« first day (1753 days earlier)      last day (3201 days later) » 

8:00 PM
@ton.yeung This is it's final form. No really this is the only way to get it to work so far. The code is clean. It's just stupid looking / stupidly structured.
 
I was having a decent day, until the build server crapped a brick.
 
Those of you who trade, do you think oil will go any lower?
I'm looking at a 1-2 week timescale
 
I swear, I'm going to get in the server business. I keep buying these old servers for super cheap.
I just bought 2 IBM X3850 w/ 4x dual core 3.0GHz XEON processors, 64GB RAM, 6x73GB 2.5" SATA HDD for $250.
I have no idea what I'm going to do with them.
 
@JGrindal you could run a steal-your-own compute farm
Leave them vulnerable to hacks and let nature take its course
 
@ton.yeung Yeah
@TomW That's actually a pretty fun idea.
@ton.yeung Yeah.
 
8:12 PM
Just go post something inflammatory on a security reddit and sign off with your ip
2
 
@TravisJ I'm going to do this.
 
lol
Can you do a blog post about it afterwards?
I am curious what happens
 
I have 5 static IPs. I'll just put it on one I don't use and see what happens.
@TravisJ Sure.
I'll drop it on its own RG and everything.
 
@JGrindal if you can get them to respond over some low-level protocol "Just so you know, I pull out and magnetise incinerate the hard drives weekly. Have fun."
 
@TomW Haha. I'm very excited about this.
 
8:17 PM
@JGrindal just read up on your safe harbor law, lest something nefarious be going on under your roof
 
hmmmm, good point.
Methinks I may be best having it be an "active" server for something.
some files, maybe a webserver.
 
Well, there's a specific linux distro built with numerous severe security holes, for the lulz, IIRC
 
@TomW I'll just throw up some vanilla Fedora whateverthehellthecurrentbuild is.
 
So the query works on the new postman but not the old one. FFS
@ton.yeung I'm using HTTPS but yeah something with this X-A stuff.
I'd assume
 
@JGrindal - Maybe a dynamic ip would be best, so that your static one isn't ruined for eternity
 
8:28 PM
I'll ask someone at work tomorrow. I'm too tired tonight.
 
@TravisJ Meh, I'm not too worried about it. Like I said, I have 5, I only use 2.
 
Yeah, in the future they will be nice
I really hope that SO hits 10 million questions on September 1st
 
o/
heyo
@ton.yeung my guess is no, considering that would make cracking it easier
 
@ton.yeung Most cryptographic hashes, only the length
Assuming the hash is a hex string
any algo that generates a unique hash, easy
In short, no, but it's pretty darn easy to guess.
 
has anyone ever used autogenerated unit tests for their code? I learned about the feature today and I am wondering if that means if I have to write my own unit tests now since parasoft comes with autogenerated unit tests that pass when running it.
 
8:36 PM
@ton.yeung What's the hash?
Or, at least, how long is it?
@KalaJ Autogenerating unit tests seems like a really dumb idea to me
But I am probably missing the utility
 
yeah it sounds dumbs but super useful lol
no point?
 
@ton.yeung I personally don't see the usefulness of TDD either
 
well that's the true TDD way but we work with external clients and apparently they don't have tests for their project
so we have to write them :/
 
@KendallFrey does the length stay the same if you hash the same thing multiple times?
 
Tests should a) test that the requirements are met b) serve as an example of how to use the API (unless they're testing failure modes) and neither requires writing tests beforehand
 
8:40 PM
interesting post about it here: stackoverflow.com/questions/142481/…
 
@SteveG all the hash algos I know of have a fixed size output
 
Jon Limjap talks about what you said @ton.yeung
 
@KendallFrey interesting, i wasn't aware of that
 
I mean the guy in that link I posted
but I see what you mean, apparently client neglected null checks in their code
so if there's a null return for one of the test cases, it's actually expected....
 
@SteveG BTW, hashing a hash is almost always a bad idea.
 
8:43 PM
@KendallFrey thats not at all true
 
hash and salt is the right idea no?
 
@SteveG do elaborate
 
one sec, i'm looking for a php example
 
lol no, i can't find it
but basically, for passwords, you get a salt and hash the hash a ton of times
it makes it slower, which makes cracking it slower
 
8:45 PM
you wish it were sha1 didn't you, @ton.yeung?
 
nah, you use an iterative hash algorithm
 
i don't remember what it is, but like 3 years ago or so, it was the go-to method
 
hashing a hash destroys entropy
 
in php
yeah, you iteratatively hash the same hash, isn't that wasn't iterative hash algorithm is?
i fucked up the spelling
lol
 
(There is the possibility that I don't know what I'm talking about and even industry standard iterative hashing is hashing hashes directly, but that sounds dumb)
@SteveG No, the hash should be internally iterative, before producing any output
 
8:47 PM
how does it internally iterate? what does it iterate over?
 
it's like using a single PRNG generates randomer numbers than creating new ones with different seeds
@SteveG a larger state than the hash itself
 
205
Q: Is "double hashing" a password less secure than just hashing it once?

Bill the LizardIs hashing a password twice before storage any more or less secure than just hashing it once? What I'm talking about is doing this: $hashed_password = hash(hash($plaintext_password)); instead of just this: $hashed_password = hash($plaintext_password); If it is less secure, can you provide ...

 
@ton.yeung, I thought you were trying to crack it?
 
Assuming a perfectly distributed hash, if you hash every possible hash, you'll end up with a smaller set of results.
 
sha1 is easier to "crack" than sha512
 
8:50 PM
> Merely chaining hash output to input isn't sufficient for security.
my point, well put
 
@ton.yeung, oh for what?
 
@KendallFrey yep i read that
but
well, no but, you're still right
 
:)
Oh gosh, I wish I knew where that article I read on PRNG seeding was
 
but i was thinking of bcrypt before, which was the way to do password hashing in php for a while, and it used iterations
 
it was really insightful
 
8:52 PM
but according to this, they have a built in function now
687
A: How do you use bcrypt for hashing passwords in PHP?

Andrew Moorebcrypt is a hashing algorithm which is scalable with hardware (via a configurable number of rounds). Its slowness and multiple rounds ensures that an attacker must deploy massive funds and hardware to be able to crack your passwords. Add to that per-password salts (bcrypt REQUIRES salts) and you ...

 
@SteveG but not using output/input chaining
 
nobody said output/input chaining except for you lol
 
12 mins ago, by Steve G
@KendallFrey does the length stay the same if you hash the same thing multiple times?
I assumed this is what you meant
 
@ton.yeung i don't know what blowfish is
 
oh ok
 
8:53 PM
@KendallFrey oh, i didn't mean the precise output
misspoke
you can throw in whatever you want, salt, to preserve entropy (i'm not even 100% sure this sentence makes sense, but lets go with it)
when i was 14 i implemented hashes for my website, one single md5 with no salt, i thought i was so smart
 
Hey it was better than my code at 14
 
@ton.yeung ah
ah, and thats what does the iterations? because i thought i remembered reading over it and seeing it manually iterate
with a salt at each iteration (maybe? it's been so long since i read it)
i'm heading home, i'll read all of the responses you all have for me when i return
hang in there, i promise i'll be back
 
@SteveG Here is a response for you to read
 
SO crashed, should I post on a Meta with a question? is that how meta works
or do they declare that it isn't compat. with IE? :D
 
TIL "megamorphic"
 
9:03 PM
@NETscape bug report maybe?
I forget the exact tag
 
@NETscape - define "crash"
 
oh, the tag is just
I wonder...
oh cool
yeah, that tag
wut?
oh
[meta-tag:bug]
I wonder if it does red ones too
aw
 
That is all good and dandy, but how did it "crash"?
 
9:21 PM
@TravisJ IE stopped working prompt
just posted anyways, no idea if its relevant
 
9:43 PM
yep
 
blah
I can't even test my own code in dev because the code that calls my code is in a different system that I don't have access to
who thought this was a good idea
 
10:45 PM
=/
I think I just overwrote my chat script with css
oh, ty pastebin
I was totally f'd
 

« first day (1753 days earlier)      last day (3201 days later) »