The DMZ

Lucas Kauffman

12:01 AM

but I think we don'T allow all of them in

Adam McKissock

@LucasKauffman discrimination FTW

Scott Pack

@AdamMcKissock These are the same people practicing eugenics on plants for how many centuries? What do you expect?

Lucas Kauffman

@AdamMcKissock they try to evade taxes in france by coming here, if that's their only motivation we're not letting them in since that would defy the basis of the EU

on the other hand if they want to invest a significant amount of money here, like LVMH, then we let em in

Adam McKissock

@LucasKauffman So you only shun the poor ones?

Lucas Kauffman

but to be honnest 75% tax on the highest wages is really a bit over the top

Gilles

12:05 AM

@LucasKauffman proposed (it still hasn't been voted in)

Lucas Kauffman

@AdamMcKissock only the ones earning over 1 million euro a year that do not want to create jobs over here

Gilles

we're getting all the right-wing propaganda and none of the left-wing action

Lucas Kauffman

@Gilles What's Francois doing these days?

Gilles

war in Mali

Lucas Kauffman

ah right

Gilles

12:07 AM

also, legalizing gay marriage

Lucas Kauffman

I think we supplied some helicopters and planes

read about that too, it surprised me france didnt have that already

Gilles

the previous left-wing government had set up a marriage-in-all-but-name

this one is now calling it marriage

the French right is predominantly liberal, but pays lip service to conservatism

Lucas Kauffman

@Gilles how is the war in Mali going actually, some are saying it will become a second afghanistan?

Gilles

> Reply hazy, try again

Adam McKissock

@LucasKauffman Wasnt Iraq the second Afghanistan?

Lucas Kauffman

12:27 AM

@AdamMcKissock guess it wil be the third then

Tinned_Tuna

International intervention is almost always bad in the end. It usually results in the installation of a puppet :-(

Gilles

but it sometimes makes a difference whose puppet

Tinned_Tuna

Wether or not they're a benevolent dictator or not...

Lucas Kauffman

1:03 AM

0

Q: Encrypted message in a popular TV show?

So I was watching a popular series tonight (Person Of Interest) when suddenly during a frame change I noticed a very quick blue screen with writing. At the time I never thought anything of it as it was to quick, it was embedded within a one second interval gap at 20:50 to 20:51. I tried using...

I lolled

Scott Pack

@Tinned_Tuna If you want to talk about installing puppet then the Comms Room might be better. There are a few puppeteers in here, but more on-topic there.

Lucas Kauffman

and another satisfied customer

time for me to hit the sack

nn!

Scott Pack

1:20 AM

Sweet dreams

TRiG

1:54 AM

So I recently returned to a website I'd last visited five years ago. The "forgot password" link e-mailed me out a plain-text copy of my password, which disturbed me a little, but when I logged in, I got this:

I don't think I'm impressed, to be honest.

Iszi

I'd be mildly concerned over the ambiguity of "highly secure way" but otherwise, yes. That's a good thing.

TRiG

@Iszi Better than it was, but the "numbers, letters, and hyphens only" thing (actually, it also accepted spaces, but not slashes) was a little worrying.

Iszi

@TRiG That means they're sanitizing input before hashing. Given a proper hashing method, I don't think that should be necessary.

TRiG

@Iszi It also means my standard password-generation mnemonic doesn't work.

@Iszi Our own websites aren't quite as secure as they might be (salted sha1 hashes), but we don't restrict on characters. The only actual restriction is "must be at least 8 characters long", but we also use zxvbn.js to give strength hints.

Probably this is as good as necessary, but I'll read up on reimplementing in bcrypt fairly soonish. (I've got some free time to do general development work soon.)

I recall a good canonical "how should I store passwords" somewhere here.

Should probably rebuild the session management code while I'm at it ....

Adam McKissock

Why am I the only one that noticed the name of the site is "fitlads"?

3

TRiG

2:06 AM

@AdamMcKissock What makes you think you're the only person?

Adam McKissock

It seems like something the kind of people that live in here would bring up

TRiG

@AdamMcKissock It's not exactly a quality online dating service. (Which may, perhaps, be one reason why I've not been there in five years.)

Adam McKissock

I could tell by the awful shade of red

TRiG

@AdamMcKissock Tsk. UX SE is a different site.

Adam McKissock

1. Different from what?
2. Different how?

TRiG

2:20 AM

@AdamMcKissock Just saying that this is sec SE, not UX SE. So the red is Off Topic. :D

Adam McKissock

@TRiG Meh, I know what I likes.

TRiG

@AdamMcKissock And I likes fit lads. ;)

Adam McKissock

I guessed

Terry Chia

This is weird.... even for this room.

Adam McKissock

@TerryChia Why?

TRiG

2:26 AM

@TerryChia You don't spend much time in EL&U chat, do you?

Adam McKissock

Do I want to know what that is?

TRiG

@AdamMcKissock English Language & Usage. Excellent site. Very high quality. And the main chat room is constantly off topic and frequently filthy. Wonderful.

Adam McKissock

@TRiG Ahh, thats not nearly as kinky as I was hoping for....

TRiG

@AdamMcKissock Sorry to disappoint.

Adam McKissock

:(

TRiG

2:34 AM

in English Language & Usage, Jan 18 at 19:58, by RegDwighт

So yeah, I was searching for donut-shaped dinosaurs but found your gay porn. That was like unexpected.

Adam McKissock

your gay porn?

Iszi

@TRiG I've had some DAFUQ moments in here. That's pretty close to topping them.

Adam McKissock

specifically?

TRiG

@AdamMcKissock Apparently so.

in English Language & Usage, Jan 18 at 19:47, by RegDwighт

Oh no, not the gay-porn TRiG!

It was news to me, too.

Iszi

@AdamMcKissock Just take a look through the starred posts in here. Check out the sidebar at any given time. Interesting stuff.

Adam McKissock

2:36 AM

Sounds like somewhere that my exceptionally warped brain might feel at home

Iszi

@AdamMcKissock Reminds me of this: bash.org/?334331

Holy crap. When did Sheldon become The Dread Pirate Roberts?

Adam McKissock

@Iszi Who stores porn on un-encrypted volumes these days!

3

TRiG

@AdamMcKissock Me. shrug

in English Language & Usage, Jan 30 at 22:31, by TRiG

@tchrist I still prefer the GIF of him taking his clothes off ....

Adam McKissock

@TRiG The only porn that I actually store (as opposed to just googling), is porn that involves people I know/have met/have /insert whatever here/'d, and I value people's(and my) privacy.

TRiG

@AdamMcKissock Where would we be without Google?

Adam McKissock

2:41 AM

@TRiG Indeed, although everyone has their favourite sites that are forever engrained in memory

Iszi

@AdamMcKissock To sum up: The only porn you store (as opposed to Googling) is the porn you don't want showing up on Google?

TRiG

@Iszi That actually makes sense, when you stop to think about it.

Adam McKissock

@Iszi Pretty much.

Iszi

@TRiG I should hope so. That was sort-of the intent.

Adam McKissock

@TRiG Someone in here - making sense?! What do you think this is?!

TRiG

2:45 AM

Though the time I managed to derail a conversation in The Upper Room onto pictures of cute divers was perhaps my greatest achievement. (That's Christianity SE chat.)

Adam McKissock

"divers"?

TRiG

in The Upper Room, Aug 18 '12 at 19:29, by TRiG

@El'endiaStarman If you want embedded GIFs, how about British Olympic Diver Tom Daley taking his clothes off?

Adam McKissock

Oh dear.

TRiG

You've gotta admit that was an impressive derail. We were talking moral philosophy. And then ...

in The Upper Room, Aug 18 '12 at 19:30, by TRiG

Adam McKissock

I must admit

That isn't as bad as I thought it was going to be

TRiG

2:50 AM

@AdamMcKissock I can do worse.

Adam McKissock

ponders whether to click that link

Ah, thats again not as bad as I was thinking

Iszi

@TRiG Okay, I think it's generally not-good when someone reminds me of bash quotes as often as you have, now.

bash.org/?178890

Adam McKissock

Lol, I remember that one

TRiG

That's one of the ones I have bookmarked.

@AdamMcKissock I try to avoid posting stuff that might actually get me banned.

(Even though I do have a liking for boobies.)

Adam McKissock

@TRiG Thats the reason that I dont post porn, softcore isnt in my vocab.

Oh jesus

I just noticed that you two starred that encrypted drive comment...

TRiG

3:02 AM

@AdamMcKissock evil grin

Adam McKissock

@TRiG damn you!

3am? sighs

TRiG

@AdamMcKissock Cool, we're in the same timezone.

Adam McKissock

gmt

all the easier to stalk you in!

Terry Chia

3:26 AM

For all the W8 fans, this looks like a pretty awesome device. lenovo.com/products/us/tablet/thinkpad/thinkpad-helix @RoryM @AviD

Scott Pack

3:39 AM

@TerryChia If you think this place gets weird and uncomfortable you should hang out in The Comms Room. Go look at the star wall. Go on. Look at it.

@TerryChia According to the transcript there are currently 991 instances of the word "fisting".

@TerryChia Here's a quote that resulted from one of the recent times fisting was brought up.

in The Comms Room, Feb 6 at 20:54, by Cole

I'm like, LOOK YOU'RE MY LADY PUPPET.

Adam McKissock

How many times has "figging" come up?

SilentKiller

4:17 AM

morning morning

makerofthings7

5:00 AM

Obama's Executive Order - Improving Critical Infrastructure security: m.whitehouse.gov/the-press-office/2013/02/12/…

Stack Exchange

5:31 AM

A human is a system for converting dust billions of years ago into dust billions of years from now via a roundabout process which involves checking email a lot.

Rory Alsop

8:53 AM

@rorym - print screen: superuser.com/a/144092/57828

Terry Chia

9:29 AM

insidehighered.com/news/2013/02/12/…

Hahaha what. Genius.

Rory Alsop

@TerryChia nicely done

Colin Cassidy

10:25 AM

@TerryChia And that's a behaviour that continues later on. As you work out what metrics you are being measured on you will game the system, in some cases to the detriment of the overall end result (not that I'm talking from bitter experience or anything...)

Rory Alsop

@Terry Or in corporate speak - KPIs (Key Performance Indicators) generate behaviours that efficiently maximise KPI scores, at the expense of everything else

Lucas Kauffman

10:40 AM

The teacher gave her fifth-grade class an assignment: Get their parents to tell them a story with a moral at the end of it.
The next day, the kids came back and, one by one, began to tell their stories. There were all the regular types of stuff: Spilled milk and pennies saved. But then the teacher realized, much to her dismay, that only Janie was left.
"Janie, do you have a story to share?"
“Yes ma'am. My daddy told me a story about my Mommy. She was a Marine pilot in Desert Storm, and her plane got hit. She had to bail out over enemy territory, and all she had was a flask of whiskey, a pis…

6

Colin Cassidy

@RoryAlsop As a real example, all our developed code is manually code reviewed before it can be delivered. Someone (manager) made it their goal to reduce first time code review failures, so rather than taking more care over their code developers would have their code unofficially code reviewed and fixed before the formal review submission

Rory Alsop

@ColinCassidy exactly

it happens everywhere

Colin Cassidy

now don`t get me started on the idea that a code review failure is a "Bad Thing", in all cases the real problem is code that has been reviewed but still contains a bug. but that's a harder problem to solve so no one wants to tackle it :)

Said manager and metrics guru are no longer working for us :) So there was a happy end afterall

Terry Chia

11:08 AM

Have you guys seen Valve's employee's handbook? Pretty interesting stuff. media.steampowered.com/apps/valve/Valve_NewEmployeeHandbook.pdf

Colin Cassidy

@TerryChia I'd hate to work there, it's too good a place to work and I'd have nothing to bitch about (scowl!)

I need something that feeds my cynicism

Terry Chia

@ColinCassidy You can always get on the internet to bitch about things. There is always something on the internet to bitch about.

Colin Cassidy

@TerryChia Someone on the internet is wrong, I must correct them!!

Terry Chia

@ColinCassidy heh. where's the obligatory xkcd?

Rory Alsop

11:34 AM

What do you want me to do? LEAVE? Then they'll keep being wrong!

Terry Chia

1

Q: Is physical tape backup better than disk to ensure integrity

When assessing tape backups vs online disc backups, which of them ensure better protection from integrity incidents. For example, if the system is compromised by attacker or virus or malware and I know the date when it happened, i can roll back data backup from tape before that incident and it ...

backup

@ScottPack I think you should throw in your stone tablet suggestion.

Scott Pack

12:08 PM

@AdamMcKissock Just the fig fruit.

Terry Chia

12:35 PM

QOTW seems pretty dead lately but:

0

A: Requests for Question of The Week blog posts

I propose: How practical/important is the Lucky Thirteen TLS attack? More attacks against the SSL/TLS protocol is always interesing. Our resident Bear could give it a nice write up if he has the time.

Rory Alsop

12:52 PM

@TerryChia I know - I'll need to do some write ups. (and @Thomas and @AviD - hint hint :-)

Terry Chia

@RoryAlsop Heh. I'll contribute some in about 2 weeks time. About to start my holidays soon.

Thomas Pornin

1:40 PM

@RoryAlsop I am scheduled for a QOTW write-up ?

Rory Alsop

@ThomasPornin I had thought you had volunteered to do this one:

Thomas Pornin

Oh, when I suggested a question for the question-of-the-week, I was actually volunteering for writing the blog post ?

Rory Alsop

8

A: Requests for Question of The Week blog posts

I propose this question: How valuable is secrecy of an algorithm? because it tries to explore the limits of a well-known security slogan. Also, I am narcissic enough to enjoy reading my own answer.

Thomas Pornin

It was not obvious that it was a recruitment scheme.

Rory Alsop

if not, no matter - I'll do a brief QoTW post about it

That question isn't - it was from a chat we had on here some time back - you, me, AviD

Thomas Pornin

1:41 PM

Wasn't the English Navy manned that way, back in the old days ?

Rory Alsop

@ThomasPornin heh

Thomas Pornin

Ok, I'll write something

Terry Chia

@ThomasPornin Heh I hope not. Else i'm due for 4 blog post.

Thomas Pornin

maybe not before next week-end, though

Terry Chia

Hey @RoryAlsop. Was wondering. If I write several post for QOTW, would it be alright to cross-post it on my own blog with links back to the sec.se blog? Would be nice to have more content on my new blog.

Rory Alsop

1:48 PM

@TerryChia definitely yes

We spoke with SE folks and they have no problem with it

Terry Chia

@RoryAlsop Alright cool. :) I'll work on a few once my holidays start.

Scott Pack

2:10 PM

Be careful with how you do it. Sometimes Google can get pissy if you end up cross-posting blogs like that.

I don't know the right way to do it.

There have been a couple of times where something I've written would have been not unreasonable to post both on ours as well as NubbyAdmin, since it was useful to both security and systems people in general.

Terry Chia

2:44 PM

> Google engineers are regularly credited in security updates, but this month's count is unusually high. (Google engineers reported a bug a month in October, November, and December, and none in January.) The total number of bugs Microsoft fixed this month is close to the all-time record of 64.

Iszi

@RoryAlsop Sounds more or less like proper CC-BY-SA usage - isn't it?

Transcript for