The DMZ

Adnan

3:00 PM

@LucasKauffman What's an HD i7?

Lucas Kauffman

@Adnan full hd screen and i7 cpu

@Xander the ones I can get here have either an HD screen or an i7

Adnan

@LucasKauffman Okay got it.

Xander

@LucasKauffman Ah. Well that's sub-optimal.

Terry Chia

@LucasKauffman Just wondering, why lenovo specifically?

Lucas Kauffman

otherwise I need to resort to Dell

@TerryChia they are pretty sturdy and not too expensive

Terry Chia

3:02 PM

Asus? They are my first choice for non-Apple laptops.

Lucas Kauffman

I haven't looked at them yet, will have a look

tr1n

Thanks @ThomasPornin

Ladadadada

3:24 PM

<sigh> The second example on php.net for this new password_hash() function uses a static, non-random salt. And people wonder why PHP has a reputation for bad security.

The salt used in the example doesn't match the salt in the example output either.

tr1n

I wasn't aware people wondered why PHP has a reputation for bad security. I thought everyone just knew.

Iszi

@tr1n I don't know, but I assume it based on input received from multiple reputable sources - namely, the regulars in here. Then again, maybe I should refine my definition of "reputable".

On a completely unrelated note, has anyone else noticed a change in font for usernames in here?

Antony Vennard

@Iszi Well, gcov.php.net/viewer.php?version=PHP_5_5 is a typically cited source of problems. 110 failed tests, 800 compiled warnings, 25% code coverage. Depending on who you talk to, code coverage should be more like 80% ish. 800 compile warnings could, depending on your compiler, be pedantry (but still, shut them up, right?) ...

but 110 failed tests?

5.4 gets better, but still has 40-odd unexpected test failures, and 753 compile warnings. gcov.php.net/viewer.php?version=PHP_5_4

Adnan

@Ladadadada That's an example of people who don't know about security. The documentation don't teach you secure programming.

@Iszi I'm in no way saying that PHP is good programming language (if there was such thing). But security-wise, if the programmer is aware of the OWASP Top 10 and some other security "stuff", PHP can be as secure as any other language.

I hate it when I see PHP blamed for bad security practices or jQuery blamed for bad JavaScript code.

People who write bad code they don't really need PHP. People who write bad code would write it in Paint.

Antony Vennard

3:45 PM

@Adnan It's not PHP, it's just there's a higher incidence of security issues with PHP code because it is used by a larger number of inexperienced devs, I think. Although their interpreter build state still shocks me a little. I turn /Wall /Werror on, then fix everything when writing C.

Adnan

@AntonyVennard Exactly. Thank you for being sensible.

Antony Vennard

@Adnan You could theoretically fix their interpreter, then make everyone use a decent PHP framework, then you'd probably get rid of all the obvious errors and be left with the nastier ones. If you think about it, in say python you use a framework, e.g. web.py/django, or in ruby you use rails. You don't write raw python in quite the same way you do in PHP.

So the framework fixes quite a few things for you. Want a robust csrf protection mechanism? Got it in the framework.

Whereas if I open my .php file with notepad, I have to think about that stuff.

Adnan

@AntonyVennard But there are already lots of frameworks that handle security stuff for PHP.

Zend, CodeIgniter, ..

I don't know much names, I'm not really into the PHP framework scene

Antony Vennard

@Adnan True, but my point is there isn't quite the newbie association to use them. If you're doing to do web in python, chances are you'll be directed to Django. PHP not so much.

ManishEarth

@AntonyVennard Flask is actually quite popular for newbies

Antony Vennard

3:51 PM

@ManishEarth Hopefully it contains some decent basic security stuff, then they'll be fine for the easy bits.

ManishEarth

not sure about that

Antony Vennard

I don't know much about PHP frameworks, but I do think frameworks help newbies out a bit assuming they are good implementations.

Adnan

@AntonyVennard While I agree with you on that one, I still think that this has nothing to do with the language itself.

Antony Vennard

@Adnan No, true. It's more the ecosystem around it, really.

Adnan

4:10 PM

@void_in By the way, that's not how "at least" is used. The best I can do is write a proper and complete answer.

@void_in Since I don't posses the required amount of knowledge to write an answer for that particular question, I refrain from writing one, as I don't want to confuse the OP and others. That's called being responsible.

@void_in For that exact reason I opted for writing my thoughts as a comment.

@void_in Finally, I'm talking to you as a fellow StackExchanger. I don't mean to be rude or mean. I just hope you learned something today. As the others, we all learn something new here everyday.

ManishEarth

@Adnan He won't be pinged

Adnan

@ManishEarth Why not?

Iszi

@Adnan Because he's not in the room, and probably hasn't been for awhile (if ever).

The only ones who can ping absentee chatters are mods.

Adnan

@Iszi Well.. then I was talking to myself.

ManishEarth

alternatively, I'll sping

Iszi

4:16 PM

@Adnan Seems like. I wish there was a way to force the "take this conversation to chat" feature from the comments, without actually having to make a long comment thread first.

ManishEarth

Done

I just converted your first message into a mod ping

Adnan

@ManishEarth Thanks

@ManishEarth I feel special now

ManishEarth

:P

Iszi

@ManishEarth Does that work? I mean, even though you modded the message it's still technically by @Adnan.

Adnan

@ManishEarth By the way, is ManishEarth a literal translation of your real name?

ManishEarth

4:18 PM

@Adnan Manish Goregaokar is my real name. The Earth is just there because Manish is usually taken on the Internet

@Iszi Not exactly. If you guys tried to use a superping code it would not have converted into an @void_in

Lemme test

Yep, works :D

@Iszi also, when a mod edits a message, the message is sort of owned by the mod

1

A: When a chat post is edited by another user, it incorrectly shows the editor as the author

Another thing that it does is make it impossible to reply to the chat message that you've edited, while the original owner can. Ditto for starring; the original owner can star it but you can't. Basically, when you edit a message, the system treats it as yours to some degree. IMO this isn't a ma...

in The Bridge, Feb 27 at 2:40, by Grace Note

When I edit someone's message, I essentially take over the message. This not only does what you note, but also means that I can't star the message while the original author should be able to.

Adnan

@ManishEarth Ahaa.. Thanks for the explanation

ManishEarth

yw

Iszi

@ManishEarth Dunno how old that thread is, but it's not impossible to reply to your own message - just inconvenient.

ManishEarth

@Iszi yep

Iszi

@Iszi See?

ManishEarth

4:22 PM

my mistake

I know that one can reply back, just that it's hard. I came up against that when I was doing the janitoring for the Android.SE THC

Iszi

@ManishEarth I'm sure a lot of people on SOFU and other IT based sites probably could figure it out in short order if they thought a bit about it. Non-IT/supergeek sites, maybe not so much.

ManishEarth

@Iszi Hey, I'm from a non-IT site :P

Iszi

You just take the post ID (the numeric part at the end of the permalink, e.g.: the 9196616 from http://chat.stackexchange.com/transcript/message/9196616#9196616), prefix it with a colon (:), and then put your reply after.

ManishEarth

Yep

Again, I know this, just made a mistake while typing it :)

Iszi

@ManishEarth I think the sites you are on qualify under "supergeek" though. ;-)

ManishEarth

4:27 PM

@Iszi ITSec?

I only occasionally visit SO. And I've only recently started on ITSec

Iszi

@ManishEarth I was referring to Physics and Chemistry.

ManishEarth

ah

I thought computery things fall under supergeek :P

Iszi

@ManishEarth They do, along with a lot of other things.

ManishEarth

ah

Iszi

2

ManishEarth

4:30 PM

lol

TildalWave

@ManishEarth Physics and chemistry geeks can wipe all other geeks out, if it was a desirable state of being :)

ManishEarth

@TildalWave :P

I am actually an amateur when it comes to Chem

I like Chem, but hate having it as a subject

TildalWave

@ManishEarth that's actually even more scary :)))

ManishEarth

Ha! Boom!

TildalWave

@Iszi is it just me or does that con geek look a bit like... ya know ;) hehe

@ManishEarth Ha do you ever play with nomenclatures? as in bihydromonoxide instead of H20? Because if you don't you're not a true geek then :P

ManishEarth

4:40 PM

DHMO you meen? Sure. :P

Dihydrogenmonoxide it is

Adnan

@Ladadadada Actually, I've just read RFC proposal and implementation security review. With all due respect, allow me to say this, the documentation and the language aren't to be blamed for your ignorance.

TildalWave

@ManishEarth well... I'm not a chemistry geek :) you OTOH seem to be a proper one LOL.. +1 on that answer, more scary is that I actually remember that from my chem classes. It's not just oxygen bound to fluoride tho, there's many other elements that can stabilize oxygen to facilitate violent combustion ;)

Adnan

@Ladadadada It's clearly an excellent implementation. Just because you didn't read the documentation well enough doesn't make it the language's problem.

All respect for ircmaxell for actually doing something and not just sit and complain.

ManishEarth

@TildalWave You may enjoy the category "Things I Won't work with" on Derek Lowe's blog pipeline.corante.com/archives/things_i_wont_work_with (this question and a few others on Chem.SE have arisen from it

Adnan

@Ladadadada I know I won't get a reply, but that's fine. At least now I feel good that I did my part, the part I'm able to do with my level of knowledge.

Ladadadada

4:49 PM

@Adnan There's nothing wrong (that I know of) with the implementation. It's the documentation I'm criticising.

TildalWave

@ManishEarth Actually, I was way too close already to being legally prohibited from reading such blogs, so I better stay clear (for sake of all of yours health... and mine LOL). I'm now more into the other kind of chemistry (which seems to have done the trick well enough) :)))

ManishEarth

@TildalWave ah :P

Adnan

@Ladadadada The documentation clearly states "If omitted, a random salt will be created and the default cost will be used. "

I don't know what else do you want the documentation to do, write your own secure code for you?

Ladadadada

The documentation is probably simplified to focus on only the functions being documented, but devs have a habit of copy/pasting code straight from the first hit of a Google search.

TildalWave

@Adnan that would be neat :)

Ladadadada

4:52 PM

It will be interesting in a few years to search online code repos for 'BCryptRequires22Chrcts' and see what shows up.

Adnan

@Ladadadada Yeah, .NET and Java devs, on the other hand, take hours to research the classes/methods they use?

@Ladadadada How is that the language's problem?

Let's be realistic, there won't be a world were all programmers are good.

A pinky world full of unicorns and lolcats

You write insecure code, you get hacked.. NEXT!

AJ Henderson

@Iszi is it sad that I figured out how to do that correctly without even trying it as soon as you said it was possible?

Adnan

If you're smart and strong, you survive.

Ladadadada

@Adnan It's not. It's the documentation's problem. All it would take would be to replace 'salt' => 'BCryptRequires22Chrcts', with 'salt' => password_make_salt()` except that they didn't actually implement that function.

Something like base64_encode(mcrypt_create_iv()) would do.

At least some indication that the code in the second example is not OK to use as it is.

Of course, there is an argument to be made that a dev who copies and pastes that code is never going to end up with a secure app anyway so why bother?

AJ Henderson

@ManishEarth well chemistry is just physics applied

as is just about every other science

Adnan

4:58 PM

@Ladadadada Just like the warning they on the spray can telling you to put it away from fire. Or the warning on the plastic bags telling you not to put them over your head.

ManishEarth

@AJHenderson there's a fundamental diff though. Physics is more rigorous, Chem has many exceptions and can get handwavy

Adnan

@Ladadadada Oh, I feel I have to say this. I hope you didn't understand that I'm angry, screaming, being rude, or anything of that sort. I don't like text chat because it doesn't convey real tone.

AJ Henderson

@ManishEarth that just means all the chemists are amatuers ;)

TildalWave

@Ladadadada Who's to stop you from creating your own? I know I was teasing @Adnan before with same notions on language security, but I'm actually with him on this one. PHP isn't crap, it's most of PHP programmers that seem to fail on being... proper programmers and understand all the implications of the code they write. Why is that, is another matter tho.

ManishEarth

@AJHenderson ha

Adnan

5:00 PM

@Ladadadada But in the end, if you actually think it's okay to use that hash as is, it's your problem (well not you, copy-pastie)

Ladadadada

@Adnan I understand completely. It's very difficult to convey in text what comes naturally when speaking verbally.

AJ Henderson

though the mathematicians still get the last laugh

since without math, physics would be stuck, and that's good for the mathematicians so atleast they can have something to be proud of while they can't get a job

Adnan

Not a long time ago I remember someone mentioning correct horse battery, and the next user comments (with two upvotes) that correct horse battery is a bad password.

Ladadadada

@TildalWave I think PHP's problem is that there are so many devs out there that the good ones who take the time to do a proper job have to compete with the ones that take all the shortcuts. Security and robustness are victims of PHP's success.

AJ Henderson

but yes, chemistry is to phyisics what Comp Sci is to math

Adnan

5:02 PM

I don't remember the exact situation, but it was about taking something as is

AJ Henderson

far more loosy goosey, but far more practical in a lot of ways

Adnan

@Ladadadada Mostly true.

Thomas Pornin

@AJHenderson The mathematicians I know are not proud of maths being useful to physics. Actually most seem to think that it is demeaning that mathematics are useful to anybody.

5

Ladadadada

Java and .Net's security problems stem from different sources.

AJ Henderson

@ThomasPornin That's just because other people can actually make money off of their hard work

TildalWave

5:03 PM

@Ladadadada Yes but that's a problem of financing, not a problem computer science can solve on its own. Of course there's many poorly skilled PHP programmers out there. 99% of all web projects would be out of budget and never see the light of day otherwise

ManishEarth

@ThomasPornin That is correct

Iszi

@Adnan correcthorsebatterystaple and all its permutations on their own are not bad passwords - they're actually a fair deal better than average. However, given the popularity of the XKCD comic, they are not favorable choices now.

ManishEarth

Physicists are happy that Phy applies to Chem. However, they look down on Chem since it's not really axiomatic

Iszi

The same goes for any password which has been be suggested as an example password anywhere, and especially if that "anywhere" happens to be a popular webcomic.

ManishEarth

Chem is more "because it works that way" at times

AJ Henderson

5:05 PM

meanwhile my dad started in physics and then went accounting and I just went straight for the CS

Adnan

@Iszi Indeed! That's why I either use a password manager, or come up with my own "password generation methods"

AJ Henderson

@ManishEarth or the more vengeful way, "it works that way because the physicicsts haven't figured out why yet"

Ladadadada

@TildalWave I have a truly marvelous solution to that problem which the star wall is too narrow to contain.

ManishEarth

@AJHenderson lol

Iszi

@AJHenderson Or the more assertive, cryptographer's excuse: "It works that way because @ThomasPornin says so."

AJ Henderson

5:07 PM

what happens if chuck norris and ThomasPornin and Tom Cruise and Mr. T get in a fight?

does the internet get spontaneously encrypted and the key gets destroyed

Adnan

@AJHenderson I think @Thomas would just sit peacefully and meditate, while the others fight each others.

AJ Henderson

actually, irl, I suppose cruise would just win because none of the other 3 would want to fight

and they all know he's bat shit crazy

Iszi

@AJHenderson What do Tom Cruise & Mr. T have to do with this?

Thomas Pornin

@Iszi Maybe they write PHP code on their free time ?

It could be a scientology thing; I don't know.

ManishEarth

@AJHenderson I once overheard this in a convo between two physic(ists|ics professors) "Chemistry was created by Physicists when they realized that physics was growing too unweildy and had some useless topics. That's why I tolerate the subject -- it keeps Physics clean. In a few years, we may even give them another useless topic, like Geometrical Optics or something" (the whole thing is tongue in cheek, but hilarious)

AJ Henderson

5:11 PM

@Iszi Mr. T has lists similar to Chuck Norris out there and Tom Cruise is just entertainingly crazy

Iszi

@AJHenderson For that matter then, why not throw in Charlie Sheen & Mel Gibson?

AJ Henderson

@ManishEarth so you mean it's like why SecSE has SO

ManishEarth

@AJHenderson Exactly!

Iszi