« first day (2114 days earlier)      last day (2833 days later) » 

4:14 AM
If you want to show employers that you mean business, start your own business and compete with them.
It shows you have relevant industry experience, go-gettingitude, and willingness to go above and beyond.
And if you end up being more successful than your would-be boss, win-win.
 
 
7 hours later…
11:17 AM
Hey, everything I see for encrypt-then-mac seems home baked. I need encrypt-then-mac with AES in C# :/
 
ADH
Anybody know much about MSMQ?
 
@BenjaminGruenbaum What's the problem? Use BouncyCastle and AES-GCM or something
 
in JavaScript Go! Gotta try { ... } catch (em) { ... } all!, 2 mins ago, by Benjamin Gruenbaum
@copy I need to share something between two servers via a shared cookie - it is secret but not horribly secret (let's say, the user's email and an ID) - I figured I'd encrypt-then-hmac but I don't want to write the code myself. I'm using .NET and I don't see any "baked" solutions.
Any reason to use BouncyCastle and not the built in?
 
Because GCM is not built-in. That's why you see home-baked or library usage.
Honestly, AES+HMAC is just fine, too.
But that's 'home-baked' :P
AES-CTR and then HMAC suffix. Requires a bit of custom code for the CTR bit.
 
I'm unfamiliar with GCM to be fair, I did my crypto course a long while ago so I'm hesitant to roll everything on my own.
However, I am implementing a spec and it says AES with IV then MAC
 
11:30 AM
AES-GCM is essentially AES-CTR with GMAC.
 
Oh, that does sound more reasonable
 
But since .NET does not have AES-CTR nor GMAC built-in, it's very easy to use a different MAC.
Personally, I've mostly seen HMAC (which is built-in) in .NET and Java world
So, what it boils down to:
1. Generate a nonce.
2. Encrypt payload with nonce and secret (CTR mode is easy here, just ++ the nonce per block)
3. HMAC over the entire nonce and payload
Tada. Your nonce adds 16 bytes, the hmac 32 bytes
All you really need to built is AES-CTR
Which someone conveniently did here gist.github.com/hanswolff/8809275
 
Yes, I'm just hesitant to build it, I realize it's no more than 40 lines of code but I always feel dirty when I implement my own crypto - even if it's an obviously correct scheme
I don't really feel that easy using an unreviewed gist, the part that worries me is subtle errors in the code.
 
I understand completely but I wouldn't mind too much about it. Or, like I said earlier, use AES-GCM through BouncyCastle. It's a completely pre-built thing.
 
There is also a GenerateIV method built in in .NET
The problem is that I'm not sure what the other language I'm working with is - and I'm writing against a spec that says AES-CTR
 
11:35 AM
I personally use a derivative of that gist in my encrypted filesystem driver. I guarantee its implementation is correct.
 
What I'd really like is a published and reviewed project with many eyes on it that does that.
 
RNGCryptoProvider is well suited for random generation. I dont know about GenerateIV
I'll just point back to BouncyCastle then. Opensource for both Java and .NET with tons of people using it.
And it has pretty much everything from scrypt to aes-gcm to aes-cbc
 
 
2 hours later…
1:46 PM
posted on July 30, 2016 by Scott Hanselman

In my last blog post I was exploring a minimal WebAPI with ASP.NET Core. In this one I wanted to look at how NancyFX does it. Nancy is an open source framework that takes some inspiration from Ruby's "Sinatra" framework (get it? Nancy Sinatra) and it's a great alternative to ASP.NET. It is an opinionated framework - and that's good thing. Nancy promotes what they call the "super-duper-happy-pa

 
 
3 hours later…
4:33 PM
Anybody know about access tokens?
 
@chewbapoclypse you'll need to be more specific than that
 
lol yea no problem
I am trying to revoke a token with google
 
oauth2, right
 
and i am getting error : invalid token as response
 
and you know the token is valid?
 
4:36 PM
well i am connected to the service that I got it from when I am running theprogram
and I check th TCP connections
they are still solid
 
What TCP connections?
 
the connection that issues the the access token, that I am trying to revoke so that it no longer is up
 
I don't think it works like that
the connection that you open to the server to acquire a token would usually be closed when the response is received
so I don't know what you mean by 'the connection'
 
the token is used to communicate with a server as a specific user with the access token, if you revoke the token you no longer are logged in as that user correct?
 
Yes, but that doesn't mean a single TCP connection is maintained
what does your request to that /revoke URL look like?
 
4:46 PM
HttpClient client = new HttpClient();
                var values = new Dictionary<string, string> { { "token", token.Token }};
                var content = new FormUrlEncodedContent(values);
                Console.WriteLine(content);
                var response = await client.PostAsync("https://accounts.google.com/o/oauth2/revoke", content);
                var responseString = await response.Content.ReadAsStringAsync();
 
I can't find anything in the google docs that describes revoke, where do the docs tell you that the token parameter should be called 'token'?
 
I have used oauth2 but never google's, so I don't know where to find stuff
 
scoll the very bottom of the page
To programmatically revoke a token, your application makes a request to https://accounts.google.com/o/oauth2/revoke and includes the token as a parameter:

curl https://accounts.google.com/o/oauth2/revoke?token={token}

The token can be an access token or a refresh token. If the token is an access token and it has a corresponding refresh token, the refresh token will also be revoked.

If the revocation is successfully processed, then the status code of the response is 200. For error conditions, a status code 400 is returned along with an error code.
 
oh yeah, I must have skipped straight over that part
ah, right, you're not doing what it says
 
4:49 PM
ok
what do I needs to do?
 
putting content in the request body isn't the same as using a parameter on the URL
 
ok go on you have me intrigued
 
post to url stuff/revoke?token={token}
 
var response = await client.PostAsync("https://accounts.google.com/o/oauth2/revokerevoke?token={token‌​}", content);
?
 
well no, the {} means 'substitute the value in here'
 
4:51 PM
kk
so
 
Hello!
 
var response = await client.PostAsync("https://accounts.google.com/o/oauth2/revokerevoke?token=", content);
hola
 
I am using SQLite db and when I insert char into char field it become ascii number
is it possible to prevent this?
I want to store char itself and not its ascii
sqlc.Parameters.AddWithValue("@Type", 'C');
 
{
"error" : "invalid_request"
}
 
Literally any permutation of "chewbacca" and "apocalypse" sounds better than the one you chose.
"Chewbaccalypse"
"Chewpocalypse"
"Wookiepocalypse"
 
4:59 PM
Chewpocalypse
was how i say it
 
..
 
but not how i spell it
 
And the reason for that would be
 
cause i am F*&* hipster
;D
 
Sippy has removed Sippy from the list of this room's owners.
 
5:09 PM
Sippy?
@Sippy?
he is hiding probably
 
5:26 PM
Hello people, anybody on?
 
Ayy
 
whats up/
 
Does anybody know how to write bitwise OR using a while loop?
I have bitwise AND like this:
X = 12345 & 100; // Bitwise AND 12345 with 100

while (X < 0) {
X += 101;
}
X %= 101;
Assuming X is set to 12345 before above while loop, it would perform bitwise AND like on the first line (X = 12345 & 100).
 
5:45 PM
@OmegaExtern ...I have no idea what you're trying to do.
 
See above while loop and modulo operation below it? That comined is same as bitwise AND. Now I just wonder, how to make bitwise OR like that..
 
How is that the same as &?
 
Simple. If you run it, you would see.
Just insert int X = 12345; above while loop statement
 
I ran it. It's not the same.
You'll have to elaborate
 
Wait a sec..
Oh, big and little endian trouble?
& returned 32 and while loop returned 23
Hm
 
5:56 PM
There's nothing to do with endianness there
I don't think you can do bitwise math using only arithmetic
 
 
3 hours later…
8:53 PM
Aww, my bad. It is supposed to be a byte.
it is byte arithmetic.
Figured it, now two are actually equal:
byte a = 123 & 255;
byte b = math.bAnd(123, 255); // math is a proxy, it takes two ints and outputs a byte (it is that while loop code)..
Still have to figure bitwise OR..
 
9:17 PM
on click Search button
{
gets the userid from database
ViewState["userid"] = Userid;
}

On click Update Button{
if(txtbox_search.text != null)
{
Select SQL query here with clause > WHERE userid = ViewState["userid"].ToString();
and show it by putting the data in txtbox fields
}

Now when i'm writing anything in txtbox and hitting enter.
it executes the 'update button'
and program crashes giving me object reference not set.
because there is nothing in 'viewstate' since the search button didn't execute before.
to prevent from my program to crash.
 
9:35 PM
@OmegaExtern That's a special case, try math.bAnd(123, 4)
It should return 0
!!> 123 & 4
 
@KendallFrey 0
 
user3790646
Does anyone here have any experience with DotNetOpenAuth or Imgur's API?
 
10:05 PM
@KendallFrey Yes it is 0 :D
Slightly changed bAnd
 
Yeah? Can I see the code?
 
Yeah I will upload it on my GitHub, just as fun project :)
 
link me when you do
 
k
It is bitwise funcs in pure math, with small help from two funcs in System.Math (Floor and Pow)
 
What's it for? Just for fun?
 
10:15 PM
Pretty much, yeah. Just experimenting with bits, trying to implement those operators (in proxy) with less effort as possible, so it comes down to pure math.
oh.. Figured bOr :D
 
If all you're using is Floor and Pow, you could write those yourself.
 
True, but I don't see the point in that?
 
I thought it'd be interesting, as long as you're reimplementing things for educational reasons.
 
@OmegaExtern Well, what's the point in writing & and | yourself? :P
 
Experimenting bits, not (reimplementing) System.Math funcs :P
 

« first day (2114 days earlier)      last day (2833 days later) »