« first day (860 days earlier)      last day (3207 days later) » 

Bob
4:04 PM
@Hennes rust => corrode
 
Yup. that would be better
 
DMZ is unresponsive, so here: shamelessly cross-posting
Can anyone tell me if the Apache Struts Taglib "token" functionality (where your HTTP response contains a unique, cryptographically-secure token that the client has to spit back to you in the HTTP POST of a form) is a security function that prevents CSRF? if so, is it necessary or sufficient for preventing CSRF?
I found a CSRF vuln in our app (during the testing phase, thank god, before production implementation) and the developers deployed a fix by adding those taglib tokens into all the forms; you can't submit an HTTP GET or even a POST of the form using javascript on the user's behalf without running some native code because Same Origin Policy prevents your script from viewing what's in the child iframe from another domain
seems like the token is acting as a defense mechanism against CSRF but wanted to be sure
I take that back: you can submit a POST or GET of the form all you want; but the app just kicks back a vague error page and refuses to process anything in your request because you didn't supply the (correct) token
HWND WINAPI CreateWindowEx(
  _In_      DWORD dwExStyle,
  _In_opt_  LPCTSTR lpClassName,
  _In_opt_  LPCTSTR lpWindowName,
  _In_      DWORD dwStyle,
  _In_      int x,
  _In_      int y,
  _In_      int nWidth,
  _In_      int nHeight,
  _In_opt_  HWND hWndParent,
  _In_opt_  HMENU hMenu,
  _In_opt_  HINSTANCE hInstance,
  _In_opt_  LPVOID lpParam
);
@Bob, enjoy
 
Bob
ok, another advantage of AddClipboardFormatListener: I don't need to bother with disposing off/removing the listener when closing the program (I think/hope)
@allquixotic D:
actually, that's not that bad
 
which API has the most arguments?
 
Bob
I don't want to know.
hm
@allquixotic can you suggest an icon for the notification area? :P
 
4:23 PM
@Bob How about a low-res, close-up picture of a white fru-fru dog who looks like he's about to bark?
After all, fru-fru dogs are a part of SU/RA culture.
 
Bob
hm..
@allquixotic SU/RA?
 
@Bob SuperUser / Root Access
Ruuuuuun! A programmer is up in hurr! /me points at @NullUserException
hisses and puffs up to twice his normal size
 
Bob
hwha
and since when did you suggest a dog?
you're our resident cat-guy
 
@Bob True, but the dog meme is more well-known.
It's just me and HackToHell who like cats. The rest of the Cool Kids have dog gravatars.
 
Bob
guess I'm not a 'Cool Kid' then :P
 
4:28 PM
Well, except Tom. I don't think I want to claim that Taylor Swift is a type of dog.
@Bob a fox is a dog! of a sort.
There was a superstition during the Win8Challenge that pictures of small dogs were somehow psychologically leading users to upvote the posts of users who employ said dogs as gravatars.
 
Bob
@allquixotic Vulpini, not canis...
 
And accept them as answers, too.
 
Bob
@allquixotic ah, I believe that may have been my fault :P
 
@Bob Oh, good point.
Fine! You're not a Cool Kid, either, then.
 
Bob
 
4:32 PM
If you insist on arguing that you aren't, I won't stop you.
@Bob THAT is the fru fru dog I was thinking of.
 
Bob
A Bichon Frisé ( or ; French, meaning curly lap dog), is a small breed of dog of the Bichon type. They are popular pets, similar in appearance to but larger than the Maltese. Etymology and history The Bichon Frise descended from the Barbet or Water Spaniel and the Standard Poodle. The word bichon comes from Middle French bichon ("small long-haired dog"), a diminutive of Old French biche ("bitch, female dog"), from Old English bicce ("bitch, female dog"), related to Old Norse bikkja ("female dog") and German Betze ("female dog"). Some speculate the origin of bichon to be the result ...
 
they kind of remind me - vaguely - of the icanhascheezburger cat, because in many pictures of both those dogs and the cheezburger cat, you can see their bottom front teeth.
 
Bob
yay, clipboard notification works
 
yay!
 
Bob
oh boy
> The runtime has encountered a fatal error. The address of the error was at 0x6bff6b10, on thread 0x2b24. The error code is 0xc0000005. This error may be a bug in the CLR or in the unsafe or non-verifiable portions of user code. Common sources of this bug include user marshaling errors for COM-interop or PInvoke, which may corrupt the stack.
 
4:37 PM
@Bob make sure you're running the debug version of the CLI (with debugging information in the natives) and trap the native exception and see if you can isolate the problem
should at least be able to get a native function call stack trace
your other alternative is to set a breakpoint before and after every native function call in your program (or libraries you're using) and see which one crashes, but that's more tedious
 
Bob
interesting
hm
this only happens when copying from MS Word
copying from FF is fine
 
Word is extremely odd about how it uses the clipboard
 
Bob
..
wut.
 
Microsoft Office programs in general (Outlook, Word, etc) use an extension/overloading of the default Windows Clipboard called the Office Clipboard
 
Bob
Fun stack trace.
OutOfMemoryException
O.O
 
4:39 PM
O_O
 
howdy folks
 
what's your max heap size? hi @sathya
 
Bob
ah.
 
Word can put many megabytes of data on the clipboard because of all the formatting etc it captures
 
Bob
4:40 PM
wait for clipboard modification, change clipboard, repeat.
a fun little loop.
 
infinite loop? :D
 
0
Q: Why can we only edit our comments for the first five minutes after posting?

terdonI sometimes come across comments that I have typed quickly or on a mobile device or simply without paying enough attention and they have spelling mistakes or typos. Since I can only edit my comments for the first 5mins after posting, I cannot correct such errors when I see them and they are extre...

 
catching events from your own program? :D
 
Bob
@allquixotic funfunfun recursion
wwell, not really
I think SetData returns immediately
@allquixotic I believe it usually uses delayed rendering
hence the 'do you wish to keep using the data on the clipboard' message when you close it
@Sathya someone's learning markdown! :D
 
jsut fiY yuo cna aslo delet yuor unstighly coments. — allquixotic 30 secs ago
 
4:43 PM
hehe
 
Bob
oh wait, the button inserts Blockquote automatically. meh.
ok, how the heck do I stop this infinite loop?
oh, I know! hash the image, store that, check it.. I guess.. actually, I don't know.
 
@Bob that'd work
in the general case of where you have a getter and a setter for some data, and an event callback wired up to the setter, and your callback calls the setter, you need some way to determine whether your callback is being called as a result of your callback calling the setter
the easiest way to do that is to perform an equality check or hash check on the data
 
Bob
@allquixotic nope
 
it'd be more elegant if you could call a setter that doesn't trigger the event
 
Bob
@allquixotic I guess I could check if the window handle that added the data to the clipboard is my own, but I don't exactly want to upload duplicate data
@allquixotic eh, not possible here
unless there's something buried deep in the Windows API
but not much point in letting programs hide their clipboard changes
hm.. I know one clipboard monitor program explicitly adds a custom data type to alert other monitors to ignore it
 
5:00 PM
@allquixotic LOL
 
@NullUserException Don't worry; we're not really hostile to programmers in here. I am one. It's just a bit unusual, because most people who have a lot of rep at SO are smart enough to not need to come to SU with their problems. Just a trend. But of course you are welcome ;-)
I'm a (bad/mediocre) programmer who's better at tinkering, troubleshooting, and validation than I am at writing copious amounts of well-architected, efficient code.
 
@allquixotic If it makes you feel any better I haven't written copious amounts of well-architected, efficient code either
 
welcome back to RA, @Null
 
Could've fooled me ;) If I were a hiring manager and you were interviewing, I'd probably hire you from your SO rep alone. :D
 
@allquixotic It's not in my job description
I honestly don't know if I could be a code monkey type
 
5:04 PM
Nor is it in mine, but I do get "requests" from time to time.
 
@Sathya HI
@Sathya Do you have mod access to all SE chat rooms, too?
 
@NullUserException yep.
but not Stack Overflow ones
 
Bob
O.O
0
Q: PC loading programs slower than normal after voltage change

SephiraI always turned on my PC at 220V, it always worked normally. Today I turned my PC at 110V and it was very slow to load any program. I turned it back on at 220V but it is still very low to load anything. Changing the voltage could have changed some configuration on my PC? What could have happened...

don't tell me this guy has one of the older PSUs (non-SMPS) with a voltage switch... and he switched it to lower-than-input voltage?
if so, I would've expected smoke...
how.. how did it even work?
 
@Bob I always turned my 747 at 10 degree bank, and it always worked normally. Today I turned my 747 at 80 degree bank and it was very slow to respond to any controls. I turned it back to 10 degree bank and it is still very slow to respond to controls. Banking too much could have changed some configuration on my ailerons? What could have happened...
 
He needs top recapture that magic smoke. This is best done by applying an unicorn horn to the PSU
 
5:16 PM
@allquixotic How's Win8? Would you recommend it to someone who doesn't have a touchscreen?
 
@NullUserException I have a very strong viewpoint on this. My overall opinion is that Windows 8 with the "Start8" application installed and certain configuration options is perfect for a non-touchscreen, keyboard/mouse configuration, but you need to be willing to live without Modern UI, or at least, very rarely use it.
 
@allquixotic What do you mean by "Modern UI"? "Modern" from a looks or functionality perspective?
 
I split it out into three cases. Case 1: Touchscreen and kbd/mouse. Result 1: Go for it; perfect setup. Case 2: Touchscreen; NO kbd/mouse. Result 2: Use Modern UI as much as you can, and avoid the desktop. Case 3: No touchscreen; kbd/mouse. Result 3: Use Start8 to avoid Metro as much as possible; set group policy to open URLs in desktop IE; and use the desktop whenever possible. It's Windows 7 with better drivers and Client Hyper-V!
Modern UI is the name of the "Metro" UI. The name Metro was discontinued but it refers to the same thing
Windows 8 essentially has two entirely separate desktop environments installed alongside one another: the traditional XP/Vista/7 "desktop mode", and the brand-new, touchscreen-biased "Modern UI"
the Start Screen which appears in Windows 8 out of the box is basically the launching-off point for starting Modern UI apps, but the Start8 application from Stardock all but disables Modern UI. It doesn't disable it strictly speaking, but it makes it easy to use desktop mode without having Modern UI pop up in your face.
 
Bob
@allquixotic eh, I've found that, with the correct drivers, a touchpad with gestures can be a reasonable substitute for a touchscreen in MUI
well, it's a lot smoother than a mouse
 
for example, with Start8, a Windows7-esque start menu is resurrected, and instead of booting up into the Start Screen, it boots up into the desktop.
@Bob perhaps, but I'm talking about a mouse
 
Bob
5:21 PM
@allquixotic but you never addressed touchpads! :P
 
@allquixotic So essentially it would be like using Windows 7 with a boxier looking UI?
 
@Bob I've never used a touchpad with good enough drivers to make it even a semi-replacement for a touchscreen
 
Bob
@allquixotic not for a replacement, per se, but the gestures help with the little things
 
@NullUserException if by "boxier" you mean that they replaced Aero with a different window theme, then yes, but Stardock (again I recommend one of their products!) should be coming out with WindowBlinds 8 soon, which will allow you to customize the window decorations.
 
Bob
showing charms bar, showing the app bar thing, scrolling..
 
5:23 PM
@Bob having to use the charms bar at all (or the app bar thing) is a misfeature if you don't have a touchscreen, IMHO... which is why Start8 disables it
you can also disable the hot corners that pop up the start screen by moving your mouse into a corner; that way you can actually use your entire screen for mousing without triggering unwanted features
 
Bob
@allquixotic does it disable the new wlan selection dialog?
cause that's the buggiest piece of crap I've encountered so far
 
@NullUserException the other part of it is, if you look past the UI, Windows 8 does have significantly improved drivers, better performance, IE 10 (which is worlds better than IE 9), DirectX 11.1, and WDDM 1.2
 
Bob
crashed at least twice while setting up three methods
 
@Bob I don't know! I've never used wifi on Windows 8 at all
 
But IE 10 still does not allow you to use proper add-ins
 
5:25 PM
@allquixotic I don't care too much about the UI (hell, I'm a programmer) and I don't use IE anyways (Chrome all the way)
 
what do you mean by "proper"?
 
Meaning until ms changes its design IE is never going to get recommended over $other_browser plus flashblock, add block etc etc
E.g. allowing greasemonking, or other scripts to grab the html input and cleaning it
 
Bob
@Hennes wasn't there an AdBlock for IE?
 
@Hennes there are viable adblocking extensions for IE
 
Which, as I understand it, is blocked per design in IE
 
Bob
5:26 PM
ditto for userscripts
 
@allquixotic Though I'd like to know, how can you say it has "improved drivers"? Performance isn't a huge issue for me; I have a pretty beefy computer and it can handle anything I throw at it
 
@NullUserException well then, if the additional "under the hood" features aren't enough to entice you, then indeed there is no reason to upgrade to Windows 8... without Start8, it's a frustrating experience with a mouse. With Start8, you can eliminate the usability regressions and basically return to how it was with Win7.
@NullUserException well, to start with, all of the new graphics drivers for Win8 from Intel/AMD/Nvidia support WDDM 1.2 rather than Win7's WDDM 1.1 (and Win7 will stay at WDDM 1.1); read up on wikipedia about the added features and stability of WDDM 1.2... that's an improved driver right there
you can also look at the driver signing date of most of the system drivers and find that they are newer than the ones that shipped out of the box in Win7 or earlier, which suggests that they were updated
if you're not having any problems with your existing config (performance, usability or otherwise) then I really can't convince you to upgrade, nor do I have any particular desire to do so (you see, despite my knowledge of Windows, I'm rather anti-Microsoft.)
it's really NOT going to "wow" you -- at best, it will make you pull your hair out until you pony up the $5 to buy Start8 to get back to where you were with Win7.
touchscreens are another matter entirely
 
@allquixotic I was looking for a user's perspective; most of the reviews out there have been mixed to negative
 
I'm a programmer like you. I'm perfectly fine with modifying my system to fit my needs, whether it's by installing a program, modifying the registry, changing group policy, whatever.
I don't tolerate things not working how I want them to work. I fix them. So instead of tolerating the horror that is Modern UI with a mouse, I simply reverted to the Windows 7 UI paradigm.
Now that I've done that, my review would be "it's fine" -- but out of the box I'd give it a 3/10 on touchscreen-lacking boxes
then again, almost any software that I intend to interact with for an extended period of time gets a 3/10 from me out of the box, until I have a chance to mold it to my use case and preferences.
with very few exceptions
 
@allquixotic Even Chrome ?
:D
 
5:35 PM
@NullUserException even Chrome. I have to install LastPass, Xmarks, Adblock, visit chrome://flags, tweak some preferences, and (at work) set up the proxy stuff and install FoxyProxy.
Don't get @OliverSalzburg started on Chrome modification. He loves it as much as I do, but tweaking it is half the fun.
 
@allquixotic You can sync bookmarks using a Google account
 
@NullUserException But not passwords, and you can't sync bookmarks to other browsers using a Google account (for instance, IE and Firefox)
I'm already half-house into Marvasol by mandate because I'm locked into LastPass, so I may as well install their other extension
 
@allquixotic Is LastPass like a in-browser KeePass?
 
Yes, where your keepass encrypted file is kept on the Marvasol servers, locked up tight as a fortress.
You can't observe the process yourself, of course, but I trade convenience for the potential that there might be a security issue because they take security so seriously.
 
@allquixotic I don't know why, but I personally would not want that
If they were compromised, I would lose access to everything
Call me paranoid but I trust no one
Except, maybe, Google
 
5:39 PM
:D
 
@NullUserException Well, someone here was saying the other day they were working on some kind of script or sync or something to store their KeePass file on Dropbox, and keep a keyfile on their systems and sneakernet it around. They were like, well, at least I can observe the encryption on my KeePass locker
 
I also would never use LastPass, but I keep my KeePass in my GDrive ;P
 
But the thing is, it's not like LastPass stores your data in plaintext. I'm absolutely certain of that. And each individual record in your database is separately hashed and salted, so even if they knew the salt, it'd grant them access to a whopping one of your accounts
they have so many layers of protection that you can hear your system groaning as it struggles to decrypt the data they send you
 
@allquixotic You can't hash and salt that stuff
You need the plaintext password, so it's encrypted at best
2
 
And how is KeePass any different? Symmetric encryption. Storing your symmetrically-encrypted data anywhere on the public Internet is the same security risk, or perhaps even worse if LastPass uses better crypto than your locker.
And if it isn't on the Internet, then you lose the convenience factor entirely, and have to sneakernet around your database and manually sync it between devices and operating systems, which just isn't worth my time.
 
Bob
5:43 PM
@allquixotic well, I do that, and have mentioned it here - recently. but no scripts involved...
 
Life's too short to worry about what would happen if some hacker gains access to 100 of my forum accounts and starts posting spam or hate speech in my name.
 
@allquixotic Sure, but this also introduces a single point of failure, doesn't it?
 
I memorize my credit card number. I don't store any financial data in LastPass.
 
@allquixotic That's really handy
I think everyone should do it (memorize CC numbers)
 
Bob
yay, I just broke somethign again
 
5:45 PM
@NullUserException The only alternative to having a single point of failure is to literally memorize every password for every account you ever create; don't write them down; and never repeat the same password.
 
Bob
either copying from Word crashes it, or it doesn't work at all
damn
 
The only thing that differs is where your single point of failure is.
 
Bob
and Word adds something to the Text format field, even when copying an image, so I can't reliably not-clobber existing text.
 
@allquixotic What I meant was, if LastPass goes down wouldn't you lose all of your passwords?
 
For some people, it's a card file. For others, it's a notebook. For others, it's LastPass. For others, it's KeePass. Everybody keeps their passwords somehow. Some people don't even bother with that, and just use the same password everywhere, which introduces multiple weakpoints and is categorically worse than having a password database and using a different password everywhere.
 
Bob
5:46 PM
I'm starting to hate how Windows and MS Office seem to have their own ideas of how a clipboard works
 
@NullUserException Three of my devices store an offline cached copy of the encrypted data (basically the same as a KeePass file) from the last time I authenticated, and it can be unlocked using your master password.
If LastPass went down and I lost access to all three of those devices, then yes, I'd lose all my passwords.
But on my Android phone (for example), I can have no Internet connectivity whatsoever, and, without planning ahead, I can just type my password, tick the offline mode box, and access my passwords.
 
@allquixotic I see
 
And they're stored in the NAND in a secure way, such that brute-forcing it would take an incredibly long time even for a supercomputer.
 
My paranoia comes from the reliance on this service: they (or an attacker who compromises them) could easily get your master password and thus all of your passwords
I don't have this risk with KeePass
 
Also, KeePass has QR Code support ;)
 
5:49 PM
As I understand it, your master password isn't ever transmitted over the network, not even in an SSL tunnel.
 
@allquixotic Yes, but it could be if someone maliciously modified their code
 
Basically, your master password is an entirely offline thing. Your encrypted data is transmitted to you (or anyone who knows your email address) just by requesting it of their server, but the encrypted data is useless without knowing the master password.
And since LastPass has no clue what your master password is, they are unable to disclose it, even if they were fully hacked.
All the hackers would gain access to are thousands of encrypted files. Step 3: procure 270 years' worth of compute time on all the Top 500 supercomputers in the world.
Then maybe your great-great-great-great-great-grandkids can benefit from your treachery by hacking into forum accounts on forums that have long been retired and taken offline.
 
@allquixotic What I meant was, what if the code was modified to send your master password (when you enter it) somewhere ?
 
@NullUserException The client-side code of the LastPass app, you mean?
 
@allquixotic Exactly
 
5:53 PM
I could ask the same about KeePass. Client security is a completely separate topic.
Any program where you enter a password on any input device, interface, etc. has the same liability.
Even a piece of paper has that liability.
It comes down to physical security.
 
@allquixotic Well, for one, KeePass is opensource. Also I could use stop it from connecting to the Internet entirely, because it really has no business doing so
 
Bob
...great, now I'm getting two different hashes for the same image
 
@NullUserException Right, which means that an extremely clever attacker could sneak in a commit that looks perfectly legitimate but has some nasty side effect of sending your password to them. I'm not saying I don't trust open source in the general case, I do; but if Debian's primary OpenSSL certificate generation mechanism can be compromised for years due to an innocent, non-malicious code cleanup, what, do you reckon, could be done if there were malicious intent?
A "strange" line of code in an otherwise-awesome feature addition commit to KeePass could end up being a backdoor. Not every committer audits every line of code down to the assembly level to ensure it isn't doing something nasty.
It could be as benign as putting a copy with weaker encryption in some cache on disk, or steganographically storing your data in a way that can be retrieved by an attacker who knows that your data is stored in a particular way. We can go in circles like this for hours once you start talking about client-side compromise.
Heck, both LastPass and KeePass are equally vulnerable to EM transmissions leaking out of your monitor, CPU, or input device and being picked up by the outside, while you're typing your password.
Why do you think the DoD has the TEMPEST program?
Tempest (often spelled TEMPEST) is a codename referring to investigations and studies of compromising emanations (CE) (see Van Eck phreaking). Compromising emanations are defined as unintentional intelligence-bearing signals which, if intercepted and analyzed, may disclose the information transmitted, received, handled, or otherwise processed by any information-processing equipment. Compromising emanations consist of electrical, mechanical, or acoustical energy intentionally or by mishap unintentionally emitted by any number of sources within equipment/systems which process national securi...
 
@allquixotic But all that is rendered moot if I block Internet access for KeePass
I mean, realistically, for an average Joe like me, you wouldn't want to invest that many resources to steal my forums' passwords (I still memorize and use different passwords for banks and other important accounts)
 
@NullUserException And LastPass "requires" an internet connection to download the latest copy of the encrypted vault. I get it. But the problem eventually devolves to this: if your computer has an Internet connection at all, and any programs on your computer have unfettered administrative access and can run native code, then anything you type could, in theory, be transmitted over the internet, unless you block all Internet access to all programs.
That's true of every OS, in every environment, which is why environments requiring real security use the Air Gap method.
 
6:01 PM
The most logical avenue of attack would be to compromise LastPass, which would allow someone to harvest a ton of passwords
 
Bob
@allquixotic I don't think I'll bother supporting Word
 
Compromising LastPass itself is actually quite useless.
 
Bob
fixed everything else, great. then Word decides to pick the text if both text and image formats are available in the clipboard
 
Your encrypted vault is, essentially, public information. Anyone who knows your email can download it for free from LastPass with no authentication needed. They may as well provide your vault on a public directory on their webserver, keyed by an auto-incrementing ID.
 
@allquixotic For the purposes of injecting malicious code (to steal master passwords) into their client binaries
 
Bob
6:02 PM
facepalm
which kinda kills this idea
cause it breaks Word in the process
 
@NullUserException Oh. Yes. But KeyPass runs native code, too, so if you ever update KeePass, you're taking the same risk.
Risks involved include: (1) If you don't download the MD5/SHA sum over SSL, you could be MITM'ed into downloading a compromised binary; (2) Even if you completely block all traffic to KeePass, it could fork a randomly-named process into the background and do its evil stuff from there; (3) Even if the SSL cert is trusted, the guys who write KeePass could be evil and do bad things on purpose, shipping a malicious binary of their own free will.
So unless you download the KeePass source and audit it to the machine code level every time you update, it's really no safer than LastPass.
Even if you set your firewall to block KeePass and alert you to any Internet traffic from an unrecognized program, it's very likely that any program that is running arbitrary native code on your system can exploit a vulnerability, obtain root, disable the firewall, and then do its magic.
 
@allquixotic I suppose
 
Again, the thought experiment devolves into a simple cryptological scenario where client security is essential and, assuming client security is intact, the only thing you have to worry about is quantum computers.
 
Though from a functionality perspective, with LastPass you are restricted to accounts on websites, right?
Like if I had an encrypted PDF, it couldn't manage that password
 
Incorrect. You can store arbitrary data in LastPass. I don't know what the maximum file size is, but I have stored some fairly interesting data in LastPass.
It has a "Secure Note" feature where you can paste any textual data in there. For binaries, like SSH private keys, I use Base64 to store it.
I would be surprised if you were allowed to use more than, say, 100 MB for your entire vault, but it's not meant as a secure file store.
It's plenty to store a couple SSH keys and PGP keys and passwords though
 
Bob
6:09 PM
@allquixotic I think KeePass 2.x runs via .NET - so, not native :P
 
@Bob Even if it uses .NET or Java, unless it's running in a sandboxed environment, it can get to native code trivially.
The default behavior when double-clicking an exe, or running java, or whatever, is to assume full trust. Full trust leads to native, and native leads to "anything".
 
Bob
@allquixotic the point is, though, it is possible to audit the code. it's not possible to say what exactly LastPass is doing
 
@Bob Have you actually audited the code? Can you show me the formal or semi-formal proof of the mandatory security functionality of KeePass?
Having the ability to do something and then not doing it is not security; it's warm and fuzzy good feelings.
I'm all for Free/Open Source software, but that argument has been used so many times by people who don't actually audit their code.
And you have no reason to trust anybody else who might have previously audited it.
Their methods might have been faulty; they might have intentionally overlooked something.
Same is true of closed source, of course.
But still, claiming the ability as an advantage and then not availing yourself of that ability? It's a moot point.
What you're essentially doing by not auditing the code down to the machine level and formally verifying it is that you're emplacing trust in someone or something other than your own mathematical calculations, which is exactly what I do with LastPass. So we're on the same ground.
It's trust or spend a lifetime verifying it... you pick. I think most reasonable people pick trust.
 
Bob
@allquixotic I like my warm and fuzzy good feelings.
4
 
Anyway, that's the long and skinny of why I don't think LastPass is a risk any greater than the risk we take simply by connecting to the internet and using its conveniences and services.
 
Bob
6:15 PM
still, these aren't absolutes
you don't have to review it yourself
 
Surely it is a much greater risk to carry out any financial transaction where you provide payment information over the internet -- even over SSL -- because the sites that convey or receive that information are always under the most invasive possible attack to get at their valuable data.
I don't know about you, but I buy stuff on Amazon, Google, etc. all the time.... I consider that a greater risk than LastPass, and I do it every day almost.
 
Bob
the sheer amount of interest in popular (and open source) security programs increases the chance someone has reviewed it, (the chance) which will always be greater than a closed source program/website.
but, I'm not going to bother arguing this
 
In principle, I agree with you.
 
If y'all haven't seen this, it's a pretty cool list of must have apps from reddit.
 
That's part of the reason why openly-documented protocols like OpenSSL are so resistant to attack.
 
Bob
6:17 PM
nothing is trustworthy, unless done yourself
but that's only for absolutes
there are many levels of 'good enough'
I simply choose the 'store this stuff locally in a transparent format'
whether that is more or less secure.. well, I have no idea
 
I don't think closed source adds any security, to be sure. Obscurity is useless at best and dangerous at worst. But I've seen enough of LastPass to know that it's "good enough" for me. The value of the convenience is so astronomically high compared to the offline alternatives that the nominally increased risk comes down to "...meh".
On an absolute level, it's the same. And since I can't even begin to calculate what kind of probability delta there is of a vulnerability between a closed source service and an open source program, the problem isn't even tangible in any sort of analytical sense.
It may be 0.0000000000000000000000000000000000000000000000000001 versus 0.001, or 0.0000000000000000000000000000000000001 versus 0.99. I don't know.
Just seems pointless to worry about it if I can't analyze it any more than "ooh, closed source scary stuff, might be evil"
 
Bob
sigh
I haven't even implemented the actual uploading code
 
then again, if you don't find the convenience of LastPass to be all that useful, then why take the risk? :P
everyone's sure to value that convenience factor differently, too, which must weigh into our own individual calculations of cost/benefit.
 
Bob
@allquixotic perhaps if I start using more than two devices :P
 
for example, a person who only ever uses one computer and doesn't have a smartphone would not care about having their info available on any device they use.
yeah, exactly
 
Bob
6:22 PM
it's trivial for me to synchronise a KeePass database between my desktop and laptop
 
I use about 12 devices, not counting spurious things like randomly visiting someone's house and they're like "can you check your email"
 
Bob
if I start introducing more devices, e.g. phone or even public devices (throwing security out the window), then LastPass may be more useful
 
have to dig out my email password, receive a text for 2-factor authentication from gmail, etc
it's all on my smartphone :)
 
Bob
LastPass or KeePass, if you enter your password on a public device, you may consider it compromised :P
 
true, lol
 
Bob
6:24 PM
@KronoS cool, missed that one
more accurately, that thread title didn't really interest me :P
 
@allquixotic I always assume there's a keylogger on whenever I use a device that's not mine
if I really, really have to access an important account I change the password later
 
@Bob you migh also be intersted in this: blog.reddit.com/2012/12/…
 
Bob
@NullUserException always bring an internet-connected smartphone/laptop
 
@Bob I always try to, that's why I've only had to do that a handful of times
 
Bob
brings back memories
 
6:29 PM
how secure is cellular broadband? I wonder that sometimes
 
Bob
it's been a while since I needed to use those, thank god
 
obviously it's pretty good if you tunnel stuff over SSL, but what about sending plaintext over cellular broadband?
I honestly don't know
 
Bob
@allquixotic at least as secure as unencrypted/public wifi?
 
assuming the routing between you and the endpoint is secure - I'm talking about, like, physical security of grabbing it out of the airwaves
 
Bob
14
Q: Is data transmitted over 3G secure?

SensefulWhen data is transferred from my iPhone via 3G, is it encrypted, or is it relatively simple for a hacker to read the data that's transferred to AT&T's cell tower? What about after it reaches the tower?

@allquixotic well, you can do just that with unencrypted/public wifi :P
> it's more secure than using free/unsecured WiFi hotspots/networks
 
6:31 PM
> 3G is encrypted, the most common encryption algorithms have been cracked,
WTF?
 
@NullUserException they may be referring to the fact that some crypto suites used on EvDO or HSUPA, etc. have been cracked
which may or may not be true, I don't know enough about the protocols used in cellular broadband
here's some useful info about the particular cellular broadband I use: radio-electronics.com/info/cellulartelecomms/…
 
Bob
note to self - avoid AskDifferent...
> Even HTTPS is secure only from non government or ISP level actors.
that has a score of 2...
 
@Bob wow
 
nutty nuttersons
2
Q: The moderators have decided to have a little yuletide fun, join us will you?

jcolebrandPS: You only get so many Iceland Friday's in a year, so make it special people ... To start things off, a little refashioned seasonal tune: On the twelfth day of Christmas, my Stack Exchange gave to me: 12 inbox 'lerts 11 chatty pings 10 AnnaLears a Leaping 9 spam bots posting 8 weeks a fe...

 
I disagree that HTTPS is secure "only from non-government or ISP level actors" :-/
I mean, I hope government/ISP actors don't know how to crack the better cipersuites used in SSL/TLS
 
6:34 PM
18
Q: What is preventing us from sniffing the mobile phone communcation?

clawsI'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air surrounding us. So, what makes it difficult to intercept? By the way, is there any standard l...

 
but you have to be pretty nutty to assume they can
 
Bob
@NullUserException I should've gone with the IT Security specific search, not the generic Google search :P
@allquixotic well, the guy mentions SSL you can guarantee security to the server, but the certs themselves come from a chain of trust.
 
so he doesn't trust the root CAs :D
cool beans
 
Bob
of course, that would have to be a pretty big conspiracy
 
I don't trust the root CAs, either. When I want to sign into Gmail, I drive to Mountain View, CA and hand them my password on a piece of paper. Sergei Brin signs me into the datacenter and lets me use a console at the end of a rack to read my email. Connected to https://localhost of course.
4
Speaking of security, I really would feel warmer and fuzzier if they would get over the "but performance!!!!!!!!!!!!!!!!!!oneoneoneone" and just give us https:// for the entire SE site.
If performance is a problem... hardware crypto modules. PCI-E.
 
 
1 hour later…
8:12 PM
Anybody here have office 2013 installed?
 
Yup
What's up?
 
can you add this video to a powerpoint?
I keep getting this stupid error:
 
I get that too... I guess that it doesn't like iFrames
If we could use the old embed code, I'm sure it would work
 
According to that I should be able to get the old embed code
 
office 2013 is released as final?! whoa
 
8:29 PM
@allquixotic no it's still in beta
or at least they aren't charging me for it yet :P
 
<object width="425" height="350"><param name="movie" value="http://www.youtube.com/v/uWJ300rFFeE"></param><embed src="http://www.youtube.com/watch?v=uWJ300rFFeE" type="application/x-shockwave-flash" width="425" height="350"></embed></object>
 
Grrr.. I'm done with this. I'll just put a hyperlink to it
 
That code works
 
@Luke You're a genius!
2
 
Thanks, and no problem :)
 
9:03 PM
That's gonna be the last one today, @allquixotic
 
@Luke cool, it only took three right-clicks and three left-clicks to return to a pictureless workspace :)
this is fantastic
 
9:21 PM
@allquixotic I know about that add on, but I have very little use for it on this computer :P
 
your pic spam is minuscule compared to what one of my facebook friends does... OMG
that person posts like 30 pictures on their timeline every night... i had to disable facebook notifications
random political statements, quotes, etc
 
I'd love to see those, but I don't have Facebook
 
i hate facebook and very rarely if ever sign in, but i made the mistake of authenticating myself into the app on my phone and it practically took over my phone
i had to uninstall it
 
I've seen that happen too many times
 
i'm okay with having a facebook account but it should stay in my web browser and leave me alone unless i specifically visit the site
if i'm not at the site i don't want to hear from it
 
9:32 PM
That too
 
i have a few friends who send me messages on facebook, but they're rare, and i always tell them afterwards to please email me (although a few repeat offenders apparently forgot how to use email once they discovered facebook)
 
hey guys
anybody here?
 
Nope, just us bots
0
A: Is 7200rpm thru sata 2 worth it?

sawdustBased on my first-hand experience developing firmware for disk controllers, here's an answer from a different perspective. You question seems to based on a misconception that, somehow, R/W_head-to-platter transfer rates affect the drive-to-host transfer rate. The reality is that these two I/O t...

 
9:59 PM
what are the softwares that can limit users
in windows 7
like right click etc
 

« first day (860 days earlier)      last day (3207 days later) »