« first day (3253 days earlier)      last day (1693 days later) » 

1:45 AM
@derobert any relation? podcasts.apple.com/us/podcast/99-invisible/… Just over 30 minutes in: "this is Anthony De Roberts he's a special effects technician at McGuffin films" -- transcript at bullhorn.fm/99_invisible/posts/tMdi6BU-356-the-automat
 
 
5 hours later…
7:15 AM
@JeffSchaller The surname is different...
 
 
3 hours later…
10:41 AM
snap Oh well! The similarity in name and our derobert's cooking profile was too much to pass up.
 
 
1 hour later…
11:45 AM
hello
 
Hello Kiwy!
There’s a bunch of potentially interesting conferences in Lyon at the end of October: events.linuxfoundation.org
 
Hello Stephen, thanks for the information :-)
will you be there ?
 
@Kiwy I’m hoping to go to the security summit; I have colleagues going to the open source summit but I’m not sure I will
 
well well well, I'm pretty sure the more than 800$ dollars won't be accepted as I already go to Hepix (a conference for computing in high energy physics) 2019 in Amsterdam in October.
But still would be very interested.
 
Are conferences helpful?
 
11:56 AM
Wow yes the OS summit is expensive! The security summit is cheap though, $100
@FaheemMitha I use them to catch up with people IRL
 
@FaheemMitha Yes they are
 
@StephenKitt Ah yes, real life meetings. What about the talks?
 
they are here to bound people together
 
@FaheemMitha that varies, more technical conferences tend to have decent talks
some generalist conferences have great talks if you’re looking to widen your horizons, but you generally won’t learn much to help you do your job
 
@StephenKitt Assuming one can follow them.
As I recall, that was always a problem with math, and even statistics.
 
11:58 AM
I would say that most tends to describe state of the art (which is often not implemented ) so interessting to know what you should or could do, but the bouding to know that you're not the only one with a problem to share with other it's priceless
 
@FaheemMitha yeah, for me a decent talk is one that I can follow but that still goes to interesting depths
 
After the first 15 minutes I usually used to get lost.
 
the conferences I enjoy the most are those where you can go to a talk, discuss it with the people involved, and even start hacking on stuff in the corridor straight after
DebConf is the best conference I know of but its audience is somewhat limited ;-)
 
debconf ? never heard of
 
the Debian conference
 
12:00 PM
wonder why audience is limited
:P
 
it’s a ten-day get-together for people interested in Debian
in ten days you can get a lot of interesting stuff done
 
@StephenKitt Is typing code in a corridor really practical?
 
@FaheemMitha many conference corridors have tables and chairs ;-)
 
Well now I'm working with centos, I loose a bit my interest in Debian and I have to admit the adoption of systemd was kind of an unpleasant move from my pov
 
last time I was at DevConf (not DebConf) they even had bean bags
 
12:02 PM
@StephenKitt Even so. You mean you start working on patches right then and there?
On a laptop?
 
but I should I have been engage in Debian developement so I could really criticise the choice
 
@FaheemMitha yes!
 
@StephenKitt hardcore.
Ten days? Really?
 
@FaheemMitha OK, eight days this year
 
@FaheemMitha I worked on a laptop for years it's pretty decent, patching an OS though might be a bit tricky in a busy room
 
12:05 PM
@Kiwy patching an OS? We were just talking about general code.
 
@Kiwy you wouldn’t believe how many kernel patches get written at 3am in conference bars
 
@StephenKitt that explains a lot of recent issue in the kernel I guess :P
 
@Kiwy heh
 
@StephenKitt Hmm, if true, that would explain a lot.
 
as long as code review doesn’t happen in the same bar at 4am ;-)
Kernel patches tend to go through a bunch of iterations, so even if the initial stab is at 3am in a bar, follow-ups (if needed) won’t happen in the same context...
 
12:08 PM
I was joking of course, I've been doing some dev from time to time and I exactly know how some Idea could be the best at 2:00 am and be the worst the day after when your eyes align with your orbit
I guess it also applies to my marvellous plans to enslave the whole human race...
isn't it a question for Kusa ?
https://unix.stackexchange.com/q/538674/53092
I feel someone's trying to parse gene sequence with regexp
 
@Kiwy Do tell.
 
12:28 PM
@FaheemMitha I think I should not, if I really want it to work I should make it public I think.
there might be a project to raise a rat army and build a doomsday device that could transform any human into cheese...
 
@Kiwy That would be some interesting technology. And a lot of cheese.
 
Rat + Cheesed anyone = total power
 
 
1 hour later…
1:54 PM
Does anyone know of a fairly simple method to find numbers that sum to another number?
For example if I input 15 I would like to output something like:
5 5 5
8 5 2
3 3 9
11 2 2
It doesn't have to be every possible combination just a few valid combinations
 
Divide, rounding up, then adjust (always in the same direction):
5 5 5
6 5 4
7 5 3
 
@StephenKitt: I'm not a very smart man. I'm not sure what you mean
 
Starting with 15, since you want 3 numbers, divide 15 by 3, giving 5, rinse and repeat (divide by 2, then take the remainder): 5 5 5
Then increment the first number, and decrement the last one: 6 5 4, 7 5 3, 8 5 2, 9 5 1 (and then you stop)
 
Ah, nice thanks
 
You can generate more combinations by using the same division approach after incrementing; this would give 6 5 4 again, then 7 4 4, then 8 4 3, 9 3 3, 10 3 2, etc.
If you only increment in the same direction, you end up with fewer dupes to deal with, assuming number order isn’t important.
 
2:24 PM
@Jesse_b Use case?
 
@FaheemMitha I'm making a random password generator that will just string together words from the dictionary file. I want it to pick random length words based on a given maximum password length
 
@Jesse_b Such things already exist. As I'm sure you aware. Regardless, just pointing it out.
 
@FaheemMitha They do. I'm still going to make one :)
 
And the approach Stephen is suggesting isn't exactly random.
 
It's random enough but I think I've got another method
 
2:31 PM
And you haven't said how many numbers you want to sum. You example was 3.
@Jesse_b Not a terribly useful way to spend the time, but ok.
 
If you’re generating passwords using a dictionary, the simplest approach is to pick n words at random, and if they pass the length criteria, keep them, otherwise restart.
(Don’t use a dictionary.)
 
"If you’re generating passwords using a dictionary ... don't use a dictionary" ? :)
 
Yeah I like giving constructive, actionable advice ;-).
 
Meh I don't really see an issue with it
 
But seriously, if “dictionary” is a list of real words, go take a look at hashcat before generating passwords from it.
 
2:34 PM
> "No" is an answer
 
There is still debate whether or not length beats complexity but from what I've read the length side is winning
 
@Jesse_b Any password based on dictionnary is prune to be defeated by a simple dictionnary attack
 
Many security "experts" recommend using a long phrase of words vs a randomly generated "complex" password of much shorter length
 
What was the title I saw ... the #1 password captured was "password" and the #2 password was "correct horse battery staple"
 
so: `mypasswordcouldbesomethingaboutmegoingtothebeach`

Is supposedly more secure than something like: `$shjjKJHsh-0289`
 
2:39 PM
passwordmeter.com tends to disagree
 
Length is very important, but dictionary words don’t count. Basically, if you’re looking at length, you should consider that one word counts as one character.
 
I think it depends on a few factors -- how visible it is (including whether it's used across multiple places) and how long until it's rotated
 
Honestly I think it doesn't really matter much at all
 
Jesse obviously works at a place with four-factor authentication, so password strength isn't a concern
 
I think the odds of my password being brute forced are next to zero regardless of how complex it is, and all passwords will likely eventually be compromised one way or another due to vulnerabilities in the system they are stored, keyloggers, or something similar. Also regardless of complexity
 
2:43 PM
48 letters no caps = 2.4746478666093177e+45 possibilties
15 chars with caps and special char = 1.2409358191964896e+74 possibilities
(based on 48 chars length for 26 possible chars) and (15 chars length for 65 possible chars)
 
Yes but the person cracking the password has no idea how complex it is
So they will need to check for all possible chars not just 26
 
whereas three English words gives 1e+15
@Jesse_b common brute-force strategies start by trying words
Admittedly, brute-forcing a three-word password with 1M attempts per second would take 147 years
 
@StephenKitt still given 235886 words with n combinations would be 235886^n combinations
 
@Jesse_b yes, I was working with orders of magnitude, on the order of 1e+5 words
 
I could also make this tool change l's to 1's, a's to @'s, etc at random
 
2:48 PM
Yup, that improves it somewhat
But nowadays hashing speed is insane, so if you’re trying to resist that (i.e. the password database is leaked) then you need passwords made of random chars
 
r_sum () {
	local total=$1
	local remain=$total
	local temp
	local arr=()
	until (( $remain == 0 )); do
		if (( $remain <= 3 )); then
			arr+=( "$remain" )
			break
		fi
		temp=$(( RANDOM % remain + 1 ))
		(( remain -= temp ))
		arr+=( "$temp" )
	done
	echo "${arr[@]}"
}
 
3:09 PM
$ ./genpass 55
pathologicopsychologicalplatydolichocephalicJupiterLuha
tetraiodophenolphthaleinproreconciliationArdisiareissei
formaldehydesulphoxylatemanquestepbrotherhoodbraccioCid
scientificophilosophicalphotocollographunbidenCystideaa
pathologicopsychologicaljthyroparathyroidectomizeznokan
tetraiodophenolphthaleinteaismsubdialectallykexaccederQ
pathologicopsychologicallaparonephrectomypolioneuromere
overcondensationphototelegraphicallybaudliturgizekyahoh
agrobiologicallygastroenterocolostomycounterobligationL
Has issues with being random when generating extremely long passwords. I changed the random number function to make temp = 24 if temp was greater than 24 since the largest words in the dictionary I have are 24 characters. That causes it to choose 24 character words more than anything else if you are generating a password that is much larger than 24 characters
 
3:25 PM
@JeffSchaller four-factor authentication?
 
@JeffSchaller no relation I know of
BTW: Learned something new over on Serverfault...
15
A: GRUB "Some modules may be missing from core image" warning

FruitHad the same thing today. Turns out it's caused by grub-probe trying to access partitions through /dev/sda, which is not cache-coherent with /dev/sda1 (and sda2 etcetera). You can fix it using blockdev --flushbufs /dev/sda1 (repeat for other partitions as necessary).

Specific application of the principle found here, of course.
 
Tim
3:41 PM
Wondering which languages are good for studying concurrent and parallel programming?
Thanks in advance for enlightenment from programming or language enthusiastists and anyone else
Please give functional languages special attentions
 
@FaheemMitha It's the latest fad in multi-factor authentication: (1) something you know, (2) something you have, (3) something you are, and (4) something I made up
 
randomize () {
	local input=$1
	local length=${#input}
	local index=0
	local char
	local string
	while [[ $index -lt $length ]]; do
		char=${input:$index:1}
		if (( (RANDOM%10) < 4 )); then
			case $char in
				a)	char='@';;
				l)	char=1;;
				o)	char=0;;
				s)	char=5;;
				*)	char=${char^};;
			esac
		fi
		string="${string}${char}"
		((index++))
	done
	echo "$string"
}
 
@JeffSchaller Hmm. Is this actually more secure? And do you have an example to hand?
 
I think you need to order a new sarcasm detector.
 
$ ./genpass 25
TEloTR0ch@ganGlI0CytePiaX
p@1e0@nTHRop0logIsTt0poTo
anatomiCophY5io1oGic@ln@y
eYFRosTaqu@aNETi0logIc@lN
oVeRsHaRppharmaCopeiadooH
CerEbrUMstepGRaNDF@tHeR@M
JuDaIsmcaRbasUs@iK@@loudU
CTudispRop0rTion@Ti0nmeeK
di5pR0p0rTi0naB1eNEs5NHip
EPIDidYm0DEfereNTecToMyTu
Does that satisfy all the password complexity gurus?
 
3:50 PM
@Jesse_b Possibly, but if you make users enter that on a phone, they will actually come and murder you.
 
=)
For phone users I have:
$ ./genpass 255
u1TRacrepIdaRI@NI5Mngl055o1aBi0phaRYNgEa1Kod@iNdefensIblenE5s5teREoph0toGraMMeTry@nTiDi5cip1In@rianTecHNogRaphica11yhepatIcoEnterostoMyDeV0RatIVerEpNeUMonedem@coMpoUndHem@T0sPeCtr0pHoT0MeteradEn0cYsTomatou5aUtodepolYmeriz@ti0nDd@iVaWumMelpREciPitativetytA
 
@Jesse_b I think you need more letters.
 
@StephenKitt That's not quite right. /usr/share/dict/words here is 654895 lines, so ~19 bits of entropy per word, if picked entirely randomly. Quite a bit more than the ~6 bits from a random character.
 
@FaheemMitha I generated 10 passwords with 1000 character length
real	3m50.316s
user	3m49.078s
sys	0m10.304s
 
@FaheemMitha sorry for the missed joke -- it's "something I made up"
 
4:03 PM
So something like hieroglyphing incombustible unrestorative warrantability's is ~75 bits of entropy (lost a few bits because I rejected a bunch of ones until I got something half sane), which is AFAIK well beyond hash attacks even on something quick like single MD5.
 
@derobert Sounds uncomfortable. It's incombustible and unrestorative?
Bummer.
 
@FaheemMitha Maybe it's a rock or something? You can put hieroglyphs on those, they don't burn, and they're not very comfortable to sleep on. Not sure where you get a warranty on one, though.
 
@derobert if it catches fire, of course
oh, you said "where"
 
That would make sense. You (somewhere) got a warranty in case your incombustible rock in fact combusts.
 
4:34 PM
@Jesse_b That passphrase ought to be divided up with spaces, a variable amount of spaces.
 
$ ./genpass -cl 16 -n 5
53n5YN3 si5 5a 5lue
x Ta1mUD v@5ew0rk k
Pr@esTeRnal z H 1uX
TI t@ne Y pr0clIsis
uN31id3D Io b0 G 0Ra
I've never heard most of these words
 
I had a v@5ew0rk once. Hurt like heck.
 
hah
 
Don't you mean it z like H?
as long as we're submitted feature requests on your own project, consider skipping words that have [il0O] (or others), if people are re-typing them
 
I generally don't type passwords, I use a password manager
Also that seems a bit difficult to implement
 
4:43 PM
wait, if you're using a password manager, why not just generate entirely random characters?
 
I am probably not going to use this script
But also lastpass makes it fairly difficult to generate a random password within certain applications
I don't always make useful tools...every once in a while I see a tool someone else has wrote and I hear a voice in my head
That voice is usually @Kusalananda saying: "You should not make this in shell script"
and then I begin working on said shell script
In this case however the voice was @FaheemMitha saying: "Someone else has already made said tool"
 
@Jesse_b It's generally more useful to work on existing tools.
Most free software projects, including many useful, important, and interesting ones, have a severe shortage of manpower.
 
I'm sure they don't want me contributing any of my nonsense
 
 
2 hours later…
6:50 PM
@Jesse_b I believe that's what they call positive thinking.
 
The more I learn about that Hitler guy, the more I don't care for him.
 
I didn't know that British Steel was in trouble. The New Yorker has a detailed article.
 
 
1 hour later…
8:17 PM
I made my tool bypass the dictionary to be able to generate truly random (maybe?) passwords as well. It's much faster lol
computers suck at random
the ] character shows up in passwords way more than I think it should
 
@Jesse_b compare with tr -dc '[:graph:]' < /dev/urandom | head -c "$n" ? (adapted from here)
substitute :graph: for your own charset, if you want
 
tr: Illegal byte sequence
I think I was wrong anyway, I did some random testing and it seems to appear no more or less than any other characters
just seems strange because when a character appears, it seems more likely to appear multiple times in a single word
 
8:33 PM
@Jesse_b then apparently you need the LC_CTYPE=C tr ... version
 
I wonder if there is a brace expansion to include all special characters
Also I wonder why I can do {A..z} to wrap around uppercase (through some special characters) and then all the way through lowercase, but I can't do a similar thing with numbers to letters
 
@Jesse_b man ascii -- and the brace expansion says it'll expand characters in the range, it appears to distinguish numbers and letters specially
I tried and failed with {'!'..'~'} and {\!..~}
 
$ echo {Z..a}
Z [  ] ^ _ ` a
$ echo {\[..\^}
{[..^}
I think brace expansion is simply the devil
I think it just doesn't know about : through @
 
@Jesse_b Brace expansion in bash only works if both the start and the end of the expansion is of the same "type" (alphabetical or integer). It will not work if either is different of different "type" of the other, or if either is non-alnum.
 
@Kusalananda Either way it's strange that {Z..a} will loop around through some special characters, but {z..A} doesn't loop around through the numbers
 
8:49 PM
The numbers lie before A in the ASCII order.
Neither of those two ranges goes through them.
z..A is a backwards range
Like {4..0}
 
9:15 PM
Even Perl won't take 0..z; you have to force it (e.g., perl -E 'say map(chr, ord("0")..ord("z"))')
(note that last close paren, since it isn't clear from the font, is part of the sentence, not the perl command)
 
9:35 PM
I'd seeing some odd behavior in Mercurial. If one does a cp of a hard link, is it still a hard link?
(I realise this may be seem a very obscure question.)
 
@FaheemMitha No, generally not.
Not sure if even cp -a would do that. Normally if you want to make another name for a file, you'd use ln.
 
Actually, I was using cp -a out of habit.
How does one make a hard link, anyway?
 
ln existing-name new-name
 
@derobert Isn't that a symbolic link.
Oh, that needs the -s, I guess.
 
no, that'd be ln -s
(I checked: if you use cp -a on a single file, it makes a copy, which isn't linked to any other copy. If you use it on a directory, which contains two names for the same file (hardlinks), then the copy of the directory it creates also does that.
 
9:41 PM
@derobert You mean it preserves internal hardlinks?
Is it possible for a directory to itself be a hard link?
 
yeah. I'm not sure how hard it looks for links, e.g., if one is between names in different directories
@FaheemMitha Not on Linux, AFAIK.
 
Oh, and does ls show hard links?
And if not, is there something else that shows it?
 
-l should link count, various color options will show when >1 too
Easy enough to play with: touch foo && ln foo bar. Then you can see how ls, etc. behave on them
 
Directories don't have associated inodes?
 
@FaheemMitha They do.
 
9:57 PM
Ok, mystery solved. The mercurial tangle I got myself into had nothing to do with hardlinks.
Just a slightly dotty implementation.
I wonder if I should stop using the share extension.
It's convenient, but there is the potential for unexpected surprises.
 
10:22 PM
@FaheemMitha Come over to the dark side. Then you won't need random extensions to give you unexpected surprises.
 
TIL: CTRL+SHIFT+T
 
11:00 PM
@derobert I'll get unexpected surprises without the extensions?
@derobert I see Git's front page carefully forgets to mention Mercurial.
 
cas
11:42 PM
@Jesse_b I wrote a passwd generator like that. It picks multiple random words (with -w, -m, and -x options for number of words, min word length, and max word length. defaults 4, 4, and no maximum), and joins them together with spaces and random 1-3 digit numbers and/or punctuation. It also randomly capitalises some letters in each word. output is the generated password, followed by the length. e.g.
$ random-password.sh -w 4 -m 4 -x 6
18 smeech 96 visit +9 vised 17 acanth
37
$ random-password.sh -w 8
25 grAmmatologic 81 ostrichiSm 71 Laytonville ; cinereal 3 atomistic 15 sprog 31 cloDhopping 2$ schmelze
104
words alone are probably easily cracked (although more words is better). words plus random punctuation and numbers is far less easily cracked. I never bothered writing a script to do this until after the "correcthorsebatterystaple" xkcd comic, but I've been manually making multi-word passwords separated by numbers and/or punct since the early 90s. easy to remember, and once you type them a few times, your mind automatically associated the words with the numbers/punct in the right order.
these days most things that require passwords don't impose stupidly short (8 or 12 or 16 characters) password length limits....but back then it was a challenge to come up with a good password that fit in the limit.
catdogfish is a crap password. but cat 43doG 1 fIsh 77! at 20 characters is good enough to defeat current brute-forcing. The longer the better. and use a password-safe program. e.g. pass to store them in a gpg-encrypted git repo.
for truly random passwords, i just use pwgen to generate passwords with 32 or more characters. e.g. pwgen -c -B -y 32
 

« first day (3253 days earlier)      last day (1693 days later) »