The DMZ

Adnan

15:00

@LucasKauffman What's an HD i7?

Lucas Kauffman

@Adnan full hd screen and i7 cpu

@Xander the ones I can get here have either an HD screen or an i7

Adnan

@LucasKauffman Okay got it.

Xander

@LucasKauffman Ah. Well that's sub-optimal.

Terry Chia

@LucasKauffman Just wondering, why lenovo specifically?

Lucas Kauffman

otherwise I need to resort to Dell

@TerryChia they are pretty sturdy and not too expensive

Terry Chia

15:02

Asus? They are my first choice for non-Apple laptops.

Lucas Kauffman

I haven't looked at them yet, will have a look

tr1n

Thanks @ThomasPornin

Ladadadada

15:24

<sigh> The second example on php.net for this new password_hash() function uses a static, non-random salt. And people wonder why PHP has a reputation for bad security.

The salt used in the example doesn't match the salt in the example output either.

tr1n

I wasn't aware people wondered why PHP has a reputation for bad security. I thought everyone just knew.

Iszi

@tr1n I don't know, but I assume it based on input received from multiple reputable sources - namely, the regulars in here. Then again, maybe I should refine my definition of "reputable".

On a completely unrelated note, has anyone else noticed a change in font for usernames in here?

Antony Vennard

@Iszi Well, gcov.php.net/viewer.php?version=PHP_5_5 is a typically cited source of problems. 110 failed tests, 800 compiled warnings, 25% code coverage. Depending on who you talk to, code coverage should be more like 80% ish. 800 compile warnings could, depending on your compiler, be pedantry (but still, shut them up, right?) ...

but 110 failed tests?

5.4 gets better, but still has 40-odd unexpected test failures, and 753 compile warnings. gcov.php.net/viewer.php?version=PHP_5_4

Adnan

@Ladadadada That's an example of people who don't know about security. The documentation don't teach you secure programming.

@Iszi I'm in no way saying that PHP is good programming language (if there was such thing). But security-wise, if the programmer is aware of the OWASP Top 10 and some other security "stuff", PHP can be as secure as any other language.

I hate it when I see PHP blamed for bad security practices or jQuery blamed for bad JavaScript code.

People who write bad code they don't really need PHP. People who write bad code would write it in Paint.

Antony Vennard

15:45

@Adnan It's not PHP, it's just there's a higher incidence of security issues with PHP code because it is used by a larger number of inexperienced devs, I think. Although their interpreter build state still shocks me a little. I turn /Wall /Werror on, then fix everything when writing C.

Adnan

@AntonyVennard Exactly. Thank you for being sensible.

Antony Vennard

@Adnan You could theoretically fix their interpreter, then make everyone use a decent PHP framework, then you'd probably get rid of all the obvious errors and be left with the nastier ones. If you think about it, in say python you use a framework, e.g. web.py/django, or in ruby you use rails. You don't write raw python in quite the same way you do in PHP.

So the framework fixes quite a few things for you. Want a robust csrf protection mechanism? Got it in the framework.

Whereas if I open my .php file with notepad, I have to think about that stuff.

Adnan

@AntonyVennard But there are already lots of frameworks that handle security stuff for PHP.

Zend, CodeIgniter, ..

I don't know much names, I'm not really into the PHP framework scene

Antony Vennard

@Adnan True, but my point is there isn't quite the newbie association to use them. If you're doing to do web in python, chances are you'll be directed to Django. PHP not so much.

ManishEarth

@AntonyVennard Flask is actually quite popular for newbies

Antony Vennard

15:51

@ManishEarth Hopefully it contains some decent basic security stuff, then they'll be fine for the easy bits.

ManishEarth

not sure about that

Antony Vennard

I don't know much about PHP frameworks, but I do think frameworks help newbies out a bit assuming they are good implementations.

Adnan

@AntonyVennard While I agree with you on that one, I still think that this has nothing to do with the language itself.

Antony Vennard

@Adnan No, true. It's more the ecosystem around it, really.

Adnan

16:10

@void_in By the way, that's not how "at least" is used. The best I can do is write a proper and complete answer.

@void_in Since I don't posses the required amount of knowledge to write an answer for that particular question, I refrain from writing one, as I don't want to confuse the OP and others. That's called being responsible.

@void_in For that exact reason I opted for writing my thoughts as a comment.

@void_in Finally, I'm talking to you as a fellow StackExchanger. I don't mean to be rude or mean. I just hope you learned something today. As the others, we all learn something new here everyday.

ManishEarth

@Adnan He won't be pinged

Adnan

@ManishEarth Why not?

Iszi

@Adnan Because he's not in the room, and probably hasn't been for awhile (if ever).

The only ones who can ping absentee chatters are mods.

Adnan

@Iszi Well.. then I was talking to myself.

ManishEarth

alternatively, I'll sping

Iszi

16:16

@Adnan Seems like. I wish there was a way to force the "take this conversation to chat" feature from the comments, without actually having to make a long comment thread first.

ManishEarth

Done

I just converted your first message into a mod ping

Adnan

@ManishEarth Thanks

@ManishEarth I feel special now

ManishEarth

:P

Iszi

@ManishEarth Does that work? I mean, even though you modded the message it's still technically by @Adnan.

Adnan

@ManishEarth By the way, is ManishEarth a literal translation of your real name?

ManishEarth

16:18

@Adnan Manish Goregaokar is my real name. The Earth is just there because Manish is usually taken on the Internet

@Iszi Not exactly. If you guys tried to use a superping code it would not have converted into an @void_in

Lemme test

Yep, works :D

@Iszi also, when a mod edits a message, the message is sort of owned by the mod

1

A: When a chat post is edited by another user, it incorrectly shows the editor as the author

Another thing that it does is make it impossible to reply to the chat message that you've edited, while the original owner can. Ditto for starring; the original owner can star it but you can't. Basically, when you edit a message, the system treats it as yours to some degree. IMO this isn't a ma...

in The Bridge, Feb 27 at 2:40, by Grace Note

When I edit someone's message, I essentially take over the message. This not only does what you note, but also means that I can't star the message while the original author should be able to.

Adnan

@ManishEarth Ahaa.. Thanks for the explanation

ManishEarth

yw

Iszi

@ManishEarth Dunno how old that thread is, but it's not impossible to reply to your own message - just inconvenient.

ManishEarth

@Iszi yep

Iszi

@Iszi See?

ManishEarth

16:22

my mistake

I know that one can reply back, just that it's hard. I came up against that when I was doing the janitoring for the Android.SE THC

Iszi

@ManishEarth I'm sure a lot of people on SOFU and other IT based sites probably could figure it out in short order if they thought a bit about it. Non-IT/supergeek sites, maybe not so much.

ManishEarth

@Iszi Hey, I'm from a non-IT site :P

Iszi

You just take the post ID (the numeric part at the end of the permalink, e.g.: the 9196616 from http://chat.stackexchange.com/transcript/message/9196616#9196616), prefix it with a colon (:), and then put your reply after.

ManishEarth

Yep

Again, I know this, just made a mistake while typing it :)

Iszi

@ManishEarth I think the sites you are on qualify under "supergeek" though. ;-)

ManishEarth

16:27

@Iszi ITSec?

I only occasionally visit SO. And I've only recently started on ITSec

Iszi

@ManishEarth I was referring to Physics and Chemistry.

ManishEarth

ah

I thought computery things fall under supergeek :P

Iszi

@ManishEarth They do, along with a lot of other things.

ManishEarth

ah

Iszi

2

ManishEarth

16:30

lol

TildalWave

@ManishEarth Physics and chemistry geeks can wipe all other geeks out, if it was a desirable state of being :)

ManishEarth

@TildalWave :P

I am actually an amateur when it comes to Chem

I like Chem, but hate having it as a subject

TildalWave

@ManishEarth that's actually even more scary :)))

ManishEarth

Ha! Boom!

TildalWave

@Iszi is it just me or does that con geek look a bit like... ya know ;) hehe

@ManishEarth Ha do you ever play with nomenclatures? as in bihydromonoxide instead of H20? Because if you don't you're not a true geek then :P

ManishEarth

16:40

DHMO you meen? Sure. :P

Dihydrogenmonoxide it is

Adnan

@Ladadadada Actually, I've just read RFC proposal and implementation security review. With all due respect, allow me to say this, the documentation and the language aren't to be blamed for your ignorance.

TildalWave

@ManishEarth well... I'm not a chemistry geek :) you OTOH seem to be a proper one LOL.. +1 on that answer, more scary is that I actually remember that from my chem classes. It's not just oxygen bound to fluoride tho, there's many other elements that can stabilize oxygen to facilitate violent combustion ;)

Adnan

@Ladadadada It's clearly an excellent implementation. Just because you didn't read the documentation well enough doesn't make it the language's problem.

All respect for ircmaxell for actually doing something and not just sit and complain.

ManishEarth

@TildalWave You may enjoy the category "Things I Won't work with" on Derek Lowe's blog pipeline.corante.com/archives/things_i_wont_work_with (this question and a few others on Chem.SE have arisen from it

Adnan

@Ladadadada I know I won't get a reply, but that's fine. At least now I feel good that I did my part, the part I'm able to do with my level of knowledge.

Ladadadada

16:49

@Adnan There's nothing wrong (that I know of) with the implementation. It's the documentation I'm criticising.

TildalWave

@ManishEarth Actually, I was way too close already to being legally prohibited from reading such blogs, so I better stay clear (for sake of all of yours health... and mine LOL). I'm now more into the other kind of chemistry (which seems to have done the trick well enough) :)))

ManishEarth

@TildalWave ah :P

Adnan

@Ladadadada The documentation clearly states "If omitted, a random salt will be created and the default cost will be used. "

I don't know what else do you want the documentation to do, write your own secure code for you?

Ladadadada

The documentation is probably simplified to focus on only the functions being documented, but devs have a habit of copy/pasting code straight from the first hit of a Google search.

TildalWave

@Adnan that would be neat :)

Ladadadada

16:52

It will be interesting in a few years to search online code repos for 'BCryptRequires22Chrcts' and see what shows up.

Adnan

@Ladadadada Yeah, .NET and Java devs, on the other hand, take hours to research the classes/methods they use?

@Ladadadada How is that the language's problem?

Let's be realistic, there won't be a world were all programmers are good.

A pinky world full of unicorns and lolcats

You write insecure code, you get hacked.. NEXT!

AJ Henderson

@Iszi is it sad that I figured out how to do that correctly without even trying it as soon as you said it was possible?

Adnan

If you're smart and strong, you survive.

Ladadadada

@Adnan It's not. It's the documentation's problem. All it would take would be to replace 'salt' => 'BCryptRequires22Chrcts', with 'salt' => password_make_salt()` except that they didn't actually implement that function.

Something like base64_encode(mcrypt_create_iv()) would do.

At least some indication that the code in the second example is not OK to use as it is.

Of course, there is an argument to be made that a dev who copies and pastes that code is never going to end up with a secure app anyway so why bother?

AJ Henderson

@ManishEarth well chemistry is just physics applied

as is just about every other science

Adnan

16:58

@Ladadadada Just like the warning they on the spray can telling you to put it away from fire. Or the warning on the plastic bags telling you not to put them over your head.

ManishEarth

@AJHenderson there's a fundamental diff though. Physics is more rigorous, Chem has many exceptions and can get handwavy

Adnan

@Ladadadada Oh, I feel I have to say this. I hope you didn't understand that I'm angry, screaming, being rude, or anything of that sort. I don't like text chat because it doesn't convey real tone.

AJ Henderson

@ManishEarth that just means all the chemists are amatuers ;)

TildalWave

@Ladadadada Who's to stop you from creating your own? I know I was teasing @Adnan before with same notions on language security, but I'm actually with him on this one. PHP isn't crap, it's most of PHP programmers that seem to fail on being... proper programmers and understand all the implications of the code they write. Why is that, is another matter tho.

ManishEarth

@AJHenderson ha

Adnan

17:00

@Ladadadada But in the end, if you actually think it's okay to use that hash as is, it's your problem (well not you, copy-pastie)

Ladadadada

@Adnan I understand completely. It's very difficult to convey in text what comes naturally when speaking verbally.

AJ Henderson

though the mathematicians still get the last laugh

since without math, physics would be stuck, and that's good for the mathematicians so atleast they can have something to be proud of while they can't get a job

Adnan

Not a long time ago I remember someone mentioning correct horse battery, and the next user comments (with two upvotes) that correct horse battery is a bad password.

Ladadadada

@TildalWave I think PHP's problem is that there are so many devs out there that the good ones who take the time to do a proper job have to compete with the ones that take all the shortcuts. Security and robustness are victims of PHP's success.

AJ Henderson

but yes, chemistry is to phyisics what Comp Sci is to math

Adnan

17:02

I don't remember the exact situation, but it was about taking something as is

AJ Henderson

far more loosy goosey, but far more practical in a lot of ways

Adnan

@Ladadadada Mostly true.

Thomas Pornin

@AJHenderson The mathematicians I know are not proud of maths being useful to physics. Actually most seem to think that it is demeaning that mathematics are useful to anybody.

5

Ladadadada

Java and .Net's security problems stem from different sources.

AJ Henderson

@ThomasPornin That's just because other people can actually make money off of their hard work

TildalWave

17:03

@Ladadadada Yes but that's a problem of financing, not a problem computer science can solve on its own. Of course there's many poorly skilled PHP programmers out there. 99% of all web projects would be out of budget and never see the light of day otherwise

ManishEarth

@ThomasPornin That is correct

Iszi

@Adnan correcthorsebatterystaple and all its permutations on their own are not bad passwords - they're actually a fair deal better than average. However, given the popularity of the XKCD comic, they are not favorable choices now.

ManishEarth

Physicists are happy that Phy applies to Chem. However, they look down on Chem since it's not really axiomatic

Iszi

The same goes for any password which has been be suggested as an example password anywhere, and especially if that "anywhere" happens to be a popular webcomic.

ManishEarth

Chem is more "because it works that way" at times

AJ Henderson

17:05

meanwhile my dad started in physics and then went accounting and I just went straight for the CS

Adnan

@Iszi Indeed! That's why I either use a password manager, or come up with my own "password generation methods"

AJ Henderson

@ManishEarth or the more vengeful way, "it works that way because the physicicsts haven't figured out why yet"

Ladadadada

@TildalWave I have a truly marvelous solution to that problem which the star wall is too narrow to contain.

ManishEarth

@AJHenderson lol

Iszi

@AJHenderson Or the more assertive, cryptographer's excuse: "It works that way because @ThomasPornin says so."

AJ Henderson

17:07

what happens if chuck norris and ThomasPornin and Tom Cruise and Mr. T get in a fight?

does the internet get spontaneously encrypted and the key gets destroyed

Adnan

@AJHenderson I think @Thomas would just sit peacefully and meditate, while the others fight each others.

AJ Henderson

actually, irl, I suppose cruise would just win because none of the other 3 would want to fight

and they all know he's bat shit crazy

Iszi

@AJHenderson What do Tom Cruise & Mr. T have to do with this?

Thomas Pornin

@Iszi Maybe they write PHP code on their free time ?

It could be a scientology thing; I don't know.

ManishEarth

@AJHenderson I once overheard this in a convo between two physic(ists|ics professors) "Chemistry was created by Physicists when they realized that physics was growing too unweildy and had some useless topics. That's why I tolerate the subject -- it keeps Physics clean. In a few years, we may even give them another useless topic, like Geometrical Optics or something" (the whole thing is tongue in cheek, but hilarious)

AJ Henderson

17:11

@Iszi Mr. T has lists similar to Chuck Norris out there and Tom Cruise is just entertainingly crazy

Iszi

@AJHenderson For that matter then, why not throw in Charlie Sheen & Mel Gibson?

AJ Henderson

@ManishEarth so you mean it's like why SecSE has SO

ManishEarth

@AJHenderson Exactly!

Iszi

On the other hand, physicists like to say physics is to math as sex is to masturbation.

(Looks like HTTPS XKCD oneboxing is broke again.)

ManishEarth

I know, I know

AJ Henderson

17:13

@Iszi because I posted it more than 5 minutes ago and can't edit my message anymore :/

ManishEarth

@Iszi The mouseover text makes physics the best :P

Scott Pack

INVALIDATE ALL THE FLAGS

2

Adam McKissock

This represents my life pretty accuratelly

Scott Pack

That'll change as you get older.

TildalWave

17:37

@Iszi no existentialist? :O

lynks

trying to work with a full freebase dump on a single core machine with 512MB of memory is a test of true zen-mastery

patience has been required

TildalWave

@Ladadadada would that be  ? :)))

Rory McCune

@ScottPack yeah once the 9-5 jobs kick in, you get more fixed on a schedule :) Weirdly I used to be a late riser, now I get up 7-7:30 in the morning even though I work from home. I got into the habit when I was commuting and it stuck

Scott Pack

17:53

@RoryMcCune Somewhere around 21-22 I found that sleeping more than 9 hours caused me problems. Now I get ridiculous headaches all day if I get less than 6-7 hours.

ManishEarth

@RoryMcCune university is a 9-5 job. You still stay up all night

Scott Pack

@RoryMcCune My wakeup time is more tied to the sun than the clock.

ManishEarth

:P

Rory McCune

@ManishEarth heh

Scott Pack

@ManishEarth Bullshit.

ManishEarth

17:53

@ScottPack .....we sleep in class though

Rory McCune

@ScottPack mine is tied to the sun and my cats waking up earlier as it gets lighter

Scott Pack

@ManishEarth Hell, I would go several weeks without going to class sometimes.

ManishEarth

And of course we don't have classes filled between 9-5

lynks

i had a major freak out for a few minutes - unknown python process on my production server (we dont use python). turned out to be denyhosts :)

TildalWave

Can we please protect that CTRL+ALT+DEL question? It's becoming littered with crap answers

Scott Pack

18:02

Turns out you do use python.

Adnan

@lynks You use DenyHosts? Nice!

Scott Pack

I like denyhosts.

lynks

@Adnan i throw it on just about anything with internet-facing sshd, it helps keep the logs a little cleaner

Adnan

@ScottPack After having my little home SSH/VPN/FTP box on the Internet for a couple of days my logs were so scary.

I quickly ran denyhosts

Then after a couple more days I just changed the port to something silly

and removed denyosts

now you can all murder me.

4

Scott Pack

@Adnan Every now and then I could go in and whenever I found an address I would block the /8 itbelonged to.

lynks

18:05

it makes me sad that people don't write their dictionary-attack bots properly. if the server says 'Permission denied: public key` PLEASE move on to another IP and stop throwing passwords at my daemon :'(

Scott Pack

@Adnan Hey, I thought I made my feelings on changing your port pretty clear.

Adnan

@lynks I can't get key-based SSH to work on my Android

That's the only thing forcing me to keep using passwords

God damn it! When will this UTC day end?

TildalWave

Do we know of any CSP 1.1 recommendations? Has anyone been researching it?

It just upgraded its status... which was fun to realize (not!) investigating possible answers to one question here

lynks

fun fact: TechCrunch use tracking/advertisement cookies from 43 different organisations.

simultaneously, on every page load.

Adnan

@lynks Have you recently started using Collusion?

lynks

18:14

@Adnan someone else in the office is using a similar addon :P

Adnan

@lynks I remember that I have somewhere a screenshot comparison of the visualization with and without third-party cookies allowed.

lynks

right, home time. everyone needs to go do alhazred.net to validate my existance

Rory Alsop

There's a lot to be said for Manchester right now - I'm sitting in the restaurant at the V&A overlooking the river, sun streaming in, a pint of Stella in front of me and browsing stack exchange

Oh, and @RoryM - got 150k AP in under an hour - Manchester city centre was blue. No longer :-)

Rory McCune

@RoryAlsop woo!

what you doing down manc way?

Scott Pack

@RoryAlsop So there's pretty much just two of us playing in this town. Myself, a L4 green, and this other guy a L8 blue. That makes it tricksome.

Rory Alsop

18:27

@rorym - roadshow for two days. Pitching what my team does.

@Scott - well, he can't improve. You can :-) it does get much better once you get to L6 - watching the sea of red numbers is awesome. And today I sat in the centre of about ten blue portals and fired off an L7. My phone nearly choked :-)

The local enlightened were amused. I wasn't bothering to power up each portal so just tagged them with one res and moved on to the next

Scott Pack

@RoryAlsop Oh sure. The annoying part is that he's going around pumping them up with L6 and up reses. Makes it hard for me to make much headway. :)

Rory Alsop

Have you got any L8s who could visit to help you level up?

Rory McCune

@RoryAlsop coolio

Scott Pack

@RoryAlsop I figure I'll spend some time hacking and building up my item stores.

@RoryAlsop I have no idea. Every now and then we'll have someone show up for the weekend.

Rory Alsop

We have local g+ groups so we can coordinate. I got my local L8 to chat to lead London L8 to see what I should do in London, and I met another L8 the other day so he could offload over 500 bursters, as his inventory was full

Scott Pack

18:34

@RoryAlsop I requested access to our local G+ community a few weeks ago.

Rory Alsop

You could even talk to him - in Glasgow we have an agreement so one area is served for level 1 and 2 only. So blue and green can both level up their lower guys - makes it more fun for all

Scott Pack

@RoryAlsop He did keep dropping busters for me. Until one day I went through and cleared out the town and made it all glow green. :)

Rory Alsop

Heh

Do you have anyone else who wants to play? I may have an invitation...

@adnan, for the windows phone q do you know how to do it? Would be a useful answer if so...

Scott Pack

@RoryAlsop I'll have to check. Most of the people I've mentioned it around haven't shown any interest. Those that do are iOS only.

Iszi

@ScottPack Sorry, been off the conversation for awhile - I presume we're talking Ingress? If so, add one WP8 user.

Scott Pack

18:48

@Iszi People use Windows Phones?

Iszi

@ScottPack Please, don't make me smack you. I get enough of the "Winblows Phone" crap from another guy in the office as it is.

Scott Pack

I'm not afraid of you. Pack your parka, it's only about 60 up here.

Rory Alsop

60 - what's that in real money? Sounds warm to me

Scott Pack

@RoryAlsop 15.5C

Rory Alsop

So, t-shirt weather then

Iszi

18:51

@RoryAlsop lmgtfy.com/?q=60+f+to+c

Scott Pack

Ooo, well played Paul....well played

►

Rory Alsop

@iszi - pfffft I knew, I was just being all Scottish and tough:-)

Scott Pack

@RoryAlsop I will put on a light jacket at this temperature, but I'm wearing short sleeves underneath.

Rory Alsop

So. On an iPad,when you click on a link that takes you to YouTube, how can you get back to safari? There is only one button an it takes you to the home page. What sort of bad design is this?

Iszi

I've got the "terrorist jacket" handy at all times. Haven't worn long sleeves for anything short of a job interview, wedding, or similarly formal occasion, in a long time.

Rory Alsop

18:54

@scott - I took the kids to the beach on Saturday as it was so nice. It was about 11 degrees so they were only paddling, not swimming, but it was lovely. We were all in shorts, t- shirts and bare feet

@iszi - pockets for devices? Yes?

Scott Pack

@RoryAlsop That is slightly cooler than I would prefer.

Thomas Pornin

@ScottPack You are too uncool.

Iszi

@RoryAlsop Devices, gum, lens cleaning wipe, earplugs... whatever. I figured it was that or a murse.

Rory Alsop

London was 23 degrees - which was nice, but far too hot for me

Scott Pack

@ThomasPornin Snap.

@RoryAlsop I agree.

Rory Alsop

18:57

murse? Goes off to google

Ahhhh

Nice

Scott Pack

@RoryAlsop I think 21±1 is my preference.

Rory Alsop

Hahahaha - tight tolerances, sir

Scott Pack

Around 22, particularly under the sun, I start to feel too warm. Under that I start to want a jacket.

Rory Alsop

I think I have attended security conferences from -12 in Cleveland to +41 in Vegas. The important thing is that a black t-shirt was worn at all of them

Scott Pack

Any chance you'll be in or around Cleveland again in the foreseeable future?

Rory Alsop

19:01

Not sure with this new role - not sure RBS or Citizens has a core presence there

Rory McCune

@RoryAlsop double button tap brings up the list of running apps, you can then tap the appropriate app to go there :)

Rory Alsop

Oh. Never knew that. So much for intuitive :-)

Mmmm- treacle pudding and clotted cream!

Adnan

@RoryAlsop I don't. That's why I didn't write an answer. What I do know, however, is that extracting strings from binary files is not a difficult task.

Rory Alsop

Gotcha

No worries

Iszi

Y'know, I think we could get away with murses better if MacGyver was still around & popular. Remember his always-handy messenger bag?

Scott Pack

19:04

/me carries a messenger bag

Adnan

@RoryAlsop I've had fun with strings before. But I guess that's all.

Iszi

I remember one line being something like: "It's not for what I'm taking in - it's for what I find along the way."

Xander

19:15

I have a couple of murses. Don't use 'em often, but they sure come in handy from time to time.

I have this one that I use occasionally when I'm traveling: http://www.rei.com/product/747932/rei-boarding-bag

And this one for when the family's having a out-of-doors day and I need some extra stuff, but not enough for a backpack: http://www.maxpedition.com/store/pc/catalog/0412k_detail.jpg

TildalWave

19:30

@Iszi playing Elder Scrolls much? :P

Iszi

19:41

@TildalWave Eh? Haven't played Skyrim in awhile.

TildalWave

@Iszi j/k ;) wouldn't mind having some of the alchemy skills in it in real life tho

TildalWave

21:00

To be precise, it is not necessarily impossible to prove a function to be one-way. It is just that, right now, we do not know how to prove any function to be one-way; but that does not mean that one-wayness is inherently non-provable. Also, we do not know whether a one-way function can actually exist at all; there again, we have no proof one way or another. — Thomas Pornin 17 mins ago

@ThomasPornin - Didn't want to post it there (I'm a nice guy, remember?)... I think that boils down to what constitutes a mathematical proof. Which boils down to what constitutes an assumed truth (axiom) as our starting point. This paradigm can probably be solved with expansion of these axioms to support indefinable (quantum?) states. Anyway... brain... hurt! :)))

BTW how do you feel about that example I used? I realize it's not a good fit if we start dissecting it, but then again none of the previously used lock mechanism analogies would survive such scrutiny either. But in its essence, I don't see any major flaws with the analogy used.

That is - to illustrate the one-wayness

hmmm.... quiet here... what am I missing AGAIN? :)

Thomas Pornin

21:16

@TildalWave I am working here...

Your example looks fine to me, although the analogy leaks a bit when looked at too closely (like all analogies).

The padlock emulates a system which computes a hash function and compares the result with a reference value, returning a boolean (match / mismatch).

TildalWave

@ThomasPornin ROFLMAO you know that blonde enters the library and orders cola and fries... joke, right?

Thomas Pornin

@TildalWave I had successfully removed it from my memory.

I don't wish to see it there again.

Gilles

@ThomasPornin but you hadn't managed to remove the information that it was there?

is this about The Game?

TildalWave

@Gilles pssst.... crosstalk!

@Gilles The Game?

Gilles

The Game (mind game)

The Game is a mental game where the objective is to avoid thinking about The Game itself. Thinking about The Game constitutes a loss, which, according to the rules of The Game, must be announced each time it occurs. It is impossible to win most versions of The Game; players can only attempt to avoid losing for as long as they possibly can. The Game has been variously described as pointless and infuriating, or as challenging and fun to play. Gameplay Rules There are three commonly reported rules to The Game: # Everyone in the world is playing The Game. (Sometimes narrowed to: "Every...

TildalWave

21:25

@Gilles It could also be a simple case of sharing partial information between The Bears. Detection is then still possible, but prevents brainhurt of knowing all of it ;)

Xander

21:48

What in the world?

0

Q: Breaking into your own systems

So as security professionals, most are overly paranoid about external hackers, leaks, etc. I'm looking for ideas on how one would go about attacking their own systems maliciously (ie not penetration testing) To give a more concrete example, If i was working in an area with highly sensitive inform...

TildalWave

@Xander Maybe it's Full Moon again?

Xander

@TildalWave Between all the "Not an answer" answers today and now that, it must be.

TildalWave

@Xander you thought you've seen it all?

-1

Q: Spyware, Trojans, do they get it?

My question is do Chinese, Japanese, other languages beside Americans get their passwords stolen. I figured there couldnt be some sort of bruteforce attack software for them also? Their characters are so different the the usual ASCII or us keyboards.

passwords

0

A: Spyware, Trojans, do they get it?

YES

It will probably get deleted, but what the heck, the question should be too, it's ridiculous LOL

@JeffFerland hehe sorry :)) but a question now... the question stays?

Jeff Ferland

@TildalWave I've got a lot of work ahead of me, but it's a great time to explain machine code and I'm having issues with a syntax compiler, so I rather talk about that than fix it anyway

Those who can't do teach and all that, and right now... blargh :)

ManishEarth

0

Q: Breaking into your own systems

So as security professionals, most are overly paranoid about external hackers, leaks, etc. I'm looking for ideas on how one would go about attacking their own systems maliciously (ie not penetration testing) To give a more concrete example, If i was working in an area with highly sensitive inform...

exploit known-vulnerabilities research academia

wtf?

TildalWave

22:04

@JeffFerland I would usually start doing house chores :)

Xander

@TildalWave LOL! Yeah, never. And that was at least a semi-coherent question, even if it was naive and hopelessly ethnocentric.

TildalWave

@Xander at least he's aware there are such places as not America, that probably moves him up the ladder automatically, let's just hope not too high to end up having any buttons he could press :))

Gilles

1

Q: Using x509 PKI with PGP

I'm building x509 PKI. And I want to apply CA's concept to my own private apt-get repository. I just found that apt-get repository (reprepro) use PGP certificate and some textbook said they can't use mix of them. But I just see another textbook said it could. I want to know if it is possible to i...

pgp

this is rather conceptual, I think it would fare better on sec.se

TildalWave

@Gilles Or SF? There's a lot of questions like this there

Gilles

@TildalWave really? serverfault.com/search?q=x509+pgp serverfault.com/search?q=pki+pgp

TildalWave

22:13

@Gilles oh :( touché :(

Gilles

@TildalWave so then? stay on U&L (it's borderline on-topic, technically it's a question about using gpg under Linux), or migrate to sec.se (which is the go-to place for pki)?

This one is definitely U&L material but might appeal to sec.se people:

1

Q: PGP keyserver and proxy firewall issues

I am not sure this is a Linux question directly ... I use Arch Linux which uses package signing. This requires me to download a set of pgp keys with the pacman-key program. This works off the presumably more general gpg program. If I can get gpg to work, I am guessing I can get pacman-key working...

networking firewall proxy pgp

TildalWave

@Gilles don't ask me, we've already established what body cavity I'm talking out of on this one LOL

@Gilles But if it's borderline then why not leave it there for a while and see if it gets any response? If it doesn't, then move it here... BTW I think it's fine on both U&L and Sec.SE actually. It's conceptual true, but it's also about implementing that specifically on Linux so it goes over merely being conceptual. Maybe that's what you think is wrong with it, that it should be split into two separate questions? One is it possible and the other how to do that?

Jeff Ferland