« first day (637 days earlier)      last day (4541 days later) » 

00:49
@Gilles Alas, only 94...
 
6 hours later…
06:46
@ThomasPornin Only Thomas can mention 94 votes and only in the same sentence.
07:21
At least they're for something deserved
My highest voted answer on SO on the other hand is just a "I quoted the spec for you" answer
07:32
@CodesInChaos Yeah i notice that lot on SO. My top voted answer here isn't anything special as well.
07:54
Morning all
@RoryAlsop Afternoon.
heh - you're the only one on here who out-timezones us Europeans
even @AviD isn't that far ahead
Heh. Singapore ftw.
 
2 hours later…
10:11
Wow. What the actual fuck, Chris Brown? happyplace.com/17815/chris-brown-gets-tattoo-of-beaten-woman
 
1 hour later…
Hi
@TomLeek Spot on the money then!
@Polynomial Well, when the tattoo artist asked if there was a picture example Brown probably went through his wallet looking for the least beaten woman in there.
@ScottPack haha
12:13
@ScottPack The really sad part is that he said "It's a beaten woman's face, but it's not Rhianna. That'd just be weird." (or words to that effect)
which is just... what? O_o
That was pretty much my reaction too.
HOW DOES THAT MAKE IT BETTER?!?!?
the fact that he had to even disclaim that possibility is beyond insane
I think I just realized something.
"So I beat my girlfriend, and then got a tattoo of a beaten woman's face on my neck, but it's ok because the tattoo isn't of her, it's a different woman."
Chris Brown is ironically beating women. He's a goddamn hipster!
12:18
@ScottPack That Chris Brown is clearly on crack?
haha
he also loves fish sticks.
Probably
And now for something else painfully annoying...Windows Updates Reboots. Joy.
@ScottPack For funsies, I did that on a vanilla install of XP (pre service packs)
the update reboot count exceeded 20, I lost track after that
downloaded about 15GB of patches
keep in mind I only did the "important" patches, and service packs.
jrg
jrg
@ThomasPornin: Congrats on the Ars mention.
@Polynomial gotta love Windows for that.
I do like that they schedule them nicely. That's the one thing that bugs me for Linux - you have to sort out patches every day.
but yeah, the reboots are a pain.
12:51
@Polynomial That's why I hate having the auto-update daemons running for me. It's easy enough to have a script run on a schedule and update for me.
Then check to see if the kernel updated, and if so tell me to reboot
@RoryAlsop How many hits is the blog post at now? I would expect it to jump after the ars mention.
Today's count so far is 640.
Woah. Very nice.
13:18
hey guys i have an query,what will happen if we send an mail with an plaintext encryption
the other person will receive it.
and they'll probably delete it.
like I do, with every email I get.
but which type of encryption i best for email
escrow encryption?
PGP / GPG
simple, plenty of integration / plugins, decent security
does pgp similar to s/mime?
roughly, yeah.
13:23
but pgp wont cause interoperatablity problems?
PGP is a bit more secure imo, but I can't really back that up with much real detail
PGP is an open format
there are plugins for Outlook, Thunderbird, etc.
gmail too.
when i find all types encryption i got confused
so came to clarify things
@Polynomial
I'm working right now
@Polynomial sure sir,if time persists read it and clarify me thanks for info
13:37
@TerryChia I aim for digital distribution for a token amount (1.50 GBP or something)
the medium of staining wood derivatives with oily black liquids is rather archaic ;)
14:14
@Polynomial There are no functional PGP plugins for modern versions of Outlook.
Unless you pay for commercial PGP and license the mail module.
Microsoft changed the way plugins integrated with the move to Outlook 2007 such that they pretty just stopped working.
I did come across a google code project that was trying to make one that worked, but the last I checked it was so early as to not be meaningful.
14:31
Oo. Well done. Now we have the "Pornin Effect" and "Pornin's Attack".
2
16k views. Reddit....
The Porn(in) Identity
Is Pornin gonna be our new meme?
@TerryChia Will it be? I think it has already happened. Your were just Pornined and you didn't even know it.
@TerryChia As long as you're not posting Pornin here, we're all good.
14:47
Ars Technica actually dubbed it Thomas Pornin's attack?!
Oh, from D.W.'s comment... still.
@JeffFerland They are quoting @D.W.
@Iszi When I was in primary school, fun about my name was not along these lines
Rather, they used French homophony "Pornin = porc nain" (i.e. "dwarf pig")
@ThomasPornin We aren't in primary school anymore.
@ThomasPornin Ah, right. I keep forgetting you're in Canada.
@Iszi I am French; I came to Canada only a few years ago (2007).
"The CRIME attack is the nation-state attack" I'm sick of quotes like that one. Somebody paste-binned a POC here.
14:56
Wait... So, did Ars already publish their interview with Big Bear? Link?
Ah, I see. Still, nice publicity for him and Sec.SE!
15:19
@Iszi The guy just called me to know how I should be known. We convene on "professional cryptographer" but I have apparently been promoted to "well-known cryptographer".
@ThomasPornin Well, you're at least well-known in SE circles.
grats, Thomas :)
15:41
@ThomasPornin 's attack - very nice!
16:32
That's some kind of fail by the poster
@JeffFerland I'm a little bit confused as to what he's proposing to do with the QR codes, to make them any more effective than watermarks already in use?
@Iszi It probably doesn't involve QR codes at all. Microscopic machine readable patterns that are only readable under certain wavelengths.
The game of telephone by the time it hit /. is... horrid.
@JeffFerland No, the Engadget article specifically calls out QR codes.
Well, "QR-style ciphers".
Though, I see nothing in the quoted press release indicating any "cipher" in use.
It would be cool, I think, if they could use this to apply an effective digital signature to physical currency.
@Iszi Yeah, exactly.
Here's the originating article from AFP, which cites a paper published in Nanotechnology. google.com/hostednews/afp/article/…
It talks a lot about how the "QR Code" would require special lasers and microscopes to read, and that it's been wear-tested. There's mention of putting in a "microscopic message" to be read by forensics investigators, but no mention of the message's proposed contents.
16:56
@Iszi I think the goal is that placing the message takes expensive tech
@JeffFerland So, security by obscurity, more or less? Really would have been more impressed if they could have gone the "digital signature on paper" route.
@Iszi It's possible that they did. That article is written so crappily that anything could have happened.
@JeffFerland Talking about the AFP article?
Oh, missed that when I was working. Was talking about engadget
Will read now
If the QR code contained a signature of a serial number, it might be useful.
Of course, that's a lot of bits
It also doesn't solve the replay attack
... but you would need to acquire a copy of every bill that you want to counterfeit.
@JeffFerland Yeah, replay attacks would be hard to spot.
17:09
@Iszi Yes and no. If enough are printed and they hit the bank system, the bank might notice it has multiple bills with the same serial number floating around
Especially the Fed
It does put a limit. You can't print 1,000 bills of the same serial number without somebody seeing.
I think this is a good question to post :D
@JeffFerland You'd have to design a system very carefully, and also rely heavily on proper human procedure implementation, in order to reliably catch that without a high probability of false-positives.
I'll do it next year :P
@JeffFerland Really, the same could be done already - is it?
I don't know.
17:26
@JeffFerland A good (EC)DSA signature can be as small as, say, 400 bits.
Down to 200 bits with BLS
At the risk of jumping into a conversation with absolutely no context, a QR code can store up to about 3kb, right?
Also, the Pornin Attack post just passed the Home Page for all time views.
I suppose they could theoretically hold any amount of information if you could print them large enough.
@ScottPack Huh?
Sure, but I was working off memory of the current largest standard size and density.
@ScottPack Oh. I was looking at our site analytics when you mentioned that.
Oh, heh. I can see how that might be confusing.
More so since I shouldn't have access to them.
How do our new user numbers look over the past couple of days?
17:38
@ScottPack The first rule of unauthorized access is don't bitch about having it.
2
True statement.
@ScottPack Views doubled, user registrations tripled.
Shazaam
I've definitely noticed a lot more activity on /review, but I wasn't expecting that big a jump.
On another note, the fact that my DSL modem died made me very sad. AT&T hadn't registered that I was installed... despite functioning Internet, I apparently wouldn't ever get a bill.
I wonder how many of those will remain active users.
Until now...
17:40
@JeffFerland look at the view from graduation until now :-)
that end of May spike trumps everything
@RoryAlsop Yeah. I wish I could find the Reddit article that drove that.
No referrer data presented on that dashboard?
@ScottPack not to that level of detail, no
Too bad.
@JeffFerland Or with small enough pixels.
Oh yeah
By the way, remember Carrier IQ?
Their office is in my building.
@JeffFerland You get close to all the interesting stories now, don't you?
Have you discovered any monitoring devices in your pockets after walking past their office?
Holy carps. The CRIME thread has grown by at least 2k views just today!
And Big Bear's two votes away from having +200 on that answer!
18:09
@Iszi It's a bit mad, eh
@RoryAlsop Hehe.... Yes, and yes.
Dunno if this is a recent development, or I'm just now catching on, but it seems HowToGeek really likes SE.
They have a few articles specifically going over some SE Q&As, much like our QotW posts do.
As I recall there's a really good reason for that..
@ScottPack Aside from SE just being that awesome?
18:11
@Iszi What is it with the fishes ? A new cult ?
@ThomasPornin They're for you, Big Bear. Thought you might be hungry.
@Iszi Some kind of partnership at the very beginning. My first sticker set from SEI had a HowToGeek one included.
@Iszi By Tradition, I prefer salmons.
what is this i dont even
@ScottPack I seem to remember those being available from the store. Don't think any of my sets had one though. Speaking of which, have we heard if mod candidates and/or the elected one are getting care packages?
18:13
@Iszi Probably, but give it a few more months.
Rome wasn't burned in a day....
@ScottPack Neither are AOL Discs apparently.
(Yeah, I know that was a stretch. For some reason though, it came to mind and I had to share.)
@Iszi all mod candidates, AFAIK they haven't discontinued the practice
@ardnew which this?
@Gilles ...are belong to us?
:-)
@Gilles Ah. I wasn't sure if it was just a "Charter Election" thing or if it applied to all elections.
I can hear my wife now: "Another one?! What's this for, now?!?!"
(Pretty much what she said when my Arqade package, the fourth one I've received, came in.)
18:18
@Iszi heh - I got a nice Stack Exchange T for one of the elections I stood for - Claire did start to worry in case I tried to get one for each site...
/me still wants them to make a Sec.SE polo.
3
But I have less t-shirt space than her handbag space in the wardrobe - so...
@Iszi definitely
18:45
Is it appropriate to ask a question about a specific penetration testing course? (offensive-security.com/information-security-training/…) I wanted to ask here first because the FAQ doesn't make it particularly clear if this sort of question is appropriate for the site..
@Daniel I don't see why not, as long as you don't have to have followed the course to make sense of the question
Okay, thank you :).
19:03
@Daniel and, as long as its not a vague or offtopic question, of course :)
in fact, I believe it has been mentioned a couple of times, though I seem to remember it being closed for those reasons...
It has come up a couple of times, and I think the questions were just poor fits. Too discussiony or shopping.
19:21
evenin' all
Quick Q. in case it's come up in the CRIME discussion. Are there easy/good ways to detect whether a server supports DEFLATE compression?
@RoryMcCune openssl -s_client -connect theservername:443 -msg
@ThomasPornin thanks :) one to add to our web server testing check list..
mmh, I am not sure it will report the compression clearly, but the hexdump of the ServerHello message will contain the information
I'll have to check tonight
Oh yes it does
openssl s_client -connect theserver:443 -msg
no '-' before s_client
19:25
ah yeah that's pretty clear on the compression front, nice.
When handshake is completed, you'll see some info, including:
Compression: 1 (zlib compression)
19:50
Howdydoody
@LucasKauffman Howdydoody
how are you jeff?
@LucasKauffman Doing well, keeping damn busy, loving the new job and California
@JeffFerland weather must be a lot better there?
@LucasKauffman Well, I moved in summer. It's hard to beat a Maine summer... but it's consistently nice ou there and I can ride my moto year-round. I'm looking forward to that.
20:00
@JeffFerland very nice
how are the girls in california?
@LucasKauffman At least in Silicon Valley, the only thing I've noticed is that there's more diversity in racial background. Population density helps, though. Last night at the rock gym was... pleasant on the eyes.
@JeffFerland potential misses ferlands then :P?
@LucasKauffman I hate to label anybody a few weeks in to something...
@JeffFerland that's why it's potential :D
@LucasKauffman Fair enough!
20:05
what motorbike do you drive?
Kawasaki Concours 14
touring bike?
 
2 hours later…
21:46
Well three of us have posted now and I don't think any of us have really answered his question. That's interesting I suppose: security.stackexchange.com/questions/20140/…
 
1 hour later…
23:07
Apple's newest release announcement: collegehumor.com/video/6823327/…

« first day (637 days earlier)      last day (4541 days later) »