« first day (961 days earlier)      last day (4212 days later) » 

13:00
It's, as I already said, more of an annoyance than anything, but not really a threat to the security
@ircmaxell And incidentally helps you be able to see actual threats without them hiding in the noise of things that aren't a threat.
Have to agree with @ircmaxell
@Danack that too
It's great to have a good suit of armor, but its also great not to have a sword swung at you in the first place.
I.e. I fully agree that moving it off port 22 is a good idea, I just don't think it changes anything in terms of security
13:01
25
Q: The valid role of obscurity

BellThat security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no line delineating what you are trying to ban from apparently effective strategies. For example - r...

@NikiC It prevents script kiddies who don't know how to edit/use the hacking tools properly
@ircmaxell "helpful to security in many cases as it can force an attacker to generate more "noise" which can be detected." Okay, that does make sense :)
keep reading
> The other benefit is that the version number will not be indexed by services like Shodan. this can be relevant where an automated attack is carried out for all instances of a particular version of a service (eg, where a 0-day has been discovered for that version). Hiding this from the banner, may actually prevent a given instance of the service from falling prey to that attack.
That is by very definition security through obscurity, yet it clearly does prevent attacks
is there a good extension to digg deeper in session information?
@ircmaxell yes, you have a point there
13:03
How about this: Security Through Obscurity doesn't prevent any threats or vulnerabilities from being exploited, but it can be effective at stopping some types of attacks, and as such is useful when combined with actual security measures
@tereško hey do you know what the hell is going on here stackoverflow.com/questions/16896730/…
@ircmaxell Security Through Obscurity doesn't prevent any threats or vulnerabilities from being exploited, but it may increase the amount of work the attacker has to put into it, thus making at least some automated attacks infeasible.
@tereško nice interpretation
but it may increase...
and it doesn't make them infeasable, it makes some of them...
hrm, neeed to post on this
now better? :)
13:05
I think so, but need to think on it further
The overarching point though is that security through obscurity isn't evil, so long as you're not relying upon it for actual security
@David $customer = $this->customers[$customer->getId()];
this like will not override the object
@ircmaxell The name indicates it provides 'security', but it doesn't if I understood your discussion right.
instead you should want for the identity map to return an instance of customer
@dragon112 It doesn't.
It provides pseudosecurity
Most attackers are not after your box, they are after a box
Security through obscurity will probably deter those attackers
But when someone comes for your box, you wont be able to rely on it.
For example, a lot of skiddies will port scan ranges of IPs for an open 22, by putting your ssh on port 22000, you will avoid those attacks.
BUT if someone wants to take your box, they will port scan your specific IP, then they'll find an open ssh process so you're going to need a secure login process there to greet them.
@tereško so check if the object already exist, if it does do something like $customer = $this->identityMap->.....;
@tereško is it not possible in PHP to override the reference/pointer to an object?
13:16
no
@LightningDust So basically it gives an incorrect feeling of security to 'unknowable' people..
hi guys, I hope i am not disturbing you. i am getting problem in zf2
return it instead
damn
i am getting error "Invalid magic property access in Zend\Db\TableGateway\AbstractTableGateway::__get()"
$this->select->from('y2m_user_group')
->columns(array())
->join('y2m_group', 'y2m_group.group_id = y2m_user_group.user_group_group_id', array('group_title', 'group_id'))
->order(array('y2m_group.group_title', 'ASC'))
->where->like('y2m_group.group_title', '%a%');





$statement = $adapter->createStatement();
$select->prepareStatement($adapter, $statement);

$resultSet = new ResultSet();
$resultSet->initialize($statement->execute());
echo "<pre>";print_r($resultSet);exit;
i am trying to run this query. plz help
13:17
so now instead of my mappers fetch(EntityInterface $entity) return true or false it will have to return an object aswell?
cakePHP ships with one controller (PagesController) with one action that.... routes
@David Change it to return object or null.
any suggestion, what i am doing wrong ?
where's @igorw when you need him
That will fit in with the rest of the application logic, rather than return either boolean or an pointer-ish data type.
13:20
@dragon112 - Correct. Security through obscurity is like wearing camouflage, you may be less likely to get shot at but you're no more likely to survive if you do. That doesn't mean you'd go out on the battlefield without camouflage, but alone it isn't going to keep you safe.
@shail - You're trying to access a protected function incorrectly, it seems.
@LightningDust Nice metaphor. Thanks for the info!
@Danack so now when I do something like fetch($customer) and this customer is not in my IdentityMap but he does exist in the database just assign the data to it like normal and instead of returning true return the object?
@shail looks like you should be doing ->where()-> instead of ->where->
missing parenthesis
@shail @grobolom - ^ select() instead of select too.
@David Sounds about right - though I am still low on coffee. But yes "fetch($customer)" should return a customer, and either null if it can't be found or throw a ObjectNotFoundException if you feel that way inclined.
13:24
i am just simpley follwing this post
0
Q: zend framework 2 tutorial AbstractTableGateway

user1655688I'm very new to Zend Framework and php. I went through the Zend Framework 2 tutorial and tried to use AbstractTableGateway for querying multiple tables. But got the following message on the web page: The table name of the provided select object must match that of the table Here is part of my ...

@Danack ok cool thanks and @tereško thanks aswell
i will probably be back in a while with more problems
k, let me see solution
@shail - Solution to what? Your code is fundamentally wrong, you're calling functions without parenthesis.
4
A: Get all variables used in a twig template file

HamZaYo dawg, I heard you like Twig so I wrote a regex so you can parse while you parse: regex \{\{(?!%)\s* # Starts with {{ not followed by % followed by 0 or more spaces ((?:(?!\.)[^\s])*) # Match anything without a point or space in it \s*(?<!%)\}\} # Ends with 0 or more spaces not followed...

@LightningDust ^ I like to reinvent the wheel :p
@lightning
13:33
@HamZa - I don't. :P
nop, i got the solution
little tweak :)
@HamZa I'm glad someone invented the wheel for me. ;)
@LightningDust Then I would expect a flying vehicle from you :D
@HamZa - Someone invented that for me too :P
yaaa :)
13:41
user image
3
That just reads funny :P
@HamZa ^^
@Bracketworks hahahaha
it's 30°C in the office ... i am slowly boiling in my own sauce
@tereško sauce, hmmmmm
I wonder if @tereško is smokey or tangy.
@tereško how is that even possible in europe at this time o_O
13:44
@tereško sparing for dinner?
lmao @Bracketworks

India

The chat room to discuss India proposal on Area 51. Find the ...
I work in an old building and it's never reaches any temperatures of over 22 degrees
India proposal on Area 51 lol? I just left India :)
12
Q: How to write a single-line password generator

powtacIs there a way of writing a password generator in only one line? The password should consist of 8 random chars out of a-z, A-Z and 0-9. Example: This is one attempt I made in PHP! echo substr(str_shuffle(implode('', array_merge(range(0,9), range('a','z'), range('A','Z')))), 0, 8);

If @ircmaxell saw this ^
13:55
@HamZa Ugh. Stuff like this is scary...it suggests that you are clever if you can write immensely obscure code to do pretty simple things...and people even feel good about it. Yuck.
I hate to repeat myself, but: Yuck!
@HamZa You forgot to give credit to NikiC :)
@Jack @NikiC actually improved it, but I didn't edit :)
First time I see this in a forloop ... codegolf.stackexchange.com/a/11758
@HamZa To address this bug (too long in code golf) we must add a str_random function
(and actually, I think that would really make sense, especially if one could choose the prng source)
14:02
GolfScript is still pretty amazing I must say, even though I haven't the slightest idea why it works =p
@NikiC I saw some guys use md5() to generate a random str ...
why does codegolf.stackexchange.com/users/95/gnibbler provide two answers... same language?
@HamZa That by itself might be okay, the problem is more that they take the md5 of rand() ...
@iroegbu moar upvotes :p
So many poor practices in answers. Felt like I had to answer that one just to avoid establishing a horrible programming practice in a noob.
14:05
@NikiC Well the goal is to make the shortest script not a secure one ...
why not just use github.com/ircmaxell/PHP-PasswordLib and generate random numbers getRandomNumber([$min] [, $max]) ?
@iroegbu code golf is all about making your script short OR fast. Depends on the Q by the OP ...
@HamZa oh ok
The problem is that with PHP you can't really make your script short since the function names are long :p ...
14:09
@HamZa function getPassword() { return 'password'; } is definitely the best password generator.
PHP should restrict all function names to one character!
(With lots of unicode function names of course)
extremely false... I can do function(){ return 'p'; }
@NikiC We would then have only 26 functions
@NikiC You typed S(), did you mean q()? :)
@Jack More like "You typed ಠ(), did you mean ♫()"
14:11
lol
lolz
0
A: How to write a single-line password generator

ircmaxellConsidering that security should be the upmost priority, and someone may stumble across this thread and actually try to use the code here (the horror), I feel this answer is appropriate: Use A Library!!! In PHP, You could use the GenPhrase Library: PHP (37 characters) (new GenPhrase\Password)->...

@ircmaxell haha nice +1 !
mysql_connect() is being deprecated, you should now use m̫͕̱͕̩̪y̖̺̻ͅs̬̗̲͕̦͙q̻̲͇͉̖̠̞l̳͚̗͉͚_̻̙̹̱ͅc̼͕̬͇o̭̪͈̯͎n̟͓̙̻̺̹ͅn̘͉̗͕͕e̯̞̦̰͇͍̥c̳̜̠̬̠̝‌​t͙̺̹̤ͅ()
@Farkie eh?
14:15
:-P
@ircmaxell Someone actually downvoted it :O
@HamZa It is kinda off-topic for the site ;)
Hmmm yeah ...
I'm not surprised
nor do I care
I said my piece :-P
@ircmaxell to be fair though, if someone stumbles across that and doesn't immediately realize that, they pretty much deserve what's coming to them
14:19
@CarrieKendall But their customers that expect a secure website don't.
@dragon112 then their customers shouldn't hire developers that look for answers on PUZZLE websites
@dragon112 - Reason #581892 not to use the same password on multiple websites
and that should be tied directly into wages if my assumptions are right about the developer :]
Just remember guys; someone, somewhere, has hashed your password unsalted with MD5. ;)
(and someone else has put it into his database in plaintext)
of what use is short code if it is bad or unreadable?
14:21
@CarrieKendall If only the world worked that way. Unfortunately, their victims wouldn't deserve what came to them
@CarrieKendall Most customers don't know anything about programming, that's why they hire people to do it for them.
@dragon112 - The old phrase rings true that if you pay peanuts, you tend to get monkeys. These people paying 'developers' $8/hour (or less) on e-lance deserve what they get for $8/hour.
@dragon112 If I find out one of my employees is using codegolf examples for production code, they will get burninated!
I'm far more worried about their customers' customers. The people whos credit card details might be stored by these people.
@LightningDust Incorrectly storing credit card details is different though
14:28
NikiC - It's the same kind of cowboy devs who would do both.
In that it will have legal repercussions (unlike incorrect password storage and stuff like that)
unless incorrect password storage leads directly to credit card number leaks ;-)
@Jack - Which is likely, especially as the person who uses the email address & password combo on that site probably uses it on Paypal too.
At least I'm not aware of any significant lawsuits due to password leaks (but there are quite a few high profile cases about credit cards)
Because most end users are lazy
Which is why we have to enforce using strong passwords so harshly usually.
14:30
@LightningDust That's why I use the same strong password everywhere! :P
@LightningDust I use a single password for unimportant websites like forums etc and I have different passwords for important ones like paypal and SO xD
We have learned that unauthorized individual(s) secured a link promoting our website xxxxxxxxx.com on one or more of your web properties.

The links were placed purely for SEO purposes, with the intention of manipulating search rankings, something that we do not approve.

The presence of these links is harmful to our site's good standing with search engines, and unfortunately, retaining them may also be potentially harmful to your own website's reputation.
what'sat?
wudd?
Wait, so it's bad to have SEO url's?
14:32
that's an email I just received
Wow. that's uhh weird
@dragon112 - I use LastPass to keep unimportant passwords, at least that way they'll only be compromised if I'm stupid enough to give away my lastpass master key. :P
Wanting to get high in the search rankings, how dare you!
or if LastPass is the best long con ever and actually doesn't client-side encrypt passwords.
I find Keepass (keep ass) quite useful in that respect; it comes with a password generator so that you can create random passwords for each site and save them in a wallet.
14:34
@Jack - LastPass has a password generator too.
Probably similar tool.
Does it work cross platform too?
@Jack - Yes, it's cross platform, can work from the web with new browsers and has native mobile apps too.
And its $1/month.
@LightningDust What's that? Money?
I think there's a free option but doesn't include all the mobile clients, @Jack.
14:36
no , we are not interested
@LightningDust If I can't view the source, I'm not putting my passwords in it
3
You shall use regex as passwords :D
For the sheer fun of it, our site now offers empty passwords ;-)
@LightningDust , try selling that crap in the wordpress chat room
@tereško or JQuery room !
14:42
@ircmaxell - Convenience matters. :P
@ircmaxell - But I certainly wouldn't store anything important in there.
@LightningDust Why don't you remember each password ?
if you can't remember your passwords there is a problem :p
@iroegbu I actually forgot the password of my paypal account since I did not use it for a while ...
Too many sites, and I like my passwords to be at least 16 characters
14:45
And no duplicates because I don't know how each site stores them
@LightningDust If you won't put anything important in there, why are you putting anything in there in the first place? :-P
What do you guys think ?
My bank forces me to change my password each 6 months (or 1 year I don't quite remember) ...
Is this a good practice ?
Possibly
It's superstition.
password rotation isn't a bad policy, as long as it's not overly fast
14:48
@ircmaxell Where I work I have to change it each month, which is really bothersome ...
that's crossing the line IMHO
Don't you have a token for banking?
@ircmaxell - I don't store anything of financial value (was going to use Liberty Reserve as an example... but -__-), or anything I'd be particularly inconvenienced by losing (SO, FB, etc) in there.
@webarto I've TAN codes
14:49
@HamZa ING For the lose
I store things like forum passwords which I may use multiple times, or things I sign up to which I may one day come back to.
Throwaway email accounts etc
@dragon112 hehe yeah, why do you have rabo ?
I don't know any of my passwords.
I raped Forgotten password? on Vimeo.
@HamZa Rabo > all xD
@LightningDust Use bugmenot.com. It may spare you a sign-up
14:51
@HamZa, too many sites like to mail you a password reset link. :P
I have used Mailinator on occasion
I sometimes also use guerrillamail.com
I have about 12 outlook.com accounts
Most of those are in LastPass
@LightningDust You sound like a spammer hahaha
@HamZa :P Nah, I just don't like everything to be in one throwaway account, or I want to share the stuff in one of them with other people.
Rule Of Thumb: If your code isn't designed to be reusable (models, controllers) it shouldn't be throwing exceptions (as that's control-flow)
14:55
Random thought for the day: Someone, somewhere, has hashed your password unsalted with MD5 (and someone else has stored it in plaintext).
:D Nice
@ircmaxell So if my code is designed to be reusable, it's okay to throw exceptions or it should throw exceptions? :)
Neither
that would be the inverse
My working day is over, See you all tomorrow!
@dragon112 - See you tomorrow, 2 more hours for me. :D
what you want is the contrapositive. If your code is throwing exceptions, it should be designed to be reusable
14:58
'If my code is designed to be reusable, it's okay to throw exceptions' is correct.
No it's not
@LightningDust yeah but it's meaningless :)
Doesn't mean it should, but it can. :P
If your code isn't designed to be reusuable it may still want to throw exceptions
it's a heuristic, not a rule
14:59
@NikiC ?
Yeah I got Twitter today

« first day (961 days earlier)      last day (4212 days later) »