The DMZ

this.josh

01:46

@TomLeek It's not evil enought! You additionally need Opera, Firefox, Camino, Lynx, and Internet Explorer for Mac.

Thomas Pornin

03:41

@thisjosh At some time I used Internet Explorer on Solaris (Sparc) as main browser. Does it count ?

Rory Alsop

10:34

@ThomasPornin I don't see a spam one - unless you mean Toby's one, which is a bit half and half

he has provided a link to your post on his blog - not sure whether it has affected site traffic though

Thomas Pornin

17:04

@RoryAlsop Well, that's it. I could not understand what that comment was about unless I clicked the link, so this really looks like spam to me.

Now maybe it is not worth the effort deleting it.

Ninefingers

17:59

0

Q: What was the earliest use of cryptographic tokens in URLs?

I was wondering: it now seems to be more and more common to see people/framework putting cryptographic tokens in the URLs their webapps are generating (to prevent quite effectively against quite some attacks). It is advised by OWASP etc. However I was wondering: what was the earliest known usag...

Any thoughts on the suitability of this here? @pauloebermann and I don't think it really fits on crypto (@ThomasPornin ?) (cc @annalear).

Thomas Pornin

@Ninefingers It is an historical question so I am not sure it belongs to security.SE either

There is an underlying crypto question, which is: how would I generate and verify a "token" embedded in the URL, destined to filter out non-genuine URL ?

the answer being: use HMAC or an asymmetric signature, depending on context (HMAC will be lighter)

but that's not the question which is asked

Ninefingers

@ThomasPornin indeed. I think as it stands "ask questions about actual problems you face" which is in the faq of every site basically covers it.

Thomas Pornin

So the question would be appropriate on a site about history of science. I am not sure there's one.

Ninefingers

@ThomasPornin There's a history.se but they don't take academic history questions - they're history in the school history sense, not "anything old".

Stefano Palazzo

18:33

I've got a quick question for you guys,

though I might well be in the wrong place

here goes,

if a^(phi(m)) = 1 (mod b), where a is coprime to b, and phi is euler's totient function,

then why is a^(phi(b)-1) = a^-1 (mod b)?

it's RSA, in case this seems utterly off topic. it's only 96% off topic (:

I should probably move that to the maths room.

Ninefingers

@StefanoPalazzo because a^phi(m) * a^(-1) = 1 * a^(-1). It's just a re-arrangement of the powers, basically.

Stefano Palazzo

oh my word

yes! hey thanks a lot :)

Ninefingers

@StefanoPalazzo no problem :)

Stefano Palazzo

I might as well get in a plug on that note,

if you know a bit of python and some maths, why not help us out with ZS Crypto? :-)

we are always very short on code review

Ninefingers

18:50

@StefanoPalazzo I'm massively short on time, but, that said, I write python as a day job, would love to create more python 3 code and could do with an excuse to study the elliptic curve stuff, so I'll clone it and upload to my github if I get any time.

Stefano Palazzo

fantastic. and if you do study ECC, I'm afraid there'll be more questions coming your way ;-)

this.josh

21:01

@ThomasPornin Only if you are still running Netscape 4.x on a AMD 486.

It's hard to have failth in your IT department when they think a .bz2 compressed file is encrypted because McAfee told them so.

Thomas Pornin

@thisjosh At that time, my desktop system was an Alpha machine under FreeBSD; it was around 2000 and there was no reasonable Web browser for that system -- so I was using IE from a Solaris system (thanks to the X11 support for network).

this.josh

@ThomasPornin Wow, talk about nice kit! Do you still have the Alpha machine?

Thomas Pornin

@thisjosh It was at the lab where I did my PhD. I think the machine has been shut down for at least the last five years.

I also had (much smaller) home Alpha systems, but they all died

this.josh

Thats too bad. At university we had some Sun Sparcs. I think they ran netscape.

Last time I checked my first 386 was still running, but that was two years ago.

Thomas Pornin

21:20

@thisjosh My very first computer (from 1984) is still operational, but it is stored in a box at my parents' place, because there would be little point to bring it to this side of the Atlantic: it requires 220V / 50 Hz current, and a TV with a SCART plug and displaying 50 fps (interlaced).

this.josh

Ow thats a good chalenge. Let me think, available in France, uses a TV, but I don't think so

There was a BBC computer, but I can't remeber the dates, Amiga maybe

no too late, I'll go with BBC micro

Thomas Pornin

It's a Thomson MO5

Thomson MO5

The Thomson MO5 was a 6809E-based computer introduced in France in 1984. It featured 32 KB of RAM, a 40×25 text display, and built-in Microsoft BASIC. The MO5 was replaced by the MO6 in 1986. External links *[http://dcmoto.free.fr DCMOTO]: PC emulator for Thomson MO5, MO5E, MO5NR, MO6, T9000, TO7, TO7/70, TO8, TO8D, TO9, TO9+ and Olivetti Prodest PC128. Comprehensive software and documentation are also available. *[http://www.old-computers.com/museum/computer.asp?st=1&c=12 MO5 at Old-Computers.com]

this.josh

Damn, I didn't think those were common enough.

Thomas Pornin

At that time (it was late 1984), there were dozens of computer types on the market, all incompatible with each other.

The Thomson computers were quite common in France because they were chosen for the plan "Informatique pour tous" (literally "computers for everybody")

French government injected a lot of money so that all schools (even elementary schools) had such machines

this.josh

I was guessing that Apple, Amiga, and Atari would have delayed a year or two from USA introduction to European intoduction, making them too late.

Thomas Pornin

21:32

First Atari ST was built in 1985, I think, maybe 1986

An first Amiga a few months later

the Apple II was quite widespread, but expensive

direct competitors for the MO5 / TO7 were Amstrad CPC

this.josh

Yea, I also wasn't sure of the dates. I had an Apple ][.

Thomas Pornin

an MO5 cost about 3000 F at the end of 1984

an Apple ][ was almost twice as much

this.josh

Yikes!

Thomas Pornin

(that's about 600 $)

from 1984 to about 1990, that price (3000 "Francs") was the basic price for a home computer

this.josh

Huh?

Thomas Pornin

21:36

then, from 1990 to around 1998, home computers became substantially more expensive

it took almost a decade for home computers to become affordable again

this.josh

Ok, I am certain my Apple ][ cost at least twice that but it came with a color monitor.

and an 80-column text card!

Dual 5.25" floppy drives, so I didn't have to remove the OS disk to run programs.

Stack Exchange

Stack Overflow Blog: The Art of Organizing CHAOS

Posted by Abby T. Miller on November 8th, 2011

Three months ago, CHAOS was born unto this world. There were just three of us to begin with, and nobody had any clue what our team was supposed to be accomplishing. Well, that’s not completely true: from Joel’s blog post, we knew that our eventual goal was to grow the Stack Exchange communities past some sort of imaginary tipping point at which they would begin to magically thrive on their own.

Easy, right?

So imagine for a moment that you’ve been hired as part of a team with this goal. You walk into work on your first day, fill out all your paperwork, get your computer set up …

Thomas Pornin

My MO5 only had tapes...

One year later, my parents might have bought a CPC 664 or 6128, with floppies

Three years later, it would have been an Atari ST or an Amiga

Gilles

Hello, what do you think of this question on Sec.SE?

0

Q: What does Amazon's S3 Server-side encryption protect against?

Amazon's S3 storage service offers server-side encryption of objects, automatically managed for the user (Amazon's Documentation). It's easy to enable so I'm thinking "why not?", but what kind of security does this really provide? I guess it prevents someone from wandering into the AWS datacente...

amazon-s3 aes

the very fact that it's being unloved on SO makes me think it's a worthwhile question here

Thomas Pornin

@Gilles I think it would be appropriate on Sec.SE

Gilles

21:48

@ThomasPornin right, flagged

Thomas Pornin

And I would have answered the same thing that your comment (but with more words, because I am verbose): such server-side encryption should protect against some partial breach scenarios on the server side, in the area managed by Amazon, and in particular stolen backups.

Gilles

@ThomasPornin I hope you will write such an answer

Thomas Pornin

@Gilles It can be done.

I'll wait for the migration, though

Hey, I got the "Proofreader" badge, but my "activity" page records only 99 reviews

Normally, I should have gotten this for the 100th review

(actually got it this morning, for my 98th review)

Gilles

maybe 2 posts were deleted after you reviewed them

they'd disappear from all histories, but I guess your review counter stays

I was looking for information on laptop searches at borders (for this and that question). It's hard to find info on countries other than the US!

> Although one might wonder what a customer account database has to do with privacy rights

M'vy

22:27

Hey DMZards! or is it DMZers?

Gilles

@Mvy DMZels? (none openly :-()

Thomas Pornin

@Mvy DMZians ?

this.josh

Oops meeting time...

Thomas Pornin

Meetings, the all-time favourite alternative to real work.

3

M'vy

^^

Gilles

22:29

@ThomasPornin didn't you forget a “least” in that sentence?

Thomas Pornin

@Gilles It depends on the context...

for me, meetings involve Skype

so this can easily translate to free Web-browsing time

M'vy

^^

Thomas Pornin

or even, horresco referens, free chat-on-DMZ time

Is it me, or are we entering a French zone right here ?

M'vy

Citing Virgile?

Euh...

Learned new latin sentence thank to you : fr.wiktionary.org/wiki/horresco_referens

Curiosly there is no english page for this

Thomas Pornin

Some people say that Virgile is mostly quoted by French authors because of the masterful translation by Baudelaire -- which English-speaking people cannot appreciate.

M'vy

22:37

Good point

Thomas Pornin

That's my favourite example when I argue that dubbing can be of high quality (although in most movies, it is just horrible)

M'vy

I agree with you on the last part :P

Thomas Pornin

Which leads me to the Big Question: the latest "Tintin" movie by Spielberg, should I see it in French or in English ?

Gilles

@ThomasPornin I've heard that of Poe, but the (few) passages I read in translation didn't support this

@ThomasPornin methinks this is a trick question

Thomas Pornin

@Gilles On the subject of cryptography, "The Golden Bug" is a very good introduction to old-style cryptosystems, and the French translation by Baudelaire ("Le scarabée d'or") is quite good.

Thomas Pornin

23:10

@Gilles A good answer was already posted by @Ninefingers; no need for me to add to the redundancy.

Ninefingers

@ThomasPornin @Gilles basically answered it in the comments... I only really fleshed that out into a fuller answer.

Transcript for