« first day (2139 days earlier)      last day (2812 days later) » 

user6568562
2:00 PM
@corvid For the time being* Many ad-based companies are implementing paid subscription strategies (Youtube being one of them). Which make it seem like the TV industry. I guess the future will tell us if ads take their value from their utility or from the will of those who pay for them. If it's the latter, the interwebs are gonna have a bad time
 
@tristan You sound like the kind of person that believes that the moon landing was faked
 
@DSM no, but I am working for a co who does twitter+fb data analysis
twitter sample gives 1 % of tweets
 
user559633
@James Of course it wasn't. But the earth is flat.
 
@tristan true
 
and all companies truly care about you and your feelings. They said it. So it's true.
 
2:00 PM
@James youtube.com/watch?v=P6MOnehCOUw - can't resist posting Mitchell and Webb when it's possible :)
 
it specifically works so that it yields those tweets that were published between 666...675 1000th fractions after whole UTC seconds
 
user559633
There's a strong difference between drinking the bullshit shady internet marketing companies are selling and not believing in scientific achievements.
 
@JonClements seen that, it's great
 
@JonClements I was thinking a pop-up box in the chat room itself. So you can view people's stats by clicking on their names. That part is done. It's the whole "talking to the database" part that's tricky.
 
that is YYYY-mm-dd HH:MM:SS.666 - YYYY-mm-dd HH:MM:SS.675
 
user559633
2:01 PM
It's not "tin-foil hat" to think that diet pepsi is bad for you.
 
Rather, talking to the database is easy. Talking to the database in a way resistant to MITM attacks etc etc is hard
 
@Kevin can't help but feel you're over complicating this...
 
user6568562
@tristan It would've been so easy to refute your arguments if you didn't believe in the moon landing, though
 
@randomhopeful +1
 
twitter sells its data via gnip.com
 
user559633
2:03 PM
I believe that we landed on the moon, but the moon I believe in is different than the one that big NASA wants you to believe in.
 
@corvid I more don't want to use something I'm not paying for, so that trumps it
 
user559633
Twitter sells its data to whomever will give them money.
 
any time you've heard me complain about the worst API ever designed happened, that's the Gnip.com API that sells your precious tweets.
 
@tristan They landed on Cruithne?
 
user559633
@IntrepidBrit Shh! We do not speak its name to humankin.
 
DSM
2:04 PM
@AnttiHaapala: they don't sell mine.. I don't have a twitter account!
 
@AnttiHaapala sentiment analysis is talked about very positively on Twitter, according to them
 
@tristan I know Twitter sell their data, I'm just saying - do they sell their private data?
 
@DSM so that's why your tweets are infinitely precious on average!
 
user559633
@James Theirs or yours?
 
Users'
 
user559633
2:05 PM
Theirs? Probably not. Yours? Read the terms and conditions.
 
DSM
I didn't think of that. Maybe I should sell one.. one borderline-priceless tweet..
 
Russian wikipedia page says that Python copies integers by value stackoverflow.com/q/39125486/2301450
 
user559633
Make sure to keep reading them as their stock price dwindles.
 
nothing will currently sell nonanonymized private data...
 
user559633
@AnttiHaapala Facebook
 
2:05 PM
not to us...
 
user559633
Yeah, we don't have enough money.
 
though, they've sold statistics about private convs.
 
DSM
@vaultah: my best guess is that because other languages distinguish atomic from non-atomic types, and certain features of Python can make you think that's true, some people figure that it's true for Python as well. Those people are very hard to convince. It's kind of admirable that the OP here figured out something was wrong.
 
@AnttiHaapala You can buy photos and stuff can't you?
 
@JonClements Yeah probably. I'm more inclined to write interesting code than useful code. So it's not unprecedented for me to make pointless artificial constraints for myself.
 
2:07 PM
@vaultah so who's going to edit that :P
 
@AnttiHaapala I remember when everyone got annoyed when FB bought Instagram - the Ts&Cs changed saying that they had the right to sell your Instagram photos
 
user559633
They were never "yours", you just took them.
 
DSM
"Namespaces - a great thing! We will make them more!"
 
@AnttiHaapala someone who knows a little bit of Russian and cares about Russian wikipedia >_>
 
Speaking of not rolling your own crypto (as I was the other day), I'm not very good at following my own advice. :) I've been playing with Format-preserving encryption. Briefly, it lets you map a range of integers to a permutation of that range without having to store the whole range in memory & shuffle it.
So far, I have a non-crypto version that seems to works ok, and a crypto-grade version that uses a SHA-1 HMAC for my Feistel network's round function. But it still needs a beat of tweaking, and I'm not sure how secure the crypto version is.
 
user559633
2:09 PM
@vaultah Is there a russian wikipedia clone?
 
user559633
e.g. facebook/vk; google/yandex
 
What does it mean to roll your own crypto, anyway? If I use hashlib instead of implementing MD5* myself, does that count?
(*or whatever the new hotness is for algorithms of that kind)
 
user559633
I just imagine my data is in little coffins.
 
@tristan nope, none that I know of
 
user6568562
2:11 PM
@tristan I doubt there would be one. I mean an encyclopedia where content is generated by its own users. Too much work and not enough revenues to encourage a clone
 
user559633
(don't want to ping two people) Interesting. Yeah, I imagine it would be a revenues thing.
 
@Kevin It depends on what you do with the stuff in hashlib. If you just use the hashlib functions to compute hashes & verify them, you're good. If you try to build your own encryption scheme from the hashlib primitives, then you're on shaky ground.
 
Right now I'm interpreting it as "just never do anything involving crypto", which is... Stifling.
 
I do not give SO or any entities associated with SO permission to use my pictures, information, or posts, both past and future. By this statement, I give notice to SO it is strictly forbidden to disclose, copy, distribute, or take any other action against me based on this profile and/or its contents. The content of this profile is private and confidential information. The violation of privacy can be punished by law (UCC 1-308-11 308-103 and the Rome Statute).
there
I'm safe
 
@Kevin exactly
you should use hashlib.md5 to calculate message digests, period.
not anything else.
if you need message authentication codes
 
DSM
2:14 PM
@idjaw: oh noes! Having rejected the SO TOS, don't you have to leave now? :-(
 
user6568562
@idjaw : D Haha
 
you'd use hmac, not your own "my fancy way of getting things done"
 
I'm implementing a simple, well-known algorithm (a Feistel network), and using the hashlib & hmac modules to do the SHA-1 stuff. So I should be ok...
 
why sha-1?
 
@DSM I should be allowed to post whatever I want on a public service I use for free and have my data protected and not shared if I don't want it to. You can continue being a peasant. Peasant.
 
2:16 PM
I need a thing where the user enters their password and I do something to verify that their password is correct without actually storing their password in plaintext. I thought all I needed was a table with (user_id | salt | hash) but then we had a conversation about it in here and a lot of it went over my head. Something about signatures.
 
@PM2Ring if you're after speed, use md5, if for security, use sha-2 :D
@Kevin exactly, that is rolling your own crypto, don't do it.
you should never think of using algorithm for anything else than its name says
 
user559633
You found a lawyer's only weakness: adding text in the form of unenforceable, severed layman's legalese-jargon.
 
@AnttiHaapala Well, it's a little bit stronger than MD5, and I'm only just playing with it at the moment. It'd be easy to allow it to use any of the SHA family hashes, but I've currently got it hard-coded to use SHA-1.
 
Do you list Python libraries you're familiar with in your CV?
 
@vaultah no. CV should fit on 2 sheets.
 
2:18 PM
Ok, so I should be looking for a verify_password_without_storing_its_plaintext algorithm? Is that in the standard libs anywhere?
 
@tristan It works though, right? I'm safe?
 
user559633
@vaultah Major ones that are in the realm of the company for which I'm applying.
 
Right now we're back at square one where all advice just points to "don't do this" with no avenue for me to actually do the thing I need to do
 
user559633
@idjaw Totally. SO and other advertising-backed internet companies totally have your interests at heart.
 
@Kevin you're storing passwords:
then look for algorithm for storing passwords
 
2:19 PM
@AnttiHaapala :D thanks...
 
especially do not look for user-supplied advice in PHP interactive documentation
 
"virtual interview" requires a 5 minute answer to a simple question like "what accomplishment are you most proud of?"... I think they probably need a more laconic designer.
 
user559633
I boil down "don't roll your own crypto" to mean two things:
1) Make cute little jokes about data being in little data coffins
2) If I use dunders, I'm actively fucking up.
 
3) just use rot-26
 
@Kevin you wanted to store passwords:
passlib.
use the recommended algorithm from there.
that simple.
 
2:20 PM
@Antti: My Feistel network does 5 rounds. It uses 5 32 bit keys, which I get by slicing up the SHA-1 hash of the key string. My "crypto" round function is HMAC, my fast non-crypto round function is just a hash of a tuple: hash((key, right))
 
user559633
I like staying in standard lib :)
 
@Kevin so I think I'm starting to grasp this a bit more - are you doing this from a userscript?
 
DSM
Shouldn't we salt stuff? I seem to remembering hearing something about salt.
 
user559633
And pepper.
 
user559633
If you have access to Old Bay Seasoning, lightly dust with that as well.
 
2:21 PM
@Kevin Are you trying to implement password login? Don't people usually store a password in a field on the user like password_hash as a one-way hash like bcrypt, then compare passwords to it by using the hashing algorithm and comparing it?
 
@tristan there is no proper password hashing in the stdlib
 
user559633
Whatever you do, make sure to have strong opinions about security mechanisms you haven't implemented
 
I googled "algorithm for storing passwords" and I came up with crackstation.net/hashing-security.htm and a real quick skim of the contents, it seems to say "store the user id and salt and hash" which is what I said I was going to do which I was then told I shouldn't do.
 
DSM
I do prefer pepper to salt. And I like shichimi.
 
@Kevin do not google.
@Kevin rather read wikipedia
wikipedia is surprisingly good when it comes to cryptography.
 
DSM
2:22 PM
Silly. How can you get to wikipedia without googling "wikipedia"?
 
user559633
@AnttiHaapala No? Because passlib suggests sha256, which is in hashlib
 
@tristan ...
 
I find that Wikipedia is pretty reputable when it comes to topics that are too complicated to troll.
4
 
@tristan should I slap you with a herring
 
It's easy to deface the article on Walt Whitman. It's hard to deface the article on dot products.
 
@AnttiHaapala if you'd have said "trout" - I'd feel obliged to remind you this isn't IRC :p
 
user559633
@AnttiHaapala Meh. I'll stick with md5.
 
user559633
It's behind SSL and there's a legal disclaimer that states you're not allowed to hack it, so we'll be fine.
 
Cryptography Stack Exchange and Information Security Stack Exchange have some pretty good information. Some of the regulars there are top class, and they post awesome references.
 
@Kevin the thing is... all those idiots who say "1 round of sha-x" are idiots
you're to do 100000 rounds
and ever hardening
 
2:24 PM
@Kevin do you have access to the sopython app secrets?
 
@Kevin there is no decent thing in standard python library, unfortunately.
thus passlib
>>> from passlib.hash import sha256_crypt

>>> # generate new salt, encrypt password
>>> hash = sha256_crypt.encrypt("password")
>>> hash
'$5$rounds=80000$wnsT7Yr92oJoP28r$cKhJImk5mfuSKV9b3mumNzlbstFUplKtQXXMo4G6Ep5'

>>> # same, but with explict number of rounds
>>> sha256_crypt.encrypt("password", rounds=12345)
'$5$rounds=12345$q3hvJE5mn5jKRsW.$BbbYTFiaImz9rTy03GGi.Jf9YY5bmxN0LU3p3uI1iUB'

>>> # verify password
>>> sha256_crypt.verify("password", hash)
True
>>> sha256_crypt.verify("letmein", hash)
@corvid ...
@corvid there is passlib and you should stop shouting the bcrypt, passlib can use that bcrypt just fine
 
user559633
bcrypt is just fine.
 
@JonClements Yeah.
@JonClements I don't know what an app secret is, so probably not.
 
user559633
it's okay to take a different route to use the same algorithm
 
the bcrypt api is broken on Python 3.
it returns bytes for hash.
 
2:27 PM
@Kevin So we can do a bit of middleware that you query first and re-use the existing auth system
 
@Kevin ^ you only need these 2 functions for passwords, say.
 
@AnttiHaapala Ok, cool.
 
actually the hash is coded in there ($5$), so you're future compatible
 
user559633
so trivially encoded.
 
This class will use the first available of two possible backends:

    stdlib crypt(), if the host OS supports SHA256-Crypt (most Linux systems).
    a pure python implementation of SHA256-Crypt built into Passlib.

You can see which backend is in use by calling the get_backend() method.
 
user559633
2:28 PM
@corvid is the red line easy to get to for you?
 
@Kevin actually you want to know what platform you're running on.
because you want to use the C library for speed.
@Kevin you can use pythonhosted.org/passlib/lib/passlib.hash.bcrypt.html with the bcrypt library from pypi
 
@JonClements I'm not opposed to using an existing system. Provided it doesn't, like, disqualify half the people here from using the userscript because they don't have a Facebook account or something.
 
I work on a vegan friendly OS that is constructed by a commune of peers in an organic and liberal way.
 
@Kevin well the auth system for sopython works on oauth against SE's servers
 
2:31 PM
@Ffisegydd VirtuOS
 
Nice
 
user559633
@Ffisegydd Did you just say commune? Groups are highly problematic and I suggest you check your privilege.
 
I'm not allowed to check my privilege at work.
 
There's no privilege in VirtuOS. Everyone has the same root access.
 
DSM
@JRichardSnape: heh
 
user559633
2:32 PM
Root? Ugh, reported for ban.
 
@Kevin anyway, most of the practical exploits against crypto are because people are using perfectly good algorithms incorrectly.
 
@AnttiHaapala Although MD5 isn't as strong for simple signature use as was once believed, it's still ok to use it in a HMAC. en.wikipedia.org/wiki/… But I guess I'd still feel safer using a 256 bit SHA. :)
 
yeah.
 
We like roots, they're edible for our vegan gluten free friends.
 
user559633
@Ffisegydd Root is arbor-ableist and denies the experiences of people that grew up in cities.
 
2:34 PM
MD5, nor any other message digest never made guarantee that it is not fast to calculate the exact message that produces the same digest.
 
I prefer the term concrete jungle to city.
 
they only "guarantee" that it is infeasible to find another message that produces the same digest.
 
Yeah, that's what I'm worried about most. Like, I'll be all set using a strong hashing algorithm and securely generated salts and then it turns out that an attacker can use the birthday paradox to reduce the search space to 2^8 possibilities and trivially spoof an administrator user in five minutes
 
user559633
@Ffisegydd _Con_crete? #microaggression
 
@Kevin that's not possible.
if you use sha256_crypt from passlib with the default settings,
it takes milliseconds to try one password... for one user...
 
2:36 PM
Anything is possible if you believe.
It's possible if the first password they guess is correct. Edge cases, brah.
 
Yeah but then it will turn out that I'm using http instead of https and then the attacker can find the user's credentials by patching a wire+tin can into the phone line outside the server's data center
 
user559633
How do you defend against psychics?
 
@Ffisegydd happened at Nokia, IT guy gave me a password... then I forgot it before I logged in, he asked "what password did I give you", I said "c-something-i-don't-remember" so the guy typed in
cft66tfc
Security in Finland in 2000 (tm).
 
user559633
lol i'd imagine most of the time "c something" as a password given to you by an IT guy would be something different
 
intermittent recbg
 
user559633
2:39 PM
hi! o/
 
@tristan so would I
 
what is funnier is that I didn't see the pattern on paper.
 
@tristan Keep shocking images in sealed envelopes scattered around the data center. Psychic hackers looking for low-hanging fruit will be dissuaded from exploring further after the third or fourth goatse.
 
user559633
meaning "command and conquer" of course, because i'd imagine year 2000 finnish IT folk would have liked that game
 
2:40 PM
command&conquer is so 90s
 
Some bloody demolition going on here is actually shaking the building I'm in. Wondering about the possibility of low frequency fatigue in 1990's brick built structures.
I may wonder from a position on my back lawn with a beer shortly.
 
user559633
@JRichardSnape 1990s is probably fine, but I understand that "I don't like this at all" instinct.
 
StarCraft + Broodwar was in though
 
@tristan Yeah, I reckon you're right. Probably a lot of steel around the place that just flexes a bit. Just bloody annoying really.
 
user559633
@JRichardSnape Yeah, when I was staying in Moscow, they were drilling at concrete walls for weeks while doing renovations in a floor below and it filled the building with a high pitched grating sound. I wasn't a fan of the noise or the idea that someone was chipping away at the structure that kept our floor from falling to the ground
 
2:45 PM
Time for my weekly plug to go to pycon! Programme released today. Go see it. Come and visit.
 
user559633
For those of you in the Northeast Northern Continent, this is my time to pitch the NoNoCoSoPyCon
 
Can I get a NoNoCoSo with ginger ale?
 
I have seen it. Seeking pass to leave the house from significant other who has been single handedly battling looking after the kids all summer. P(Snape attends PyCon) low and falling.
 
user559633
@KevinMGranger Please, this is serious
 
@JRichardSnape I can pretend to kidnap you if it helps.
 
2:48 PM
I'm going to NaNoWriMo about my experiences at NoNoCoSoPyCon. I just find NoNo so exclusionary.
 
Plan B is I don't pretend
 
user559633
@JRichardSnape Yes, it will be pretty StackOverflow exclusive.
 
The problem with me driving to Portland Oregon for a convention is, I've never driven farther than thirty minutes beyond the borders of New Jersey, and thus I have never learned how to pump my own gas. In NJ, you have to let the pumping servants do it for you. It's the law.
 
Non-snakes need not apply.
 
2:50 PM
May I ask you to review the first version of my CV and tell me if there's anything that could be improved? Note though that I can't really add more entries in the "Work experience" section :(
in case it's very bad: it's a rip-off of Fizzy's CV :P
 
D:
 
user559633
I'd take off the music and video games interests. Use the little bit of room that gives you to list high level details of some of the freelance projects.
 
Curriculum Ffisae
 
@vaultah What is "emotion management"? Managing others through emotion? "work harder, because I love you and I know you can do better"?
 
You also might want to add your name
 
2:51 PM
@vaultah Couple of things I'd take off "emotion management".
 
I keep misspelling Fizzy's real username
 
Don't use "a few", either specify a number or just delete.
 
@Kevin OR happens to be the other state where gas is pumped for you
 
Ah, so it's only the bits in between that will be tricky.
 
"Emotion management" is something that I found on the internet. People say it's important to have it in the CV :(
 
user6568562
2:53 PM
@vaultah Pretty impressive [ : As others said. Lose the video games and add a bit of details. A couple of those websites they may access would be great [ :
 
user559633
Which country are you applying to work in?
 
@tristan Just trying to find some remote jobs
 
@vaultah they might, but I'd definitely lose it. Particularly if you're not sure why it's there. Depends on country culture, maybe.
 
user6568562
Emotion management is suited for stressful jobs (like a telemarketer)
 
@vaultah "Kill them off while they're fresh"
 
2:54 PM
Having no familiarity with the term, I assume it's something like how Spock struggles with his human heritage and has trouble fitting into Vulcan society.
 
At least he can list his extensive graphics API experience
 
The probelm with "Emotion management" as one of 6 core competencies you want to highlight is that it might well be interpreted as you saying you're very likely to lose it and be angry or upset in the office to such a degree that you have to actively manage your emotions on a regular basis.
You've got a typo on "department"
 
I think the last MB test I took I was a plant/shaper/chairman in about equal measures
 
user559633
@vaultah I'd take out the "competencies include" section, remove the music & video games interests, add a couple details to work experience for what you worked on, explain what the CPython contributions were, and fix the minor type on "Deparment of"
 
Thank you all! :)
 
2:57 PM
Also - I'd expect to see a little bit more in Education - some results of the most recent level of education you've finished as well as your ongoing course. Agree with Tristan's comments immediately above. Work your "competencies" section into the examples - e.g. SO answers demonstrate problem solving, freelancing on Upwork might demonstrate flexibility etc.
 
I'd consider putting in your estimated end date for uni
 
user559633
No problem :) Keep in mind that my suggestions will help bring it in line with what north american hiring managers will want to see and might not be the best if things are culturally different in the EU/Asia/etc
 
Yeah I'd discuss interesting things you may have done at uni. Or relevant at least.
 
C&C -- but I realized that comment was earlier in the chat and had since moved on XD
 
Depending on where you're applying, you may want to explain that you're fluent in Russian and English.
 
DSM
3:02 PM
I'd mention that regardless. Language skills never hurt.
 
I've always heard that you include languages no matter what-- it shows employers you can dedicate yourself to learning something difficult, and there's numerous studies that bi+lingual people are more $quality_here, etc.
 
Well if he wanted to keep his Russian self secret.
But yes definitely, I'd normally always suggest it but vaultah is weeeeeeeeeird.
 
Oh right. How old are the hiring managers? Did they exist during the cold war?
 
@Ffisegydd that's the problem: I'm not fluent in English
 
DSM
No one will figure out that a guy named Riley speaks Russian.
 
3:03 PM
Yeah you are.
You speak better English than a lot of people I know.
 
user559633
@vaultah You seem to have at least working proficiency.
 
DSM
@vaultah: consider the many conversations we've had in Russ-- oh that's right, we've never spoken in Russian.
 
user559633
at least
 
And even if you don't want to say "fluent" you should definitely say advanced working ability or something.
 
@DSM I just say that Riley Banks was born and raised in a bilingual Russian-English family ;)
 
DSM
3:04 PM
I had this conversation on the subway the other day, when the girl beside me noticed I was watching a Japanese show she recognized. She said she didn't speak English, and I had to remind her that fully half of our conversation at the time was in English!
 
You've already lied by saying you can code python. Might as well go for broke.
"Please see my stack overflow account. For privacy reasons I use an alias online. My alias is Martijn Pieters."
 
I don't list languages anymore -- I've had it backfire more often than not
 
user559633
Spent a year writing Ruby?
 
@DSM and the other half in Japanese?
 
user6568562
@MarcusS How so ?
 
3:09 PM
At one point I included Japanese / Mandarin (which I can speak and write casually / very basically), and I had listed them as such. But I've always had people speak it to me faster than I can understand it, and that never ended well. So I just don't include them anymore
 
@vaultah all that black redaction works well with the Russian aspect;)
 
Spanglish I can imagine. But Janglish? What would that sound like?
 
Edowado Erurikku
 
user6568562
Oh, I thought you were talking about programming languages : D
 
user559633
probably like my Runglish. Englissian? Lots of sentences that start in the language that you're less familiar with, proper nouns are in your native language, then sometimes there's linking phrases or sentences that end in the less familiar language.
 
3:11 PM
sounds scary
Mne ne ochen' nravitsya oh fuckit already
 
user559633
ya seglasian, ne minogiye lyudi ponemaio what the fuck i'm trying to say
 
user6568562
@tristan That reminds me of someone from my High Scool days. He always considered English as an accent. So he pronounced words in arabic / french with what he believed was an English accent when speaking to foreigners. Aah, fun times.
 
Nihoneego o speaka-da?
 
user559633
@randomhopeful lol that's awesome. our high school students do the same when they want to seem 'cultured'
 
@KevinMGranger Jar Jar Binks, is that you?
 
3:14 PM
lol
 
Imagine if episodes 1-3 were an anime...
 
user559633
jar.jar would be a good username
 
user6568562
@tristan Haha, kind of like that
 
Actually quite useful
Or was in a previous life.
 
sow wude!
 
3:18 PM
I wonder if he has any siblings, e.g. Rar Rar and Zip Zip
 
>Jar Jar Links
 
@JonClements obligatory
 
@MarcusS maybe that new brotli format? Bro Bro?
 
and for puppies (or aliens), Yip Yip
 
Hooray!
 
3:20 PM
@AnttiHaapala Brute force might be impractical against hashing schemes, but they give up their secrets to rainbow table-based attacks fairly readily. Computing a rainbow table is a fairly serious piece of computation, but it need only be done once ...
 
Toss in some salt
 
user559633
yeah, per pass salt. and hope that no one that works for you is the exploitation method
 
@tristan you rely on them being frauds
 
Actual line from a BBC report:
> A spokesman said: "The flight went really well and the only issue was when it landed."
 
It's not the fall that kills you, it's the sudden stop at the end.
 
3:24 PM
OK, have to rhubarb guys. Off to Kuala Lumpur for PyCon Malaysia!
 
@tristan Interesting you say that - there's a heavy emphasis on "social" exploits of various kinds in the Computer Security research at our Uni. Very often the weakness.
 
@tristan you can never protect yourself against a $5 wrench
 
@holdenweb enjoy
 
user559633
@AndrasDeak Easy, just buy a $6 wrench. Wait, that doesn't make sense
 
3:25 PM
@PM2Ring my point exactly;)
 
user559633
Tristan's 9th Law: The level of encryption used on a personal device is inverse to the value of the contents of the device.
 
user559633
@JRichardSnape Yeah, asking seemingly unimportant questions to people that want to be agreeable is way easier than math.
 
does your Wreck This Journal live inside a safe?
 
But $5 wrenches aside, using salts makes rainbow table attacks impractical.
 
user559633
 
user559633
3:28 PM
in my tradition of "fixing" xkcd
 
@Karin Welcome to the Python chat room! We do actually talk about Python here, but we also talk about other stuff as well. :)
 
user559633
What's a Python?
 
it's one of those fancy jqueries
 
user559633
I think it's actually proof of a decent language design that we only talk about the programming language in intense bursts before solving the issue at hand and talking nonsense.
 
3:29 PM
Nowadays I just assume the worst -- that everyone is storing the pass in plaintext
(because sometimes it's actually true)
 
user559633
Oh man, I wish my JS work was only jquery. That is a well designed, consistent approach.
 
a lot of times it's true, hence plaintextoffenders.com :/
 
"I forgot my pass!" "No problem, we've emailed it to your address on file!"
 
This is a Python:
Apr 28 at 15:40, by PM 2Ring
user image
 
user559633
TristanCorp does bcrypt + salt + tokens + changing salt when password is changed.
 
user559633
3:31 PM
ugh i really do not like snakes
 
iirc bcrypt has salting baked into it
 
You missed out adding on a different hashing algorithm each time they change password
 
user559633
Oh, sorry, I was being serious for a second.
 
Just make sure you hash an odd number of times or you'll just get plaintext.
 
To save space you can just make the salt the list of hashing algorithms you need to apply
 
user559633
3:33 PM
@Ffisegydd ha ha secretly goes to research if that's true
 
There's no need to change the salt when the password's changed, but it doesn't hurt. See crypto.stackexchange.com/a/18979
 
Like Morgan yesterday when I made him think you'd written tristan in the first char of every line of his CV
 
<philosoraptor> if you search, don't find anything, then search again, does that count as research? </philosoraptor>
 
user6568562
@AndrasDeak It doesn't surprise me coming from cloth retailers as much as it does from a VoIP company
 
@randomhopeful or jobs.lucasfilm.com? Agreed:)
 
user559633
3:35 PM
Back in joke land: you whisper your password into the ether and Joey, the one-eyed dolphin, chirps your password attempts into the deeps, where the ancients compare it to that which was engraved on the core of the earth by its Creators, returning two chirps in reply, one of which is a lie, and the other a token
 
What if you want to change password? Does Joey carve a new record?
 
The one-eyed dolphin would've been a dead giveaway
 
DSM
@AndrasDeak: sorry, meeting. Demo hai, nihongo de.
 
user559633
@PM2Ring yeah, i do the salt change because it was simple to implement and gives a little hook for someone later to say "oh, the idiot that wrote this did it wrong" and fix it
 
@DSM I should've mentioned that I don't speak any Japanese:P
 
user559633
3:37 PM
@Ffisegydd Joey knows not of that which ghosts in the depths. Joey knows only chirps and echoes
 
@tristan I hope you encrypt your salt with sugar
 
user559633
@AndrasDeak Wait in the joke one or in the real one?
 
Both
 
user559633
I've got too many threads going! I feel like a writer on LOST
 
hmm...I guess in the joke one (otherwise my question might not make any reasonable sense)
 
user559633
3:38 PM
SHIT CRAP SMOKE MONSTER, RELIGIOUS OVERTONES, I ALREADY SPENT THE ADVANCE
 
@tristan cue the smoke monster to finish up loose threads
 
user559633
i got u, fam
 
user559633
Link to morgan trolling of yesterday?
 
user559633
Also, almost time to go back to writing Bro Man's Sky News
 
3:40 PM
yesterday, by Ffisegydd
I can tell by the fact he's spelled Tristan down the edge with the caps.
 
@AndrasDeak Funny you should mention Lucasfilm, randomhopeful lives in Tunisia on Tattoine.
 
user559633
@AndrasDeak ^you're the best :)
 
user559633
Tattooine would be a great name for a tattoo studio
 
I agree, if I may say so myself
 
bye folks and especially bye to ... (drum roll) @RobertGrant ;))
 
3:42 PM
@PM2Ring Tatooine sounds like one of many places I'd not live;)
 
Bye Andy!
(Why me? Did I miss a joke?)
 
but I'm actually very happy with the place where my ancestors settled their nomad butts
 
user559633
Nomad's Sky would be a great name for what No Man's Sky should have been
 
oh and bye, Andy
 
Game chat. The Metroid 2 fan remake is pretty good. I never actually played the actual Metroid 2, so I'm not sure how much of it is novel.
 
user559633
3:50 PM
@Kevin Weird, the creator is allowed to distribute again?
 
very strange. I would think Nintendo would have perma-squashed that one
 
The controls feel very authentic. They're pretty much indistinguishable from, say, Fusion and Zero Mission.
 
user559633
idjaw, did you get a chance to grab those vacation photos?
 
@tristan I doubt it. I found a download link on 4chan's exceedingly NSFW "torrents" board.
Apparently you can also find magnet links in the developer's forum if you look hard enough, but I couldn't be bothered.
 
user559633
@Kevin am2r.freeforums.org/am2r-v1-1-update-t1639.html they're linked off the official forum (via downloads button that goes here: metroid2remake.blogspot.com/p/am2r-downloads.html)
 
3:53 PM
Oh, good. Maybe I can upgrade from 1.0 now.
 
I wonder what Kevin ended up downloading. Maybe the guvment is trying to take over rabbit!
 
rabbits and nsfw torrents...
 
My primary complaint about the game is that the minibosses are repetitive. You have to exterminate ~35 metroids, and there are only three varieties (that I've seen so far).
 
Knew the comic without loading the link
 
user6568562
@PM2Ring : D True
 
3:58 PM
I'm guessing that the lack of variety in bosses is because of the limitations of the original game, which was on the Game Boy. Copy-pasting the same Zeta metroid into five different arenas saves you a couple decibytes.
 
decibytes?:D
 

« first day (2139 days earlier)      last day (2812 days later) »