The DMZ

kalina

14:00

that definitely didn't happen

Mark Buffalo

@kalina they already know who I am :b

kalina

exactly which means you're dramatically increasing your surface area for potential opsec failure

Mark Buffalo

who I am is an open secret

kalina

because now I have 6 people I can talk to and get information out of instead of 1

Mark Buffalo

not trying to opsec

kalina

14:01

bwahahahahahaha... etc

MickLH

Kalina detected.

kalina

fine, remove all of my fun

MickLH

Fun removal. Complete. Begin fun ransom.

Rory Alsop

Fun removal. Fun removal machine... </Ian Astbury>

kalina

all my fun doesn't belong to me :(

MickLH

14:03

But it can be yours for the low, low price of your soul!

kalina

I don't have a soul

MickLH

Hence "your" italicized

kalina

A wild @Monika appears

are you a friend of @MarkBuffalo?

Mark Buffalo

@Monika hello colleague friend

Monika

huh?

Mark Buffalo

14:04

@Monika I'm sitting across from you

kalina

are you the one he said was shockingly beautiful and he'd cheat on his wife with?

Monika

that shouldn't be me :-)

Simon

"Member for 1 year, 6 months"

pls that's not your colleague.

Mark Buffalo

DAMMIT KALINA

Simon

Markus, continuing his lying streak.

Mark Buffalo

14:05

That's disgusting!

kalina

hmmm, shouldn't, not isn't

.oO( idea )

Mark Buffalo

@Monika No, I'm just messing with you

Monika

I wouldn't want to ruin your dreams

kalina

@MarkBuffalo the thought of being with @Monika is disgusting?

that's so rude

I can't believe you'd say that with her just there

points

Simon

-.-

M'vy

14:06

hey new persons!

Simon

This whole thing is so damn silly.

And yes, I'm the one who says it.

Journeyman Geek

@Simon not everyone knows about chat ;p

Simon

That's how silly it is.

kalina

@JourneymanGeek I wish he didn't know about chat

Rory Alsop

Welcome new person!

So, you're a fed too, eh?

Journeyman Geek

14:07

I feel that way about a lot ~~of you~~ of people ;p

Rory Alsop

:-)

Monika

I'm hardly new, but I'm willing to act new if it brings me any privileges?

Simon

@Monika Literally none.

kalina

I grant you temporary fireproofing

Simon

Actually I lied, since you're new, you get to think that we're not assholes.

Matthew

14:08

@Monika Slightly more abuse, I think

Journeyman Geek

naw, other than the lack of cake and grief counseling

kalina

may you remain unburnt

MickLH

the're fuckin bluffing

kalina

@JourneymanGeek this obviously doesn't include me since you love me and I'm awesome

Rory Alsop

I love cake

kalina

14:09

all normal people love cake

Journeyman Geek

I wouldn't mind some cake.

Arperum

@RoryAlsop Cake is good. But not chocolate cake. I love chocolate, and cake, but I really dislike the combination for some reason.

Monika

I tried to sneak in here to see people say what they actually thought about my question, but would be to 'civilised' to write down in an answer.

Rory Alsop

Civilised? Here?

Monika

chocolate cake is good.

M'vy

14:10

yeah well... cake is... you know

kalina

@Monika which question

Rory Alsop

Chocolate cake is in the top 5 best foods ever.

Cheese is obviously top

Simon

0

Q: Is this use of PBKDF2 for generating passwords secure?

Reading Security Engineering by Ross Anderson, chapter 2.4.7.1 Password Manglers got an idea that finally seems to solve the issue I have with the existing 'I need to remember a strong* password for too many systems' solutions. *) my passwords are randomly generated, with a size depending of the...

kalina

I'm not sure if cheese beats chocolate cake

Monika

ah, that one.

kalina

14:11

I think you need two lists

maybe have a "sweet" list and a "savory" list

Ohnana

cheese and apple pie?

kalina

so they can both be #1

Monika

only chocolate can beat chocolate cake.

Arperum

I guess I'm a monster then for disliking chocolate cake.

kalina

@Arperum WHAT?!

Matthew

14:11

KILL THE MONSTER!

Arperum

1 min ago, by Arperum

@RoryAlsop Cake is good. But not chocolate cake. I love chocolate, and cake, but I really dislike the combination for some reason.

Simon

@Monika Generally, any patterns in your passwords decrease security.

Monika

@aperum nah, as long as I can have yours.

kalina

whhhhhhhhhhhhhhhhhhhhhhaaaaaaaaaaaaaaaaat

Rory Alsop

I can accept two lists, @kalina

Journeyman Geek

14:12

oocities.org/heartland/valley/6470/wildp21.html I'm inordinately fond of this

Ohnana

@Monika personally, I store my keepass file on a usb stick with a portable copy of the software sitting next to it. the usb stick sits on my keyring with my keys

Monika

Simon, I know. but having them stored (in for example lastpass) is bringing its own risks

Ohnana

not the point of your question, but just food for thought

Simon

@Monika I won't argue that password managers are risky but it is pretty much the best way to deal with randomly generated passwords.

MickLH

@Monika you're defeating the entire purpose of the salt by making it both predictable and constant across many users

Simon

14:14

I'd rather use a password manager than a pattern in my passwords.

Monika

I used to have them on a usb stick, but then, I'm at a friends place in a weekend, forgot my thumb drive and had no access to my passwords, when I really needed them.

Simon

@Monika Sync it with Dropbox or another service.

Matthew

@Monika In some ways, it depends on what risk you are defending against. If you trust a password safe application, you are trusting that the software developer is trustworthy. If you trust to a pattern, you need to trust that all the sites you use passwords on are trustworthy

Ohnana

@JourneymanGeek huh, using cider vinegar to balance out the alkaline cocca powder... interesting

Simon

@MickLH I think it's for her own passwords, not a user base.

Journeyman Geek

14:15

@Ohnana and to react with the baking powder so its light

Rory Alsop

Confirmation I haven't grown up yet: presenter showed a slide with assurance framework summarised, and I snorted out loud- Ass. Framework

Heh

Ohnana

@JourneymanGeek yeah, i ran into that making red velvet pancakes... recipe called for "baking" cocoa powder and i didn't notice

Monika

@Matthew, I wanted a system that does not care about the site's thrustworthyness. If a password leaks from their system, it doesn't compromise any of the other passwords I use (at least, that was the thought).

Journeyman Geek

"You momma so fat she needs an ass framework"

2

Simon

Anyway @Monika, @ThomasPornin answered your question.

M'vy

14:16

@ROR ooops

Journeyman Geek

@Ohnana oh, there was thing thing.

Simon

That should close the debate :p

MickLH

These are the bright minds... humanity is doomed.

Ohnana

@JourneymanGeek er wha?

@RoryAlsop i would have lol'd

Simon

@ThomasPornin "relative yo the master password that you type and send to your Web server."

Monika

14:16

@simon, Ah, so that should fix any uncertainties. goes reading.

Ohnana

growing old is mandatory, growing up is delayable

Journeyman Geek

Apparently the 'old' method of making red velvet used a chemical reaction with cocoa powder made with an older process for colour

Rory Alsop

I'm supposed to be mature and responsible

2

Ohnana

@RoryAlsop HAHA

@JourneymanGeek yeah, something with the food coloring... but now they have less alkaline cocoa powders on the market so the point is moot

Journeyman Geek

io9.gizmodo.com/…

Simon

14:18

@Monika He brings a really good point with the password rules and change too.

Monika

password rules suck, but that can be worked around typically. the password changes require some thought though.

Ohnana

@JourneymanGeek ooooh interesting

i wonder if I can recreate it with raw cocoa.

Thomas Pornin

@Monika If you store some site-dependent data on your trusted Web server, you can use that to parametrise the password-generation process; this can be used both to comply to some site-specific rules, and also to handle password "generations".

kalina

@Ohnana interesting information to share

Thomas Pornin

But then, if you accept to store and modify site-specific data on your trusted Web server, simply storing the site-specific passwords on that server would be simpler.

Simon

14:22

@ThomasPornin I assume that you would suggest using a password manager instead though?

Ohnana

@kalina i mean, if you steal my keys, the passwords in an encrypted file on the usb stick will be the least of my worries

also if you're close enough to steal my keys I'll probably attempt to hug you c:

kalina

oh no, random hugs while pickpocketing

Monika

@ThomasPornin, That would be a nice solution, because then there is still no password database that could be stolen.

Ohnana

yeah, i think you need a higher perk level to avoid them

kalina

I find the best method of password generation is to choose a string of 64 random characters and arrange them in a random order

and then memorize it

Ohnana

14:25

"draw the rest of the fucking owl"

Monika

@kalina, tried remembering more than 100 of those random strings yet?

Thomas Pornin

17

A: What is a good practical (and sane) way to manage all your passwords for online sites?

What I do is the following: I write the passwords down. Many people will cringe and scream and curse me and say that this is wrong and should never be done, but this is too simplistic an assertion. Details matter. Here are the details: I keep the passwords in a text file. When I get out of ...

kalina

@Monika yes well that's not the actual problem, plus, it's not 100 really is it

many online services don't allow you to have a password of that length so password 1 is 64 characters in length but the first 16 are used on facebook and the second 16 are used on twitter and the third 16 are used on soundcloud and the fourth 16 are used on google

* for examples

Monika

@ThomasPornin, I read that, but the solution would then not always be available to me.

Simon

@ThomasPornin That's badass.

kalina

14:28

@ThomasPornin I essentially use this method

Simon

^ nurd alert

Thomas Pornin

In fact the problem really is not a problem. There are only five or six passwords that I need to keep with me and that make sense to use when I am not in my home, and these passwords comfortably fit in my mind.

Simon

What doesn't comfortably fit in your mind anyway?

Ohnana

meanwhile my brain is a damn sieve

Thomas Pornin

@Simon Your mom ?

8

Simon

14:29

@ThomasPornin OH COME ON

kalina

@Ohnana play memory games

Ohnana

i forgot my keepass password the day after i made it and didn't remember it for a few hours

most of my passwords are stored in my hands

Journeyman Geek

>_>

kalina

"in your hands"?

Thomas Pornin

@Simon @AviD appears to be absent; the service must be maintained.

M'vy

14:30

Aha ah rekt.

Ohnana

@kalina muscle memories

Simon

@ThomasPornin That's fair.

Journeyman Geek

@kalina bionic USB drive finger.

and heh

M'vy

Oh we do have a SLA for that?

Journeyman Geek

I only really need 3 passwords

kalina

14:31

@ThomasPornin even with half the room on ignore I'm still seeing your mom jokes, from you, of all people

I thought you were better than that!

Thomas Pornin

Anyway, I don't type passwords on untrusted devices, and all devices that are not mine are, by definition, untrusted.

AviD

@ThomasPornin admirable success.

Thomas Pornin

@kalina I has become a Tradition at that point. I am a bit traditionalist at times.

kalina

@Ohnana that's still memory though

@ThomasPornin doesn't make it any less disappointing!

@JourneymanGeek I'm not sure if this would be awesome or not

Monika

@ThomasPornin I don't type passwords I value on untrusted devices. but some of them are just not worth enough to worry about.

kalina

14:32

@JourneymanGeek the first thing I thought of was the "in hand" cell phone from the total recall remake

AviD

Let it be noted that @Simon was yourmommed by @ThomasPornin himself. The only ostensible adult here.

10

Rory Alsop

@kalina most folks would worry about the opposite

Ohnana

@kalina true, but sometimes I can't consciously recall the actual characters... but I remember the motions needed to type

Rory Alsop

@AviD ostensible, eh? Who does this @AviD think 'e is...?

Ohnana

bascially if I wasn't in front of a qwerty I'd be screwed :P

kalina

14:33

@Ohnana hehehehehe

azerty layout on a qwerty keyboard

Simon

@AviD It looks like people of all age are fans of my mom.

Journeyman Geek

@kalina what remake? ;p

kalina

@JourneymanGeek well I'm a little young for me to recognize the first one as the first one, since I saw the remake first and think it's a better movie

AviD

@Simon not the little kids though. She scares them.

Simon

@AviD Naaaah.

kalina

14:42

I feel some kind of retail therapy needs to occur

TildalWave

sheesh 29 people here? I thought I entered the SE complaint department

sup bronies?

M'vy

15:05

heya @TildalWave

TildalWave

haiiiiiii :)

review queue: done

reading chat transcript: can't be arsed

starring starred messages: done

I just realized I haven't eaten anything today yet :(

kalina

I wish there was a way I could see the star list without seeing ignored people

TildalWave

oh?

kalina

yeah

TildalWave

I didn't realize

kalina

15:08

realize what

that the star list ignores your ignore list?

well that's always happened

TildalWave

that ignoring someone in chat also removes their starred messages from the list

kalina

no it doesn't do that

TildalWave

I don't see anyone in the list of people that I'd ignore, so... :P

kalina

ignoring somebody in chat doesn't remove stars from the list

-.-

gosh @TildalWave are you lacking in coffee?

TildalWave

2 mins ago, by kalina

I wish there was a way I could see the star list without seeing ignored people

then I don't get this

kalina

15:10

@TildalWave yes, as in I wish I could see the star list without seeing stars from people I've ignored

TildalWave

gotcha

kalina

I can't, so I hid the star list as well

LEAVE NO EVIDENCE

TildalWave

3 mins ago, by TildalWave

I just realized I haven't eaten anything today yet :(

I'm probably low on sugar :)

kalina

I feel like I'm low on coffee

insert coffee and press any key

Ohnana

@TildalWave GO EAT

TildalWave

15:12

which is interesting because I feel like I'm on fire today, done everything like at 2x the speed and I haven't taken any drugs either :P

Ohnana

actually wait i only had an afogado this morning. i'm going to go eat

kalina

you feel like you're on... fire?

TildalWave

hahaha

I just realized :)

kalina

now I'm slightly jealous that you found a new source of fire

M'vy

Just tell me why installer don't give you the option to use a proxy! Or don't use the default system proxy by... default!?

kalina

15:20

because the people who created the installer did not know what a proxy was

Arperum

@kalina I haven't gone that far yet with my ignore script. I just hide their avatar in the list of people in the room.

kalina

@Arperum yeah, which in turn seems to fix the weird line spacing issue that occurs when you use ignore

Rory Alsop

Lol - I enabled the star wall and the top item made me laugh again

Arperum

@kalina Yup. that's part of the reason why I made the tiny script originally.

kalina

there is no star wall

the star wall is a retired feature of chat

Rory Alsop

15:24

Normally I never see it on most devices. But I wanted to see what you were talking about

kalina

but but but but

Rory Alsop

Gone again now - it borks layout on this device too much

kalina

I might post my various ignore related bugfeatures to meta

or not

because it's largely a waste of my time

Rory Alsop

I am pretty good at running ignore scripts in my own head

kalina

well I used to do that but now I wanted something more permanent

M'vy

15:27

> If you need a standalone installer, please select the file according to your operating system from the list below

But I need internet connection to access my account while installing.

What was the point you missed in the installer being "standalone" ?

Iszi

@M'vy What's this?

M'vy

qtcreator 3.6

Iszi

Hm. Well, I guess their definition of "standalone" is "requires no additional download during install".

M'vy

btw. qt ppl bother you too much with the licence things when I only want the IDE which is opensourced

diagprov

@AviD the answer to this is as always nuanced. You can foam at the mouth irrationally both for and against C++ if you like. C++ the language allows you to write as many overflows as you like. It also gives you a set of techniques to manage buffers to avoid this, i.e. what you would call "STL".

AviD

15:32

@diagprov pls, rational nuance is not as much fun as foaming at the mouth, both for and against things. Preferably simultaneously.

M'vy

> Please chose a username

M'vy

> Error, cannot contain special characters

mvy

> Error, must be at least 4 characters

Seriously go *********

RoraΖ

hahahaha

mvyx

I use razx when raz is too short

M'vy

Seems fun

Thomas Pornin

@diagprov I think the greatest flaw in C++ is its insistence on using a C-like syntax based on the erroneous premise that the C syntax is "natural".

RoraΖ

mvyyz if you're into Rush

M'vy

15:42

Seriously what's the matter with 3 letters usernames anyway?

@RoraΖ there seem to be a joke here I can't grab

diagprov

@AviD Even better that whole comment thread entirely misses the point. C was designed to be portable-ish assembly. It can do whatever the underlying processor can do. If the address you ask to write to is mapped into the virtual address space, it will write there. Unless you use x86 tasks (which I don't think exist in long mode) x86 doesn't understand "your" process and certainly doesn't understand your data structures, so can't validate them.

Iszi

@M'vy Some sites require 8+, and at least one character has to be a digit.

M'vy

@Iszi no, that's for passwords :)

Iszi

@M'vy No, seriously. That's for usernames.

M'vy

yikes

AviD

15:43

@diagprov I have no idea what the thread was about, I didnt read it at all

was just responding to @ThomasPornin's comments...

Stirring it up a bit

diagprov

@AviD Bunch of people arguing about whether overflows are necessary.

RoraΖ

Rush - YYZ (HQ)

►

AviD

@RoraΖ rush is awesome

RoraΖ

Yes they are!

Iszi

@RoraΖ Aww, you should have gotten the one live from Argentina.

Rush fans there are nuts!

RoraΖ

15:45

True!

Fantastic live DVD

diagprov

From the processor's perspective there is no overflow.

AviD

I really should start my mornings with more Rush.

2

RoraΖ

Or Dream Theater

AviD

@diagprov that's a flaw.

Iszi

@RoraΖ Mmmmm, yeah.

AviD

15:46

@RoraΖ nah, Dream Theater is for afternoons.

also Live.

^ most confusing band name.

diagprov

@ThomasPornin yep and a lot of people writing C++ essentially are writing C with classes. Try discussing move operators and ownership concepts with the average C++ programmer.

Iszi

Dream Theater - Stream of Consciousness

►

AviD

@diagprov I think DEP or NX make perfect sense, and their lack is a conceptual flaw in CPU design.

RoraΖ

@Iszi One of the best instrumentals

Iszi

@RoraΖ I concur.

AviD

15:47

@Iszi wait which album is that from?

RoraΖ

Train of THought

Iszi

@AviD Train of Thought

AviD

not one of the ones I know by heart

Iszi

Damn, ninja'd.

RoraΖ

:D

AviD

15:47

year?

RoraΖ

DT's my favorite band

AviD

its beautiful

RoraΖ

2005?

AviD

@RoraΖ ah well, long after I'd stopped buying new music...

RoraΖ

haha

AviD

15:48

@RoraΖ mine too

Iszi

@AviD Wiki says '03.

RoraΖ

Their new album has grown on me

I knew it was an odd year

AviD

or, was, back when I selectdively listened to music

kalina

should see a doctor if you've got an album growing on you

RoraΖ

Octavarium was '06

AviD

15:48

as opposed to just putting on whatever was on the radio

RoraΖ

'05*

AviD

@RoraΖ that one I've actually listened to quite a bit.

RoraΖ

@kalina Not if I don't mind

AviD

not their best album, but gotta keep it fresh.

RoraΖ

@AviD Octavarium's fantastic

TildalWave

15:49

@kalina dr. Mayhem?

AviD

29 secs ago, by AviD

not their best album, but gotta keep it fresh.

kalina

@RoraΖ it might evolve into a breakup/reunion/belated world tour

AviD

derp

RoraΖ

@kalina Strangely comfortable with that

kalina

your nonchalance will result in disaster

spice girls reunion world tour 2020

diagprov

15:51

@AviD They are and do exist in modern x86 (NX-bit in PTE). Which is good.

RoraΖ

@kalina When Donald Trump becomes president

oh wait.... shit

kalina

:))

AviD

@diagprov right, so there IS overflow. Otherwise it is a flaw.

kalina

inb4 donald trump completely shocks us all by actually turning out to be exactly what was needed

TildalWave

Philomena Cunk and Barry Shitpeas on Donald Trump

►

reminded me of this :)

kalina

15:52

yay for weekly wipe

RoraΖ

@kalina Ronald Reagan was a good president, never know

diagprov

@AviD Yes, overflow exists. Of course it does, because what you meant was "copy X bytes to this buffer" and what you did was "copy a lot more bytes to this buffer". But the CPU doesn't understand that. All it knows is that memory has a no-execute bit set, so if the instruction pointer moves there it should raise an exception.

deed02392

i LOVE charlie brooker's stuff

Simon

I LOVE men

6

wot

switches to https

kalina

"One in twenty people is a victim of crime, which means that nineteen out of twenty people must be criminals"

"When you think about it, thinking about thinking is the hardest sort of thinking there is... which makes you think..."

diagprov

15:56

If it happens that you try to write to a virtual address that is not mapped to anything, then you get a segmentation fault. In that sense you have overflown, if you like, as you are out of bounds for the address space. But the whole stack is valid memory, and the processor only understands this is non-executable (assuming the nx bit is set). It'll happily write to it.

kalina

"Some of Winston Churchill's words were immortal. If he were alive today imagine how good his tweets would have been"

“There’s almost nothing a person can do that a computer can’t, except ride a horse.”

"The computer was invented by Charles Babbage in 1822, but it didn't have a screen so nobody knew what it was doing"

Transcript for