The DMZ

kalina

18:00

@Simon McDonalds doesn't classify as a date

Simon

o

Iszi

@DavidFreitag But yeah, I did look at that one and think "damn, I'm failing at restraint today".

kalina

neither does Tim Hortons

Simon

What about KFC?

David Freitag

@Iszi It was very Masuka-esque of you.

Ohnana

18:01

@Simon why would you eat at kfc?!

Mark Buffalo

Documenting code is one of the most boring things ever

But it's really worth it

David Freitag

@Ohnana Why not?

kalina

no KFC isn't a date either

fast food is not a date

Simon

@Ohnana I have no idea ohnuhnuh, I have absolutely no idea.

Iszi

@DavidFreitag Damn. I had to go and tell you exactly how to make me feel like a gross and despicable human being, didn't I?

Simon

18:01

@Iszi Despicable Me?

Mark Buffalo

I'm finding tons of issues with redundancies and inefficies

David Freitag

@MarkBuffalo I have found that if you document while you're writing instead of writing code then documenting everything it's so much better

Mark Buffalo

@DavidFreitag this is what I do

David Freitag

@Iszi I didn't know that had such an effect on you. Noted, I'll reserve that one for when you really gross me out.

Mark Buffalo

But this is for legacy code where nobody documented it

Simon

18:02

I can't believe that no one said that since I'm this handsome, my ween must be too.

Iszi

@DavidFreitag +1 to this. Especially because it avoids going through "WTF is this? Why did I do that?" while you're trying to document.

Simon

You guys are the worst at compliments.

Mark Buffalo

@Iszi yea

Thomas Pornin

@DavidFreitag It is not possible to go into a KFC in Montréal. There are only PFK.

Mark Buffalo

Well for one project, people didn't comment or document at all

At all.

And so new guys coming in are going wtf

Simon

18:03

@ThomasPornin If you can still find one.

They're going extinct and it's for the best, just like dinosaurs.

Mark Buffalo

So we're making it better and improving our process

David Freitag

@Iszi Yeah I really like C#'s comment system. Create function skeleton, then type /// before it and fill in all of the intellisense stuff, then comment line-by-line as I go

Mark Buffalo

@DavidFreitag I looooove this!!!!!!

David Freitag

@ThomasPornin Phosphofructokinase?

Thomas Pornin

@Simon How appropriate. Technically, the poor chickens that KFC/PFK is using are dinosaurs.

Mark Buffalo

18:04

That's such an amazing feature

Simon

@DavidFreitag Poulet Frit Kentucky you donut.

Mark Buffalo

@ThomasPornin PFK?

Thomas Pornin

@Simon Loi 101.

Xander

@DavidFreitag And then you can use Sandcastle to build a CHM, and it's all official like.

Mark Buffalo

Haha

Simon

18:05

@ThomasPornin ô_ô

David Freitag

@Xander Yup!

Simon

@ThomasPornin Indeed, "Les cafés Starbucks" is a good example.

Xander

Although that's more useful for APIs that for LoB apps.

Mark Buffalo

Polos

Simon

I'm fairly sure that's the official name here.

Iszi

18:05

I find that if I don't comment my scripts as I write them, I probably never will. Might try to some day, but then I'll be all "screw that mess, I'm not fixing what ain't broke".

Simon

Oh no, that's for Second Cup.

Thomas Pornin

@Simon And it does not happen that way in France. There, you have Starbucks Coffee and KFC.

David Freitag

Alas sadly the biggest C# project I have at work is like 40k lines of pure shit from an Indian company, and going through to comment the whole thing would take a bloody eternity

Iszi

@Simon What? There's a second cup? Do the girls know?

David Freitag

@Iszi What, you think they filmed that in one take? Don't be silly.

Thomas Pornin

18:06

@DavidFreitag It might be faster to simply rewrite the code properly.

Simon

@ThomasPornin Yet they're also surrounded by other languages and no one's scared of assimilation.

Unless I'm wrong.

David Freitag

@ThomasPornin Which is exactly what I'm doing in my free time

Proper Async RS232 coms

Iszi

@DavidFreitag Ah, so there was the one cup to start out with and then the "stunt double" did the rest?

David Freitag

None of this freezing the UI every time you communicate nonsense

Thomas Pornin

@Simon The Académie Française will protect the purity of the language. That and being smug with all other countries.

Simon

18:07

@ThomasPornin Hehe.

Mark Buffalo

@ThomasPornin I do this sometimes. I specialize in massive refactoring

David Freitag

@Iszi Nah, no stunt doubles. They shot that scene over a week until they got it perfect.

Mark Buffalo

Sometimes a project becomes too bloated and can't be saved. So I will sit there for a few months and rebuild from the ground up

But only if I'm asked to

David Freitag

@MarkBuffalo All the while it will sit there festering

Mark Buffalo

It's rare, most companies don't want to spend the money to do it

But I've gotten so fast at it

Thomas Pornin

18:09

@MarkBuffalo Every software project MUST be written three times: the first time to understand the problem, the second time to understand the solution, and the third time to do it properly.

David Freitag

All the while accumulating patches and fixes like pus-filled blisters ready do explode and make a huuhuuuuuuuge mess.

Mark Buffalo

@ThomasPornin agreed

Simon

@ThomasPornin Where did I read that before?

Thomas Pornin

@Simon Possibly in the DMZ.

Simon

Mar 17 '15 at 12:59, by Thomas Pornin

A properly developed software project must be written three times: one time to understand the problem, a second time to understand the solution, and a third time to implement is correctly.

David Freitag

18:10

IIRC the bear has said that many times

Simon

Looks like I remember what the bear says.

Mark Buffalo

@ThomasPornin this is the approach I take

David Freitag

@Simon A wise choice on the part of your brain.

Thomas Pornin

@Simon Pavlov said that it also works on dogs.

David Freitag

@Iszi I must know, was it you that pinned "Battle shits" ?

Simon

18:11

Which means that I'm a dog, got it.

Mark Buffalo

But I can also work on legacycode and continue the entropy bloat if need be

David Freitag

@MarkBuffalo If the price is right

Mark Buffalo

Refactoring is very very fun, though. it's one of my favorite things to do

Simon

Mine is ruining the code.

Mark Buffalo

I jump on any chance to do it

David Freitag

18:12

Mine is designing the hardware your code runs on

Mark Buffalo

I can really only work with basic hardware right now :(

That's something I want to learn though

Programming it, sure. Great

Actually making it... well, like I said... basic. Like those kits :(

David Freitag

16

Q: Challenge for lovers

One of my friend asked me this puzzle. Please help me find the answer for it. Jane and Mike have fallen in love, and Mike wishes to send her a ring via mail. Unfortunately they live in Kleptopia where anything sent by mail will be stolen unless it is in a padlocked box. The two of them have many...

Simon

Kleptopia hehehe

Mark Buffalo

Lol

David Freitag

The Scope – Circle Of Two severs ties with Imperium after Tribute Defeat

►

Deeeeyum son

Xander

18:18

@DavidFreitag Ugh. So...Simple..

Might die of simplicity.

Thomas Pornin

@DavidFreitag The two-padlock protocol is a well-known example. It has a cryptographic incarnation using "commutative ciphers".

Three-pass protocol

In cryptography, a three-pass protocol for sending messages is a framework which allows one party to securely send a message to a second party without the need to exchange or distribute encryption keys. Such message protocols should not be confused with various other algorithms which use 3 passes for authentication. It is called a three-pass protocol because the sender and the receiver exchange three encrypted messages. The first three-pass protocol was developed by Adi Shamir circa 1980, and is described in more detail in a later section. The basic concept of the Three-Pass Protocol is that each...

l1thal

@Xander I had a dream about this chat and me, you and some newer guy were arguing about a clash royale game.

Just wanted to throw that out there. xD

Simon

Only a guy who owns a Mustang would dream that.

Xander

@l1thal Interesting. Unfortunately far-fetched, I fear, and I have no idea what a "clash royale game" is.

Iszi

@DavidFreitag Heh. No. Should I have?

David Freitag

18:21

@Iszi No, I just wanted to know if it was you

Now that there are more room owners it's difficult to tell who pinned something

Iszi

@DavidFreitag I thought mods could pin?

David Freitag

@Iszi They can, but usually none of the mods do

I mean, on occasion, but it's usually easy to tell when it happens

Iszi

@DavidFreitag Then that just narrows it to @RоryMcCune or myself. Unless @ScottPack stopped by.

David Freitag

@Iszi Hence why I asked

Iszi

In fact, I had nothing to do with either of the pins. It looks like the one thing I did pin has either been removed or expired.

Simon

18:23

@Iszi They don't expire, you got rekt son.

Rоry McCune

@DavidFreitag pls that was me

Iszi

@Simon Like your mom, ex-son?

David Freitag

@RоryMcCune :D

Simon

@QPaysTaxes You wanna wrestle about it?

Rоry McCune

it was better when it was the other way roundt though

Simon

18:23

@Iszi Yes, like your wife.

Rоry McCune

sigh post aging messes up pinwall stories

David Freitag

@QPaysTaxes pls, pudding

Simon

@QPaysTaxes The guest decides.

Iszi

@Simon We've been over this. You being my ex-son means that she must be (at most) my ex-wife.

David Freitag

@QPaysTaxes Exactly

Iszi

18:24

@Simon Or at least my ex-one-night stand. Or maybe ex-rapist.

Simon

@Iszi No, I've disowned you.

Hence why you're my ex-dad.

David Freitag

@QPaysTaxes ( ͡◉ ͜ ʖ ͡◉)

@QPaysTaxes Yeah I can't help you with that

Iszi

@QPaysTaxes Fair point. Main issue is, me being @Simon's ex-dad does not alone mean that I am currently - or have ever been - married to his mom.

Simon

Hence why I'm referring your actual wife.

Every time you're saying "Simon's mom", you're actually talking about your own wife.

Iszi

@Simon That doesn't make sense.

Simon

18:26

YES IT DOES.

Ohnana

@QPaysTaxes well that escalated

Iszi

@Simon It only makes sense if you pair it with unsubstantiated assumptions.

David Freitag

@QPaysTaxes Please, age has nothing to do with being an adult.

Adi

@Xander Have you checked wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning ?

It seems that security.cert_pinning.enforcement_level = 0 disables the pinning

Iszi

@QPaysTaxes Well, if you put it that way, the only thing it really has to do is with being biologically capable of procreation and/or legally culpable for your own actions.

Adi

18:28

This makes it possible to perform the tests

@QPaysTaxes The fuck is wrong with your face?!

I don't want you to the context. Happy now?

Ohnana

@Phil Lello do you consider more "regrettable" using an SSL MITM proxy than breaking your employees' fingers? Interesting... — A. Darwin 44 secs ago

Iszi

@QPaysTaxes There may actually be none. Could be a whole new topic.

Rоry McCune

So I was away but my working theory on the #SE attack is now. Attacker compromises A.N.Other system, (look at haveibeenpwned for candidates). Attacker then does a scan of a number of other systems for credential re-use, one of these systems is SE. A Sec.SE user with high rep. whose account is tied to gmail had a successful login with the attacker using this approach. SE have mitigated this by blocking a single IP trying many accounts

Ohnana

@adi chill man

Adi

@QPaysTaxes Also, smartypants, I'm not replying to any old message. This is the first I'm discussing it.

Iszi

18:30

@QPaysTaxes Ummm, not quite. "'Adult' as an adjective" may mean any one (or all) of those three things.

Simon

Whoa.

Xander

@Adi I seem to recall that Firefox had that option. Chrome, however, does not, as far as I know.

Iszi

@QPaysTaxes And I'm being more pedantic. What's your point?

Adi

Has thing thing been in the DMZ before?

I don't want to talk to it.

Jacco

#SE attack ?

Simon

18:31

sets da room in ovid mode

Adi

@Xander I actually had to modify the Chromium code to disable it

Xander

@Adi Ah! The question was, fact, Mozilla specific. I need to update my answer.

Adi

It sucks that the option isn't exposed in the configs

Xander

@Adi Yeah, Google is quite militant about anything they decide is The One True Way To Security.

Iszi

@QPaysTaxes Yeah? I'm a guy. Gender-verified, in fact. How does this surprise you?

Adi

18:33

@DavidFreitag Do you know where Newegg ships from? I called their customer support. They literally said "we have no way to determine where the package comes from"

Xander

And @Adi, quit being an ass.

Iszi

@QPaysTaxes Ah, well at least you're honest about them.

Adi

@DavidFreitag I asked if they at least know the continent.. nope they don't

@DavidFreitag I then asked if they at least can tell me if it's from Europe or not. Still they don't know

Ohnana

@QPaysTaxes oh haha.

David Freitag

@Adi My guess would be they don't know because they have items ship directly from manufacturer's distribution locations

Adi

18:35

@DavidFreitag So if I make one order I might receive multiple packages from multiple countries?

Not cool

David Freitag

@Adi That's possible. When you order inside the US everything comes from their main distribution center in NJ

Rоry McCune

@Jacco read up to the bit with shog9 :)

Adi

I can't believe I'm about to say this..

Xander

@Adi Are you ordering directly from Newegg, or from one of the vendors who resells through their site?

David Freitag

I thought you were ordering from that place?

Adi

18:36

I wish I lived in the US

Ohnana

i mean, the manufacturers are all over the globe. so either they waste time aggregating packages or they send them from different place

Adi

@Xander Directly from them

@Ohnana In theory, that sounds cool

Thomas Pornin

@RоryMcCune My theory is similar except for the initial compromise of another system; I would guess that the bot just tried credentials on-the-go, simply inferred from the account name -- this would explain Shog9's comment about how simply looking at the account name is sufficient to gain access to the user's email.

Xander

@Adi Then I agree, that is very weird.

David Freitag

@Adi Their site is very sparse, and my googlefu didn't really turn up anything, but it seems like they have major distribution centers in both the UK and in the Netherlands

Given that Finland is pretty much equidistant from both locations it would be hard to tell

@Adi Usually when you build a computer you get most of the components in one box and the case separately

Rоry McCune

18:38

@ThomasPornin ahh my surmise had been that comment was based on them looking at the attackers traffic for successful logins and noting that the Sec.SE one had the same username/password

yay flags!

Thomas Pornin

Mod swarm warning!

Rоry McCune

@ThomasPornin but either is plausible based on @Shog9 's statements

Ohnana

guys, can we at least pretend we have decorum

Rоry McCune

@Ohnana hey my conversation is actually on-topic!

David Freitag

@Xander @Adi Well you need to understand that Newegg doesn't have any distribution in Finland, so it would be difficult for them to determine which center the parts would come from. It's likely determined automagically based on stock shipping costs, etc

Xander

18:41

@DavidFreitag Yes, and presumably they have access to the information that they use to make that decision.

David Freitag

Whereas in the UK or the US it's easy for them to say because they already have an in-place distribution network setup that is very predictable.

Rory Alsop

Yay - UNIKONG!!!!

David Freitag

@Xander Well not necessarily

Thomas Pornin

@RоryMcCune Since any confirmation one way or another is unlikely to be forthcoming, I suggest we don't beat that specific horse any further. Its corpse is already quite cool.

Xander

@DavidFreitag It would be quite difficult for them to make that decision, without having the information required to make it.

Rory Alsop

18:42

Ohnana

@RoryAlsop wat

Simon

Adi got rekt by a flag.

Rоry McCune

@ThomasPornin yeah it was interesting to work out the likely flow, but without any more infomration it's kind of a dead end.

David Freitag

@Xander I wouldn't expect some random customer service rep to know the nitty gritty details of how the system determines where packages come from for a specific destination in europe

Ohnana

@QPaysTaxes it's the april fools minigame

Max Vernon

18:43

@ThomasPornin that flagged comment was a good one. Got me wondering what could possibly lead to that comment.

Rоry McCune

@ThomasPornin well unless someone tries a single password guess against many accounts from a single IP to see if it gets blocked :)

David Freitag

I'm curious what @Adi said that got him flagged

Thomas Pornin

@DavidFreitag He used a forbidden word.

David Freitag

@ThomasPornin The c word?

Rоry McCune

@DavidFreitag he suggested in colourful terms that he would have to pay a lot of customs charges

Max Vernon

18:44

@ThomasPornin which one?

Rоry McCune

it was quite a colourful term, and not one I'm going to repeat in-room

Max Vernon

there were two interesting words. None of which I would have flagged, btw.

@RоryMcCune quite

David Freitag

@RоryMcCune Interesting, as per usual I wasn't paying attention until I noticed a deleted message

Max Vernon

poor customs guys always get a bad rap

Thomas Pornin

stoned for saying jehovah (life of brian)

►

Rоry McCune

18:45

To describe it without using the term would be easiest to suggest that american prisons are notorious for this practice

Xander

@DavidFreitag The CSR does not need to have the details of the algorithm by which the compute chooses, nor all of the data to be fed into the algorithm. On the contrary, if the computer has automagically decided to ship the package from say, Outer Mongolia it should be sufficient to merely inform the CSR of this final decision.

Max Vernon

@ThomasPornin LOL. exactly!

l1thal

Are there any auto-flagging systems in the chat rooms?

David Freitag

@Xander Yeah but I bet @Adi hasn't purchased anything yet, he was just asking so he knew ahead of time, thus they wouldn't be able to tell him anything.

Rоry McCune

@l1thal not AFAIk so that would've been a real person

Thomas Pornin

18:46

@l1thal If there was one, we would have already abused it, I think.

Rоry McCune

hey @RoryAlsop @Adi 's been blocked for like 30 mins, can you unblock him?

Xander

@DavidFreitag Ah, well that would be a different story.

Max Vernon

@QPaysTaxes just what I was going to say.

Rоry McCune

@QPaysTaxes can you think of how that would end up being swear words?

David Freitag

@Xander I'm assuming since Finland has some pretty hefty import taxes, and the fact that all the parts I spec'd out are like 50-120% more expensive than they are in the US, that @Adi is trying to shop around to get the best deal possible.

Max Vernon

18:48

@QPaysTaxes there you go.

Rоry McCune

@QPaysTaxes well sure but my phrasing woulnd't lead back to that easily, as that's just swear words to describe a problem where this is a specific things that notoriously occurs in american prisons

Xander

@RоryMcCune Done. // cc: @RoryAlsop

Rоry McCune

@Xander ta :)

Shog9

to be fair to Adi here, folks in the US mostly don't realize just how bad customs are elsewhere.

Max Vernon

@RоryMcCune yet, not in other countries' prisons? What are you saying about American men?

Rоry McCune

18:49

yeah I'd suck at charades

David Freitag

@Shog9 Yeah customs is a huge PITA

But customs isn't even the entire issue

Rory Alsop

@RоryMcCune sorry - was playing the unicorn thing

6

David Freitag

It's the massive markup on literally everything

Rоry McCune

@MaxVernon it's a practice which isn't common in other countries that I'm aware of (not something I've made a big study of mind) but in popular media, US prisons are notorious for it

David Freitag

The system I built using US prices was like $1200 USD, and for @Adi it ended up being something like 1500€

Rоry McCune

18:50

@MaxVernon with the perception that some americans see it as justified additional punishment for those sent to jail <shudder>

@RoryAlsop np unicorns always win

Max Vernon

any sec folks, I'm outta here. back to my dba playground.

Ohnana

so, to not beat around the bush: rape jokes are considered poor taste by many, MANY people

keep that shit out of here

Rоry McCune

David Freitag

@RоryMcCune Love it when that happens

@MaxVernon o/

Xander

@MaxVernon Later!

Rоry McCune

18:52

@DavidFreitag it's like twitter don't like hot-linking!

David Freitag

@Ohnana Is that what he said? Well no wonder it got rekt

Rоry McCune

@MaxVernon o/

@DavidFreitag it wasn't a rape joke it was using a term related to that to describe the level of custom charges

David Freitag

@RоryMcCune Well, I mean, close enough

Rоry McCune

@DavidFreitag perhaps, but one suggests an intent (making light of a crime) that the other does not

David Freitag

@RоryMcCune Either way, it's a touchy subject.

@QPaysTaxes o/

Xander

18:54

@QPaysTaxes Later!

Rоry McCune

@DavidFreitag that is true

David Freitag

Does anyone know how to display ethernet PHY information in linux?

Simon

da fuk are customs?

I missed so much fun today.

Damn you, work!

Thomas Pornin

@DavidFreitag What do you mean by "phy"? MAC address?

In that case, try ifconfig

Mark Buffalo

Man this keto is making me smell

David Freitag

18:56

@ThomasPornin A PHY is the physical interface, for example the KSZ9031 10/100/1000 RGMII chip

Simon

@ThomasPornin Wow! That's a wild command, how did you know it?

Xander

@Simon The people who charge you for the privilege of allowing things you've bought in another country to cross the sacred border into your own.

David Freitag

The kernel loads the driver for it, but for some reason there is a problem communicating with the outside world

Simon

@Xander Ah, I thought there was a definition that I did not know.

Mark Buffalo

This is sad. We were just given cards to help protect us against active shooters

Simon

18:57

Can't figure out the context at all.

Mark Buffalo

This shouldn't even be needed, yet it is

Thomas Pornin

@DavidFreitag It is up to the driver to talk to that chip, so if the information is somewhere, then it is in the syslog messages that the driver produces when it loads.

David Freitag

@ThomasPornin Syslog? As in dmesg?

Thomas Pornin

@DavidFreitag Yes.

David Freitag

@ThomasPornin Yeah that's not printing anything of use.

> [ 1.572265] Initializing Micrel PHY...
[ 1.639678] davinci_mdio davinci_mdio.0: phy[0]: device 0:00, driver Micrel KSZ9031 Gigabit PHY

Transcript for