n00b

Say User A types "secret" and the database stores "X%*@". If an attacker steals "X%*@", and pastes it in the web interface, it gets stored in the database as a new ciphertext. Then when the hacker goes back to view their note, they will again see ""X%*@" (exactly what they typed). If they however, insert a new row, with the original ciphertext, then your scenario is valid. but not through the web front end.

@flawr its a puzzle, not yet listed on codegolf.

working on a simple regex hoping somebody here can provide guidance. need to capture digit from a URL, where the url does not contain a given word. been trying to use negative lookup but not getting expected results. heres what i have: regex101.com/r/tC7tA7/1

but if I dont do then, then i end up with redundancy, (e.g. "microsoft" would appear many times over in the same table, as would "windows 7" etc). i dont like having a bunch of integers either though. that would be normalized though, correct?

@Lamak thanks. so then follow up question, should i then have a lookup table for each possible field (for example, a lookup table for OS, a lookup table for version, a lookup table for service pack info, etc)? then essentially one table would just have integer references to the multiple sub tables, which seems kind of ugly to me?

*database table

have the data use one field "configuration" or several "os/version/servicepack etc."

what is the best practice in this scenario?

hey guys, question for you. i have am building an XML parser which is loading some db tables. I have a field/column that is made up of several parts that make up the whole. i.e. "o:microsoft:windows_server_2003::sp2:x64" I can either parse it so that each component is in its own column in the database table, or just have the people using it on the other end, parse it when they query it out of the database

!!/lick -recursively

!!/lick !!/lick !!/lick !!/brownie

!!/lick

!!/blame

!!/alive

@SmokeDetector make me a sammich.

@SmokeDetector is there anything on fire?

you are talking to the bot?

thanks though usually public scope makes everything easier. :D but yea, i know I dont declare global variables at free will. so i guess restricting scope on methods makes sense for similar reasons

other then good coding practice?

*if you are not

why does variable and method scope matter if you are releasing your code for public use (i.e. work stuff)

Why is there an assumption that everybody has a smart phone on which they can download apps? If its not a company provided phone, they can't make you download anything.

thanks

just for a home computer

@Bob thanks for your feedback, very helpful. Can you recommend a consumer level IDS that free or cheap? ive heard of snort, never used it though

you just do it so that you can access those off your host? I thought you could get those off the password manager website (at least for last pass)? I havent used it but just what i gather from their marketing material

(and your banking creds for that matter too)

what protection does having your email creds outside the password manager provide if your host is compromised?

well, I certainly use different passwords for my banks, email and other sites but yea, most people dont. point taken.

Especially since its used in so much two factor auth. scenarios.

Good point. The accounts I care about I login in to regularly from my host anyways so theyd be compromised if the attacker was looking through all keystrokes/pages browsed. Speaking of email, would you recommend not storing your email creds in the password manager then?

Yea, I can see down sides to both sides, I'm just wondering if i am opening myself to bigger risk by consolidating all accounts and passwords in one place to where if im compromised im giving the attacker everything in one bow tie package vs them having to extract it manually from a dump of key logs and waiting for me to login to every site that interests them.

true. i just havent used one before and am considering the risks.

there are plenty of zero-days that can infect a windows host. and once your box is compromised, all your passwords are toast

isnt that a bigger risk then lastpass servers getting compromised (and ridiculously hashes being exposed)?

hey guys, anybody familiar with lastpass here? im thinking about starting to use it by my concern is that if your host (or one of your devices employing last pass) is compromised, wouldnt that essentially give the attacker full access to all your passwords for all your sites? sure if its compromised they could install a key logger without last pass but then theyd only get credentials for the sites i log in to while as opposed to all of them ive ever used last pass on

with a small ego ;)

Yea, your probably right. thanks for the perspective gents. I guess I'm just impatient

in this particular instance

its actually just a db function that somebody failed to deploy

i guess thats subjective and hard to measure. so yea i get ya

if it were a big change i wouldnt object. its just a small change thats concentrated

when you work with accountants turned coders sure

if they know what they are doing

hell yea

noobs. all of them.

I guess that makes sense

i tested and reviewed it

which is why i should be able to just put it in

it is high priority