« first day (362 days earlier)      last day (4816 days later) » 

09:40
@Ninefingers - is this one of interest to you?
1
Q: passphrases - lowercase and dictionary words

WojtekAmid all the discussion about password length vs. complexity (summarized by the famous xkcd strip and the followup dicussion) I am trying to make up my mind about passphrases made up with dictionnary words. I understand the various calculations for brute force attacks -- would you know of a reas...

it's pretty much a comparison of brute forcing and dictionary attacks, but for passphrases made of multiple words
@RoryAlsop Hmmm - possibly I think it might. It could do with some editing I think. I need to disappear for a bit unfortunately but when I'm back I'll have a look, see what can be done. If @ThomasPornin or @pauloebermann are around and want to have a nosey, feel free not to wait!
 
5 hours later…
15:06
Does anyone else just love it when the fecal matter collides with the spinning turbine, and you've suddenly got to re-construct a timeline from a few months' e-mails, involving three or four groups, within a matter of two hours?
</vent>
@Iszi Please, don't vent fecal matter through a turbine to the atmosphere.
@JeffFerland I think it depends on where the atmosphere is. Farmland? Probably pretty fine
I think I picked the wrong day of the month to reset my preferences... which is MDY and DMY?
15:25
Nicely done!
@JeffFerland Ha!
@JeffFerland Set your time zone to somewhere in Australia.
Just don't pick Perth. I mean, honestly, who would want to do that to themselves?
@JeffFerland Thanks by the way. Needed the giggle.
VMs make me happy. "This is taking too long, I'll throw a few more cores at it until the initial load finishes."
16:27
0
Q: Generic updater for php-applications and other webapps

Fabian Zeindli administer a few servers, on some of which are a lot of users which happily deploy mediawikis and oder php-applications. this gives me head-ache since there are often old versions of them lying around. Is there something like an automatic upgrader for php-applications and other web-apps? I kno...

Offtopic?
I think so, yeah.
I'm not sure which site would be best, though.
webapps, webmasters, or sf?
I've no idea - possibly webmasters?
I don't know enough of webapps or webmasters to actually know what they want or do
Not webapps - that's for gmail/hotmail/facebook/whatever customers. Webmasters do... being webmasters and serverfault probably cover webmasters too.
Yeah, I don't actually know where that line gets drawn.
Ok, webmasters might work out
They don't onebox the faqs? Wow.
16:34
@ScottPack Too big, probably. To onebox the whole thing would be a bit difficult...
The onebox usually only gives you a relatively short context anyway. I mean, wikipedia is on the onebox list
True
Looking at this migration (serverfault.com/questions/340183/…) I wonder if serverfault might not be a better home for it?
I could just ask I guess.
That might be better
According to the first couple of lines of the faq, I would have thought this would be topical for them
Rephrase:
actually, nm
just kick it to Serverfault. I'll answer it there.
Create your own .dpkg setup or pull from unstable is the answer
I can't.... we need @RoryAlsop for that one!
Sounds like a serverfault thing
16:51
Answer from serverfault chat was:
in The Comms Room, 5 mins ago, by Chris S
Yeah... That could go either way. I think if it goes to SF he's going to get general configuration management solutions... Webmasters might have better ideas as to something simple.
And everyone else said ship it to webmasters :)
17:51
herro - someone say my name?
@RoryAlsop See ma flaaaaaaag!
so you want me to ping it to webmasters, yes?
will do that then
done!
@RoryAlsop That appears to be the conclusion of everyone I asked.. it's not really "security" server admin and SF chatroom said no.
sorry - it's been utterly hectic all day. RFP came in yesterday afternoon for response tomorrow!!!
very little time to check in on my usual sites
18:12
I think the existing answer covers this one well, but should it be migrated anyway?
0
Q: Is it possible to not store passwords locally, at all?

ekajEarlier this year I was playing around on the schools computers and found out the administrative password to a computer in my classroom. I realized how XP stored their passwords, booted into Ubuntu, and took the SAM and SYSTEM files. I was wondering if it was possible to store these passwords on ...

I think so - we can close as dupe once it is here, and it at least lets the OP know that this is where he should ask
@RoryAlsop We have a dupe?
@Iszi I think so - I'm sure we have
If not, even better :-)
18:33
@RoryAlsop You're evaluating and writing a response for one, or you're reviewing responses?
 
1 hour later…
19:55
Migrate?
0
Q: Are powerline ethernet adapters inherently secure?

zm15I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or townhouse. I've noticed the speed is much faster when i just plug and play, rather than going through ...

20:09
That could be an interesting question, though I suspect the real answer is pretty hardcore EEish
Do we have any of those guys?
As far as I know @Rory is our closest
@ScottPack sadly - I'm writing a response :-)
@ScottPack :-)
Sadly?
well it basically means 3 14 hour days in a row
have popped an answer on the powerline question - as I've tested it extensively in various environments :-)
20:37
Shit, I could have answered that.
I was expecting you to talk more about monitoring the EMF and reconstructing data streams.
@RoryAlsop Since you've done some testing, where do un-encrypted powerline adapters fit in operation mode, relative to switches and hubs? I'm not really that familiar with the technology at all, but I would imagine it has to operate as a hub just on principle.
@ScottPack LOL - I'm really all about doing the simple stuff
Oh, some guy wants you to site [sic] your sources on power line bleed between homes.
@Iszi more hubs than switches - but some are intelligent enough to learn what Mac address should be on a port, so can work as switches
@RoryAlsop How can they possibly work as switches across the power line? It doesn't make sense to me.
20:48
The adapters themselves would perform the switching, aye?
@ScottPack On the Ethernet end of things, I can understand that. But how does the adapter control the route its data will physically travel across the power lines?
@Iszi Ah - no I see what you are asking - no, that doesn't happen
for devices with multi ports, they act as switches on the ethernet end
everything gets broadcast on the power line
unless it is destined for a port off the same device
@Iszi Don't forget that switches fall back to hub behavior when that specific device doesn't have the MAC in it's learned table.
@RoryAlsop So, for the purposes of the vulnerability assessment in question, the answer is "hub".
..... yes
:-)
sorry - there I was reading too much into the question
20:50
So let's think of them as small switches linked by a bus?
@ScottPack Yes, but that's very temporary unless we're getting into things like ARP poisoning.
@Iszi Define "very"
I've seen this behavior last for an hour or more.
@Iszi oh, and some don't learn, but have to be taught
Let's take the example of a syslog server.
It might be receiving UDP datagrams every second, but never communicate out.
So the entry in the learned table ages out and never gets updated.
Even though the machine continues to receive data.
20:54
Systems don't ARP before sending UDP?
Oh, wait. We just moved to a lower level.
Now I'm wondering if things will go to the local net if no arp reply is received
So, @RoryAlsop - Are we getting that question pulled here? It seems apparent that this is where the expertise lies.
@Iszi yep - Ivo is pinging it over
@RoryAlsop Well, this is interesting. I could swear I voted your answer up over at SU. It looks like I get to do it again here, now!
@Iszi yay
:-)
wonder if I should ping that as a bug to MSO... lemme go see if it's already there
21:04
Apparmor -- kind of a bitch when your OS changes underlying directories
@Iszi here:
11
Q: Migrated question's answers can be upvoted twice by the same user

Ilia JerebtsovThis question was created on Server Fault, answered on Server Fault, I upvoted some of those answers on Server Fault, and then moved by consensus to Super User. Now that the question is on Super User, I can upvote the same answers I previously upvoted on Server Fault.

@JeffFerland what did it break?
@RoryAlsop MySQL... I kept my config file because it had some custom directories. The diff didn't seem important to me... I didn't realize Ubuntu was adding a whole other root directory... now there's /run and /var/run. Ugh.
7
Q: Building our own migration list

M'vyNow we've graduated from beta, wouldn't it be time for us to set our migration list? I would propose: meta.security of-course superuser serverfault webapps math / theoretical.cs / stackoverflow Does the moderators have some feedback on this in term of statistical of previous migrations? Th...

@Iszi ARP tables tend to have a much longer age out than CAM tables.
I want my damn list!!!
@JeffFerland If the relevant piece of network kit doesn't know the MAC, it won't send the packet.
21:15
@ScottPack I thought you just said that it would broadcast it if it forgot the MAC? Or am I getting confused?
@Iszi So let's say I send a packet to another device on my broadcast domain/
@ScottPack That was my understanding.
I'll check my ARP table for an entry, if one doesn't exist then I'll arp for it.
The destination will reply and update the learned table on the switch.
Oh, I've got it now.
If I send something to a device on a different broadcast domain, the router on the remote subnet does the same thing.
21:18
If there is no ARP reply, the ARP sender won't send the next packet.
However, it's not uncommon to see routers with ARP timeouts measured in hours.
And switches with CAM time outs in minutes
(Regardless of what the switch would do if the packet were sent.)
In that case, I know the MAC address so I'll send the packe.t
The switch, however, doesn't know which switchport the destination device lives on.
So it forwards that packet to every port.
For TCP it's no big deal, because the SYN will trigger a SYN+ACK which will update the CAM tables.
UDP gets a little wibblier since there is no ACK.
The question then becomes, how paranoid are you about leakage of your UDP data?
I'll go with that, sure.
21:24
@ScottPack Are we talking about a logging machine that has its send cable cut or all traffic firewalled? Otherwise, it will respond to ARP which will come before a UDP is sent to it.
Unfortunately, it presents as a pretty severe network glitch if you don't understand the RFCs and implementations well enough.
I actually recommend you do a packet capture on your desktop, filter out your stuff, and have a gander.
It's good fun.
@JeffFerland Not necessarily.
Since I brought it up earlier, let's take the example of a syslog collector.
@JeffFerland The problem is, as Scott mentioned, that the ARP table will sometimes outlive the CAM table. So, the switch will forget where the target device is long before the sender asks it again.
If nobody logs into it, it's not forwarding logs, or sending alerts, when would it ever talk back out?
Check for updates, sync time?
OK< now I get the context... UDP spitting out of every port on the switch.
I've seen linux machines that can go hours without ever sending a packet.
21:27
And on honeypots I build, the logging box physically only has promiscuous in - the other twisted pair is cut :-)
@RoryAlsop I knew somebody else out there did that. :)
@RoryAlsop Oooh, I've got to learn that. But right now, I've got to go. Cy'all later.
@JeffFerland it is essential if you make the assumption that the bad guys are smarter than you and can figure out a way round technical controls
When I was young, I used to create loopback plugs that had no cable sticking out the back, only 2 wires that connected send to receive and then crimped. It was a fun toy.
this way they have to physically own the box to get at the logs
21:28
@JeffFerland You can buy those in ThinkGeek now
@ScottPack excellent
@ScottPack That's just wrong. Some things shouldn't be mass produced. If you can't build your own damned lightsaber, you don't get one.
I am such a dick
0
A: making sure daemons are safe

Scott PackThis is a fascinating question. Normally, one asks how to protect themselves from daemons. Working backwards, I would recommend starting with a high quality summoning circle. Once the daemon is within the circle, charge it the same way you when when summoning, except reverse the polarity so that ...

@ScottPack hahaha - let's see how long it lasts before getting flagged into oblivion :-)
It was fun, that's all that matters
If I get a few downvotes I'll go ahead and delete it. I just had to do it.
21:38
and the 'sensible' answer is just wrong :-)
Thanks for stealing my thunder, @Jeff.
@ScottPack Headshot!
@ScottPack hahaha
I like to help to newbies!
... even if that was a pretty good answer.
ಠ_ಠ
21:41
I really need some rep on Serverfault. It's sad that I'm so low there. I don't answer enough.
for posterity :-)
It looks a lot longer on your screen.
@ScottPack heh - that's what she.....etc
@JeffFerland don't rub it in - I have half what you have over there
Oh baby!
I had intended to hit 10k over there by the end of this year.
@ScottPack Yes, I upvoted you. You're now at 3
21:43
I've not answered shit on either place in forever.
@ScottPack I am running this one at 1920x1080, but the chrome window is only at 2/3 that
Well, there it went.
glad I screenshotted while I did
@ScottPack Did you delete it?
@sysadmin1138 Well, I expected as much. Good while it lasted :)
21:47
@ScottPack sysadmin1138?
oh - he nuked it
Oh, he's one of the mods on SF.
@ScottPack yarr - I have seen his name in a summoning before :-)
(in the Teacher's lounge, if we want to speak to mods of a particular site, we have a summoning command :-)
nice - and also prone to much silliness :-)
pashaw
21:55
no really :-)
hang on, have I put a smiley after everything I have typed this evening?
jeez!
You're like a 13 year old girl
If this weren't google index that would be followed up with a very funny joke.
hahahahaha - I'll take that as read
@RoryAlsop DAMN YOU HENDRIK, YOU'VE STOLEN MY POWER TOYS!
Crap, he's about to beat me to 10k too.
@JeffFerland but you got 150 more rep than him this week
you just need 10 more upvotes
They chose a very nice photo to get the point across there
22:06
go go @Jeff vs @Hendrik
22:39
incoming lads - SO mods are going to send us this. Needs a bit of cleanup work, but the core topic is good, I think
-2
Q: Is it safe to transfer Facebook access token via TCP?

Jason SmithIs it safe to transfer Facebook access token via TCP? What is the worst that can happen if someone gets the token?

23:04
Oh, snowman.
@JeffFerland, I had a head start.
Evenin
Or one of (morning, afternoon, night). Select as appropriate.
23:19
just about bedtime for me - my brain is fried. Need to be in the office early doors to continue writing this proposal
I detest writing proposals.
If I could write "just agree with me, now fund my project" that would be much easier but apparently that's not how it is done.

« first day (362 days earlier)      last day (4816 days later) »