« first day (636 days earlier)      last day (4542 days later) » 

02:23
How many hits do the blog post have now? I don't have permissions to view stats.
 
2 hours later…
 
2 hours later…
06:42
@StackExchange So true. Stupid football
@TerryChia you need to be editor and have special permissions. I can't see them myself, but can see arqade ones.
 
2 hours later…
08:40
@M'vy wait wait, you might not have noticed that little glyph after the "Football"... There 2 different footballs there, right?
@Polynomial repwhore :O
I just noticed this morning that it'd hit 9015
I actually came on here to read the latest questions :P
mod tools by the end of the month eh
oh yeah, forgot about that
@RoryMcCune Haha, yeah, there is only one of me! :)
09:39
@AviD Yep. And by football, I meant soccer
10:04
@TerryChia wow - over 6000
the next most popular <1000
even the home page only has 7000
Heh. Imagine if CRIME really turned out to be that.
My link on reddit/r/netsec is still the 8th most 'hot' post :-)
@TerryChia better yet, imagine if it doesn't.
@AviD absolutely
10:36
yay, time for an adobe-reboot :@
11:33
the reddit effect - blog post stats
:-)
pretty cool, eh
the numbers for the other days are grand, until they get scaled down by the CRIME post
that compression trick is genius
12:03
@Rory should we call it the Pornin Effect or Being Beared?
curious, i was sure doing a service network restart would allow be to change the hostname after modifying the /etc/sysconfig/network file on RHEL6. apparently i have to reboot the entire system.
That's usually easier, but you should be able to get away with just restarting services that read in the hostname at start.
Usually what I for is change that file, set the hostname using the hostname command, and go about my merry way.
@ScottPack hmm good shortcut, thanks for the tip. studying up for RHCSA in 2 weeks.
 
1 hour later…
13:31
Just added VtC on two questions that are candidates for migrations to what should be primary migration options. @RoryAlsop @AviD @JeffFerland - How are we coming on those?
Crypto / SuperUser, I guess?
oh, the SF one too
@Polynomial Crypto / ServerFault
Where's a SuperUser one?
it was a while back
I think it already got closed
13:35
(Though, that would be my third option.)
I think migration was denied
Crypto, SU, SF, SO would be my top 4
Thanks for bringing that up. I voted on one, but forgot to flag.
But yeah, I requested migration to SF and Crypto this morning.
It looks like, based on historical data, Crypto/SF/SU are our consistent top 3 with U&L/SO waffling.
Also, I'm becoming increasingly frustrated with the lack of functionality in the new review system. At this rate, MSO will be getting really familiar with my TL;DR style of writing.
1
Q: Allow voting on comments from Review interface

IsziI'm still becoming increasingly confused as to why we can't do or see certain things (really, just about anything except for answer a question) from the Review interface. Today, it's comment voting. I came across a question in the close queue where another person had already left a comment that...

Generally, I like the new review system, but I really wish I could upboat and flag directly from it.
If I want to do multiple things, I usually open it in a new tab to do the additional processing.
+1'ed that. should definitely be able to upboat.
13:47
@ScottPack What would be really great, but I'm sure they're avoiding for the purpose of shorter page loads, is if the review interface had a button that said "expand this question" and/or "show all options". These buttons should do what they say, without leaving the review page.
Also, being at least given the option to stay on a post after selecting the review action would be nice.
they could do it with Ajax
so the page load wouldn't be any longer.
Throw some Ajax at it and the problem goes away.
Right, time to go get sheared.
bbl
@ScottPack Oooh, I don't think SEI will ever let you be a mod with that attitude. ;-) Then again, I'm sure I've expressed similar sentiments before, so retrospectively I'm wondering why I even bothered running.
14:31
Hey, if @vortaq7 was allowed, then there's no reason why those kinds of comments should exclude me. :)
change the 'status:' to 'tag:'
That's the stuff!
For things where Jeff said: Only over my dead body
I think half my meta.SE downvotes are on Jeff's answers
A wonder hat the vote-fraud script didn't trigger yet
Back in the early days of the podcast it was always interesting to listen to them yammer on, Joel would talk about how he sponsored it but it was totally Jeff's project (or at least that's how I remember it) then Jeff would a design or procedure/policy decision they had made that the community seemed to like and Joel would just say, "No. You can't do that."
I wouldn't be surprised if the vote-fraud script is more micro than that. That is, it only checks on a daily basis if that day looked suspicious.
273
Q: Show all of my question/answers to me even if they are deleted

vavaI would really like to see all of my questions and answers on the profile page, even if some of them were deleted, and I don't have enough rep to see them on the site. (Note that some questions are automatically deleted after 30 days or 1 year, and the author might be oblivious about what happen...

It's also one of the changes I'd really like to see
@CodesInChaos Oh, that answered the question I was about to ask regarding what/whom you were proposing be assassinated.
14:52
> Will not get implemented as long as I am still alive to prevent it from happening.
Oo! He's not here anymore!
To be fair, in that comment, he did give us the solution to getting it implemented....
by the way, what happened to a certain Mr. Trollypants going by the initials "A.S."? I haven't seen him around here recently. certainly not complaining.
So I've got a perl script that's using a hash to emulate a simple two field database (stored in yaml). I was just about to add a 3rd field, and implement it as a hash of hashes, but since I need to be able to operate on all 3 fields...well...my ethics subroutine kicked in and told me no.
My first thought was to migrate to sqlite. Does that actually seem reasonable to you blokes?
sqlite is an option.
if you want something more cross-platform / interoperable / networky, take a look at Redis.
15:09
Those things aren't really anything I've been getting concerned about, I've been trying to focus more on simplicity.
Just a skim of the about page...Redis does look pretty interesting.
Redis full on rocks.
@Polynomial > This account is temporarily suspended because of low-quality contributions. The suspension period ends on Oct 4 at 23:57.
It seems like a whole different database paradigm, at least to me.
@ScottPack It's designed as a flat key-value storage engine, but it supports advanced key types (hashes, sets, etc)
it's probably the simplest API I've ever seen in any such system, and the code is gorgeous, which is saying a lot for C.
@CodesInChaos w00t. So we have until October 4th to enjoy ourselves! :3
@Polynomial Yeah, the description of it being a data structure storage style db was what really made me blink.
@Polynomial He was posting in here on the 10th, so a 30 day doesn't seem quite right. /cc @CodesInChaos
15:15
@ScottPack It's ludicrously efficient too, especially in terms of memory. the data set is kept entirely in memory, with disk backing for persistence. normally that'd hammer memory usage, but it's amazingly efficient due to some clever tricks.
@Polynomial That's actually what I really liked about straight hashes and yaml. Looks like they took that and turned it into a full on storage system.
e.g. instead of allocating separate objects for numbers 1 to 10k, it actually just allocates all of those numbers as objects and sets pointers to them on new low-value numeric keys.
so a 100k key database might actually only point to 8 bytes worth of data if all you're storing is 0/1
actually, 2 bytes, since numbers are actually ASCII representations.
Isn't a pointer larger than such a small number?
no, because there'd be a pointer anyway
each entry is an object with certain flags (e.g. expiry time)
@Polynomial Speaking of clever tricks, did I ever horn toot about doing a sort unique in perl? The code itself wasn't anything amazaballs, but it sure saved my bacon when I was trying to uniq a 20GB file during a meeting.
15:17
@ScottPack haha, I'm totally stealing "amazaballs".
That's...pretty cute.
what's a sort unique?
yeah, it's smart. Archive.org's entire archives are stored in Redis
and it saves them gigs of memory.
you can hack the code to include certain other tokens in the cache
@CodesInChaos Using the GNU tools sort and uniq you can take a input and dedupe it.
split by lines?
15:19
I honestly can't think of another time where I've looked at a project's source code and gone "I totally get how this works", in any language, let alone C.
wow, I just noticed that I am a total Redis fanboi ^_^
meh, I can say that without shame. It's an awesome project :P
The last c code I looked at(CurveCP's congestion control), made my head hurt, and I still don't get it.
@CodesInChaos Pretty much yeah. Strictly speaking, it only dedupes consecutive lines that are the same. So if you want to properly dedupe some input you have to pass it through sort first, then uniq
sorting 20GB sounds expensive
@ScottPack ah, so it's a little like RLE, except for lines.
@Polynomial Yeah, it does seem really stinking neat. I'll have to read up some more and throw it in my bag of recommendations. Probably heavier, and frankly more complicated, than I want to try to deal with in this project for now.
@Polynomial After reading the wikipedia page, I'm going to say yes.
15:23
@ScottPack I'm actually working on a presentation for <insert name of next security conference I go to here> about security and Redis, and where it falls in the pentesting scenario.
/me waits for Gilles to show up and tell me I shouldn't be allowed to use linux/unix again
how many distinct entries were there?
and some cool tricks you can do with an open instance
@CodesInChaos 179,000
oh that's low. In that case, this is almost a one liner
15:24
The original input file was 16GB ascii text where each line was a single MAC address.
Oh, I still have the original data sets (checks line counts)
There we go. The original input was 933993532 entries, and the dedupped was 176412
So you fed them into a hashtable that maps strings to ints?
The value type was pretty inconsequential since it wasn't ever being assigned. Really, I was just making use of the fact that a hash, by design, can only have one instance of each key.
Perl stores hashes as arrays of the form ('key1','value1','key2','value2',....)
So only the even numbered array offsets were ever populated, the odds were empty.
/me waits to be ruthlessly corrected
didn't you need the value as counter?
or did you just want the distinct MACs, without counts
Originally I didn't care about how many times the entry had been seen, so no. I did actually add a couple of command line switches to add in counts, sort the output, etc
I just wanted distinct number of MACs
File.WriteLines(outputFile, File.ReadLines(inputFile).Distinct());
15:36
What language is that?
I would have a hard time getting that to run in Linux
It would also require me to learn another language, which since I don't really do any development, I'm not really that interested in doing.
I'd expect most modern languages to have a library similar to linq
Maybe. Except for perl the last language I actually used was C, and that was..7 years ago?
Perl surely has lambda expressions
15:41
/me shrugs
I honestly only vaguely remember that term from undergrad
essentially inline functions
Ah, using C inlines as an example, I would be surprised if there's any direct comparison.
no not this kind of inline
I mean you define a function inside another function
I'm not sure I follow why that would be useful. The only thing I can come up with would be scope control.
Good morning from the left coast. yawn
15:47
El @Jeffe!
@JeffFerland Does that mean @ScottPack and I are always right? ;-)
(And, by extension, I am more right than @ScottPack?)
@Iszi I'm too realistic to ever make that claim myself. If someone else wants to do so? Well, that's different.
@ScottPack That's actually exactly what I use that flag for.
@Iszi Barely. I'm not sure if it should count, everyone's wang sticks out a little.
@JeffFerland que?
@ScottPack Click on the little arrow to the left that references the line I was talking about
15:50
@ScottPack Can't get much more right than where I am right now. Well, except for where @JeffFerland used to live.
@JeffFerland Can you even flag anything anymore?
@ScottPack I haven't tried
I that an available option?
I think yes
Interesting.
15:52
@JeffFerland Careful there, your flag might turn into an instant mod action. Similar to how off-topic flags for 3k+ users automatically turn into close votes.
@Iszi 2k?
@ScottPack Beat you to it.
This is bizarre...
0
Q: Strange delays in ThreadStart_Context in .NET causing performance issues

PolynomialI've written a relatively simple console utility that accesses the ClosedXML library, in order to produce an Excel spreadsheet. Nothing mind-blowing, and it should run really fast. However, when I launch it, it sits on the console screen for ~8s before displaying any progress. At first, I though...

Well, drat. @ScottPack - I was going to see if I could make some joke about having actually beat you to 2k, but I can't seem to find a histograph for rep.
16:02
@Iszi According to /reputation I hit 2k on 2011-08-02
@ScottPack Ah, so I did beat you to it! 2011-06-01!
I've always had trouble finding things to answer where I was interested enough in the topic to answer and/or was able to add enough over the existing answers to feel justified in posting.
@ScottPack Indeed.
And sometimes it's just hard to write a question in a way that it's actually relevant to enough people to be SE-worthy.
Hehe... pronounce that as "seaworthy"...
So, good questions are like boats.
Interesting is often a big problem. I really ned to find the problem interesting to want to put forth the effort.
Hehe... If five people close a question: You sunk my battleship! Or, actually that might be more like an aircraft carrier. The battleship would be more like three people plus a mod - four hits.
16:56
Anyone else following the Apple event? I'm loving the interface on Ars' liveblog. live.arstechnica.com/apple-september-2012-event-its-almost-here
17:53
I try not to.
You telling me to go issue a feature request?
Anyone fancy writing @Jeffferland's choice of QoTW? meta.security.stackexchange.com/a/987/485
@ScottPack I just saw they were accepting feedback
@RoryAlsop Ah, yeah. I think Iszi's post really does a good job of summing up what would be useful.
I do like how the first hit on that was about a mod-deleted post showing up.
@RoryAlsop I think I could probably manage to bang that out.
18:31
@ScottPack I didn't read all that conversation in detail… why?
@Gilles I was just being snarky is all.
@ScottPack with so much duplication, sort | uniq isn't likely to perform well. sort -u, folks. It's there for a purpose.
@Gilles Even it actually performed pretty terrible as I recall, but was faster yeah.
1
A: CRIME - How to beat the BEAST successor?

nicowassThe described attack and published PoC doesn't match this claim: https://twitter.com/julianor/status/245943430570704896 4 requests!?

19:34
Anyone in here have experience with SONAR? Opinions?
@Gilles Dichotomy. 64 = 2^6. Add 32 versions of the potential secret string in the attacker-chosen string. If compression is short, then one of them is good, otherwise it is one of the 32 others. "Sometimes 4 is good" is when they attack hexadecimal secrets.
In other news, an Ars Technica journalist just called me. Is that good press ?
@ThomasPornin On a day when Apple is so hot, they're bothering to call you? I'd say so.
@Iszi In my previous job they were quite fond of it.
@Iszi Hey, I just pwns Apple, then. And on the mass media battleground, no less.
jrg
jrg
@ThomasPornin Yeah, that's a big thing.
@ThomasPornin How about you? Any particular gripes?
19:47
@Polynomial each suspension is longer than the one before, until learning succeeds :-)
@Iszi Sonar was outputting lots of metrics, none of which seemed really relevant to my job, or to anything at all, really.
@RoryAlsop I think he's particularly noting the absence from chat.
@Iszi ahhh - dunno :-)
@RoryAlsop No current chat ban, then?
@RoryAlsop Is that to say, there's no indefinite suspension periods without mod intervention?
@RoryAlsop I think I saw him briefly, yesterday. Around 6pm (EDT)
19:50
@Iszi flags can cause auto bans, but suspension is a mod action, and we are trying to be fair, rather than just slap an infinite ban straight away - trying to be encouraging
@ThomasPornin ok
@ThomasPornin Chat profile says last message 2d ago. Last seen 24m ago.
20:05
@ScottPack the Pornin effect would be best, as this will also trip simplistic filters :-)
2
@RoryAlsop My thoughts exactly. :)
0
Q: Private files on a shared server?

nodirtyrockstarI continually hear/read people warning against the perils of placing proprietary information/docs within the root directory. If I am on a shared server, I cannot place files "above" the root in the document tree. Is there a work around for this that is not too hackish? More specifically, I would...

Sec.SE, or too vague?
20:22
@Gilles I'm leaning a little towards both. Could be mis-reading the problem though.
20:44
He's certainly using a different definition of "private file" than I do
My first thought was "You better encrypt a private file on the client, before uploading it to a shared server"
@Gilles it is really a question about access controls and/or encryption for shared servers
so we could have it if you don't want it
we might edit it a bit though
@RoryAlsop If this question makes sense, I think it should be on Sec.SE
I'll let someone with webserver experience decide whether it makes sense
I agree that it doesn't fit SO
flag it if you want it
perhaps sec.SE, perhaps serverfault?
20:51
@CodesInChaos it's squarely Sec.SE material, if it makes sense. Not SF material: it's calling for a security perspective
It sounds like "How do I configure my webserver correctly" to me
@CodesInChaos How do I configure correctly in order to keep some files confidential. Security perspective.
@Gilles Webmasters
What do I do to keep my server config that's in my HTTP docs path from being displayed? Limited to shared web hosting environments in scope. Totally a Webmasters Q
21:17
0
Q: Does the following data stream look secure to you?

SimonI understand the basic concept of SSL but maybe I am missing the point. Please could someone take a look at the following part of a test log to a server and tell me if it looks secure. My concerns are that although the certificate callback returns "true" you can see that it states under policy st...

not sure what this guy is asking
 
1 hour later…
22:33
wow, at this rate Thomas's answer is going to have had >100 upvotes today alone
shouldn't be long before it beats security.stackexchange.com/questions/11234/…
I know - crazy, eh
Holy carp
still in 16th place on reddit.com/r/netsec
@JeffFerland oh, and good call on the mod communication. Totally agree
@Gilles 86 upvotes for now -- still 1:23 to go before midnight UTC.
@ThomasPornin and there were 13 votes in the last 83 minutes. Oooh, close!
22:40
I have added a paragraph to my answer, which explains the dichotomy-based optimization.

« first day (636 days earlier)      last day (4542 days later) »