Well that's .. that, then. I have no idea why it destabilized

WHO MAKE MESS

WHAT IS THIS

DO I NEED TO STOP THIS CAR?

I MEAN...

Did someone accidentally take out the node stabilizer or transducer and put it back?

The redstone block is still there, so ...

There's no other reason it would have exploded like that

wiki.teamfortress.com/w/images/e/e0/…

I did nothing

This is somehow @KevinvanderVelden's fault

Where you will be disarmed and then eaten

I'm going to need dirt. Lots, and lots of dirt.

Well, I managed to clean up the goo on my lunchbreak, but what remains is why the node destabilized. The redstone block powering the transducer (visible from the ground above) had not been disturbed, so someone probably broke the transducer or stabilizer.

I'll stick another node there (and center it properly this time, had no choice due to where one ended up after a merge) but please, don't break the transducer or stabilizer or else gooey explosions will follow.

And now, I gotta build a new node for the workshop :(

@TimPost apparently feeding a hungry node crafting tables will cause lots and lots of points in the node very very quickly

@JeffreyLin Looks like hell is freezing over to me ...

@Arperum @KevinvanderVelden @ratchetfreak I'm trying to figure out a way to auth an Android app through a REST API but I'd like to encrypt the password before sending it over, is there any way to get the same hash from a password through Android and PHP?

Like, if I set something like bcrypt to the same settings, does it produce the same result on all platforms?

@Ieuan it should however you should have some way of salting

@ratchetfreak Yeah okay, but it's not like Java has a different way of doing stuff than PHP if I use the same algorithm?

@Ieuan the algorithms are public and tested against test vectors to ensure they always return the same values

for the same inputs

Aight

So it's not a bad idea to do that clientside and then do the auth using the already hashed password?

The danger then is that the hash becomes on the same authorisation level as the password

so if the DB gets leaked the attacker can log in knowing just the hashes

Hmm, right..

Didn't think of that

Well the problem is mostly that the guy I'm testing this for would have a group of friends use it and about 90% of them have HTTPs blocked at their work's wifi

Which is retarded but it happens

And I don't want to send plaintext passwords over HTTP

Not that sending hashed passwords over HTTP is a lot better but at least it's not plaintext

How about...

problem is that using user side hashing is as bad as plain text password (the hash becomes the password)

Damnit my other idea would mean that I'd have to save plaintext passwords in the database lol

Hmm

not really just sending plaintext password over http

Ok so how about this

No

Damnit

Everything either comes down to needing the plaintext password on the server or basically creating a second password

ask on security.SE

Will do

I think the solution will come down to exchanging a key with the server and then encypting client side to send over http

password will be encrypted over network and then the server can decrypt and then salt+hash like normal

I just had horrible visions of having to TLS encrypt things in javascript before I realized you're doing it with Android and have just plain old Java at your disposal.

Well tbh

Both points are in my control

I could pretty much force HTTPs over HTTP

@Ieuan SSL over http is more complicated then you'd think

depends on how they're blocking https honestly. Potentially they're doing more than just closing port 443

@Jochem Right, so HTTPs would be blocked as protocol too

@ratchetfreak Yeah I haven't looked into it yet, would like to avoid having to do so

there's another thing to consider: if both end-points are in your control, and it's just for a group of friends, how important is security?

diffie hellman, server sends the g and g^a with the form (and ID and client sends g^b and encrypted password

server can then get g^(ab) and decrypt the password

what's the worst that could happen if a password leaked, how much trouble would you or your friends be in potentially if someone else gained access?

@Jochem It's not, security is totally not a problem here, but I don't want to be responsible if someone does sniff the packets, decides to check it out and ends up breaching the server and taking all their passwords

however many people reuse passwords...

so a sniffer could get the password for their email or even work passwork

What I did for a little irc QDB for just-friends is set their passwords to something funny/embarrassing, and not give them the opportunity to change it. Illicit access wasn't an issue, if it would've happened I had a database backup and could just roll stuff back. The password really was just to prevent other friends from being dicks and posting as other people to be "funny".

I know the lure of making something proper and secure. All I'm saying is that you should always remember why you're doing it, who your target audience is, and what the consequences are of a "breach" :)

@ratchetfreak Yeah I simply don't to make the same mistakes I recently found out I was making lol

After reading a fucking 7,5 page article about password hashing

@Jochem Well for this, the target audience is a group of friends

However, the full audience likely won't be just them

It won't be a few hundred different users but it will be more than just those friends

@ratchetfreak I was like 'hey this answer to my question.. I've read this before'

Then I saw who posted it

hehe

Well.. I think I might have to have a chat with this guy to see if HTTPS really isn't an option

@Jochem What, something like this? digitalbazaar.com/2010/07/20/javascript-tls-1

@KevinvanderVelden I did not read the article. But why would you do that?

@Arperum I have no idea

disable javascript whoops, TLS gone.

Well jeah, and the app doesn't run at all

That's not an issue when implemented properly

@KevinvanderVelden I was thinking websites. Also: never underestimate hackers.

@Arperum websites are now also called apps =p

@KevinvanderVelden In that case: a website without javascript might not work for the average user, but a hacker who wants to go through will just follow the executed javascript and see what server requests he has to send. And make your site work without js.

Well, not if the server only accepts the TLS encoded data, and TLS is mostly to prevent people from snooping (man in the middle attacks)

@Arperum Depends, if all you do is use JS to generate the auth and then have the server verify it a MITM attack is very easy to receive the user's password but the actual encrypted data auth is pretty much safe

So then without anything changing the JS it'd be alright and just not work with JS disabled

Oh wait that's pretty much what @KevinvanderVelden just said

Nvm me

I'm not here

I have cable facade with no textures on it in my AE system. I love AE2

invisible or the purple "missing texture" texture

totally invisible

cable as well?

Not that I can find

maybe its because you are holding the network tool

it make facades invisible

Not even in my inventory, and it shows up as invisible in the crafting terminal

And it's not just bugged?

Sometimes the cables disappear and you have to pick them up and place them again

Other times the block location bugs out and you have to place a solid block there, remove it and then place the cable

No, this is facade I made, and I can't remember out of what, but apparently whatever it was no longer textures. In the first pack, I couldn't make facade out of sky stone which was weird

So we'll try this again.

QED is now by the auto enchanting stuff

@KevinvanderVelden How are you enjoying the Bearscape by the way?

@Unionhawk ... I don't play ToME, @Arperum does

Ooh

Bearscape was fun, bears were delicious

@KevinvanderVelden So that's where all those bear rugs in the castle came from.

how does the Infusion Alter work? i keep reading that the structure should be symmetrical and the recipe for the Sliverwood Wand Core shows a Block of Silverwood and every shard around it. also the example Image shows 4 Alters around the main Alter. i want to know as i am currently working on plans to build one