« first day (2323 days earlier)      last day (2629 days later) » 
02:00 - 18:0018:00 - 00:00

6:02 PM
Does anyone know what kind of iterations I should use with PBKDF2? At 65k iterations it still only takes around ~50ms.
I previously used a BCrypt implementation I found online which was fine with 1000-2000 iterations to get 1+ seconds to generate.
1^21 iterations gives me 1-2 seconds which I guess is fine. Just curious why BCrypt is so much slower and whether this is a good or a bad thing.
Maybe I should try asking on security.se
 
@Nathvi Is SHFB the kind of thing you mean?
@WilliamMariager Slow is a desirable property for secure hashing. A hash should be slow enough that brute force attacks are impossible, but not so slow that it wastes time for users.
I would aim for something in the order of magnitude of 1 second per hash for a web password
 
Yeah. I think I'll stick with the .NET C# library. The fact that the BCrypt library I found is slow might just be bad implementation.
 
Bcrypt is designed to be slow
 
Yeah, but I can't be sure, since I can't trust the implementation I found. :) I have far more trust in the .NET developers than I do some random BCrypt implementation I found online. :P
 
The nice thing I like about BCrypt.NET is the API, enough that I replicated it around our PBKDF2 hashing
 
6:15 PM
Ah, I wasn't using BCrypt.NET. I was literally just using something I found online. :)
 
Architect was reluctant to use a third-party library
If you have no qualms about using an external dependency, I'd recommend BCrypt.NET
 
Well, as far as I can understand, both BCrypt and PBKDF2 are equally sure as long as you hit the right number of iterations, so I don't see any reason to add dependencies.
 
453
Q: Do any security experts recommend bcrypt for password storage?

Sam SaffronOn the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved blowfish algorithm seems almost too good to be true. It is not vulnerable to rainbow tables (since cr...

essentially, bcrypt can't be cracked efficiently by a GPU
It's weak to FPGAs though
both points are pretty unimportant compared to most concerns about your code
 
Have you adjusted the DataGridViewColumnHeadersHeightSizeMode of your ListViewVirtualItemsSelectionRangeChangedEventHandler within the past 4 weeks?
(Those are actual CLR classes)
 
@KendallFrey - does 110 years of GPU and 6,500 years of CPU count as efficient?
 
6:31 PM
In that case the GPU is more efficient than the CPU
 
It was both. Didn't you read the google paper on SHA1?
 
I have no idea what you're talking about
I did hear the news though
 
Yeah, what of it?
 
> Here are some numbers that give a sense of how large scale this computation was:
> Nine quintillion (9,223,372,036,854,775,808) SHA1 computations in total
> 6,500 years of CPU computation to complete the attack first phase
> 110 years of GPU computation to complete the second phase
So, when you said that it was not efficient to crack bcrypt, would you then also say that it isn't efficient to crack SHA1?
 
6:34 PM
I don't think you understood at all
Read the linked question and answer
 
I have a question about setting an object to the clipboard
I would like to do something like this: Clipboard.SetDataObject(new Button(), true);
So that when I go back into the designer, I can paste a new button onto the page
form*
It doesn't seem to do anything though
 
uuh, I always wonder how crypto anlysist can say things like "In practice, collisions should never occur for secure hash functions."
While the whole idea & experience of hashing is to reduce the size much smaller than the minimum informative size. - Thus by default collisions WILL occur, even randomly collisions of data occur.
 
@paul23 Hashes should collide in the same way as GUIDs. In the sense that you should spend more time trying to protect yourself from an asteroid collision than a hash collision.
 
I'm studying to do that first thing already. So when do we start on hash collision prevention?
 
7:00 PM
The SHA1 breach is 'efficient' in the sense that a government or major corporation could stump up such resources as necessary to fake, say, a signing certificate that used such an algorithm
which I don't think signing certificates do, or possibly ever have
but I'd frame my notion of efficiency in that sense
 
@TomW Or someone running a botnet. - I just noticed that GIT still uses SHA-1 and has purposely decided not to change after the news yesterday?
 
Git doesn't authenticate anyone
it's for a completely different purpose
so you can falsify a commit! woo!
you'd have to be a trusted person to be able to access the repo to do that, that isn't broken
 
Yeah I wondered about that too. It's not really a problem because in the case of a collision, git takes the oldest version as authoritative. You can't overwrite good data with bad data.
 
and presumably the fake commit would be gibberish anyway
 
Practically that means that your repository is authoritative when pulling
 
7:09 PM
notwithstanding some people's code as originally written
 
True, but it feels to "beg for misuse someday"...
 
eh maybe
someone will find a way to abuse anything
 
Trolls, uh, find a way.
 
Better to dismantle the bomb now than to wait till the encasing has rotten away.
"GIT strongly relies on SHA-1 for the identification and integrity checking of all file objects and commits. It is essentially possible to create two GIT repositories with the same head commit hash and different contents, say a benign source code and a backdoored one. An attacker could potentially selectively serve either repository to targeted users. This will require attackers to compute their own collision."
 
Ah. Well that is slightly more serious.
 
7:23 PM
I am following a tutorial that shows how to configure the forgot password in MVC however there seems to be something missing. When I put in my email and click send for the password reset I do not receive an email from the local host
 
@paul23 How could git even replace the hash algorithm without requiring every repository in the world to be rebuilt?
 
Its in the first 8 minutes of the video
 
@Skullomania you certain gmail actually lets you call its smtp endpoint like that?
 
@KendallFrey By requiring that for "new projects", making the hashing part of the repository. And warning everyone if you checkout a project using the old hash method?
 
and you have a valid account to do so?
 
7:26 PM
I also wonder why programmers are so conservative: "all the repositories in the world" isn't really that much. Just do it.
 
@TomW i was just following the tutorial. I do have a valid email
 
That would be a lot of time spent rebuilding repositories, even if it was done automatically. And there are guaranteed to be many people who rely on SHA-1 in ways that aren't automatable.
 
I study aerospace, and it often happens that "all the aircraft in the world" need a million dollar change due to renewed airworthy regulations. It's not a problem at all, every - even very small aircraft companies - just do it.
 
It's not a simple as "let's use a different algorithm now"
 
7:28 PM
do you guys know of a better tutorial. I tried looking through pluralsight and I didn't see anything there
 
If it is a change that is bad for your design and means you have to redo a large part: well that's your problem. You should've made your aircraft (repository) more robust and modular.
 
@paul23 A million dollar change? To every aircraft? Most aircraft cost less than $1M I'd think
 
Or just keep using old version of git?
@KendallFrey Every aircraft = every type of aircraft, not each physical one XD.
 
You mean a change to the design?
 
yeah, which leads to a change for each existing aircraft. - An example are old jet-powered aircraft. Jet engines were often designed (for aerodynamics) to be "inside" the wing, jet engines are small compared to turboprop so this was feasible. However they still required some height so they needed to be placed near the fuselage.
A quad engine craft needs to be able to fly on 2 remaining engines, as long as they are on opposite sides of the wing. - That's what those craft were designed for. However after some near crashes it was discovered that the fact that the engines were close together often meant that if one engine crashed, it caused the other engine also to crash.
 
7:35 PM
Did the wings on all affected aircraft need to be replaced?
 
SO an additional regulation was made: engines have to a certain distance apart. - This lead to huge problems for many aircraft, since they didn't have the space in the wing to move the engine around: leading to designs where the engine became "on top of the wing".
Or below, but then the ground clearance was a problem: so longer landing gear had to be created (but then where do you store this etc).
 
Did existing aircraft need to be rebuilt, or not?
 
Yet it was still a quick change in the sense that it was expensive but "just" done. (eventually leading to a new series of crafts that depend on turboprops).
yes
 
It sounds like it only applied to a specific kind of airplane
 
Well there is a difference
nobody is regulating software
And if you think that's a good idea...well, eat a dick
 
7:38 PM
Because not all software can kill people
 
But true there is a continuing trend of reliance on software where there is no backup
It's one thing to do your day's ledgers on paper because your computers are down, it's quite another to have cars that won't move because there are no physical controls
 
Software that can kill people probably should be regulated
 
@KendallFrey Just like this is "about git" and not "about svn" - and actually it wasn't that specific; each and every new aircraft used turbojets at that time period.
 
what about software that can get people killed?
 
killer drones
 
7:41 PM
@KendallFrey Well the line starts to blur with that, we have now/soon self-driving cars: but maybe those start integrating with my smartphone and communicating with apps on there: then even my smartphone's faulty app might "break" my car.
 
Or software that is badly written and gives the supporting team heart attacks due to stress
 
@paul23 In that case I'd blame the car
 
@KendallFrey something something trolley problem
 
how to debug a car? does it support remote debugger?
 
I think the obvious answer is we go back to the low-tech self-driving car we used to have and just implant a horse's brain into every self-driving car.
 
7:46 PM
Maybe we should have driverless trains before cars
 
already happened
DLR is driverless
 
I didnt know that. Them why are the RMT striking in the South due to not having conductors when DLR can iperate driverless?
 
they say safety
reality, job losses
which is fair, union's job
different kind of train, different kind of line
totally different setup, the DLR was purpose-built for it
 
I suppose. Automation is coming though. Society needs to suck it up. Look at Amazon Go. I know only one store, but Amazon have a good track record on exapnding.
Intresting on DLR though
 
perhaps you all can help me out with something. I have had someone go through my most recent post and downvote about 9 of them. Not that I post questions for rep, but the questions I post were after I have researched the subject for quite some time, at the end of which I was stuck. Is it possible to see who has done this and report them?
 
7:53 PM
@garfbradaz I don't think I like the idea of there not being a person around who can deal with situations or call for help and be listened to
or to be honest, having my life run by robots
Interacting with people to just 'do things' is just the way
substituting robots is weird and kind of fetishy
 
@TomW have you watched Humans? Gives an intresting take on it.
I know that is more AI though
 
I have not
I must admit I'll choose the robot option for say, shopping
self checkout 4 lyf
but that's just because I live in the south and nobody wants to talk to a southerner, not even another southerner
 
If you have time, its a good. I love the scan as you shop. We just need to pay via an app next so no checkout. Southerner here too 🖒
 
Should I update vs2015 t o 2017 btw?
 
That's coming too
Oh wait, that's Amazon Go isn't it?
Grocery store where you just walk out with your stuff
 
7:58 PM
Yeah 🖒 prime members only though i think
 
They scan you and know who you are and match you to your account, and just charge you
so what happens if a random walks in?
vworp vworp vworp, outsider
Take them to the re-education facility
 
shutup mike
 
ha I saw that too
 
Luckily cars aren't trolleys, and it could just go between the group of 5 people and the group of 1 person.
 
8:18 PM
@SteveG When given the choice between killing one person with a trolley and five people with a trolley, I'm going tie you to the track and redirect the trolley to whatever track you're on.
 
the trolley would probably bounce off his fat ass
 
This is why cities don't have trolleys anymore.
 
Steve broke them all.
 
btw I did wonder
this to me is a trolley
 
that is a shopping cart
 
8:20 PM
if it's a cart where are the fucking horses
 
they push from the back
 
use English properly
 
Horses pull buggies.
Or wagons.
But enough about Kendall's mom.
 
This is a buggy
 
why is cap's rimshot gif so freaking depressing
 
8:21 PM
 
That is a dune buggy
 
where else would you drive them
superfluous language much
 
@TomW hey, you fuckers invented it
 
@mikeTheLiar :(
 
@mikeTheLiar and you fuckers are using it wrong
 
8:23 PM
We are perfecting it, thank you very much.
 
@TomW sorry I can't hear you over the sound of FREED....Trump dismantling our republic.
 
btw the saying about buggy whips makes absolutely no sense to the average teenager hearing about it in a business studies class
 
^^ THATS A BUGGY
 
Yeah that is more of a buggy than the dune buggy shown earlier
 
8:24 PM
@garfbradaz TRAITOR
 
@TomW isn't a buggy whip for sexy times?
 
@TomW or a pram 👌
 
buggy whips? sounds like something from the 50 shades movies
 
Right nightly washing up duties before the nag returns home
 
Apparently the difference between trolleys, buggies, carts, and hansom cabs is a lot more interesting than I would've thought.
 
8:27 PM
I clicked it again!!! Ffs
 
8:49 PM
Anyone in here have any suggestions for obfuscators? Have any experience with any of them?
 
9:02 PM
is it c# room :/
 
@bluetoothfx No.
 
Liar :P
 
9:44 PM
How do you guys limit line length when using complex containers?
Like lists of dictionaries of string-list pairs?
Just the type indication almost crosses the 80 characters redzone
 
10:35 PM
Is there anyone out there??
 
Just nod if you can hear me
 
sup
 
about to make dinner for 2, the wife is away, just me and the baby
 
enjoy your mashed miscellaneous
 
more like perogies and squash
 
10:40 PM
As I say, miscellaneous
Work bistro lunch today was squash bake topped with feta
I was like...how many people do you expect to buy that
usually they're pretty good but today...nah, don't do that again
 
feta makes it betta
that's what the wife says
 
false
 
i will relay the findings
 
sausage and mash : sold out
thai chicken and noodles : sold out
squash bake : the cafeteria lady looked sad at being ignored
 
Go for spam spam spam egg and spam!
 
10:54 PM
Hello!
Anyone there?
 
kind of
 
I was wondering if anyone knew where I could go to hire a programmer online
 
Is it any good?
 
@anang well you're hiring SO members. If it's any good is up for you to decide.
What are you hiring for and how much are you paying?
And where?
 
10:58 PM
to be fair there is no recruitment bar whatsoever for StackOverflow members
the only membership requirement is knowing it exists
 
That's true of most places.
 
I am a journalist. I have very little experience in sql .
I need to have a database built
I have hundreds of xml files that need to be brought in.
 
Ah, so you're FAKE NEWS.
SAD
 
I crie eerytiem
 
lol
It's okay, we're here for you
 
10:59 PM
Fortunately I only have like 5 types of xml files
by which I mean that their contents are very similar so it can be brought in in bulk
 
Who are you a journalist for? Can't your news firm supply technical expertise?
 
i mean that their data types and column names are the same. Only the contents of the values differ.
i am a freelancer
my budget is 1000 dollars but on several conditions
1.) all queries must be done using the most modern methods
2.) The profile of the person I hire needs to give me confidence that you know what you're doing
3.) Work must start immediately. I did something stupid and now someone I thought was a friend wants to steal my story. The database needs to be done asap so i can get the story first
 
It sounds like it could be either a ten minute job or weeks, depending on how precise you can be about exactly what you want
 
I believe that it is an easy job
I think a person who is experienced can get it done in 12 hours max
 
How does having the data processed entail a story?
 
11:04 PM
it has to do with politics jargon. the xml files contain campaign finance info, congressional voting records, and lobbyist information.
 
I'm out. I assume it's American, so I won't recognise the jargon and nuances
or fully appreciate what conclusion I'm endorsing
 
You don't have to. I know my data very well. I merely need it brought into sql.
as for the conclusion you need not worry. I don't know for sure what the database will reveal.
 
And at what point do we see your profile, to learn who we're working for
 
I am a 24 year old girl. I work for nobody
 
@anang What form is the data in?
 
11:08 PM
oh are you worried about the xml documents? They aint top secret or anything. they are for public viewing at governemtn websites.
 
and... is it from a lost Nigerian Prince who just discovered his riches? (just kidding, had to throw this out there haha)
 
@RyanTernier it is in xml form
 
You're paying someone 1k to transform XML to a SQL Db system? is it a one time thing, or is it a process that needs to be repeated?
 
all the contents of the xml documents are public information
 
AH, you want to query it too (just reading up). Do you have a full list of specs?
 
11:10 PM
My understanding is that a loop thingy can be made to do them all at once
i have all the files if that is what you mean
After all that I will need certain tables to be merged but i believe that can be done in bulk too
 
What it is it about a SQL database that you can't do with the data in its raw format?
 
I am not a programmer. That should explain everything about why I can't do it.
 
or, why do you need it in a sql database?
 
If they are large XML files, it'll be hard to index them. which is why a DB would be necessary
 
It must be in a sql database because I need to make queries comparing hundreds of files at once
 
11:12 PM
however, not needed
Once it's in the DB, there are no files. It's all relational at that point
 
what he said
 
You're asking for a system to load data from files into a DB for queries
 
a system? No i alrady own Microsoft sql server 2016.
 
that's a pricey piece of software
 
11:14 PM
are you writing your own sql queries too?
 
ya i might have misinterpretd what you said completely ryan
well about the queries... I'm super inexperienced. I know I'm paying insane money for this project. so i would love continued support up to march 15th
I am a fast learner as long as people are patient. ik enough about sql to not ask someone to do all the queries for me. Show me how to do a certain query once and i wont need to ask you to show me again.
 
Honestly contracting programmers in this way is quite rare
There are contractors in this business but they are like 3 months +
for a business they can physically identify
 
I guess I'll take it to the link someone posted then. I'll do the stack overflow business thingy
 
Well $1000 is around 2.5 days work @ 50$ an hour
 
and i can get info on how to do my queries on this site for free
 
11:17 PM
That's a good call. But being on stackoverflow by itself doesn't make it reliable
 
1000 dollars is my max budget
 
I could easily throw this together over the weekend, but the requirements are not there and I'm quite confused as what the end project needs to be
 
You definitely need to be able to pitch yourself as a reliable physical business run by a human that can and will pay for the work
 
what requirements?
I will pay for the project in parts to ensure that no party is cheated.
I can put the xml documents all in a google drive for any interested person to look at.
 
Requirements
1) Is the goal just to load XML into SQL Server, or does this process need to be repeatable in the future
2) Does the developer need to create any queries or a framework to write queries against the DB
3) Will data need to be updated?
4) etc.

these are things that need to be spelled out :)
 
11:46 PM
Is there any way to combine C# and CPython scripts? Where I write my core logic in C# and my application level logic in python. (And no not ironpython as I still need numpy and other C extensions).
 
@anang If you need someone to get this done for you, i'm on Linked in - send me a message
 
War
k
 
02:00 - 18:0018:00 - 00:00

« first day (2323 days earlier)      last day (2629 days later) »