The DMZ

Stack Exchange

10:49 AM

I *do* hear that they're the most comfortable thing to wear on your feet since sliced bread.

Iszi Rory or Isznti

12:32 PM

Haha... I wonder why this guy doesn't come 'round here any more?

LinkedIn: the reason my dog has a 16-character mixed case, alphanumeric + special characters name. And the reason I don't use LinkedIn.

Tweeted by secboffin on June 6, 2012 at 12:30 PM

Rory Alsop

hahaha

Afternoon @Iszi

Also, anyone interested in a small bounty I put on

0

A: Can a hypervisor rootkit enable hardware-assisted virtualization when it has been disabled by the BIOS?

It fully depend if the virtualization can be enabled or not by the OS. While I may be wrong, i can imagine that using some specific syscall, you can reflash a BIOS from a OS running. There is some motherboard that permit it on Windows, there is the flashrom tool who permit that on Linux. So the...

Iszi Rory or Isznti

Is this really a Sec.SE question?

1

Q: How would you make a comprehensive list of Google domains?

If you wanted to block access of a single machine to all sites whose domain is owned or controlled by Google, how would you go about generating a comprehensive list to add to /etc/hosts? How would you handle Google Apps sites?

google

Scott Pack

@RoryAlsop That's a pretty cool question to think about.

Iszi Rory or Isznti

The end-goal may be security-ish, but the task requested is not at all security-specific.

Rory Alsop

@IsziRoryorIsznti definitely not

wanna flag it before I migrate it?

@ScottPack that was my thinking too

Iszi Rory or Isznti

12:40 PM

@RoryAlsop Migrate it? To where?

Rory Alsop

@IsziRoryorIsznti that's a good point - haven't seen him for a while

Iszi Rory or Isznti

I can't think of a place where I'd really feel like it belongs.

Rory Alsop

well - maybe SF

Scott Pack

@IsziRoryorIsznti I would consider it pretty edgy for SF, but it's the best fit I can think of.

Iszi Rory or Isznti

@ScottPack That's kinda what I thought when @RoryAlsop said SF.

Rory Alsop

12:41 PM

@IsziRoryorIsznti looks like he was around 21 hours ago, so still part of the community, just less obvious

Iszi Rory or Isznti

@RoryAlsop I'd say ping the SF mods first to see if they want it. If not, close in-place.

Rory Alsop

@IsziRoryorIsznti yarr

Scott Pack

Shazaam

wired.com/autopia/2012/06/…

Iszi Rory or Isznti

WTF is an "MPGe"?

Rory Alsop

@IsziRoryorIsznti MPGe rating is determined based on the energy present in a gallon of gasoline and converting it from BTUs to kWh — which comes out to 33.7 kWh of electricity

Scott Pack

12:44 PM

Of course, it's more than double what I paid for my 09 Fit Sport

Rory Alsop

apparently

Iszi Rory or Isznti

@RoryAlsop Yeah... I still don't really get it.

Rory Alsop

still only 82 miles on a charge - just not enough to be anywhere useful in Scotland

Scott Pack

Straight MPG is a bit of a misnomer when you're talking about energy efficiency when trying tio compare vehicles of differing fuel sources.

Rory Alsop

@IsziRoryorIsznti me neither - I just ctrl-C ctrl-V'ed

Iszi Rory or Isznti

12:45 PM

Its range is still about 18 miles too short to be my DD.

Scott Pack

@RoryAlsop My daily commute, with coming home for lunch, is only about 20 miles.

Something like that would be fantastic. Except, you know, for half the price.

Iszi Rory or Isznti

I just read through a good chunk of the Wiki and still don't quite get it...

Miles per gallon gasoline equivalent

Miles per gallon gasoline equivalent (MPGe or MPGge) is a measure of the average distance traveled per unit of energy consumed. MPGe is used by the U.S. Environmental Protection Agency (EPA) to compare energy consumption of alternative fuel vehicles, plug-in electric vehicles and other advanced technology vehicles with the fuel economy of conventional internal combustion vehicles expressed as miles per US gallon. The MPGe metric was introduced in November 2010 by EPA in the Monroney label of the Nissan Leaf electric car and the Chevrolet Volt plug-in hybrid. The ratings are based on ...

Scott Pack

So you know how you use kWh to measure energy consumption of a battery?

Iszi Rory or Isznti

@ScottPack I think I get that general concept, yes.

Scott Pack

And then MPG is a measure of energy consumption of liquid fuel.

However, since the units are different they can't be compared directly.

So really all they're doing is a shitload of unit conversions so that those two measures of consumption are represented in the same units.

Iszi Rory or Isznti

1:05 PM

I just don't get the point. Particularly, how does MPGe help me compare the daily cost of driving an electric vehicle to the daily cost of driving a gas vehicle?

Scott Pack

It's a measure of fuel economy, not cost.

Iszi Rory or Isznti

Unrelated note: It seems "rory" is the new "star". Most of the starred items in the sidebar seem to either have the word "rory" or be about Rory.

2

Scott Pack

You can derive the cost to drive from the fuel economy, but it's derived stat, not a direct.

Iszi Rory or Isznti

@ScottPack But what's a measure of fuel economy worth, if the consumer cannot easily use it to compare the cost?

Example: I know a car that gets 40 MPG will cost half as much to drive as a car that gets 20. But direct comparisons of MPGe across different fuel technologies aren't good for that - in fact, it's conceivable that they could end up being a bit deceptive in some cases.

Scott Pack

39 kWh per 100 miles.

Go find your electric bill and figure it out

Rory Alsop

1:11 PM

@IsziRoryorIsznti new synonym: star=rory :-)

3

Iszi Rory or Isznti

@ScottPack Interesting that they would add in that "Annual Electric Cost". Don't electricity prices fluctuate about the same as gas? (The exact reason I presume "Annual Gas Cost" is not on gas-powered vehicles - or is it?)

Scott Pack

@IsziRoryorIsznti More so, actually, and in much smaller geographic areas.

Iszi Rory or Isznti

@ScottPack So, more misleading marketing there.

Scott Pack

The "Annual Gas Cost" is just as worthless a measurement, though.

Well, I take that back.

Your electricity cost is more likely to be consistent over the course of a year (whereas gasoline is pretty fucking variable).

I believe electricity has more regional variation, however.

I tend to ignore those numbers on, well pretty much everything as a result.

So on that slip, the 39kWh/100 miles is really the number that actually matters.

Iszi Rory or Isznti

@ScottPack So, you're saying it is on window stickers? I've never been shopping for a new car, so I wouldn't know.

Scott Pack

1:16 PM

Since I can actually use that to calculate how many dollars each mile will cost me.

@IsziRoryorIsznti I'm almost positive it is.

I still have the window sticker in my car, so I'll check it out when I go home.

It's also on every freaking appliance I've ever bought.

I thought it was hilarious to look at the "cost per year" estimate that was taped to the side of my 15 year old hot water tank.

Iszi Rory or Isznti

Places that sell stuff like that should be required to have a display of the current average energy/gas costs for their region - or at least have it on-hand for the customer to request.

Bonus points for having the actual "Annual Gas/Energy Costs" for their products re-calculated daily and available for request.

Scott Pack

Honestly, I think all that stuff there is just there so you can compare the models against each other, not to get a realistic notion of cost.

Misleading marketing, sure, but when you're doing a self-comparison the value you use to compare doesn't actually need to have any real meaning. So long as it is internally consistent and descriptive enough.

Iszi Rory or Isznti

@ScottPack Comparing models against each other is one thing. To know if I can actually afford to drive a given model requires the "realistic notion of cost".

Scott Pack

That would be a lot harder, considering the variability in energy prices.

Rory Alsop

1:32 PM

@IsziRoryorIsznti they definitely don't have that on cars over here. They simply give you the mpg, as any price put on a litre of petrol is out of date the next day.

in fact I still can't think in litres, so I mentally convert at the pumps into gallons

Ninefingers

Can't work out how to reply to a msg on mobile. Rubbish.@Rory nope. I'd propose it bit as yet thee volume isn't there. And I'm currently revising, hence my absence all over!

Hag, on the mobile I sound like Shakespeare.

Rory Alsop

hahahahaha

no worries - I understand you anyway. Hope the revising is going well

Scott Pack

Forsooth! I do so desire that my mobile shall force me to sound like the bard of yore!

Rory Alsop

@ScottPack wow - it translates as well, from US-ian to English :-)

Scott Pack

2:04 PM

Rock! It's a bit of a hack, but keyword expansion in git!

Iszi Rory or Isznti

4:04 PM

Geez. Still two more weeks before I can change my profile name? Feels like it's been longer, for some reason.

Scott Pack

5:14 PM

Man, I should have done the regularly scheduled thesis days a long time ago. I'm feeling pretty good with the work I'm getting done.

Iszi Rory or Isznti

@ScottPack "Thesis days"?

Scott Pack

I'm taking every Wednesday as a vacation day for me to work on it.

Iszi Rory or Isznti

Ah. Must be nice to have that much PTO saved up.

Scott Pack

5:35 PM

I very rarely take time, earn 22 vacation days per year, and can only carry over 32 days. It worked out well in my favor.

Ninefingers

5:56 PM

@RoryAlsop Answer provided.

Now I know a little bit more about processors, too.

Rory Alsop

@Ninefingers - did you want this:

1

Q: Requirement of Non-Linearity (Sbox) in Block cipher

I was not able to articulate why there is a requirement of "Non-Linear functions" as a component of many popular block cipher (eg sbox in DES or 3DES). how does it make the cipher more secure? The only intuition i have is a non linear function can have many roots (solutions) For eg : for a non l...

untagged

was migrated from SO but probably suits crypto better

@Ninefingers cheers

Ninefingers

@RoryAlsop I agree, probably us.

Rory Alsop

cool - will fling it over

Iszi Rory or Isznti

6:31 PM

@RoryAlsop "Fling it over"... For some reason, it sounds to me like you're talking about a booger.

Scott Pack

6:49 PM

@IsziRoryorIsznti The mod interface for moderation is multi-touch and uses swipes to do migrations.

Thus, the act of migrating looks like flinging.

makerofthings7

7:00 PM

6.5 Million Encrypted LinkedIn Passwords Leaked Online [REPORT] mashable.com/2012/06/06/6-5-million-linkedin-passwords

Links to @Thomas Pornin 's post on S.O. stackoverflow.com/a/2774744/328397

Anyone want to share a relevant Sec.SE link (if any)? It may be good exposure for the site

Rory Alsop

7:16 PM

@ScottPack I wish that was true :-)

@makerofthings7 good call - doing it right now.

Scott Pack

@RoryAlsop @RoryAlsop How are you setting it up?

Or are you looking for a relevant existing post/set of posts?

Rory Alsop

7:47 PM

@ScottPack Currently looking round sites which are discussing the issue, and linking to the two blog posts:

Stack Exchange Security Blog: Why passwords should be hashed

Thomas Pornin on November 01, 2011

How passwords should be hashed before storage or usage is a very common question, always triggering passionate debate. There is a simple and comprehensive answer (use bcrypt, but PBKDF2 is not bad either) which is not the end of the question since theoretically better solutions have been proposed and will be worth considering once they have withstood the test of time (i.e. “5 to 10 years in the field, and not broken yet”).

The less commonly asked question is:

why should a password be hashed? …

and

Stack Exchange Security Blog: QotW #16: When businesses don’t protect your data…

roryalsop on January 27, 2012

This week’s blog post was inspired by camokatu‘s question on what to do when a Utility company doesn’t hash passwords in their database.

It seems the utility company couldn’t understand the benefit of hashing the passwords. Wizzard0 listed some reasons why they might not want to implement protection – added complexity, implementation and test costs, changes in procedures etc. and this is often the key battle. If a company doesn’t see this as a risk they want to remediate, nothing will get done. And to be fair, this is the way business risk should be managed, …

Scott Pack

eggselent

Iszi Rory or Isznti

@RoryAlsop RE: LinkedIn? Nice one.

Rory Alsop

8:38 PM

and now twitter and kiltr (the Scottish version of LinkedIn)

Scott Pack

You have your own version of linkedin? Figures. I'll bet it was invented 50 years ago wasn't it?

Rory Alsop

hahahahaha

it's marketed as a tool to bring the diaspora together

:-)

I have started drafting the qotw 29 for Friday - hope to finish it tomorrow morning (or maybe tonight - depends how the beer goes) if someone can review end of day tomorrow?

Scott Pack

I've been hearing a lot about that game, haven't played it yet.

I think I can commit to giving it a looksy.

Iszi Rory or Isznti

Does anyone else think checking your password on LeakedIn is a bad idea, or do I just have trust issues? arstechnica.com/security/2012/06/…

CodeInChaos

9:38 PM

Half my answer downvotes on SO must be password hashing related

@IsziRoryorIsznti Is there anything interesting to write about Flame from a crypto PoV? Most of what I heard is fits IT security better.

Rory Alsop

10:25 PM

@CodeInChaos It doesn't sound like it has done much clever from a crypto perspective - it's handlers have just been very covert in its usage, keeping very quiet so it wasn't spotted for years

CodeInChaos

10:46 PM

I was refering to Iszi's starred post suggesting that writing something about Flame might fit a crypto.Se blog

makerofthings7

11:30 PM

Does anyone have a ballpark idea how much it costs for Omniroot (Verizon Business) to sign your CA?

makerofthings7

11:48 PM

@IsziRoryorIsznti I tried looking for the password file myself so I can search through it (just curiosity) and it seems that the file has been removed from the original russian source. Is the file still floating around out there?

Transcript for