« first day (867 days earlier)      last day (2332 days later) » 
00:00 - 20:0020:00 - 00:00

12:14 AM
Wheee, weekend plans :D
 
12:32 AM
@D3C4FF Heh nice looks like you could go down on a bike circling it and slowly descending in a spiral too, has anyone tried that before?
 
We're gonna try roll giant coins (hulahoops) around it like one of those 'money spinners'
 
oh nearly a 100 meter drop ... nope I wouldn't wanna try that on a bike LOL but a V rope could be fun descending from dead center
 
1:02 AM
@TildalWave Yeah. 100m rappel, i'm gonna try do it forwards facing and 'run' down the hole :D
Yayyy! Living!
 
1:28 AM
@TildalWave cool talk, not much technical info though :(
 
 
3 hours later…
4:13 AM
 
 
5 hours later…
9:00 AM
So George R. R. Martin killed half his main characters in A Storm of Swords... Interesting.
 
@TerryChia Relatively fewer deaths afterwards
There still are quite a few though
 
9:13 AM
@Polynomial that actually sounds like a lot of fun.
 
@Tinned_Tuna What does?
 
@Polynomial Arduino/HSM
 
:)
Spend most of last night working out the details.
 
are there any Arduinos that are good for high-security products?
I know that you can blow some PICs to stop them being re-writable and prevent people from reading out their contents
but I don't have much arduino experience.
Also, the usual raft of attacks, timing, power analysis, etc.
 
Arduino has a security bit
and all of my operations will be O(1).
 
9:16 AM
If we can come in cheaper than YubiHSM, that'd be hillarious
haha, excellent :-p
 
I could technically build a HSM out of an Arduino Uno and an Ethernet shield (required for throughput + SD card)
 
We'd also need to think about the fact that these things do eventually fail.
 
but I'll probably use a Due for the faster ARM-based processor
 
i.e. how does one get a backup, just in case?
 
you back up the master key and the SD card can just be transferred over.
 
9:17 AM
Are you going for physical tamper resistance?
if you are, an SD card doesn't seem like a fantastic idea... :-p
 
theft of the HSM does nothing unless you also steal the database, since each record has a key in the database.
but there will be some minimal tamper resistance.
the point is that by tampering with the device you cause an outage, which immediately alerts an admin to an issue
you can't sniff the RAM because it's embedded in the uC chip
 
(one hopes)
why not?
 
only thing you could do is reflash the chip, but then you'd lose the master key and cause an outage.
 
most chips will operate when you've milled out the surface
(if you've done it sensitively)
 
you don't mill them, you use acid to decap them
which is impractical in a live scenario
 
9:20 AM
There's several methods, I've heard of people researching laser ablation :-p
 
plus the housing will have a pair of contact switches to provide some tamper alerting
and I'm planning on adding an LDR to detect light entering the case
it's not like I'm putting it in a bank or anything silly like that. just something for additional security in average webapps
 
fair enough
 
one cool anti-tamper trick I have seen (though I dunno how I'd make it) is to have two thin wire mesh cages inside the case that sit inside each other, with the device in the middle. one cage is tied to ground, the other is tied to a pin on the uC with a 10k pullup resistor. if someone tries to drill through the side, they end up bending the outer mesh such that it touches the inner mesh, pulling the pin to ground and triggering a tamper alert
plus it doubles as a faraday cage to prevent EM leakage
you can do a similar thing with cardboard and aluminium foil, but it's not as robust ;)
 
Very cool, I've read about similar structures being used directly in tamper-resistant chips
it's a good measure, and it increases the cost of attacking, but an attacker once aware of these measures can do things like propping up the mesh
 
yeah, there's a cool trick where they used laser etching in very thin glass tubes containing chlorine, with a vacuum layer over the die, so any disturbance cracks the glass and leaks chlorine onto the die, corroding it.
 
interesting read
if I wanted a really solid solution I'd just encase the Arduino board in epoxy.
 
@Polynomial Not an issue that you need to deal with, but I saw a similar project using ethernet and a few python scripts. It worked out pretty well.
 
@AntonyVennard in this case I'm running an ethernet shield and will have a simple HTTP API running on it.
 
seen that already :P
they're using it is a signing HSM though, which is a different use-case
 
9:49 AM
@Polynomial Yeah, it looked pretty cool. My thought was just if you hadn't seen it, that might not have been a bad starting point as the architecture is mostly sorted, it's just your specific needs you need to adjust for.
I kinda wish I had the knowledge to put together something like this.
@Poly am I right in thinking if I buy the base arduino board I can simply plug in components (I think arduino calls them shields, right)?
 
yup
basically if you get an Uno it's an Atmega 328PU microcontroller hooked up to a timing crystal and power supply, and the micro is programmed with the Arduino firmware / bootloader.
that's all there is to it.
the shields are just peripheral hardware that come in a form factor that makes it easy to plug them into the Arduino
 
@Polynomial Ah, that's easier than I thought! I was looking at building a few hardware things just for my own personal experiments, but the thought of soldering stuff up... well I'm likely to kill it.
 
yeah, you can just plug in shields and use simple patch cables onto breadboards
no soldering needed
the shields look scarier than they are, too. for example there's an accelerometer shield, and it comes in the normal form factor (so it plugs right over the top of the board, with like 40 pins or something)
but only 6 of those pins actually do anything.
power, ground, then 4 pins for the SPI bus interface (MOSI, MISO, CLK, CS)
and the best part about those kinds of devices is that they stack onto the same pins, as long as you do some minimal changes to the libraries.
oh, actually, you'd need to slightly mod the shields (just cut the CS pin and wire it to a different GPIO pin on the Arduino)
'cos SPI just works by setting CS high on one device and sending / receiving commands, then setting CS high on another device and talking to that.
CS just means Chip Select
 
10:09 AM
I should really write more blog about PayPal's overall shitty-nature
 
@Tinned_Tuna Why bother?
 
@TerryChia to warn people off using them :-p
 
@Tinned_Tuna Why bother? :P
 
They position themselves (effectively) as a bank, yet are mostly unregulated in that sense.
 
There simply isn't a good enough alternative out there, but I remember having this conversation before.
 
10:12 AM
yea ...
the banks would be a reasonable choice, if they were cheaper
most people chose PayPal because they have a low setup cost, compared to being a merchant for a bank
It's partly why loads of alternative payment processors are springing up, banks are too costly, and PayPal is a lawless backwater.
 
10:30 AM
@lynks I am genuinely scared :P
 
10:48 AM
@Polynomial Okay thanks. I might get myself some arduino kit. I'm sort of thinking this summer I might learn more about electronics, so, it'd be a good project I think.
 
@AntonyVennard there's always electronics.stackexchange.com too :)
 
@Polynomial There also was Arduino.SE
 
@Polynomial Yeah, true. I should hang out there more. Unfortunately I currently feel like I'm below the minimal knowledge needed.
 
well I highly suggest learning Ohm's law first
just because it's so fundamental
then learn about power (i.e. P=IV)
that'll get you through most basics
resistor and capacitor combination equations are useful too.
Kirchoff's Laws are also good to know, but you can get by in most digital stuff without them.
 
Generally you just need to know what resistors and caps do
the rest is all logic circuitry
 
10:56 AM
well, yeah, but you need the math to get the right values for things
even stuff as simple as driving an LED from a 9V battery requires some maths
and getting the power calculations wrong when driving loads from uC GPIO pins can cause a dead chip
 
@Polynomial yeah that too
 
@ManishEarth it depends what you're trying to do. If you're building your own radio circuitry, you'll need to know about how inductors work
 
Yep
 
and then work up to things like rf circuits
 
@Tinned_Tuna yeah, analog stuff is more tricky
AC and RF are generally mathsy
 
10:58 AM
I hate analogue stuff, mainly because I can't seem to bake it into my head well enough
 
I guess I've taken a lot of physics for granted when meddling with electronic circuitry :)
 
digital, fine, TTL & FET-based logic and up, fine.
analogue and RF? I always need to consult a text book
 
pretty much the same here
except my TTL / FET stuff is a little hazy in places
 
but RF is very fun...
 
moreso with FETs than TTL
RF can be a lot of fun, yes
 
10:59 AM
FETs are occasionally magic, and I'll have to work through from first principles.
or consult a book :-p
having a university level library on hand is exceptionally handy.
 
tbf, a lot of what I do with microprocessors is practically RF due to high clock freqs
 
lol
 
every damn trace is a patch antenna
yay for clamps and decoupling
 
I think that the high clock frequencies is useful... yey for tempest attacks
 
heh
it's specifically easier on CRTs due to the scanline transformer
when you have a component whose job is to generate an EM field, you're already in the money for TEMPEST stuff.
 
11:23 AM
It seems like the daily routine of bears is to wake up, surf Security.SE, find any new questions that haven't been answered by another bear, and answer them all.
:)
 
Back in the early nineties I simulated the newest generation of high frequency circuitry for Siemens. It was ostensibly digital but in reality it was astonishingly analogue, and used all sorts of bias and timing tricks to get faster response times from transistors
@ManishEarth try changing your avatar to a bear. It may work.
 
@RoryAlsop Was that before or after you invented fire? ;)
 
Of course it may not. ..
 
@RoryAlsop Let's first see if @TerryChia's ear works out :P
 
@Terry - pffft. Tamed fire, not invented it.
 
11:51 AM
What about this bear?
 
@Manish - on a mobile device I hardly notice @terry's ear
 
12:21 PM
I guess the fastest way to get into Redact's service, assuming perfect use of crypto, good key management, strong protocols, etc. is to develop an iOS zero day exploit :-p
 
@Polynomial For a HSM worth that name, you need tamper resistance, and some permanent storage. There must be a way to store at least 128 bits worth of secret data, which will still be there when you power the machine again, but which cannot be stolen.
 
@ThomasPornin that's pretty much what I'm doing
there's an SD card for the actual records, and the master key is in firmware
since the secure bit is set, you can't pull the firmware back out
related:
0
Q: Is it worth applying a MAC on data in a HSM?

PolynomialI'm building a basic HSM out of an Arduino, and am using the following scheme to store data: Master symmetric key $k_m$ stored in firmware (secure bit set to prevent trivial extraction). Secondary symmetric keys $k_s$ stored as plaintext in web application database, one per user. HSM record key...

 
@Polynomial You can't ? It's hard to get tamper resistance without power.
 
@ThomasPornin huh? how do you mean?
oh, you mean decapping?
 
@Polynomial For instance, putting two wire meshes so that drilling triggers an extra contact makes any good only as long as the meshes are actually powered.
 
12:28 PM
sure
I discussed this above. The records can't be decrypted unless the master key from firmware and record keys from the db are compromised.
pulling out the HSM immediately triggers an alert due to failure.
killing the server does the same.
and I'd likely encase the uC in epoxy resin as an additional defense mechanism
so it's a risk in a case where an attacker has unrestricted physical access to both the HSM and the server, for a long period of time, and can completely shut off the server and HSM without being disturbed by security in the DC.
but at that point it's largely moot.
there's also an option for battery backup tamper protection, which is what a lot of chip+pin machines do
 
Or, keep a big cap or battery in there that powers the whole destruction thing for a length of time
ensure that the destruction method can work when the memory is un-powered & decaying (assuming volatile memory)
 
@Polynomial Oh, you can have some level of protection with systems such as yours, but I would be wont to call it a "HSM".
 
@ManishEarth He's the Patron Saint of ServerFault.
 
The same way that however you paint it, a super-funky skateboard is not a car.
 
@ScottPack I know :P
 
12:36 PM
@ThomasPornin I don't see why not. It's hardware, it's a module, and you can securely store content in it.
it's not really designed for high-end use, as I stated outright at the start.
 
@ManishEarth I like the way mine turned out. It's from when I was using a sepia closeup of my eye. i.stack.imgur.com/Js1NC.jpg
 
@Polynomial Securely... that's the point. A HSM worth its name would keep your secrets secret, even if the attacker steals the whole system (the HSM and the server and its database).
 
@ScottPack ah
 
I don't see how that can be possible.
 
@Polynomial Then don't call it "HSM".
 
12:37 PM
@ManishEarth Subtle.
 
if you steal the HSM and whatever system talks to it, surely you're running into the same problem DRM does, no?
you have the data and the keys all in one place.
 
@Polynomial That's what tamper resistance is about. Good HSM are supposed to implement active countermeasures. Someone who steals the whole system will be able to use the keys, but not the extract the keys.
This more or less supposes that the HSM has its own battery and commits suicide when "decapping" or whatever name you give it.
 
that's possible.
 
@ThomasPornin why not wait until the battery runs down then?
 
In NIST parlance, that's the whole difference between FIPS 140-2 level 3 and FIPS 140-2 level 1
@Tinned_Tuna With a battery, the secret is kept in RAM; when the battery runs down, the RAM contents disappear.
 
12:40 PM
yup.
 
Payment terminals do that, too.
 
except for cold-boot attacks?
(well, it's not a cold-boot, but the idea is the same)
 
@Tinned_Tuna to do a cold-boot attack you need to be able to directly freeze the chip, which you can't do since there's active anti-tamper
 
@Tinned_Tuna The internal circuitry is also supposed to detect abnormal temperature conditions and actively destroy the data in that case.
 
^
I could do that too.
 
12:41 PM
I would've thought that due to shipping constraints (-40C in aircraft hold), you'd have a lot of leeway ?
 
@Tinned_Tuna -40C is nowhere near enough to cold-boot.
and usually they're not configured with a key when being shipped, so such countermeasures could be relaxed
 
Really? I'd heard of people using up-turned cans of compressed air (around -20C) and having notable results on standard RAM chips?
but then again, I have no sources to hand, so that could be me mis-remembering
 
at that temperature you're extending the life of data by seconds
e.g. 200ms -> 4s
maybe.
 
@Tinned_Tuna I know a case where a HSM was blocked for 6 weeks in customs because of Chinese bureaucracy; when powered again, the HSM had died. It had to be reset, reloaded from a master HSM, and shipped again, this time labeled as a "network card" so that it goes through administration in less than a week.
 
heh
bureaucracy fail!
 
12:43 PM
@ThomasPornin due to lack of power, cold, or a combination of both?
 
@Tinned_Tuna probably both.
anyway, gotta go do stuff. laters :)
 
laters :-)
 
12:54 PM
@Tinned_Tuna Lack of power, actually. When the power became low, the HSM voided its RAM, then shut down completely.
 
@ThomasPornin makes good sense :-)
 
@Polynomial Instead of an Arduino, you may want to use a smart card.
They are cheap (20 EUR) and they are optimized for tamper resistance.
They are even FIPS 140-2 level 3 certified.
Plus, they embed a (small) CLR virtual machine, which means you can do some C# code which runs on them.
 
Finally, the hardware includes a crypto accelerator so it is rather fast at RSA (it can generate a new 2048-bit key pair in a few seconds, which is no small feat for that kind of hardware).
 
@ThomasPornin what's the entropy gathering like?
 
1:00 PM
@Tinned_Tuna I don't know how it does it, but the internal RNG is part of what has been FIPS certified so it must be good enough to make NIST people happy.
 
small devices typically have problems with entropy generation
due to their state being entirely known at startup
 
@ThomasPornin I think he is doing it "just for fun".
 
@TerryChia I don't object the fun; I object with calling the result a "HSM". It's like saying that a simple MD5 on passwords is a "super cheap password hashing function" suitable for non-high-end systems.
 
1:31 PM
g'day all ;) interesting discussion I see ^
 
G'day Bruce
 
1:48 PM
@ScottPack How's the weather like at you? It's so hot here the storm clouds are gathering already... from winter to summer in under a month, what the bleep? :O
 
@TildalWave We had a longer spring, but today's turning out to be not too bad. The high today is 27, which is warmer than I like, but it's 10am and is about 20.
I've got the windows open, birds are chirping, fresh air smells wonderful.
I'm home today working on school stuff, so I imagine after lunch I'll go on the backporch.
It doesn't get full sun until around 5:30-6 so it's going to be too cool out there to comfortably sit.
 
@ScottPack I checked on Google fast and it says up to 28 degrees C for you and clear skies till the weekend... similar than here only we'll obviously already have electrical storms later in the days, like in early summer times. It's wacky, I dunno why I bother having transitional period clothes any more LOL
 
@TildalWave In Québec, transition from winter to summer is known to be fast; under 8 days this year
We have very short springs.
 
@TildalWave We had pretty good rain Sunday and Monday.
 
1:59 PM
out weather has been mega-wacky lately. Late april and we've been having hail showers!
 
potentially dumb question: say I have a java server application, is there any reason why using screen to run it continuously is bad in a production environment?
 
@lynks Control is rather crude: only one admin at a time
 
Typically we have very short springs. Last year was brutal. We normally only have a few days, no more than a week, in the mid 30s. Last summer we had several weeks where it didn't get below 35 and most days in the upper 30s.
 
also, if the admin grabs the screen and his network connection dies, then the application stops
 
Considering how humid it tends to be in the summer that just gets brutal when even the overnight temperatures are 23 or higher.
 
2:01 PM
@ThomasPornin I thought screen stayed up and detaches? I often just close a terminal emulator locally and the screen session stays just fine.
 
@ThomasPornin Seems we're getting them shorter and shorter here too. I love spring time, that's why I'm complaining. It's a bit strange tho for the Alps area, actually glad that it didn't cause more problems with snow melting so fast.
 
@lynks Mmh... I have known screen sessions which were less reliable. Maybe the code has been improved over the years.
 
For your purposes, @lynks, screen should be pretty reliable. Your best bet would be to daemonize it somehow, though.
Write an init script and let the services system handle it.
 
@RoryMcCune oh that too... my mom is trying to maintain a garden too... not nice if that happens
 
@ScottPack ahh yes, I should probably look into that /etc/init.d stuff
 
2:03 PM
@TildalWave Yeah, the lady's garden can get awful messy to handle if it stays too moist for too long.
5
@lynks What distro are you running on?
 
@ScottPack hehe
 
@ScottPack debian
 
@lynks I don't know anything about managing services for debian. Does it still use sysV init scripts? I know many things are moving towards systemd or upstart. I don't know enough about either of them.
 
@lynks If you're on debian and you do have upstart, then you'll find config files in /etc/init and documentation everywhere for writing them. To manage, type start <name> or stop <name> and so on. If you're using sysv scripts, /etc/init.d/shellscript start simply copy an existing shell script.
Systemd uses systemctl start name.type as its syntax and config files live in /lib/systemd/system on fedora and are symlinked to their targets.
I think debian still uses chkconfig to enable services by default.
 
/me seriously needs to read up on systemd
Just make sure you properly fill out the chkconfig header on the init script.
 
2:09 PM
@AntonyVennard I'll have to read up., but I have always controlled daemons using /etc/inid.d/apache2 stop (rightly or wrongly)
 
@lynks it's probably sysv scripts then. That actually still works for some things on ubuntu, though, which uses upstart.
 
i think i just gave myself another days work to do...
 
Yay
 
 
1 hour later…
3:23 PM
@lynks Sorry ;)
 
for anyone who has to make presentations: prezi.com i find the infinite-zoom feature really cool.
 
@lynks I'm a great fan of Prezi used it for a couple of conf. presentations and it always seems to go down well..
 
A wild TOTP question appears. @ThomasPornin uses MasterBall.
 
3:39 PM
@lynks Have not tried Prezi, but I am currently using rvl.io
Huh, apparently the Related questions list at the side of each question shows migrated questions as well.
Confused me for a moment.
 
@TerryChia you have an ear in the middle of your gravitar?
 
@lynks Yes. :P
 
@TerryChia that really confused me for a second :P
 
Apr 28 at 15:21, by ManishEarth
@Adnan your right ear looks pointy/elfin in the grav
Go from there.
 
heh
 
3:50 PM
Any of you guys caught Iron Man 3 yet?
 
gonna see it soon
 
Someone should show Lt. Colonel James Rhodes this particular question. /slight spoiler
361
Q: XKCD #936: Short complex password, or long dictionary passphrase?

Billy ONealHow accurate is this XKCD comic from August 10, 2011? XKCD 936: Password Strength I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against me on that one. However, XKCD's analysis seems spot on to me. Am...

 
ooooh downloading at 80MB/s is fun, thats what...640mbps :0
 
wtf hax
 
@CodesInChaos O_O
 
3:56 PM
@CodesInChaos wgetting a googleapps.com file from an aws node :)
 
 
3 hours later…
6:30 PM
WTF, steam locomotive is installed on our production server... : /
 
@lynks backup power supply?
 
/me sighs
The worst is attempting to debug a regex that you are highly confident in, a tester displays is correct, but still fails to match.
 
6:50 PM
Anyone else finds SE a bit unresponsive today?
 
@ScottPack Anything goofy about the source data you're trying to find the match in? Something that's not outwardly visible but that could be causing the miss, like homoglyphs, or non-printable characters?
 
7:14 PM
anyone aware of a simple encryption algorithm (but stronger than rot13) which is not really secure but just helps obfuscating code?
 
@LucasKauffman use a real encryption algorithm with the key computed in many steps over the normal course of the code
that makes it hard to deobfuscate without executing the code, but is easy to counter with a debugger (extract the key at the point of descriptions)
for better anti-RE tips:
 
@Gilles It's for AV evasion
(doing a course on shellcode)
might use DES or 3DES hen
*then
 
@LucasKauffman why not AES?
 
@Gilles Isn't AES really hard to implement in assembly
wait
I don't need to write it myself
 
7:30 PM
@LucasKauffman gcc -S
 
BUFFALO SOLDIER!
weird question
anyone happen to know of any "industrial" grade microSD cards?
something that can operate at unusual temperatures and run for extremely long times
high number of writes, extreme number of reads
 
@Polynomial you might struggle, high density flash isn't exactly super stable at the best of times.
 
@Gilles Where do you get all these nice Jin's PNGs from? If you have some location to share, it would come handy to others too I believe ;)
 
@lynks I'll probably build some kind of parity table if I can't get a microSD that does it for me.
should extend the lifetime somewhat
 
@Polynomial you could raid 1 a bunch of them :P
 
7:38 PM
haha
it's going into an Arduino, and I only have one microSD slot
 
Just had a moment when coding of "oh that worked first time... unexpected" :P
 
I can handle 25% space reduction on 16GB, and all the data will be integrity checked using HMAC-SHA1
so fingers crossed it'll be alright
 
@TildalWave what nice “Jin's PNGs”?? I don't have any PNGs
 
but I'd rather not implement all the extra parity junk.
 
@RoryMcCune I just spent half an hour trying to figure why a database driver wouldnt load when I had mispelled 'postgres' in the connection url...
 
7:40 PM
@TildalWave I posted http://reverseengineering.stackexchange.com/, it one-boxes
 
@Adnan: you appear to have weird misconceptions about how HTTP proxies work. I suggest you reconsider.
 
@Gilles Oh, didn't realize sorry
 
@lynks that kind of typo is the worst, 'cause your mind just starts skipping it..
 
@RoryMcCune so universal balance is restored
 
I'm already using half of my code storage space for libs and the base handler code.
without even having any real functionality
 
7:41 PM
@RoryMcCune yeah and the error message you get from JDBC suggests it cant load the driver, what it really means is it cant find one that matches the url structure :(
 
@lynks heh yeah. I'm working on persisting Nessus results using ActiveRecord and associations, so was kind of surprised to have it work first time..
 
hey @Adnan you don't have a day off work today?
 
@TildalWave Yes, I've just come back from Helsinki, wild 2 days!
@ThomasPornin Thanks for letting me know. It pains me to say this, but I think you're wrong.
@ThomasPornin HTTP proxies (the ones you put in your browser's settings) are very different from web proxies.
 
@Adnan Ooh, terminology issue. I see.
 
@ThomasPornin Here's an example of a web proxy hidemyass.com/proxy
@ThomasPornin AKA, application-level proxy.
 
7:44 PM
@Adnan Nice :) Wild in what sense? We want all the dirty details!! :P
 
@Adnan Since the original poster used "Web proxy" along with "VPN" and "SOCKS", I believe that he means "HTTP proxy" when he writes "Web proxy" -- and all other answers to the question assume the same.
 
@TildalWave Oh! Yesterday I went to Helsinki for the student party! Thousands gathered in the main square and I think it's the only day in which you can approach all the finns.
 
If you want to make a distinction with other vocabulary conventions, making it more explicit in your answer might help.
 
@ThomasPornin Very true. I'll address that in my answer.
 
@Adnan “web proxy” = “HTTP proxy” or “HTTP proxy + CONNECT”
 
7:46 PM
@ThomasPornin Frankly I avoided voting on any new answers exactly because of that, didn't know who's in the right
 
@Gilles What is this called then?
 
If you're using a different meaning of “web proxy”, I suggest switching to a different word, because everybody else uses “web proxy” synonymously with “HTTP proxy”
 
Ahh.. Jesus! Guys, I'm not new here. I have a fair idea how HTTP proxies work. I'm insulted that you'd assume I didn't know that.
 
Is it OK to ask OP what country he's from? I think that might clear a few issues, it's usually well know how they implement Internet censorship and how to bypass it
 
@Adnan I don't know what the general category is called. It is logical to call this a “web proxy”, but a bad idea, because the term “web proxy” already has a different meaning
 
7:48 PM
@Adnan Well, you just assumed (and declared) that all other answers were wrong. Seems fair, then.
 
@ThomasPornin I specifically said "Regarding web proxies"
 
@Gilles This is well and concisely said, and I concur.
 
@Gilles Well, they are called web proxies. Just because you think it's a bad idea, the name isn't gonna change.
 
@Xander As it turns out, I was fucking myself.
2
 
@ScottPack so that's what took you so long to reply? :)))
 
7:50 PM
@Xander That log file reports MACs in lower case, my regex came from a script that parsed a file that reported them in upper case. The tester defaulted to insensitive. I wasn't looking at that matching sequence closely enough.
@TildalWave Actually, no, the UPS guy came so I went to go install my wiper blades.
 
@Adnan i think "please read more about web proxies" and "Please take a look at my answer and correct yours" didn't help your cause. Also, for what it's worth, to me 'web proxy' means 'something that can proxy a browser session' so either a protocol level proxy, or an entire application service would both count.
 
@ScottPack Ah! That'll do it.
 
@Xander Yeah. I was pretty well not happy.
 
anyways, home time o/
 
Let's go together and Google for "web proxy" and see what we'll get.
 
7:53 PM
@Adnan it's obvious that the question isn't refering to that meaning anyway: both VPN and SOCKS servers involve using your browser normally and changing browser or OS settings, so the intended meaning of “web proxy” is also changing a browser or OS setting, not accessing a different website
In computer networks, a proxy server is a server (a computer system or an application) that acts as an intermediary for requests from clients seeking resources from other servers. A client connects to the proxy server, requesting some service, such as a file, connection, web page, or other resource available from a different server and the proxy server evaluates the request as a way to simplify and control its complexity. Today, most proxies are web proxies, facilitating access to content on the World Wide Web. Uses A proxy server has a variety of potential purposes, including: * To kee...
(first Google hit for me, also the first DDG hit)
 
@Gilles Please continue looking in the results page. See that the majority of top results.
Please don't get me wrong. I'm not trying to provoke arguments. Look at most of my comments and messages here, most of the time I declare my ignorance on many subjects.
 
frankly, I have no idea how HideMyAss is supposed to work, could I bother one of you for a quick one-liner digest? (I'm baking bread and can't go reading longer texts... turns out bread bakes faster than I read LOL)
 
Hey, I am probably wrong. But in my whole Internet life, I've always seen that there's those kind of proxies are called web proxies.
 
@Adnan Well, technically, the way you wrote your comments seemed optimized to trigger arguments (and it did).
 
@ThomasPornin Absolutely true. The wording of my comments was probably not appropriate.
 
7:58 PM
@Adnan It was appropriate if you wanted War, not appropriate if you sought Peace. It's all relative to your objectives.
2
 
@Adnan ok, so you're not the only one to call these services “web proxies”. But they aren't what the question is refering to (it's about “proxy servers”, and those aren't “proxy servers”, they're web servers offering proxy services)
Mentioning those services in an answer is a good idea
 
@ThomasPornin Well, I never seek a comment war. I'm just here to learn and (with my limited knowledge) teach.
 
Saying that the other answers are wrong is clearly wrong
 
@Gilles True. I have edited that part out.
 
00:00 - 20:0020:00 - 00:00

« first day (867 days earlier)      last day (2332 days later) »