

16:05

I had to translate the word "grazing".

Steve DL

What really?

Are you a frog-speaker, @Simon?

Simon

Is that a word that is indispensable to someone's vocabulary?

YES I AM.

Rhino

@SteveDL what's a frog-speaker?

C'est comme un rosbif?

Simon

lulz

Steve DL

Non, un rosbif c'est un rosbif, un frog c'est une grenouille.

@Rhino though yeah, a frog eater or speaker of froglang would be the reverse of a rosbif in French

Simon

16:10

"speaker of frogland", haha.

Steve DL

in US english, capitulating monkey Q.Q

Rhino

@SteveDL Bah mais écoute un rosbif c'est un plat supérieur. On n'est pas censé de manger les grenouilles :)

Simon

Why not?

Rhino

@SteveDL Yes. I have introduced myself as a rosbif once or twice, quite funny.

Simon

And what's next, we shouldn't be eating snails?

Rhino

16:14

@Simon Exactly. Stop it, it's not even remotely tasty. Please keep making bread and wine though.

Simon

I LIVE IN QUÉBEC

WE'RE NOT THE STEREOTYPE

Rhino

@Simon Nor are most French people but that doesn't mean we can't go in for a bit of stereotyping, just for fun.

Simon

o

Steve DL

@Rhino rosbif literally means roasted beef, which apparently was used to make fun of the fact that Brits overcooked their meats.

so I wouldn't call it a superior dish, hehe :P

Rhino

@SteveDL I heard it was to do with sunburnt holiday makers also - we turn up on your nice beaches in provence and turn red... like rosbif

Steve DL

16:17

Frog's actually like dry chicken. Would try again in a proper restaurant though, might've just been poorly cooked.

Rhino

@SteveDL You are allowed to put meat in the oven for longer than 20 seconds y'know ;)

In France I ask for my meat burnt. If they ask what I mean, I say "well done, then keep going for a bit"

Steve DL

@Rhino had a Wellington recently, the middle of the meat was quite chewy and I was surprised as to why. I've ended up reading rants from chefs or culinary critics about how rare meat is a new thing in the UK and some chefs might not yet have mastered it (and also many places refuse to serve rare meat still)

raz

@SteveDL Your answer was better

Simon

Buying rep 10$ per 1k.

Steve DL

Also I LOVE pluma iberica, which is essentially medium-rare iberian pork loin

@raz agreed :p

Dunno which, but agreed :D

@Rhino you're not in London are you?

Rhino

16:21

@SteveDL Nope sorry. Not at the moment. I may end up back in the UK soon and if so can head over to London. Right now I'm in Lausanne, CH.

Steve DL

Oh right

Dont know why I thought you were there. Was gonna give you addresses for proper rare meat :D

Rhino

Confusing the locals who all think I'm German.

Simon

ich spreche kein deutsch

Rhino

Nor do I, which is even funnier, but CH has four national languages and people move around a bit and usually speak one or two of them. I heard someone shopping the other day ordering something in French then turn around and tell their kids off in German.

But people don't immediately work out I'm English, unless I tell them.

Or I'm with English people.

Steve DL

Missing a Brit speaking French? How do you blend in? Do you swear a lot?

Simon

16:26

"Sacre bleu de donut!"

Rhino

@SteveDL They usually figure out I'm a foreigner if we have an in depth conversation, just not necessarily that I'm British. I'm told I have a "little accent" but not much more than that.

I also might run out of vocab in the wrong context. Like the other day I tried to discuss greyhounds with a lady in the park and realized school doesn't prepare you for that...

actually, school didn't really help with any of my french, but there you are.

@SteveDL I've become acquainted with the swearwords, but that's an interesting story in itself. I picked up a DVD I thought was VO, but was actually VF, so I figured what the hell, immersion totale right? So I watched it and the first half an hour taught me a whole bunch of ways to be really offensive in French.

@SteveDL Also I stand out more in summer because I swear sandals and shorts like I'm a Brit on holiday.

Steve DL

@Rhino I can sympathize with that. I still make mistakes and forget words after over 10 years of English...

Also yay for swear words! Important part of the language :D

@Rhino we have a Californian colleague... he wears sandals in London all winter...

Rhino

@SteveDL That's the spirit!

That'd be me but they have actual snow here that would cause the UK to explode in a fit of closed roads and cancelled trains.

@SteveDL Yes. My gf jokes that level A1 of language learning is knowing how to swear. Then A2 is basic vocab and verbs...

@SteveDL In the UK I was in the Manchester area but I have family and friends all over the UK, London included and I've lived all over too.

Rory Alsop

16:52

I wear shorts all the time except when I have to wear a suit. And that's in Scotland. London is always too hot for me

Steve DL

@Rhino fair enough :-)

Lucas Kauffman

@RoryAlsop how do you travel past Belgium? It's going to be like hell for you :P

Steve DL

GO. TO. SPAIN.

:D

Simon

Come on dude, don't use gotos.

Rhino

Not this again.

Where's Tigger? We need to argue about tabs and spaces.

Simon

16:57

Tabs are just faster.

schroeder

tabs are space macros

Simon

pls

Rhino

I wasn't actually serious. Please stop!

Simon

1

Q: Do I need to upgrade damage/armor on my old gear before I can Ascend it?

Since House of Wolves came out, it seems the need for (and provisioning of) Ascendant materials is all but removed. All of the Legendary equipment I see on offering from the various class and faction vendors don't have the multi-step Damage and Defense upgrades which would normally require those...

destiny house-of-wolves

Look at this nurd posting nurdy questions on a nurd SE.

@Iszi nurd

Steve DL

that game looks cool D:

Rory Alsop

17:17

And I siesta

I am going to Spain in a few weeks. Right down near Gibraltar. I just wear sandals and shorts.

For two weeks

Dubai and Vegas have caused me the greatest problems so far. At 50 degrees centigrade I fail

Completely

Thomas Pornin

@schroeder Tabs are polymorphic space macros.

schroeder

@ThomasPornin I stand corrected!

@SteveDL re: security.stackexchange.com/questions/89642/… in reading your comments, you appear to be using circular logic

no one brought up legal issues, but you are arguing that they are, then shooting down their defence because they are not lawyers

it's all very confusing to me

Rоry McCune

17:34

@Rhino The Tigger is in Amsterdam at the moment

so I'd expect @Simon to take advantage of his absence by #YOLO'ing up the place!

Rhino

@RоryMcCune What's he doing there? Being hipster?

Rоry McCune

@Rhino Actually limited hipsterism he, like I, am at OWASP AppSecEU

along with @Adi

Rhino

@RоryMcCune ah I see

David Freitag

Oooh TI put out a new USB C interface chip. I can't wait until I can use Type C connectors :D

ti.com/product/HD3SS460

Oooh and you can by Type C connectors on DigiKey! digikey.com/product-detail/en/898-43-024-90-310000/ED1391CT-ND/…

Ouch, $4.69 each though

Steve DL

@schroeder because that's what the word responsibility means?

@schroeder OP is asking what they can be held responsible for, responsibility between two parties is enforced by contracts and courts

Rory Alsop

17:45

@RоryMcCune - not jealous at all....

Polynomial

@DavidFreitag just do what I do - contact bulk sellers on Alibaba and ask for free samples: alibaba.com/product-detail/…

@DavidFreitag for low-volume (e.g. 5 units) it's ridiculous to pay $25 for something that's sold at a profit for $0.10 per unit in bulk.

Simon

@RоryMcCune I'm not feeling it yet, man. It's still not time for a comeback.

Rоry McCune

@Simon yeah well you know, it's important for you to maintain your artistic integrity !

David Freitag

@Polynomial I don't want to wait a month for my connectors to get here

Polynomial

@DavidFreitag last samples I got were 5-day airmailed for £6.

David Freitag

17:58

@Polynomial I take it you live in europe? All shipments from china to the US are on a boat.

Polynomial

@DavidFreitag UK, but that's not true at all - I know plenty of folks in the US who get airmailed boards from Chinese fabrication houses.

David Freitag

Every time I have tried to get an air-mail envelope it has been nearly $30 for shipping.

Polynomial

Ah - you're just saying it's expensive.

Ok. Yeah, it may be.

Transcript for