« first day (1678 days earlier)      last day (3500 days later) » 

raz
raz
16:00
@etherealflux It seems to be an issue with sed @M'vy was right. The regex works fine on regex101.com
oh, could sed be using a different flavor of regex?
raz
raz
@etherealflux Probably
@raz or regex101 does not support UTF8 and converted your things
raz
raz
@M'vy Well I assumed it has, and just did a match for \x20
And everything was cool
ok
try to use an UTF8 file for your sed?
using -f ?
raz
raz
16:03
Well I wasn't planning on using UTF-8, I have UTF-16 characters in there
@RoryAlsop So, I guess I get the whole thing's supposed to be trippy and all. But why'd they have to turn the guitar's neck into a dildo?
raz
raz
I hate regular expressions, there's nothing regular about them!
@raz Like that's the first time that's ever been said.
raz
raz
@Iszi shush
Let's parse some HTML with 'em!
16:08
@etherealflux no please don't do th..'a1'1;2;1'1d@!:!''###!:lda
there were no survivors
raz
raz
@M'vy python to the rescue! line_x = re.sub('[\x20\x00]{2,}', '', line)
ahah
4 hours ago, by Rоry McCune
aaand the pre-BH/Defcon hype trains start to roll..... http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
basically you don't want a car that has 3G and a route from the entertainment system to the CAN bus
@RоryMcCune Jeep, huh? Mine's way to old to have affected tech. But if it was re-used in Dodge cars, that might be a concern.
@RоryMcCune Ah. Don't think my car has 3G integrated.
16:24
@Iszi yeah this is a newer car thing, but this is likely the start of a series of problems, there's more and more routes into car networks these days.. e.g DAB
@RоryMcCune CHOOO CHOOO!
did you know, for example, you can send Java code over DAB radio in some cases..
16:44
RAIN RAIN !!! I see RAIN!
raz
raz
Is it chocolate rain?
no standard rain.
raz
raz
Is it C99 rain?
std::rain ?
nurdz
raz
raz
16:48
@M'vy I like it!
^^
@raz old school
pls that thing is as old school as me.
raz
raz
@Simon Do you even know what we're talking about?
@Simon and... you're getting old now, hell you're closer to @RoryAlsop 's age than you are to being born :op
16:51
Yes, it's a dude who repeatedly sings pluie chocolatée.
raz
raz
@RоryMcCune woah woah, no one's close to @RoryAlsop's age
@raz I'm referring to his publicised age obviously, not his real one
@RоryMcCune OUCH, I feel super old now.
he can't go around letting people know he's actually as old as Jones! (well almost, no-one's as old as her)
Indiana?
raz
raz
16:53
@RоryMcCune No time for love Dr. Jones
and I'll give 5 totally meaningless webcomic points if they can get that reference
the clue is that they're webcomic points :)
and she's really really old
raz
raz
Indy's a better reference overall, I don't care for webcomic points.
ironically @RoryAlsop may be the only person in the room who'd know that (well apart from I think @AviD)
it's an old one but this q has many link only answers, I just flagged 4 of them security.stackexchange.com/questions/77/apache-server-hardening
@TildalWave you still accepted the suggested edit :)
16:55
might need some cleaning up, perhaps converting some to comments and then commenting to all of them at the same time
Also flagged the said answer
@TildalWave Don't do that, people will make a thread about you on meta!
@M'vy because the link was better, but it's still just a link
if it'll be converted into a comment, it will have a better link :P
@TildalWave yeah, but we're not sure it's the same resource
(cc. @Avid @Rorya)
@Simon I don't mind a bit of infamy among vague contributors, what would they do, throw links at me? :)
16:58
@TildalWave what's that? A kind of fetish ? :P
hehe it could be, I'm not telling :P
ô_ô
@RоryMcCune Wow. RCE vulnerabilities in cars? Shit just got real.
@Iszi yeah pretty much. kinda hoping that legislation that's mentioned turns out to be good and gets into action quickly, as it doesn't sound like the industry on it's own will sort this...
The next TSBs will have CVEs!
Hell, why are they just TSBs anyway? Shouldn't this warrant a recall?
17:12
@Iszi yeah I was surprised at no recall for this
also a shame as it would've put a $ cost on it, which could've been used to justify security spend
anyone want an autonomous car with Internet connectivity now........
BTW: Like I said, my Jeep is way too old. And my car just missed it by a year.
@RоryMcCune Car with internet connectivity? Yeah. Autonomous car? Maybe. Both in one package? Never.
there was some interesting chat on potential reasons they were connected up like that here reddit.com/r/technology/comments/3e23ge/…
this theory was a combination of cost cutting (use same Internet connection for diagnostics and entertainment) and/or mis-configuration (not restricting access to the 3G connection properly)
@RоryMcCune don't we had that guy that claimed to have hacked planes using the entertainment system as well?
@M'vy yeah, unlike him these guys could at least do it in a semi-safe way
although cutting power to a car on a real road seems like a really dangerous way to test it
@RоryMcCune and I only know because of you :-)
17:21
@RoryAlsop yeah I almost got myself into re-reading from Jones' first appearance then stopped myself, when I realised quite how long that would take me....
@Xander Sweet comment on a almost 5 years old answer, brah: security.stackexchange.com/questions/77/apache-server-hardening/…
@RоryMcCune Happens to plenty of people every day. Would have been nice if they'd asked or checked his disposition before doing so though - driving uphill ain't exactly the best place to have your car die.
17:40
@Simon Somebody is running around and flagging link-only answers. They're valid flags though. so if there's no comment yet... <Shrug />
nice to see MS have a sense of humour these days....
^is an official piece of MS imagery
along with a desktop wallpaper for @Simon
@RоryMcCune Not sure what they want to tell me by showing a T-rex riding firefox.
@CodesInChaos apparently that's a ninja cat
Or is that supposed to be FoxPro? That would fit the dinosaur imagery.
@CodesInChaos :op it's a windows 10 ninja cat
on one of his noble steeds
the other one being
17:49
And how are "ninja cats" related to windows 10?
Steals your data and deposits it in the cloud without you noticing?
Who cares. They're brilliant :-)
I especially love the t-rex upgrade
@RoryAlsop the upgraded T-Rex is impressive :)
I already had a fan-made instance of the fire-breathing Unicorn on my desktop
It can now make the bed
Reminds me of Dead Beat, where Dresden rides to battle necromancers and their zombie hordes on a T-Rex.
@CodesInChaos It knocks over your desktop environment and chews on all the line endings
raz
raz
18:03
0
Q: Mobile Phone security - good phones for privacy?

user3578951I'm in the market for a new phone, and was wondering which modles/operating systems are the best to protect privacy/security. I don't use social media, so won't have Facebook/Twitter,etc. I am fairly diligent about keeping my info. private (i.e. for my browser, I have adblock, ghostery, do not t...

"Is there any way to just use Android OS but break any connection to Google?"
My answers to the Election questions are posted.
0
A: 2015 Moderator Election Q&A - Questionnaire

schroederAnswer by schroeder: I love these questions! Do you have any pre-existing conflicts or points of tension with community managers or other moderators? This question draws rationale from this Meta Server Fault thread: Abrupt change in moderation staff I maintain good relationships with a...

@schroeder good :)
raz
raz
That'll do
18:19
@raz I miss "too localized".
raz
raz
@Iszi Was that a old close reason?
I'm not sure I agree with @RоryMcCune with Cyanogen Mod not being Google. I feel like it's hard to not have Google involved in Android. But I see where he's going with it. Google doesn't have any control over their source code.
@raz Yup.
raz
raz
That and "This is not a question" need to be brought back.
"Too broad" is still valid for that one too, though.
@raz Ah, good old NaRQ.
I think that turned into "unclear".
raz
raz
@Iszi Yeah, I just never like the wording of that reason.
Sometimes I'm like, "I know what you're asking, you just didn't provide any information at all to help you" >.>
18:27
@raz What's really fun are the ones that nobody seems to understand but you, because they're so horribly worded and you alone spent about 20 minutes figuring it out.
raz
raz
lol
There's a real question in there, but you've got to totally re-write the whole thing for them so that anyone else can understand it.
raz
raz
@Iszi Because #dedication
And at that point you get really close to changing the actual meaning of the question.
So, do you spend an hour doing the re-write just to risk the asker saying "WTF? That's not what I meant!" or do you just close it as "Nobody gets what you're saying but me - fix that."?
18:33
@raz One of these days, there's going to be a scientific journal published which includes a paper on the medical benefits of ingesting bovine fecal matter.
@Xander And you think that the citizens are going to believe that?
@raz I was thinking it's not google in that you don't have to have Google Play services installed
which you do on any "certified" android device
and that service is what essentially (IMO) ties it into googles ecosystem
logging in with google accounts, using google location services etc
@raz Look at @RоryMcCune answering close-worthy questions. See, this is why he doesn't get my vote.
@Iszi just as well I'm not up for election
anyway I'm a noted question hippy
@RоryMcCune Details, details.
Adi
Adi
18:52
@deed Congrats on the one year!
19:12
@Simon The citizens are particularly belligerent today, aren't we? Perhaps the citizens need a juicebox and a nap.
OM NOM NOM JUICEBOX
well one good thing about the elections is that the review queues are all cleared :)
raz
raz
@RоryMcCune Google Play Services is installed on any Android 4.0+ based OS. I've written Android apps that use it, and my OnePlus run them just fine. Google Play Services are necessary for almost any Google API that is used by most apps.
@raz my understanding was tho' to have google play services officially you needed sign off from google
so uncertified android devices don't have an official path to have that installed...
per wiki.cyanogenmod.org/w/Google_Apps they're not installed by default on Cyanogen
raz
raz
@RоryMcCune Ah gotcha. That's interesting I didn't know that.
19:26
@TildalWave they rarely are really full anyway. If you come once a day, you got 10 close votes usually
19:46
true enough
raz
raz
@TildalWave Typical politicians. Do stuff through the election, and probably don't do shit when they're elected.
@raz - yep, on all my android phones I need to install a gapps version if I want use Google stuff. You don't need to, but I use a lot of Google stuff so...
Anyone heard news about OneGet lately? Seems it's been awhile.
@RoryAlsop what do you call gapps?
All the Google apps
raz
raz
19:57
@RoryAlsop Yeah that's true, now that I think about it I was putting nightly builds of CM on my phone and didn't have any google apps. At the time though, Google Play would crash on Lollipop
@RoryAlsop theay aren't there by default?
Is this considered to be a valid question? I'm not really sure. security.stackexchange.com/questions/94565/…
@M'vy not on cyanogen or any other non-google build
nor on some Chinese devices that didn't pass Google's approval
raz
raz
@etherealflux It's just going to turn into speculation on why a certain organization does X Y or Z. They could be asking about Microsoft and it would still be off-topic for this forum.
20:19
0
Q: Would it be possible to create a web crawler to perform XSS and SQL injection?

InquesitionI feel like this would be the worst malware to come across, taking out small websites and maybe a few large sites as well. How do people protect against it?

What kind of god damn question is that?
@etherealflux +1 to @raz. Now, if they were asking about StackExchange, that'd be migrated to Meta.SE.
I seem to recall we have some Elite: Dangerous players in the room, right?
20:32
@ton.yeung I trust veracrypt over truecrypt
yeah , exactly...Veracrypt enhanced a few things over truecrypt
i don't know why truecrypt suddenly
stopped to be supported, and i don't like that...still veracrypt is still supported and maintained while truecrypt is not anymore...
@ton.yeung i haven't audited their code, but i'm sure that at least some independent people have looked at the code, do you audit the code of every open-source software you use?
I trust Truecrypt...although I did manage to forget the password to an important partition once
I'm gonna' blame the software :D
@ton.yeung It's not like the TrueCrypt team has been extremely forthcoming about their code or development process, or like they requested the audit. The TrueCrypt audit was entirely community-driven, and they had a fair amount of difficulty doing their work despite even having occasional contact with someone who claimed to be a developer.
i even consider most of software options for full disk encryption quite weak if you ask me...i would rather use something like www1.informatik.uni-erlangen.de/tresor TreVisor to run disk encryption runs transparently for the guest OS.
if you are so worried about flaws or vulnerabilities on truecrypt or veracrypt then i would go this way
@ton.yeung Oh, no. The audit was certainly worthwhile. But after the audit, when TrueCrypt was no longer maintained and other developers made forks to fix problems that were discovered in the audit, TrueCrypt ceased to be so.
@ton.yeung With the existence TrueCrypt forks, which have patched issues discovered in the audit, there's no longer any point in holding on to TrueCrypt.
20:47
yeah that's what i'm saying, veracrypt is just a fork from truecrypt with a few fixes, is not like they rewritten the entire code and this make easier to other people to audit the forks...i'm don't have know-how to audit code sadly but i still trust veracrypt for it's purposes...wouldn't use it for full disk encryption although
Eh, let's just write our own crypto. What could go wroooooong?
<marquee>NOOOOOOOOOOOOOO!</marquee>
I mean, if you really wanted to, you could:

1. Stay on TrueCrypt for now.
2. Put together your own team of crack crypto researchers and secure coders.
3. Fund their research into [fork of choice] for a year or so.
4. If the audit results are favorable, switch after it is concluded. If not, repeat step 3 until a favorable product is found.
5. Repeat steps 1-4 ad infinitum (in step 1, s/TrueCrypt/[fork of choice]).
Heh, that star wall.
thats a tough question
well, they haven't rewritten it in PHP
20:52
How competent do you think the TrueCrypt team is?

Oh, wait... we don't even know who they were.
Until proven elsewise, I'm just going to believe that the TrueCrypt team was Batman.
veracrypt has been around for 2 years, and no know vulnerabilities yet, and its a quite popular software with no know vulnerabilities
there's actually a huge exploit...if an attacker knows your password, they can just type it in and get your files
8
@Freedom Just because there are no known vulnerabilities doesn't mean there aren't some nasty things hiding in there just ready to chew everyone's head off.
Hopefully they'll figure that one out
20:55
@DavidFreitag you mean there's a bear inside?
or a bobcat?
"Instead of crypto system, software contained bobcat."
5
someone must have looked at the code...thats the problem with every open-source software right? I still think its thousand times better than bitlocker
@etherealflux great perimeter deterrence
Wow. VeraCrypt project lead has only 191 rep on SO? Maybe we should re-think this. ;-)
plus he's French
20:58
@Iszi TRWTF is that he doesn't have a sec.se or crypto.se account
Btw I don't know who @etherealflux is, but he seems right at home here :)
already hit the starwall
@etherealflux I prefer the burlap sack of broken Soviet appliances.
@M'vy His tinfoil hat is certainly of adequate size.
@M'vy haa, thanks. I've lurked on stack exchange for a while, and figured I should actually do something on it
:)
@etherealflux Should have shown up a couple weeks ago. Would have had time to earn enough rep to join in the election fun.
21:02
I was stymied by the reputation barrier for a while. Didn't know you got a billion points with the various badges
@etherealflux Badges don't get you any points.
not badges - er, the other things
You know, those ones!
Funny, the election draws people, but the Q&A seems empty
Achievements, I think
@etherealflux Nope.
The only things that earn you rep on SE are:

Account linking (+100)
Up-votes on questions (+5)
Up-votes on answers (+10)
Acceptance of answers (+2)
Accepted answers (+15)
Accepted edit suggestions (+2)
Bounties (+x)
21:05
Ahh, that makes sense. I figured getting upvoted would only give one rep
so when I saw ten, I thought it was a bonus
@etherealflux It was, you are special.
+10 is for answers
@ton.yeung I think I'll give it a try
@ton.yeung I'm acclimatizing to Win8, but I'm not sure it's enough to prefer it. And so are my feelings about Win10 right now.
@ton.yeung Cortana better be completely disableable, otherwise I'll probably deem it unusable.
I might try Win10..although my poor, poor laptop will probably just explode when I try to install it
21:08
Oh! Cortana (Halo) + Cortana (Windows) + Rule 34 = Cortana VirtuaGirl for Windows 10
for a while the "z" key refused to stop sending signals and it only booted 20% of the time
@Iszi I used 8.1 for a long time, then my SSD died, and I switched back to 7 and realized how much I had missed it.
@Iszi ye gods
@ton.yeung Get Classic Shell. Practically never see Metro again.
21:10
And don't ask me how far I trust the Classic Shell developers.
'Cause there it is, right there: Unless you're checking for code audits of every piece of software that goes on your computer, and you fully trust the auditors, you never know what you're running that might be sending all your data to [insert TLA or hostile country of choice here] - WDE be damned.
Just grep the source code for "hackComputer()"
@etherealflux I don't think Classic Shell is open source.
Can we get a diamond to move this one? @RoryAlsop @AviD @JeffFerland
0
Q: Tracing IP address of comments in Blogger.com

D_SIf a comment is posted from a Google account on a blog hosted in Blogger.com, can the IP address of the person who has commented be traced by the blog owner?

For most software projects, an automatic decompilation yields a source code which is not substantially less documented than the original.
2
Depends on the language. Java isn't half bad, although you still get a lot of "int a; int b; char c"
if I recall correctly, at least
21:15
@ThomasPornin Yeah but if it's not .Net I couldn't be bothered.
.net code is perfectly readable, optimized C is a PITA.
Most of the code I work with is optimized C for arm/avr
@etherealflux Now, how much do we trust those developers?
@CodesInChaos I actually tend to decompile .NET code for which I have the source code -- because the original source code is in VB.NET but the decompiler produces C#.
What is so bad about VB.Net?
I recall very little difference between that and C#
21:19
@Iszi Can we even trust gcc? There was that one wicked clever self-propagating compiler that inserted a backdoor when it compiled the Linux kernel and inserted its own malicious code when it noticed it was compiling itself.
I often decompile the framework since MSDN sucks for .net.
I'll just go back to banging rocks on other rocks...
@etherealflux There was an actual piece of malware that infected the delphi standard library and thus any program compiled using it.
@Iszi I tried. It was deleted 8 seconds before I clicked migrate.
shoot, these rocks have Windows line endings
21:21
@etherealflux See, unless you're a butterfly programmer - or know and wholly trust an auditor who is - there's really no way to tell what code is going to be safe to run for any given purpose.
@DavidFreitag The bit about line breaks means that source lines are often larger than the screen, which decreases readability.
@ThomasPornin That is indeed super annoying.
@etherealflux assuming you mean the original Thompson hack and not a more recent imitation, s/Linux/Unix/
@Gilles ahh yeah, that was way back
Also the rules on casts are poorly documented and change depending on compilation options. By decompiling to C# I see what really happens.
21:23
@ThomasPornin I usually write code that is longer than the screen, I don't mind scrolling.
I usually stop and ask myself what I'm doing if my code runs off the end of the screen
The code formatter will automatically fix that if you tell it to though.
@DavidFreitag Or just spread the window across multiple screens.
...unless I'm writin' Java, of course
AbstractSingleProxyFactoryBean.frobnicate
@Iszi Normally I have a spec sheet or some form of documentation on my second screen.
21:24
And compilation/decompilation removes the existing comments, which in many cases is a blessing.
@etherealflux or iOS
@DavidFreitag You don't have three?
Lack of comment is much better than a lying comment.
@Iszi Nope only two in my cubicle.
21:24
And only two at home. Although one at home is a 48" led visio
Do you have a mechanical keyboard louder than a jet engine at takeoff, at least?
@DavidFreitag Triple-screen is the way to go. Until of course you can get a monitor tree.
@DavidFreitag 1080p is equally useful at 48" as it is at 20", though perhaps readability will vary.
@Iszi bleh. I want a single monitor. Curved.
@ThomasPornin When I bother to write a comment, you better read it!
// adds 1 to the value contained in the integer variable 'x'
x += 1
and x is actually a double
21:26
@Gilles oooh, yes
@Iszi I really like it for games and movies. It's on a swivel mount. Readability is just fine. I can see pixels, but they are probably 0.05mm x 0.05mm in size.
@etherealflux keyboards should be felt, not heard
remind me never to accept you as my officemate
@DavidFreitag I meant the other direction - higher DPI at the same resolution usually results in lower readability.
@Gilles Those have dropped in price, they are about $1300 last I checked
@DavidFreitag yeah, they've gone from science fiction to insanely expensive to beyond my budget
21:27
@Gilles Sorry CLACK I CLICK can't heaCLACKr you
I hope they'll be mainstream by the time I need to renew mine
I have a kludged mess of 720p and 1080p monitors. I'll sort something prettier out in a lil' while
@Gilles Well $1300 isn't that bad when you consider each monitor in a triple setup could be $300
@DavidFreitag can you get a non-ridiculous resolution for $1300 now?
@Gilles I recall a friend of mine talking about a display that was equal to three 1920x1080 displays in one curved display.
21:32
But can we experience our code, preferably in 3D?
@etherealflux With an oculus rift?
nice, $400 (plus tax) for a low-res monitor, $1000 for 5k pixels
@DavidFreitag That's simultaneously awful and brilliant
it's getting affordable
@Gilles Just don't get a samsung. It'll be dead in a year or two
21:35
@DavidFreitag have they gone downhill? At work we have quite a few and they're doing well
@Gilles Recently yes, their build quality on all but their highest-end gear is pretty much crap.
Daaaaamn a 1.2GHz signal generator?
I have 3 Samsungs now on my desk and two are years old now
@Gilles - I'm with @etherealflux on the keyboards. My preferred typing keyboard is old IBM. Admittedly I don't use that at work, or gaming... As others would object
@RoryAlsop Exactly, I'm not talking about older Samsung devices, it's the new stuff that is crap.
mechanical keyboard FTW :)
I never saw the point of a mechanical keyboard
21:46
But I guess if I brought mine at work, I'd be yelled at
I'll take a $7 amazon basics keyboard any day
@DavidFreitag touch.
Dime a dozen
@M'vy Well I understand that is the common excuse, but I never really saw the difference.
You can't be mistaken whether you actuall pushed the key or not
I can generally tell by the fact that there is a character sitting in the text box ;]
21:48
Yeah, well, some people are more visual, some more tactile I guess
Sure, I will admit that a regular keyboard tends to get a bit crap over time, but I'm totally fine with buying a <$10 keyboard once every few years.
You are entitled to like 10$ keyboards :)
It's not that I like or prefer them, I just cant justify the price of a mechanical one.
Well, if I keep it for 10 years, that's definitely worth it
Not if I only spend $50 on keyboards...
You can easily spend twice that on a good mechanical.
21:51
it's not only about money anyway
well it is for me, lol
:)
Well that's not entirely true
it's definitely a criteria ofc.
I have a naga and a pair of tiamats
But I have those because the gain over a standard device is worth the price
21:53
I could say the same :)
Can you imagine Sauron using a touchscreen interface to make the One Ring ?
Some things must be forged.
:))))
Similarly, some tasks deserve, and require, a mechanical keyboard.
I have not encountered such a task
And yes I could see Sauron using a touchscreen to make the one ring.
And then enjoying a nice piping hot mug of death while it made the ring for him.
@adi ya fucking troll
22:03
@Ohnana coming from the heart, isn't it
@ThomasPornin bashing people on the head?
Well, there thousand of reasons why to use a mech-kb and probably thousand other for std-kb
just get the one that feels good to you and it should be ok :)
 
1 hour later…
23:33
guys do anyone knows a hosting company who provide BitVisor virtualization ?

« first day (1678 days earlier)      last day (3500 days later) »