The DMZ

Lucas Kauffman

00:02

What's the length salt should be?

Rory Alsop

@Lucas - were you watching Top Gear?

@jrg - we did pretty well, eh?

jrg

@RoryAlsop i'm watching yours. waiting for the other shoe to drop, so far you're just saying "just go do IT stuff, you'll be responsible for security someday, and then you'll make $$$$$"

;)

Rory Alsop

@Lucas, that car doesn't accelerate fast, corner fast or do much other than be fun. Oh wait.

@jrg - paying too much attention to my intro, eh?

jrg

@RoryAlsop well, i'm multitasking.

Lucas Kauffman

00:20

@RoryAlsop exactly

and yes :p

It was a good Top Gear episode, too bad there weren't any supercars shown :(

Rory Alsop

Amused by the 662hp engine in the 'stang...

Scott Pack

01:23

Here we go!

basicinstructions.net/basic-instructions/2010/4/21/…

@AviD Try it. You'll like it.

AviD

hahah, yes I loved that one.

@ScottPack its been near the top of my feeds for a long time.

Scott Pack

@AviD It's probably got about a 70% hit rate of awesome for me, but even the off ones are only meh.

Everett

So uhm, turns out I know the guy that makes Basic Instructions.

If I'm right, and I think I am, he lives in Utah.

AviD

@Everett I believe he does.

Everett

Yup, I was part of a social group called DHS (Dead Hackers Society) in the modem days.

He was in it too.

Group of board admins that liked to help each other out.

Scott Pack

01:35

There's also evidence to support that he lives in Orlando.

Which is more likely since his wife works at Walt Disney World.

AviD

@ScottPack I believe he does.

Scott Pack

@AviD Are you fucking with me?

AviD

@ScottPack I believe he is.

heh. no, I'm not fucking with you, I'm fucking with @Everett.

Scott Pack

Ok, it's been proven now. His Cracked profile says Orlando, his mailing address is in Orlando, his wife's blog says she works at WDW. I feel both convinced and a little creeped out right now.

AviD

Actually, if my senile memory is not befuddling me (though there is a good chance of that), I seem to remember that he did in fact move from someplace like Utah, to Orlando.

@ScottPack staaaaalkeeeer

Everett

01:43

Man, why's everybody always picking on me?

:(

Scott Pack

Ah, yes, Meyer did live in Utah for almost 3 years.

AviD

ehh, suck it up. We pick on everyone here.

Everett

Yeah, uhm I think I'll live..

AviD

@ScottPack I'm shocked that I knew that. and a little creeped out.

Scott Pack

@AviD Creeper

Everett

01:46

Yuo know, with all these remakes that Hollywood is doing, Flash Gordon should be in the list.

You even

Scott Pack

It looks like they lived in Utah until sometime in 2001/2002, at which point they moved to California.

@Everett Why attempt to improve on perfection?

Everett

Now I'm fucking with you ;)

Scott Pack

He is the King of the impossible.

Everett

Is it old news? ietf.org/rfc/rfc1149.txt

Scott Pack

Almost 23 years old.

Everett

01:50

What I'm asking is, new to you guys?

Okay, I give up, try the liver, have a nice evening all.

Scott Pack

:)

We studied that one in class back in school.

AviD

@Everett actually its been updated tools.ietf.org/html/rfc6214

at least according to the transcript.

aaaaand gnite folks.

Terry Chia

02:51

So what's with the spate of Rory-googling?

Scott Pack

It's hard to tell.

Terry Chia

Plus the amount of knowledge The Bear has about nuclear weapons is making me suspect that he is planning something sinister.

Scott Pack

I wouldn't worry about it, he's very nearly Canadian. They're far too polite to fire nuclear weapons

Scott Pack

03:48

@RoryAlsop So I just learned that my mother-in-law owns land in Glencoe.

Stack Exchange

05:04

There are probably children out there holding down spacebar to stay warm in the winter! YOUR UPDATE MURDERS CHILDREN.

Terry Chia

05:48

Not sure if you guys seen this yet: lightbluetouchpaper.org/2013/02/04/…

Seems like a good read.

CodesInChaos

08:46

Just don't believe what he writes on quantum mechanics

He's better at security than at physics

Lucas Kauffman

@TerryChia yea we had to read that book in college, it's pretty good

Terry Chia

I just grabbed the free PDF to go through when I have the time. I'll buy the book if I like what I read.

CodesInChaos

It's funny that I almost never read books on topics I'm actually interested in

I've read pretty much no programming, go (the game) or crypto books

On the other hand I did read physics books

Lucas Kauffman

@CodesInChaos I was wondering, is Keccak feasable to be used for password hashing, considering that it's main benefit is being really fast?

CodesInChaos

Keccak is slow in software and fast in hardware

exactly the opposite of what you want for password hashing

Lucas Kauffman

08:53

that's what I thought

CodesInChaos

But PBKDF2 is worse than bcrypt and scrypt

So I'd only use it because it's in my standard library or because I need NIST approved stuff

not for its technical merits

Lucas Kauffman

@CodesInChaos but isn't bcrypt just a salt+password hashed with sha1 a number of rounds?

or is that a too simplistic presentation?

Rory Alsop

@ScottPack proper land, or one of these Lord/Laird/Lady of a square foot of land deals?

CodesInChaos

bcrypt uses the blowfish key schedule as building block

Terry Chia

@LucasKauffman That's PBKDF2.

Lucas Kauffman

08:55

aha

CodesInChaos

It's a bit better than PBKDF2 since its memory access pattern fits CPUs but not GPUs

needs a small (kilobytish) really fast cache

Terry Chia

@LucasKauffman We do have about a hundred questions on the topic in the main site ya know.. Try reading them. :P

Lucas Kauffman

I see

CodesInChaos

at least that's what I heard. Didn't really investigate it

Rory Alsop

@TerryChia hahahaha

morning all!

Lucas Kauffman

08:56

@TerryChia :P

Rory Alsop

(or afternoon @Terry...)

Lucas Kauffman

morning @Rory!

Terry Chia

@RoryAlsop Yeah, afternoon is right.

Rory Alsop

all these people in the wrong timezone :-)

Terry Chia

I just finished moving my passwords from LastPass to Keepass. Much better since I can access it on my mobile devices easily..

Any suggestions on how to keep the files in sync across 4 devices?

Lucas Kauffman

08:58

@TerryChia dropbox

Rory Alsop

@TerryChia dropbox

@LucasKauffman heh

Terry Chia

Blah, guess I'll have to create a dropbox account..

Rory Alsop

@TerryChia it's actually pretty good, when used appropriately

ie - don't trust it to do your security stuff

encrypt before you drop things into the folder and it will work just fine

Lucas Kauffman

just make sure you always sync before shutting down

Rory Alsop

some good answers here on it

Lucas Kauffman

08:59

otherwise you will get conflicts

Terry Chia

Heh - it's more the hassle of managing another account. I usually just use Google Drive.

Rory Alsop

@TerryChia does google drive not work for you on this?

I assumed it should

Terry Chia

@RoryAlsop The app I am using on my iPhone has Dropbox integration. No google drive though.

Lucas Kauffman

@TerryChia minikeepass?

Terry Chia

@LucasKauffman Yeah. That's the one.

Lucas Kauffman

09:02

I got to work at night today :<

Rory Alsop

@LucasKauffman out of hours testing, huh?

Lucas Kauffman

@RoryAlsop yea, the whole week on my own, but Im going to ask if I can VPN in from home

Rory McCune

morning all. I use password safe, has android and iOS apps.. works fine with dropbox

Rory Alsop

@LucasKauffman that's the way to do it

@RoryMcCune Morning Mr M

Rory McCune

ahh out of hours testing ... yeuch

@RoryAlsop Watcha!

Lucas Kauffman

09:12

btw that was the first time I saw Amy Macdonald on top gear last night

Lucas Kauffman

09:28

LOL half of the security team is having the flu

I'm staying home!

Rory Alsop

09:53

@LucasKauffman I have met her once - we played on the same stage in 2011. She seemed nice, but if I had known she was a petrolhead I would have been more sociable :-)

Lucas Kauffman

@RoryAlsop Indeed, plus she's pretty cute too

Rory Alsop

@LucasKauffman well - yeah :-)

and nearly as fast as Tom Cruise!

Lucas Kauffman

yea

@RoryAlsop and apparantly she's single ._.

Rory Alsop

@LucasKauffman I'm not ;-P

Lucas Kauffman

True dat :P

Rory Alsop

09:57

right - best grab some breakfast - working from home today and tomorrow. Kids are on a half term, and wife is still poorly, so my usual schedule is out the window

Lucas Kauffman

@RoryAlsop poorly?

Rory Alsop

10:11

@LucasKauffman tonsilitis combined with a need for some root canal work - not fun

Lucas Kauffman

ouch

break out the codeine

Rory Alsop

@LucasKauffman aye - multiple antibiotics + multiple painkillers. :-(

Lucas Kauffman

@RoryAlsop can she even function with all those drugs :/?

I remember my gf being competely off her socks from having to take painikillers with some muscle relaxants

Rory Alsop

@LucasKauffman well, she's off work, and not able to teach her zumba class - but is doing better than expected

Kenny Rasschaert

10:48

This is kind of cool:

arstechnica.com/security/2013/02/…

Bob Watson

I wish our pen-testers would do something cool like mount high-res cameras

Kenny Rasschaert

That's the kind of stuff you see in movies

Terry Chia

@KennyRasschaert Very cool.

Rory Alsop

@BobWatson We gave our team hi-res cameras. One of our social engineers had one built in to a handbag

:-)

nice and James Bond-like

Scott Pack

12:11

@RoryAlsop One of those square foot rackets.

@RoryAlsop As Katie got more information about how i worked we both agreed that it sounded like a pretty good gig to get into.

CodesInChaos

12:53

I hate sybil attacks -_-

Rory Alsop

13:21

@ScottPack heh - am vaguely tempted to do the same, but I've camped just across from that bit of land and it just is...underwhelming. And full of midges

:-)

jrg

@TerryChia dropbox, and minikeepass is... "ok".

Adnan

@CodesInChaos, sock puppet attacks?

jrg

it's always sockpuppets @Adnan.

CodesInChaos

@Adnan pretty much

Adnan

Can such attacks be launched in real life? In the context of human communications with non-IT consequences

CodesInChaos

13:26

Only things I can think of to combat bogus accounts are IP checks and proof-of-work

Adnan

Oh yeah, stupid me! Fake election votes.

CodesInChaos

both have their issues

Terry Chia

@RoryAlsop I feel that you should revoke the bounty on this one and close as dupe.

5

Q: February 7th 2013 Facebook integration error implications

What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday? I was astonished to see site after site being redirected to a Facebook error page last evening (US time). What do we know and what can we surmise about this event? Intuitively the act...

Can't throw a close vote on it since it has a bounty.

Adnan

@CodesInChaos How would proof-of-work apply in this case?

Terry Chia

@jrg Do you have better suggestions?

jrg

13:28

@TerryChia no. it's the best out there.

CodesInChaos

For example you'd need to burn 1 CPU hour per account registration

Terry Chia

@jrg right. thanks :)

Adnan

@CodesInChaos A system like SE would still be vulnerable, even if you double that work (not saying that the example isn't ridiculous)

@TerryChia All I was able to do is down vote it yesterday

Rory Alsop

@TerryChia Hmmm - might see if there is a mod tool that will let me...

if not I'll ask a dev

Terry Chia

@RoryAlsop The bounty FAQ says mods can revoke bounties IIRC.

Rory Alsop

13:32

yep - just figured it out

wasn't sure what order I needed to do things

do you think it should be merged - the answers here seem good too

Terry Chia

@RoryAlsop The answers on the new question seems to more directly address the Facebook issue. Might be weird if merged with the old one.

CodesInChaos

It's pretty application dependent how valuable an account is

Rory Alsop

will leave it then

:-)

Adnan

The problem with most reputation-based systems is that they don't operate the same as in real life.
Anybody's "opinion" is valued (reddit voters, upvoting in SE), and you're not risking your reputation when recommending incompetent individuals (look at the lousy suggested edits approvals at SO).
They either should be economically balanced (you GIVE 1 unit of reputation to someone, you lose it) or they should resemble reputation in real life.

jrg

what life do you guys live in. i get all sorts of feedback on Ask Ubuntu when i recommend someone incompetent.

Rory Alsop

13:43

@Adnan heh heh - can'o'worms if you try to suggest that one on meta.SO :-)

Terry Chia

@RoryAlsop DO IT! DO IT!

Rory Alsop

@jrg Yep - I wouldn't dare recommend someone unless I knew they would suit the role, otherwise I end up looking like a ****

Adnan

@RoryAlsop Exactly!

CodesInChaos

I'm more concerned with attacks like flooding a DHT

Terry Chia

@Adnan In all seriousness though, the system works well when it is slightly difficult to accumulate rep. For example, it's hard to get enough rep to do anything useful on a lower volume site like this one unless you contribute positively for a while.

On SO though....

Rory Alsop

13:45

@TerryChia unless you are a bear :-)

CodesInChaos

or people reporting deliberately wrong information to a croud sourced database

I don't care about incompetents

Terry Chia

@RoryAlsop heh. Edited.

Adnan

@CodesInChaos Same concept concerns Facebook page report attacks

CodesInChaos

just the "i maked you a billion accounts and poisoned your database" kind of attacker

Rory Alsop

@CodesInChaos indeed

CodesInChaos

13:47

guess I should simply build the system first, and worry when I get actual attackers

Terry Chia

@CodesInChaos Isn't that how SSL was designed?

Adnan

@CodesInChaos gold.

AviD

@CodesInChaos If you build it, they will come.

Terry Chia

@AviD Says the Sheldon.

Adnan

But CodesInChaos is correct

AviD

13:48

oh no, that predated the sheldon by decades.

Terry Chia

@AviD heh i know. it's just that episode was hilarious.

Adnan

You can't get obsessed with the attacks before your system is up

I mean yes, you do your best to follow security measures first

AviD

@Adnan obsessed, no; plan for resiliance, yes.

and if it is a security product or a high-visibility or high-value target - then yes, obsess.

CodesInChaos

designing a protocol like SSL is easy. Simple clear goals which can actually be achieved.

combating spam is hard

Terry Chia

@CodesInChaos Step 1) Don't connect your system to the internet. Step 2) ???. Step 3) Profit.

AviD

13:52

@CodesInChaos no it's not, in the general case with arbitrary constraints.

It only becomes difficult in open and free architectures, like websites.

CodesInChaos

Freedom is not negotiable

Adnan

@CodesInChaos well..

AviD

@CodesInChaos Exactly. Spam is not about your freedom, it's about mine.

Terry Chia

@CodesInChaos Sure it is. It's just the matter of finding the right price. :P

CodesInChaos

Having users pay for registration would solve the problem in principle

AviD

13:54

@TerryChia but for any given price, you are free to accept it, or not.

CodesInChaos

but payment methods suck, and users don't like it

AviD

@CodesInChaos ... or for each "transaction".

Terry Chia

@AviD Hence, negotiations.

AviD

@TerryChia i.e. freedom.

By the fact that you are free to negotiate the price, you have unlimited, unfettered freedom (in that fact).

Terry Chia

@AviD You are always free to negotiate away your freedom... Damn my brain hurts.

AviD

13:55

But forgive me, I jumped in in the middle - is this spam discussion about something specific?

CodesInChaos

in principle yes, but I didn't mention the specifics

AviD

@TerryChia as the prophets of yore once said, "If you choose not to decide - you still have made a choice.".

CodesInChaos

I'd like to write a system that collects information about files(meta-data, hashes,...) in a central database

AviD

central, i.e. cloud, or central i.e. corporate?

CodesInChaos

and I'm wondering how to deal with people who submit wrong information

AviD

13:59

what purpose does this have?

CodesInChaos

mostly because I think it's cool

AviD

heh. So you'll be doing this with node.js then?

Hipster.

CodesInChaos

I'm a C# guy

Terry Chia

@CodesInChaos Not. Cool. Enough.

AviD

C# guys dont do things "because they're cool", we do them because it works damn well.

Nuthin cool bout that.

if your only excuse is coolness factor, you're expected to use something like node.js. No other reason for it.

CodesInChaos

14:02

and I want to promote tree-hashes. Those are really cool

AviD

Define.

CodesInChaos

that you can check if a partial file matches a certain root hash given a few helper hashes

so you can verify incomplete downloads

and they're parallelizable

really nice for distributed storage, like Tahoe-LAFS

keep an encrypted copy on an untrusted server

AviD

@CodesInChaos interesting, using something like homomorphic encryption, but for hashes?

CodesInChaos

and the server can neither read it, nor send you wrong data

no, nothing homomorphic

AviD

@CodesInChaos hey, I'm not judging!

CodesInChaos

14:06

Hash tree

In cryptography and computer science a hash tree or Merkle tree is a tree in which every non-leaf node is labelled with the hash of the labels of its children nodes. Hash trees are useful because they allow efficient and secure verification of the contents of larger data structures. Hash trees are a generalisation of hash lists and hash chains. To demonstrate that a leaf node is part of a given hash tree requires an amount of data proportional to the log of the number of nodes of the tree. (This contrasts with hash lists, where the amount is proportional to the number of nodes.) The co...

AviD

:D

CodesInChaos

Storing stuff in the cloud is nice but trusting the cloud, no thanks

Thomas Pornin

@CodesInChaos Depending on the principles, of course. Having users pay for anything means that you are looking at the issue at hand as a resource allocation problem, and not just any kind of resource, but the kind which can be financially valued.

Terry Chia

Git uses a tree-hash to generate the commit hash IIRC.

CodesInChaos

git uses something similar, but in dumb

they use flat SHA-1 for each file

Thomas Pornin

14:11

"dumb" is often "good". You should strive for the simplest solution which still does the job.

Terry Chia

@CodesInChaos Yeah, I don't recall the specifics. I just recall git using something similar to a tree-hash from a talk on github.

CodesInChaos

Not having collision resistance is a definite minus in my book

AviD

@CodesInChaos cool, thanks. That's my new learning for the day.

Terry Chia

@CodesInChaos Ehh. For its purposes it works well enough. I don't see how collision resistance really matters in a git repo.

AviD

@ThomasPornin I'm sure that's what @LucasKauffman tells himself, too... ;-)

Terry Chia

14:14

@AviD I always though auditors make things needlessly complex just to fulfill some "compliance" thing.

CodesInChaos

Having a unique hash for each file is a very nice property for a content addressed system

AviD

@TerryChia tbf, its usually not the auditors' fault, its the fault of the regulation.

@TerryChia though I wasnt referring to the complex/simple part, but the "dumb is good" part.

Terry Chia

@AviD Ahh ok. :)

Lucas Kauffman

@AviD well fuck you too

2

Terry Chia

14:30

0

Q: Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash: cookie = user_id|expiry_date|HMAC(user_id|expiry_date, k) Where k is HMAC(user_id|expiry_dat...

passwords authentication cookies session-management

The guy cross-posted on SO. @AviD @RoryAlsop.

AviD

@LucasKauffman heh, cmaaaaan, you know I tease because I care.

Lucas Kauffman

@AviD <3

AviD

and because you can take it.

Lucas Kauffman

►

top gear korea

they crashed the helicopter

AviD

@TerryChia hmm. problem is, the SO question is too old for migrating, but it does belong over here.

is it perchance a dupe of anything already here? that would be best.

@LucasKauffman that seems "good". i.e. "dumb".

CodesInChaos

14:36

> As the subject is extremely complicated I'm am only looking for answers from security experts with real world experience in creating and breaking authentication schemes.

Don't like that tone

Terry Chia

@AviD I can't recall any dupes if they exist.

The right answer would be "use the session functions provided by your framework" anyway.

AviD

@TerryChia exactly.

@CodesInChaos because it should go without saying?

it often doesn't.

Terry Chia

I gave it a short answer anyway. Perhaps someone else will give his scheme a more detailed analysis.

AviD

I want piecake.

Scott Pack

15:25

I like pie.

CodesInChaos

Is there any popular browser where using <img src="http://..."> triggers a mixed content warnings on an https page?

(oh and chat is bugging out)

Scott Pack

Probably devops.

Adnan

@CodesInChaos I believe it's the case with all browsers

Okay, Firefox replaces the lock icon with earth icon and when you click it it gives you that warning

Terry Chia

15:41

Hmm, nginx is looking real good.

Might use it in replacement for Apache for all my future web servers.

Adnan

IE completely removes the lock icon, as if the website isn't server over https

Chrome giving a yellow triangle over the lock icon

Opera, same as Firefox

Iszi

@AviD The piecake is a half-truth.

CodesInChaos

15:56

embedding unsafe images seems harmless to me

Adnan

Even here, Rory? Even here?

6

A: What harm can be done with a copy of one's passport?

Yes - it does increase the risk of identity theft, however for most successful identity thefts, the attacker would need various other bits of information as well. The best way to think of it is that every piece of information about you an attacker has, the less effort he has to expend to imperso...

CodesInChaos

at least I'd like some way to embed unsafe images without triggering warnings

Tom Leek

@CodesInChaos YEP. I SENT THE WRONG BEAR.

AviD

@ThomasPornin for you: theoatmeal.com/pl/state_web_winter_2012/twinkies

CodesInChaos

is there a difference between the bears?

Adnan

15:59

@CodesInChaos As far as I can see, unless your service depends on the security reputation (green locks and blue address bars) then embedding "unsafe" contents isn't a problem

Rory McCune

@Adnan he's the omni-Rory

Adnan

I like how that answer has Sec.SE tone all over it

CodesInChaos

grr sometimes chat highlights get stuck and play the notification sound in an endless loop

Terry Chia

@CodesInChaos About 53k rep worth of differences. :P

Tom Leek

@CodesInChaos I AM NOT A SISSY

AND BEAR #1 APPEARS NOT TO BE ABLE TO LOG ON THE DMZ RIGHT NOW

Adnan

16:01

@TomLeek now, now.

Thomas Pornin

I am back

Apparently some cookie mishap

CodesInChaos

that's what you get for not using that great stateless cookie scheme

Scott Pack

Great, now I want cookies.

Rory McCune

@ScottPack mmm cookies

Scott Pack

It's getting awfully close to lunch time too.

Lucas Kauffman

16:08

mmm like chocolate chip cookies

Scott Pack

@LucasKauffman You, sir, are an asshole.

2

Lucas Kauffman

I'm on a diet, I'm also punishing myself

also anyone here using runkeeper?

Scott Pack

That's a negative.

Rory Alsop

@Adnan thank you :-)

@AviD mmm. pie. weebls-stuff.com/wab/pikea

@TomLeek the DMZ stopped me logging in for about an hour on my PC. Phone was sort of okay though.

Scott Pack

They've been doing "failover" work with their "databases" in the "datacenters" with their "clustering". As you can see it's been completely transparent to end-users.

Rory Alsop

16:18

@Adnan I am in many places. Mwahahahahahaaaaaaa.

@AviD Bacon Bears!!!

Iszi

@ScottPack I've said for some time now that "cluster" was a bad choice of nomenclature for that particular technology - or perhaps just all too appropriate, I'm not sure which.

Scott Pack

@Iszi I'm gonna go with yes on both counts.

So, yeah. The whole site runs on a Windows stack. It's all ASP with IIS and MSSQL.

Iszi

@ScottPack Shhh! Don't tell Unix and Linux!

Scott Pack

MSSQL clustering is the problem. There really is no such thing as MSSQL clustering. What it does it use the built in Windows clustering.

Funny story about that.

Whenever you try to fail over it causes the system to crash.

It's a known issue and the fix is to upgrade to MSSQL 2012.

Thomas Pornin

@ScottPack And it is "clustering" as in "failover cluster", which is not a cluster at all.

Iszi

16:23

@ScottPack A failover fail?

It fails at failing?

Scott Pack

@Iszi Oh no, it fails quite proficiently and spectacularly.

@ThomasPornin Pretty much.

Iszi

Speaking of failing: Trying not to crash Outlook while I selectively archive the majority of a 400 MB mailbox, to a PST file on a network drive, is loads o' fun.

Scott Pack

I my favorite feature of Outlook is clicking on the window and watching it freeze for 30-45 seconds.

CodesInChaos

unfortunately most of my programs do that -_-

windows too dumb to manage RAM

Terry Chia

@CodesInChaos Need moar RAM obviously.

Iszi

16:30

@ScottPack Why the hell did you have to give it that suggestion?

CodesInChaos

doesn't matter. My old 192 MB machine didn't swap more than my current 4 GB machine

Scott Pack

@CodesInChaos This is on OSX with about 10GB of free RAM.

@Iszi Trust me, it wasn't my idea.

Lucas Kauffman

In college we were able to run 40 virtual Debian servers, this was the equivalent of exactly 1 Windows 2k8R2 with a sharepoint running on it... idle

Scott Pack

@LucasKauffman And by "in college" you mean "last semester"?

Lucas Kauffman

@ScottPack no actually more than 1 year ago

from september until december 2011

back in the day when my biggest worry was if I should take 33 cl or 50 cl beer

Thomas Pornin

16:37

@ScottPack You use Outlook on OS X ? This looks... unnatural. Unclean. A transgression of some fundamental law. A way to summon Cthulhu.

2

Scott Pack

@ThomasPornin Well, that reason is two-fold. It's more stable than Mail and it means I can use a non-tablet interface for reading mail on my computer.

@LucasKauffman I'm confused. How is that a decision?

Lucas Kauffman

@ScottPack exactly.

Adnan

What's with the chat? :(

Iszi

@Adnan Dunno. What's with it?

Thomas Pornin

By Jove ! There are actually two users called "Cthulhu" on Sec.SE.

Rory Alsop

16:42

@Adnan it went bad for an hour or so

better now

@ThomasPornin So summoning Cthulhu would be as easy as using a double @

Iszi

@ScottPack Your idea or not, I'm blaming you - it's crashed now.

Lucas Kauffman

@ThomasPornin Who is this Jove you speak of?

Iszi

Jupiter (mythology)

In ancient Roman religion and myth, Jupiter () or Jove is the king of the gods and the god of sky and thunder. Jupiter was the chief deity of Roman state religion throughout the Republican and Imperial eras, until the Empire came under Christian rule. In Roman mythology, he negotiates with Numa Pompilius, the second king of Rome, to establish principles of Roman religion such as sacrifice. Jupiter is usually thought to have originated as a sky god. His identifying implement is the thunderbolt, and his primary sacred animal is the eagle, which held precedence over other birds in the ta...

Lucas Kauffman

ah

Thomas Pornin

@LucasKauffman Jupiter, Jovis, third declination. "Jove" is a linguistic derivative from the non-nominative root.

Christian Brits have cursed by the name of a god that they believed did not exist for centuries.

It seems safer to curse by the name of a non-existent god; it avoids the struck-by-lightning awkwardness.

2

Iszi

16:51

Bah! Which one to star? I'll stick by my first choice - someone else can hit the other if they think it appropriate.

Thomas Pornin

Jupiter was the latin sockpuppet account for Zeus.

Speaking of Rome and deities, it seems that we are due for another pope in a few weeks.

Adnan

I'm not receiving notifications AND I'm getting logged out every couple of minutes

Rory Alsop

@ThomasPornin Ex Benedict!

heh

Adnan

JESUS!!

Rory Alsop

@Adnan no no no - Jove. Easy mistake, I know...

Thomas Pornin

16:52

Mmh, interesting question. Will he keep the name "Benedict" when he is out of office ?

I am sure they have a defined procedure for that.

Iszi

@RoryAlsop Isn't it a little late for breakfast?

Thomas Pornin

Catholic church is Heaven for auditors: two thousands of years of accumulated procedures, and it is all written in a language nobody speaks !

Transcript for