« first day (957 days earlier)      last day (2269 days later) » 

4:01 PM
@GreenFly What do you think of DreamHost, as a VPS provider?
I smell a rep-train!!
@Simon Hop on it! QUICK!
You might finally get your first 200/day
 
@ManishEarth Those are harmless once you get used to them.
 
Wait, what? WHERE?
Ugh, I see it.
You know what? I was one of the first to see that question and I could have answered it. I was just too lazy.
 
But my particle physics prof managed to used the index μ with three different meanings in a single expression
 
I left a comment instead.
 
@CodesInChaos Yep. So what were you talking about?
@CodesInChaos Lolwut?
 
4:06 PM
Once identifying a muon, two occurrences of one implicitly summed four-index(thanks to Einstein's sum convention) and once as another four-index that's not summed over
or x being both an operator and a variable within the same quantum mechanical formula is pretty confusing as well
 
Aren't most phishing and other illegal websites hosted in China?
 
@Simon Just post a freakin' answer and express what you think
 
@Simon it really depends on where why are targeting, and on how liberal the laws are. Many eastern european countries have a lot of evil servers.
 
You'll say something stupid, you'll be corrected, and you'll learn something new. That's what I do
 
Of course, the Cameroon tld .cm is the most evil tld.
 
4:16 PM
@CodesInChaos But really, why don't you run for mod positions?
 
@Adnan Too late. Everything I thought was posted.
@lynks I love Europe.
 
@Simon Oh come on, do you really have nothing more to add?
Not even a small thing?
 
Other than he could rent a VPS with a pre-paid CC, setup a VPN on it and not provide any personal information, nothing really.
I'm not sure if he wants to do this though.
 
@Simon Then write that with some links stuff
 
I'm so lazy, you have no idea.
 
4:21 PM
@Simon Who cares about him? The OP himself isn't exactly the main reason we write the answers.
We write them for future visitors as well
 
True.
 
@Simon Write a sensible answer and if it's good, you'll get the first +1 from me in a blink of an eye
 
Alright, alright. Give me 5 mins.
 
@Simon That's what I said.
 
Dayum.
 
4:25 PM
@CodesInChaos O_0. Indices are confusing
 
4:35 PM
Ah! I feel hurt! Someone -1 my answer
 
Boar's head; why you so good.
 
@Adnan I posted something, let me know if it makes sense.
 
@Adnan I don't want to be on SO, I'm not active enough on security, and crypto didn't have an election yet (and I didn't read the pro-tem invitation in time XD)
 
@Simon Makes sense to me
 
Good, thanks for the +1
 
4:50 PM
This annoys me: I post an answer like this:
2
A: Is mt_rand() suitable for generating a salt?

tylerlUnder most conditions, a salt needs only to be unique, not cryptographically unpredictable. So in that case, yes as long as your RNG is properly seeded. Another common technique to improve salt quality is to concatenate a random number to the current time, then hash that (e.g. SHA1), textually e...

And then this kid comes along and posts a bloody stupid comment about how you shouldn't use SHA1 because it products a birthday collision on 2^80 itnerations.
DO YOU EVEN KNOW WHAT THE HELL YOU ARE TALKING ABOUT?
 
Well, he apologized.
 
It's like people read something on a blog somewhere and go on a crusade to demonstrate their knowledge.
 
I crusade a lot
 
Yeah... did you see his apology?
He goes on to talk about using enough rounds and that's not available in PHP or whatever. Cluelessness persists.
 
I think half my downvotes on SO are for hashing related questions
 
4:53 PM
Well, you know, maybe he likes turtles.
 
I feel like SE sites do get quite a lot of crusading. It's often obvious that someone has just paraphrased wikipedia. I mean sometimes thats ok - an expert might be able to digest something highly complex and give the gist in an answer, but on smaller sites like ours, I feel like our signal to bullsh1t ratio is sometimes in danger.
 
@Simon ?
 
@tylerl Success. When you have nothing to reply, confuse the hell out of the person.
 
@lynks I don't mind if you take a stand on one viewpoint or another. But do the world a courtesy by understanding what you're explaining.
@Simon Touché. I am thoroughly baffled.
 
@Simon I do like turtles.
 
4:56 PM
@lynks So do I, they're so cute.
 
@lynks I'm fine with wikipedia paraphrased answer as long as it fits the question
 
Half the problem is that people on SO think that they are experts, so they spout what they think is right whether they read it from some random blog or not, regardless of how wrong they actually are.
That's not to say that there are a lot of seriously knowledgeable folks around.
 
I seriously offended a high rep user on SO for downvoting bad crypto answers of his
 
@DavidFreitag There are a few users I wouldn't ague with just because I know that they've researched more thoroughly than I have, no matter what the question or answer (well, maybe just one user with two accounts).
 
@tylerl Yeah, i mean don't get me wrong, SO has been a learning experience for me. There are some occasions where i stumble onto a question and think, "hmm... you make a good point..." so i end up researching it and posting what i find. That's not to say that this method hasn't backfired.
or rather, the whole exchange, not just SO.
 
5:05 PM
@tylerl Hey, you should not refrain yourself. Every Whiteface needs an Auguste, if only for plot exposition purposes.
 
@tylerl I occasionally do disagree with bears
 
Did he just say that while one of them is around? Oh god.
 
@ThomasPornin OK. How about this: Your expository drama on the lack of email authentication lacked proper character development. You should redo it.
Now I'm an editor!
 
@Simon We had a pretty long argument about DNSSEC and CAs. Fluffy parts of security are much easier to argue about than the technical parts
 
@CodesInChaos And you're still alive?
 
5:15 PM
heh, nearly a month since I wrote an answer. maybe I'm rusty
anyway, home time. gentlemen o7.
 
@lynks or maybe all the questions people ask now are varaitions on "HOW DOES TEH HACKING WERK?"
 
@lynks See ya
 
OMGAWD I'M CLOSE TO 500 REP
 
@Simon See? Hopping on the train wasn't so bad after all
 
<3
 
5:19 PM
Aw well. Guess I should start working. :(
 
@tylerl Good luck
@Simon Welcome to the awesome review queue!
 
@Adnan It's a great place to go to lose your faith in humanity!
 
Woohoo! Thanks!
 
I'm gonna fall asleep at work if I keep listening to that.
 
5:29 PM
@Simon This should keep you up youtube.com/watch?v=BFtv5qe5o3c
Hava neranenah!!
 
Jesus. I open it, view the top comments and it's a religion war. Great.
 
@Simon Doesn't seem like that to me. Have you actually read the top comments?
 
The first one is fine, the second one isn't.
He's complaining about people fighting, which sucks.
 
@Simon And now you're complaining about people complaining about people fighting!
Just listen to the freakin' song!
 
Doh.
I did!
 
5:33 PM
@Simon Now go back to work!
 
Yes sir.
 
Stupid encoding thing.
 
That should keep you awake
 
@DavidFreitag Damn! Good stuff
 
5:34 PM
Indeed. It's a shame that google doesn't have it in the play store /sigh
That whole playlist is just... great. There are one or two songs i avoid though.
 
 $ time sync
 real 0m20.800s
well, there's the problem...
 
5:47 PM
Anybody knows how synchronization with a time server works?
If you try to sync and there's a latency, then the syncing won't be accurate
If you try to calculate the latency first, you can't calculate it accurately because the two machines are out of sync
 
OH MY FUCKING GOD.
My problem was caused by htmlspecialchars
 
@Adnan, The time server compensates for latency
 
@Simon This just needs @Terry to tell you something about PHP
 
@Adnan Fuck, I despise PHP now.
 
@DavidFreitag How?
 
5:50 PM
@Adnan Yes.
 
@tylerl Would you please recommend some article/paper/book so I can learn about it?
 
@Adnan Divide the RTT in half and you have your average latency. It's not perfect, but it's close enough.
 
I can only assume by using a request/response cycle, then divide the total time in have and you get a rough guess at what the latenct is
 
Good ol 1992
There's a LOT of math that goes into NTP to get better accuracy than what I just described.
 
If I don't get too lazy, I'm gonna look into Python tonight.
 
5:53 PM
@Simon One of python's strenghts is that it is remarkably simple to learn. Probably one of the easiest languages. It's "compact", i think is the word
Very Few basic principles
 
Python? Swiss-army knife.
 
Good, that's what I need.
 
@Simon If the language is doing what you want, then it's a good language for the job.
 
Even if it's PHP?
 
It's your fault that you don't know how htmlspecialchars() works.
 
5:55 PM
I don't know if i'll ever get into php. I think i might stick to node.js or python. But you never know.
 
I taught my sister python in an hour. She's a painter with a degree in literature.
 
@tylerl I'm no painter though, do you think I can do it?
 
Lol, sounds about right. Python is nearly as easy as VB.Net. If you couldn't understand python i would be amazed.
 
@Simon Ahhh.. once you've been engaging in head-to-keyboard programming for long enough, you'll now what I mean.
 
@DavidFreitag While Python is one of the easiest languages, JS is one of the most difficult. Not because it's complex but because it's design is horrible.
 
5:57 PM
@tylerl Brilliant! Exactly what I was looking for. Thanks.
 
@tylerl Yeah, i know javascript isn't great, but i really like tinkering with it. Even though js has a lot of flaws, i (for whatever reason) think it's inherently better than php.
Or rather, i think php is inherently worse than anything else.
 
@DavidFreitag An incompetent developer will produce bad code and bad product no matter what the language is.
 
@DavidFreitag It's not quite the same: JS is crappy because it was rushed, influenced by silly corporate objectives, and targetted specifically at simple scripting. PHP is crappy because it was created by stupid people.
 
@Adnan While that's certainly true, i think i read some horror stories somewhere about PHP forever ago, now i don't want to go near it with a 10 foot pole.
 
@DavidFreitag It's certainly worth learning. I use it on my own site for a few things, and if you do security you'll absolutely certainly have to read lots of PHP code. But I wouldn't build my business on it.
 
6:04 PM
@DavidFreitag Guess what? I've read horror stories about gun accidents and motorbike accidents. I still ride and shoot (not at the same time).
 
@tylerl Good to know.
 
I wouldn't give my gun to a SWAGer teenager
I wouldn't give my project to a punk developer
You can screw things up with JavaScript, .Net, Java, or Python, as much as you can with PHP
 
So, I can love PHP forever and it will be alright?
 
@Adnan Yeah, i suppose that's true. Although somehow i got the idea in my head that PHP is an unstable heap held together with duct tape and tears. More or less i think that any problems will be in the language, rather than my code. Which is just naive.
 
@Adnan A major difference is that the way nearly everyone learns to use PHP is directly at odds with security practices. The same is not true with other languages.
 
6:07 PM
@Simon Learn it well, read good code, follow best practice and not W3Schools and their likes, and you'll be fine.
 
You have to fight with PHP to get security. Other frameworks gently encourage security instead.
 
@Adnan Well, according to Tyler, 99.9997% or so are bad PHP programmer, do you think I can be the 0.0003%?
 
@Simon If were a bad programmer, you'll write bad code no matter what language you use.
 
@Adnan True.
 
@Simon My point was the everyone who wants to learn to code learns PHP first. And they suck at it. And then people pay them to write code and don't know any better.
 
6:09 PM
@tylerl PHP has gazzilions of fameworks to choose from. Database manipulation, security-related stuff, etc.
@tylerl And that's PHP's fault because?
It's an easy language, people learn it first. Well fuck PHP then!
 
@Adnan I didn't blame PHP for that. PHP has plenty to blame for other things. Like for example mysql_real_escape_string
 
@tylerl You probably have to fight with PHP to get security, I don't.
 
@Adnan Which is funny, because despite my feelings about PHP i still regard it as one of the most mature server side language.
 
@tylerl What's wrong with my favorite super SQL injection-proof function?
 
@tylerl PDO has been around for years, it's your fault for not learning about it.
 
6:12 PM
@DavidFreitag The maturity may be be part of the problem. Same goes for perl, which is more mature still.
 
@tylerl Aha, great. Now we're getting somewhere. In that, I agree with you.
 
@tylerl Yeah, but i think to some extent people think that maturity and stability, reliability, and security come hand-in-hand.
 
But just strawmanning (aunt sallying) the issue isn't really fair.
 
If you're looking for a mature programming language, do your web development in C.
 
I'm not suicidal.
 
6:14 PM
It's older than you.
 
@Adnan One day, we're gonna rule the world with PHP.
 
This is true, although saying something is older than me isn't really fair. Pretty much every language has been around since before 1992.
 
@DavidFreitag Not PHP
 
First things we teach interns here is security-ware programming. Regardless of the language, you can still append parameters to your SQL query strings
 
It's also one of the first things they should teach you at school.
 
6:16 PM
@Simon Nah, no need to. Let's just teach people Perl and Python.
Security comes built-in with those
Jesus!
 
Built-in security? Just like Windows?
Wow!
 
@Adnan I'm a fan of teaching everyone python. It's simple enough to understand, and it build a great knowledge of problem-solving. The average person is so computer illiterate it's ridiculous.
 
I'm gonna have to find a SQL masterclass in Python though. There's no way I'm going back to mysql_fetch_query and stuff like that.
 
@DavidFreitag Oh. Just realized this: Python and Ruby are both older than PHP. And of course so is Perl, since PHP was first written in Perl.
 
Or maybe I should just make my own, that'd be a great way to introduce me to the language.
 
6:19 PM
@Simon make your own language?
 
@tylerl Haha, no. My own SQL superclass.
 
@Simon Aw. I was going to give you some pointers.
 
When you write a = "SELECT * FROM table WHERE id = " + request.GET['id']
In Python, it automatically converts it to a prepared statement with parametrized queries
 
@tylerl I knew ruby was older than PHP, but i didn't know about python. I guess i have a lot of wrong information about PHP in my head. Maybe i should learn PHP after all (if not for just security i mean).
 
I don't really like any language I've learned so far
 
6:20 PM
@tylerl Like "don't do it"?
 
too many sucky type systems
 
@CodesInChaos Use a language that isn't strongly typed.
 
@Simon Well, I was going to mention looking at Rust as a good example of how to get started quickly. They use LLVM for code generation which does a lot of hte heavy-lifting for you.
 
@Adnan Really? That's neat.
 
@DavidFreitag Weak and strong typing are very ambiguous terms. What do you mean with them?
 
6:22 PM
@Adnan Which framework? Certainly not just straight Python strings.
 
@Simon Of course, it also automatically prevents XSS and it even handles your password hashing
 
i certainly want static typing
 
@tylerl What? It doesn't? Really? It's just like PHP? Nooooo
and if you combine Python and Perl, they even automatically setup your server and install all the patches
 
@Adnan Maybe one of the ORM frameworks does it. It's certainly well within the capabilities of the language.
 
@Adnan Man, Python is so strong. I bet that when a newer hashing algorithm comes up, it converts all the hashes into a new one without the original password.
 
6:23 PM
You just overload concatenation
 
@CodesInChaos Weak and strong type aren't ambiguous i just don't think you understand what it means. A strongly typed language (C, for example) each variable has to be explicitly defined using a data type. A language without strong typing (javascript for example) you don't need to define a variable with a type, it does it on the fly.
 
@Simon The code even automatically converts itself into encrypted strings to prevent reverse engineering
and if you try to use some advanced debugger, Python code just removes itself
 
Just because a language isn't strongly typed, doesn't mean that there aren't static data types behind the scenes.
 
@Adnan Wow, just wow.
I gotta learn Perl and Python then.
Could they take over the world though?
 
@Simon Lol, do them all at once, make it fun =]
 
6:25 PM
@DavidFreitag I've heard many definitions for strong and weak. I prefer "dynamic", "implicit static" and "explicit static" in that context
 
@Simon Oh you have to. Once you learn them, you automatically become Like become a security expert.
 
Like they could update themselves and turn your server into a robot, literally.
 
Python first. It's easier. Perl is write-only. Reading someone else's perl code is like reading hieroglyphics.
 
then there is what kind of implicit conversions are allowed
 
@Simon No, of course not. Because there's a conspiracy by the bad people to keep the good languages unknown and weak.
They're being paid with baby blood by the PHP dev team
 
6:26 PM
@Adnan And I thought reading WAHH would help me to understand security more. All I needed to do was to learn those languages!
 
Well, that last one might be true. I really don't like the PHP dev team
 
While c uses explicit static typing, it's pretty weakly typed IMO
 
@CodesInChaos I suppose, but you get what i mean. Try messing around with JavaScript (If you haven't already) Its a bunch of fun not having to deal with types. Obviously use common programming sense though...
 
@Adnan Haha.
 
@Adnan You'd like them less if you tried to work with them ;)
 
6:27 PM
javascript is lua gone wrong
 
@tylerl I have made many patches for PHP throughout the years. Trying to collaborate with those people is a PAAAAIN.
 
Speaking of languages that seem intriguing, anyone ever delve into F#?
 
@CodesInChaos Javascript was designed, implemented, and released in only 10 days to head of Microsoft from making something worse.
 
F# is next on my list of to-learn languages
it's probably a bit better than C#, but not good enough
 
@tylerl and heaven is real.
 
6:29 PM
@tylerl But, despite JS's flaws, its still pretty fun to mess with. I wrote a few Chrome extensions to adjust websites that i didn't like by mangling their html with js.
F# is... weird... the notation is like nothing i've ever seen before.
 
IMO golang has some interesting ideas, but static typing without generics/templates isn't nice
in particular I like golangs mix of duck typing and static typing
 
@Adnan You don't believe me?
 
@tylerl Source?
 
You should learn brainf*ck, you will never have to worry about types again =]
 
6:32 PM
One day I'll design my own language
but before that, there are still some languages I need to learn
 
That would be an insane undertaking.
 
sanity is for the weak
 
@DavidFreitag It is just a descendent of SML / OCaml with a side dish of .NET.
 
@Adnan jwz, by the way, is Jamie Zawinski -- one of the other guys who was there. That's why Brendan reads his blog.
 
@ThomasPornin Yeah, but my background is native C/C++ that looks like gibberish to me. I think it would be an interesting language to learn.
 
6:34 PM
I managed to get one of my friends into F#, but didn't get around to really learning it myself
 
@DavidFreitag It has been said that Scheme is "the Lisp which wants to be like SML" so you could learn Scheme to have some notions of SML.
 
@CodesInChaos I agree. I really like what Go has done with typing and interfaces. There's some implementation details that get in the way of me using it for anything serious, but the idea is very strong
 
The main idea behind SML and its ilk was to support a mathematical construct called the Curry-Howard isomorphism.
 
Sounds very application-specific.
 
This allows for static typing with type inference, which is neat and powerful until the moment you realize that it does not really exist.
Of course, when there are objects dynamic typing enters the room again, and you lost the practical advantage of static types (namely, the ability to have strong, unescapable types without needing corresponding runtime information).
 
6:39 PM
@Adnan Oh, and this has to be quoted for posterity. The way he talks about the language he himself developed is funny as hell:
> Yes, it was there from the start. But bignums were not in the cards. JS had to "look like Java" only less so, be Java's dumb kid brother or boy-hostage sidekick. Plus, I had to be done in ten days or something worse than JS would have happened.
 
So do F# for learning, but it has little advantage over C# for production.
 
@tylerl Nice conversation they have there. Thanks for the link
 
it's a bit more terse, especially when you like immutability
and it has some useful types like discriminate unions
 
@ThomasPornin I thought F#'s major advantage was parallel processing? IE: graphics card manipulation.
 
interactive use of F# is nicer than interactive C# as well
 
6:41 PM
@DavidFreitag You get possibilities for parallel processing when you have strong types, but that's not really tied to a specific language. I have seen it done with Fortran.
 
@DavidFreitag You can get parallel processing anywhere. The advantage with functional programming is that it's declarative, which means that the framework can decide how to run it. Parallel or otherwise.
kinda like SQL for progamming
 
But i thought the literal purpose for F#'s existence was as a framework to make parallel processing easier..
 
One day, I'm gonna be a huge nerd and will understand all this stuff.
 
For example, write an F# DLL to manage the parallel calculations then import it into an application.
 
@DavidFreitag I think it was a stated goal, yes.
 
6:42 PM
IMO the main point of F# is that it's a functional language with type inference that integrates well into .net
 
I see. Besides if i had some huge brainpower necessary project, i would use OpenCL or the like.
 
20
A: How to securely hash passwords?

nealmcbUpdate 2: In 2013, several experts initiated a Password Hashing Competition which should result in improved and more usable methods, with winners selected by 2015. For excellent background on the need for that, and good advice in the interim, see Password security: past, present, future from Pas...

 
for high performance computing, the rather weak .net JIT is certainly a handicap.
 
News on the password hashing front. Can someone approve my tag entry? security.stackexchange.com/tags/passwords/info
 
@DavidFreitag F# came into existance when functional was making a big resurgance. goopy-functional was just released, scala was getting traction, erlang was touted at conferences. Microsoft needed a functional language.
 
6:46 PM
That makes sense. If there is something Microsoft doesn't have, they either make it or buy it.
 
Have you guys ever run into a PHP exploit that displays the code of the page instead of the result of the script?
 
Someone should bring Microsoft up on a lawsuit for false advertising. Their software is hardly Micro
 
@Simon yeah, ran into that a few years ago
some browser game spat out its source code one day
 
@Simon echo file_get_contents(__FILE__);?
 
@DavidFreitag The goopy-functional bit was more important than it sounds. The undertone was the Google was powerful because they understood functional. They invented distributed map-reduce which was something of a secret weapon and showed just how much smarter Google people were than Microsoft peole
 
6:49 PM
@nealmcb This reminds me that I have an article to write and to submit there.
 
@CodesInChaos Cool. My boss keeps talking about it and uses the exploit as an argument to store credentials somewhere else on the server, which makes sense.
 
Luckily LINQ gets the sequence transformation part of functional programming into C#
 
@ManishEarth Nah, you would browse the webpage and the code would be displayed.
 
@Simon as in?
 
@Simon Howdy! "There" being the conference? Competition?
 
6:50 PM
@tylerl I see, it wasn't necessarily about market dominance, more or less Google was 1-upping Microsoft. Good work Google.
 
But once you have the code you can get the creds anyway.
 
@ManishEarth The server suddenly decides to treat php files like it'd treat html files
 
@CodesInChaos oh that. I thought PHP injection
 
@ThomasPornin Oops - meant that for Thomas....
 
@nealmcb Yeah, you got me thinking for a sec.
 
6:51 PM
Well, won't that require you to bork the .htaccess?
 
that's why you should store your credentials in a php file outside the directories accessible through http
 
@nealmcb The competition. I have imagine a conceptual thing for a way to hash passwords and I think I have an idea about a practical realization.
 
@CodesInChaos Yup, that's what I'm doing right now.
 
Another important part is to ensure that the database access the application uses isn't exposed to outside hosts
for example with a single sever php+mysql installation you can simply deactivate remote login for that mysql user
 
@CodesInChaos Doesn't mysql have remote login disabled by default?
 
6:55 PM
@CodesInChaos Localhost as the host, yes.
 
@DavidFreitag usually you make users as username@host, where host is localhost
 
it has been a few years since I used mysql, so I don't remember the details
only that we had some users for manual remote access, and a local only user for the application
 
Right, there is no remote login by default, because it listens to localhost by default, but once you change what mysql is listening on... I see.
 
@DavidFreitag Hmm, I'm not sure if creating a user manish@* or manish@ipaddress would automatically make it listen
 
I think there was a per-user flag to allow remote login
 
7:00 PM
@ManishEarth It wouldn't, iirc when you install MySQL it adds the "mysql" user, then you can flag each user for remote access. I just meant that while MySQL is listening on localhost there shouldn't be any remote access..
 
@CodesInChaos Yes, you can set user@'%' to allow any host.
 
You should be able to whitelist/blacklist for access with mysql.
 
 
2 hours later…
8:33 PM
sigh. Running Windows on a server is a weird combination of "saving costs by not having to learn anything new" and "spending vastly more by not using the most efficient tool for the job". It's a weird bit of corporate-think.
I wish my customers would quit it.
In the mean time, my cell phone is more capable then half the things i see racked in datacenters.
 
9:21 PM
I don't think i would ever use Windows Server unless i had to. It just seems like a bot waiting to happen.
 
9:36 PM
Listen to all of it, let your ears thank me later.
 
9:48 PM
@DavidFreitag Very nearly 100% of the cases when I see people using Windows server is when they have an app written in .NET that they want to host. There doesn't appear to be any other excusable reason.
 
Well, at school we use it to understand how things work, but that's only because we get it for free through MSDNAA. We don't only use linux.
But other than that i don't see the point, linux is easier to deploy, update, secure, configure... you name it... linux is easier. (You know... accept getting an infection).
 
So we again had an easy pickings rep train and I again missed it... I see a pattern forming here :))
 

« first day (957 days earlier)      last day (2269 days later) »