« first day (317 days earlier)      last day (4627 days later) » 

user1385191
 
user1385191
use that
 
@Incognito why not?
 
user1385191
he's got a bcrypt implementation
 
I send you a salt over HTTP. you sha1 hash the password+salt and send it back
 
@Incognito lol
 
5:01 PM
What's wrong with that @Incognito ?
 
@Raynos bc now i have the salt
and the code to create it
 
random salt @neal
 
So?
just because you have the salt doesnt mean shit
 
base it on time server side
 
@Dave i have a salt on the server side
 
5:01 PM
@Dave psh use a proper random source
 
@Raynos wouldnt use of HTTPS avoid all this nonsense >
 
@Raynos You've basically just made your password into the hash, you haven't secured anything, and it's still prone to all the problems a non-SSL page brings.
 
if theres no server control theres no server control
 
@teresko yes but you have to remember some hurr durr companies dont buy certificates
 
@Raynos lol we use free ones
 
5:02 PM
and passwords are typically reused, its best to keep them non plain text
 
@Incognito true you can still steal the hash
at least you cant read the password :P
 
cert costs 5$ at goDaddy
 
*reused by the used
*user
 
@Raynos I can just POST with password=adsf908-a98f02u30[a, it's the same thing, I can still eavesdrop.
 
@Incognito haha i know! thats what i just said :-P
 
5:03 PM
I can also still intercept the page, and totally screw with the user.
If you don't have a cert, you have no business doing a login.
 
@Incognito lmao
 
-- Should there be anything important behind the login.
 
ahhh
 
@Dave Hey man, that's how banks get hacked in Brazil.
Someone just screws with your router, does ARP poisoning, whatever, injects JS or sniffs packets or have the form go elsewhere, anything.
 
whats so much better abt a https post vs a http post?
 
5:04 PM
RT @beverloo: Fullscreen API, enhanced Element Highlighting and progress on Flexbox http://t.co/KQSezWD #Chromium #WebKit
 
havent even considered a man in the middle attack in a long time.
 
@Neal Nothing. Read my blog.
 
SQL injection is the thing to worry about
 
@Incognito so why do i need https?
 
People think POST is more secure than GET, which is actually totally irrelevant.
 
5:05 PM
its the same thing
 
@Neal Because anyone can fuck with your users at any time.
 
its a variable being passed in the header
 
@Incognito huh? https vs http, not post vs get
 
yeh that was kinda random lol
 
You said httpspost vs http post :P.
POST is an HTTP method, HTTPS is SSL ontop of HTTP
SSL encrypts stuff, like, actual security.
 
5:06 PM
@Incognito No, HTTPS is HTTP on top of SSL
 
everything else I can pwn your admins with.
@gsnedders Right, sorry.
 
lmao
 
I'm speaking generally in laymen terms.
 
So this is a company thats doing logins over HTTP?
I dont wanna read up and i came late lol
cuz if thats over the internet thats bad
like...self signed cert at least...
 
5:11 PM
@Incognito ok i added a hash to the login
@Raynos i added a hash to the login
 
@Neal y u troll me like this? Does nothing.
 
@Incognito why does it do nothing?
 
That's form validation against simple bots.
It's not secure against eavesdroppers or MITM
SSL is the ONLY way to do that.
 
@Incognito why does that prevent other pplz?
ooo well
but they cannot login unless they have the hash
yes
ok
 
Okay? How hard is it to get the hash? Grep the page and store the session?
 
5:13 PM
@Incognito lol that hash only works when ur on that page
 
Brute-force a login, or use another login, or anything done on the HTTP layer of the OSI model doesn't prevent me from screwing with you on the protocol level, only SSL does.
 
@Incognito yes but that hash changes on every page load.
 
The Open Systems Interconnection model (OSI model) was a product of the Open Systems Interconnection effort at the International Organization for Standardization. It is a way of sub-dividing a communications system into smaller parts called layers. Similar communication functions are grouped into logical layers. A layer provides services to its upper layer while receiving services from the layer below. On each layer, an instance provides service to the instances at the layer above and requests service from the layer below. it is also being referred that its name was proposed as reverse o...
 
(duuh hooked to time somehow)
 
@Neal That's not how the internet works.
It doesn't matter what you do, I can still listen and edit stuff.
 
5:14 PM
@Incognito yes it does
reload the page
the hash is always different
 
@Neal No, I'm not questioning the token. Put in five hundred billion tokens. It doesn't address the problem.
Even if the all change.
It doesn't matter.
 
I KNOW
but it adds a layer
 
Sure, but the layer is totally irrelevant to MITM attacks.
 
MITM?
 
because MITM puts himself between A and B.
In cryptography, the man-in-the-middle attack (often abbreviated MITM), bucket-brigade attack, or sometimes Janus attack, is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all messages going between the two victims and inject new ones, which is straightforward in many circumstances (for example, an attacker ...
@Neal Research the TCPIP layer, how to attack it, it's the best way for you to see security.
 
5:16 PM
oook...
this is not a high stakes site
and u can still do mitm in ssl.. i dont see why u cant
 
Go ask those questions on security.stackexchange.com
 
@Neal have you ever compared a wireshark capture from an HTTP session vs HTTPS?
 
@Dave yes
one is all gibberish lol
ok i get ur point
but i have no control over the companies ssl certs
company's*
 
encrypt at just 128 bits and uve eliminated script kiddies
 
@Dave ??
 
5:23 PM
thats just crazy they dont have ssl
im surprised i thought it was standard
 
@Dave lol we do
 
@Neal Your best action is to explain the risk in that case.
 
But they need ssl.
 
that one is ssl
 
user1385191
5:23 PM
the topic of this chat has meandered more than a drunken politician
 
@MattMcDonald :-P
 
yeh self signed
honestly as a user i would rather accept the cert
 
@Dave is that an issue?
 
than put my password over http
not to me
 
@MattMcDonald And with that, I'm off to lunch :). ;)
 
5:24 PM
to a dumb user it is, because browsers are rigged to make them look bad
and i guess they somewhat can be because a self signed cert could also be a MITM
 
@Dave ?
...
 
@Neal above :P
 
well we are not paying for tons of certs...
 
lol sry
i agree
 
and how is it mitm?
 
5:25 PM
its not
lets say
I'm intercepting the original cert, decoding, and retransmitting as ssl
which is what i would do if i were playin MITM
 
but our main site striketechnologies.com and globaltradingsystems.com dont need ssl
 
and somehow managed to infect the client machine anyways
 
i guess bc they dont have logins
but even facebook doesnt use ssl
 
yeh they do
 
uhhh not that ive seen
 
5:27 PM
i would also like to point out I can hijack everyone at my works facebook sessions
 
They use FB for the initial log-in, otherwise it's an option.
 
but they do use ssl for the login
and the account page, just at gsnedders said
if a pass or personal information is being xmitted it is better to use a self signed cert than none
and never use sessions....facebook...
 
@Dave whats rong with using sesssions?
i use php sessions
 
i need help with making a pop up.....
 
im getting a cert soon
u guys pushed me
 
5:30 PM
	<span class="menuText"><a href="http://site.com.html">Home</a> : <a href="https://site2.com/main/downloads/">Downloads</a> </span>
 
have fun
although at this point i think most of those sessions have been patched
 
@Dave ?
 
with that tool, you could login to facebook, gmail, and a crapload of other accounts other local network
it works on a lot still
facebook and google patched almost immediately
 
how can i make a pop up so instead of href which is changing the page it instead gives the user a pop up where the new window will open
 
@JeffHodge a popup cannot be created without user interaction
or a popup blocker warning anyways
 
5:32 PM
@Dave ??
 
	<span class="menuText"><a href="http://site.com.html">Home</a> : <a href="https://site2.com/main/downloads/">Downloads</a> : <a href="http://site3.com/contactForm.php">Contact Us</a> </span>
 
@Neal i forgot to @ u again :/
 
that is my little menu
 
lol
 
who unstarred the carmack quote!!! RAGE
 
5:32 PM
huh?
 
but i find it annoying when it does href...i think a pop up window would be neater
 
Anyone in the Bay area?
 
@IvoWetzel 2 weeks auto unstarring
 
or some sort of "create a new tab or window and THEN take the user to that url"
 
I'll pay you to drive over and kick some US colleagues buts
 
5:33 PM
@JeffHodge what exactly are you trying to do?
 
we had to nuke 2 repos because of broken history and we're in merge hell right now
:(
 
user1385191
introducing...
 
user1385191
window.open
 
tada!
 
window.open will not work in modern browsers without the user allowing the popup
unless its in an object that had user interaction
 
5:34 PM
@Raynos I want to talk someone who is in charge, NOW!
:(
 
@Ivo: Any idea what that img tag script linking thing was all about? Think I saw something like that eons ago but have no idea why you would want to do it.
 
@Dave ... you mean like a link? Like the one posted above by @JeffHodge?
 
> "[...] you don't want people that aren't really programmers programming, you'll suffer for it! - John Carmack
7
 
@RyanKinal lmao whoops :P
 
Round 2
 
user1385191
5:36 PM
otherwise, <a href="something" id="foo" rel="external">new tab|window</a>
 
lol yeh then window.open() ftw!
 
user1385191
document.getElementById("foo").target = "_blank";
 
@ErikReppen Guess the just used it to prefetch scripts, no idea really... colleague is working on the merge... he's cursing all day long and rewriting a ton of their broken code
 
OMG. I saw this horrifying thing appear momentarily. It was like a vision of design hell. And then it was gone... was I hallucinating?
 
5:37 PM
I mean, we try to keep our code consistent
these guys... sigh
they've got like 3 different styles...
 
@IvoWetzel falcon punch?
 
@RyanKinal yeah u need a break or sleep :P
 
and then there's this one guy who writes everything completely different and re-invents the wheel by duplication the others code just because he doesn't like it
WTF?! Refactor it, do not duplicate :(
@Raynos FALLLLLLLLLLLLLLLLLLLLLLLLLCOOOOOOOOOOOOOOOOOOOOOOOOOOOOON PUUUUUUUUUUUUUUUNCH
2
 
so that is my menu basically, I know how to make pop ups with buttons but over here in menu when you click something it hrefs to the new link, but I want a pop up instead
 
@IvoWetzel jump, pwn
 
5:39 PM
@IvoWetzel
Do it.
 
Yikes. Well, if they're in Chicago I can throw rocks at them.
 
they're in SF
 
user1385191
yeah, except that pair of hands needs to be coming through another computer
 
user1385191
via the computer teleportation network
 
@IvoWetzel bill them a flight
then go over there
 
5:40 PM
we told them that we prefix "privates" by two underscores
 
and do it
Tell managements the americans suck and you need to go over there and punch them
 
guess what they're doing
they're using them all over the place
 
@IvoWetzel __trolls__
 
@JeffHodge <a href='link' target='_blank'>Derp</a>
 
management = results please. YESTERDAY!
 
user1385191
5:41 PM
@Dave html 4.01 strict + xhtml strict doctypes forbid that attribute
 
user1385191
see my solution above
 
@IvoWetzel set up an automatic metric system
That does black magic on the code and prints a "We made THIS MUCH MONEY TODAY"
 
@matt can you please make a fiddle?
 
5:42 PM
And update it in real time
 
@MattMcDonald good to know
 
user1385191
Aug 25 at 15:56, by Matt McDonald
WHY ARE YOU EVALING IT
 
@Raynos , sure .. code metrics to improve productivity .. you really should have gone into management instead of development
 
@JeffHodge ur fiddle works, not sure why the eval
 
only difference is my fiddle uses a button where as over here I have a span im trying to do it in
button to trigger the pop up
 
5:44 PM
still .. why the eval() ?
 
ooo
my bad i missed that.... LOL
yeah eval wasnt suppose to be there
but nots what I need
 
also that fn has all global vars lol
 
the pop up opens which is fine, but I dont want the button to be the trigger
<span><a href="http://test.com/AL.html">Home</a> : <a href="https://irs.com/main/downloads/">Downloads</a> </span>
thats my menu 2 objects in it
instead of href I want pop up
 
it is hard to decide , what is more annoying , the code he writes or his avatar
 
5:50 PM
so do that...
i dont see the issue...
 
@teresko no not code metrics to improve productivity
code metrics to create fake numbers to please management
@teresko defiantly his face
@JeffHodge man your face is annoying
It's straight from the 80s o/
 
its better than an anime char XD
 
@Raynos "morda prosi kirpich" , slavic saying , means "face that asks for a brick"
2
 
@JeffHodge FFFFFFFFFFFFFFFFFFFFF
 
@JeffHodge how do you know that it is from anime ?
 
5:55 PM
i dont know what anime it is but i know its anime
my lil brother watches them lol
 
lady doth protest too much ... it is always funny when people fell necessity to .. emm ... elaborate
 
Ugh. It never occurred to me that HTML has to be tokenized character-by character. But that's certainly the way it appears (and it makes sense, given the non-regular nature of the language)
 
user1385191
6:18 PM
When I get UI req that is flawed, I raise the issues; I don't just do what I am told. Don't like it? Hire someone else.
 
user1385191
words of wisdom
 
@MattMcDonald of course
 
user1385191
I've still seen an inordinate amount of ridiculous ideas that "have to be there because the client wants it"
 
When determining whether style objects can be shared, webkit takes the following into account:
> There must be no sibling selectors in use at all. WebCore simply throws a global switch when any sibling selector is encountered and disables style sharing for the entire document when they are present. This includes the + selector and selectors like :first-child and :last-child.
Wow. Just wow.
I will never use another sibling selector again.
 
6:38 PM
jQuery 1.6.3 Release Candidate is out: http://t.co/6RqkBkh final release coming later this week, help us test!
 
@Raynos I've been thinking of switching my avatar to my face.
 
@Incognito I have done the same
People kept mocking me
Oh thats why you mentioned
stackoverflow updated it
 
I just need to find a less frightening photo of myself... si0.twimg.com/profile_images/1357173009/face.jpg
 
:O
Maybe do something against those black rings beneath your eyes?
 
user1385191
ha, just take something outside
 
6:43 PM
@IvoWetzel Yeah, they're always there. =/ I've heard a few people have this too, I can't remember what I was supposed to do about it.
People think I'm the local coke baron.
 
Lovely... now I'm an emo band...
 
Striking resemblance :-)
 
@RyanKinal Now this guy looks a lot more freaky :P
 
user1385191
not emo, just bland pop rock
 
6:44 PM
Punk! Not emo :-)
@MattMcDonald Ouch. Burn.
 
@Incognito have more pride
 
They scream and whine and appeal to kids that draw circles around the letter A and don't understand politics or human nature or economics.
 
@Incognito You look like some interstellar pirate :D
 
Then again, I listen to KMFDM, so who am I to say?
@IvoWetzel Thank you. I've been called a murdering psychopath, and a med student, but never this.
@Raynos I have some better photos, I'll upload a better one.
But I do like this concept of space pirate.
 
@Incognito Hey interstellar pirates don't need to be the bad guys! :D
 
6:46 PM
My car has a skull and crossbones air freshener, does this help?
 
user1385191
I can work some magic with that photo
 
I'm a walking mash of stereotypes that don't make any sense.
Nah I have better photos anyway. That's my passport photo.
 
Long-polling is more of a server-side problem than a client-side problem. Am I correct? (For example, figuring out how not to overload your server with long-poll processes, how to achieve non-blocking long-poll processes, etc.)
@IvoWetzel Indeed it does
 
Really hope that private space travel becomes a success
 
6:53 PM
@IvoWetzel Agreed. Somebody's gotta push it.
 
governments just don't have the money, the vision, and the reasons to do it any more
 
user1385191
 
user1385191
now that's dark
 
@IvoWetzel Think about it, in 40 years we'll have been capable of getting off this rock, and what have we done? Grand accomplishment: Relay porn from satellites.
 
@RyanKinal I had a demo of long pollign with node somewhere
 
6:54 PM
@MattMcDonald I'm scared :P/
 
even worse, in 40 years we managed to make the orbit a mine field
there are hundreds of thousands of 1cm + objects
 
@Raynos Really, I'm trying to figure out what problems need to be solved in order to successfully, efficiently, and scalably implement a long-polling solution. And whether it's possible with IIS.
I like the concept of long-polling, but I'm worried about server load.
 
@IvoWetzel I saw a neat design that cleans it up via tethered satellites in orbit, the tether draws electric current from the ionosphere and powers the satellites, which store power and then turn the tether into an electromagnet, scooping areas clean.
 
@Incognito Yeah, seen that googletechtalk :)
 
@Incognito Clever
 

« first day (317 days earlier)      last day (4627 days later) »