« first day (2705 days earlier)      last day (2258 days later) » 

9:00 AM
@towc that is a retarded question to begin with
 
should I consider that my multithreading library could be used in brief-case nuke?
 
should Mozilla care, that their browser can be used to for identity theft?
 
and make a moral judgement based on the likelihood of that happening.
 
9:02 AM
This is so cool
 
yes
and do everything they feasibly can to mitigate that
 
no
how will you mitigate social engineering with software?
 
@BenFortune oh sweet
 
use your platform to educate people
 
@BenjaminGruenbaum 2.1% autistic? That's 100x more than I would have expected
 
9:04 AM
should car manufacturers consider that their car can be used as a weapon to spread religion of peace ?
 
no
 
@tereško they kinda do
the frame is easily destroyable for the safety of everyone, not for destruction
same for a lot of other components
 
@BenjaminGruenbaum Im really surprised about the blind.
 
but it's a byproduct
if the manager said "put a remotely activated autodestruct" in it, they'd be like "Uhmmmm"
I hope
I doubt they almost ever are faced with that decision
a more realistic example is cutting corners
 
9:06 AM
@phenomnomnominal I understand, that you want to show, how righteous you are, but this is silly
 
no it isn't
and it's not about being righteous
 
the manager says "you know what, the inspector is our friend, let's use this cheaper steel so we can make more money", there is probably still someone who will say "uhmmmmm"
 
if their car is used to blow up something, that has a negative impact on their brand.
 
no, no, I am not not saying that you are righteous, @phenomnomnominal, don't misunderstand
you just want to look that way
 
I'm not misunderstanding, no need to be so patronising.
even from a purely capitalistic POV, it makes sense to consider the impact of "misuse"
 
9:08 AM
I'm with @phenomnomnominal on this one.
 
do you consider what would happen if your product had a massive data breach?
 
that's not what I am talking about
 
I guess you must be totally cool with Google collecting all your data then?
Of course it is. You can't just claim that it's "retarded" to consider the morals/ethics of what we do, and then decide that some cases are invalid.
 
I am talking about the grown up children, who put "this code should not be used for evil" in their licence
 
@tereško Then you are just sigh-ing, and not really making a point.
 
9:10 AM
yeah well moral relativism is a whole other thing.
Doesn't mean it shouldn't be considered.
 
@towc you will be impressed by some autistic people. There is a group of them whose are very useful in IT: their level of detail is very high that they even an able to find possible bugs and better optimizations
 
Beacause the way I see it, it is an actual scenario, put aside the kids.
 
@towc like 10x, but yeah
 
@KarelG huh, I haven't seen an authistic person code
 
@phenomnomnominal the question should have been "is it unethical to produce bad code?"
 
9:11 AM
*with group of them. I meant that being an autistic person makes you as a part of the "autistic spectrum", commonly used in diagnosis
 
tbf I haven't met anyone authistic in maybe years
 
there is autistic people that behaves like common people ya know.
 
@tereško that would be understood so differently though.
 
oh wait, I'm thinking of down syndrome
 
they could control their sensibility to external inputs. But they do have a crisis sometimes.
eh people with down syndrome are easy to be found
it is just the face
 
9:13 AM
you'd think. But I haven't seen one in (maybe) years
 
@tereško define "bad"? Evil? Or just you don't like it?
 
@phenomnomnominal flawed, broken , insecure, unreadable
 
@towc lmao I feel so bad for laughing at the search for a down syndrome person quest
sorry
 
there's a difference between the absolute statement "this code is ethical", and considering whether or not that is the case.
 
@tereško Considering all code that's not mine is bad code, I'd be hardpressed to call you all unethical bastards.
 
9:15 AM
Realistically, usual case is that a person does not know that the code their wrote is terrible
 
considering capitalism, all code that makes money is good code
 
@MadaraUchiha please do
 
@MadaraUchiha well ... it would be a question. And I would still answer "no"
 
> sup unethical bastards
 
I don't think that writing bad code, even genuinely bad code, is unethical, unless the dev did it on purpose for job security purposes or similar such prospects
 
9:16 AM
^
 
second that ^
 
I third it
 
Its fine if it aint a malicious intent
 
@tereško eh writing a bad code is not always obvious to the developer. I can speak from my experience
 
1 min ago, by Kamil Solecki
Realistically, usual case is that a person does not know that the code their wrote is terrible
 
9:17 AM
@KarelG that would be one of the reasons why I would go with "no"
 
my code is bad by design (jk)
 
the ethic question is more about like placing fingerprints to follow users so that you know where they have been
or after getting permission to use their facebook data to get name and email, scrape it for your own data analysis
 
and, @KarelG, that's something you can control. How people use you code is something that you can't control
 
but one part is the code being bad, second part is the company being morally responsible for releasing it
 
I was talking to someone today who said they wrote dlls for a steam game to access the cookie db of browsers to get a part of a facebook cookie for marketing purposes
 
9:19 AM
that is why there is an ethical question. If you get such task, would you develop it or not?
 
he said his code didn't look for anything else in the cookie, but there was nothing to prevent him from doing it
that's scary af, and unethical if you ask me
too easy to modify it to steal my facebook login, or credit card information
 
I admit that I wrote a feature that is ethically seen not acceptable, but it was a personal request from the CEO ...
 
@KarelG Then we have the opposite
 
@KarelG Reminds me of the interview Bjarne Stroustrup gave about why he invented CPP
 
consider this, @KarelG, libjpeg is being used for child slave trade ... should the developers of that library "consider it"?
 
9:22 AM
good question :P tbf if there is no another solution, i would give my allowance to use it
 
worrying about things you can't control is what you should leave to your grandparents
 
assume that this information is exposed after the implementation of libjpeg ... then I won't instruct to change it. It is just illogical and waste of time
@BenFortune there is a minority of those. The majority however... there are two autistic persons in my train during my daily commuting to the office.
 
morn
 
@MadaraUchiha that may explain my relationship with c++
when fiddling with my rpi, i use C over C++ because I had a feeling that I could do my stuff more faster in C.
now, I am curious about that x10. Never heard of it frankly O.o
 
@tereško All tools can be used for both good and evil
Even a ransomware can be used as a study tool and to educate
 
9:37 AM
ok I am confused
> The X Window System (X11, or shortened to simply X) (wiki)
> I got some of the ideas from X10, you know, X windows. (interview)
no hits on X10
 
It's the person wielding them that chooses whether to use them for "good" or "evil"
 
How can I fix this Typescript error for lettable operators in RXJS ?
 getValue(key: string | Array<string>, interpolateParams?: Object): Observable<string | any> {
    return null;
  }

  constructor() {
       //Type 'Observable<any>' provides no match for the signature
    //'(value: any, index: number, source: Observable<any>): value is any'.
    this.getValue('f').let(first);  //<<---error here
  }
("first") is the problematic operator
 
@RoyiNamir FYI: string | any === any
 
aaah, it X10R2 or 3 is what I need
 
9:48 AM
wtf, most wanted database: MongoDB at 18.6% src
 
@RoyiNamir That's a cool site, is it as good as codesandbox?
 
^ basically for angular
but it's great. ( allowing adding packes , right click on the left tree and you have "add X" etc
 
basically it's the new way instead of plunkr
you can see that all demos here are jsbin / fiddle and now , stackblits : learnrxjs.io/operators/combination/merge.html
-
btw , there's also ng-run.com
Also when you add something ^ it also adds it automatically to the appmodule !
 
I don't plan on ever using Angular, but thanks
 
9:54 AM
why not :)
 
React all the way!
 
Because React exists
 
React ftw
 
It's also super bloated
 
Agree on that
 
@RoyiNamir because it sounds normal to you that you need all these tools just to open a page
 
@MadaraUchiha you could actually argue, that it always is ... just some lessons cost more :P
 
Basically all it takes to crate a page is a component and ngmodule. But im sure you know that . I agree that angular is bloated...
hope it will be reduced
 
@RoyiNamir Not really, you also need a build and a build environment, and to download and run their compiler whenever you change your code, in addition to a transpiler for making modules work
And maybe the CLI to keep it all in sync
And SSR requires tooling from their end too
 
Well , i'm not getting any credits for angular. Not to mention that my plans ahead is to go deep react. :)
(until some new fw arrives:))
 
10:00 AM
FWs haven't really changed in the last 2.5 years
Really, since Angular 2 in 2015 we've been doing the same thing
There is nothing new, Vue, React and Angular all existed then and they all changed very little and added marginally interesting features.
That's a good thing though since everything is a lot more stable now
 
@RoyiNamir which bit is bloated?
 
Is Martin Schkrelli going to have to forfeit his Wu Tang Clan album ownership
I need to hear it before I die
 
Bens for mods!
 
> Vladimir you are entertaining with your Bio. What is your goal if you become Moderator.
> Вова, давай, держись ) – Малъ Скрылевъ
 
BTW did you hear about Google's Flutter ?
The new native language for ios /android from google ?
 
10:13 AM
noup
 
@Cerbrus lol @ your comment on yvette's mod election
 
Had to be said.
We get along decently, but on issues like that she can get extremely passionate.
in Charcoal HQ on The Stack Exchange Network Chat, 1 min ago, by Yvette Colomb
@Cerbrus thanks :) I'm glad we're still friends. I think people don't realise that we are friends, we just disagree about things from time to time :D Also I'm dropping all that!!
 
Did you have seen Floerns election ?
42k flags
I sense a flag bot like Andy had one
 
Yeah this dude looks interesting
 
@KamilSolecki Did you just assume their gender?
 
10:23 AM
ah there was a small controversy about Andy's bot that performs accurate flagging
 
@BenFortune I did!
 
I recall it had ~99% success
yet there were opinion that he should not run it when he is a moderator
lemme dig up the meta
 
193
Q: Should moderators run automated bots under their accounts?

TarynThe most recent Stack Overflow election brought up some great new moderators, including Andy, who has for the past ~3 years been running a comment flag bot to automatically flag comments for removal. Since the end of the election, Andy graciously turned off the bot until we determined how best to...

 
oh see
 
10:43 AM
want to write a generic function which serves multiplication of two number (with different no of input) Eg: multiply (2,3) and multiply (2)(3) – both should return 6
 
@ShivamMuttoo Welcome to the JavaScript chat! Please review the room rules. Please don't ask if you can ask or if anyone's around; just ask your question, and if anyone's free and interested they'll help.
 
is it a right way to do this?
 
1 message moved to Trash can
@ShivamMuttoo Please don't post unformatted code - hit Ctrl+K before sending, use up-arrow to edit messages, and see the faq. For posting large code blocks, use a paste site like gist.github.com, hastebin.com, pastie.org or a demo site like jsbin.com
 
const multiply = (a, b = null) => {
  if(b === null) {
    return (n) => a * n;
  }
  return a * b;
}
something like this should work
 
10:48 AM
@Ikari thanks
 
11:10 AM
Hi all
I am working on ext js
and i added parameter when clear filter button is clicked
which is -
TESTStore.load({ params: { actionFilter: "clear" } });
so when clear filter button is clicked actionfilter gets added
now I want to remove it when I click on any other grid cloumn
How can I do that?
 
👺
 
how do you have access to the emojis so easily?
 
so dark chat+?
 
he has the emoji movie playing in the background
 
dark chat Q_Q
when is the FF port?
 
11:20 AM
make one!
 
Firefox is dead; pick a better browser
 
@Neoares repo is public. Feel free to fork it and modify to use with ff
 
firefox is the second most used one
 
nuuu, firefox is much better than chrome
 
👏👏👏
 
11:21 AM
I was going to do that but I considered it as not important because I am usually doing other stuff in my spare time.
 
you have no idea, Edge is better than FF or Chrome
 
Firefox doesnt even have web components yet
 
@KarelG I pay you 10€
 
Edge is a shit show
go to bed
🚫
 
oh, it was nice before?
spot spamming emojis!! Q_Q
 
11:23 AM
You’re just jealous
🖕
 
fuck u
 
emojis are cancer
 
Go away ikari; nobody likes you
🦍🍆
 
no u
 
:middle_finger:
what
wtf is this shitty FF extension
🖕
oooh :D
 
11:24 AM
I’m on mobile, you pleb
 
it is :fu: i think
🖕
yep
 
no, it's middle_finger
but I have to copy the emoji
 
@KamilSolecki Moon Lord twice
 
i have no dark chat :(
 
then you are on the light side
 
11:25 AM
💡
 
light themes as a rule of thumb are more superior, than dark ones
 
🔦
 
I prefer dark ones
 
I use SO without any themes. The default one is sufficient
 
all of my ides are light themed as well :B
 
11:26 AM
:fu:
@KarelG then how did you put that emoji
 
@KarelG yeah, default one is pretty efficient and does it's job pretty well
 
you said it's :fu:
 
chrome extension :P
 
@Neoares you know those are just unicode characters right?
 
@KendallFrey uh oh, how long after I left?
 
11:29 AM
hour? hour and a half?
 
ugh
 
Y'all quick af.
 
printer failed hard on that last print
 
not sure how much happened after i left
@KamilSolecki endgame gear :)
 
did you guys play Terraria together yesterday?
 
11:30 AM
@rlemon watcha printing this time?
 
@GNi33 you got it
 
Another fang
 
@KendallFrey :sobs:
 
@GNi33 yes
he just said "this emoji is :fu:"
idk what does he mean by :fu:
so it seems it is an extension
 
😢
 
11:32 AM
🖕
 
@KamilSolecki owned
 
🖕
 
@KamilSolecki at some point you need to play through the whole thing in singleplayer with no help
 
:middle_finger:
 
11:32 AM
@MadaraUchiha ugh cheater!
 
fuck this shit xD
 
@KendallFrey I am, actually. With my second character.
 
ah nice
 
🖕
 
finished skelly yesterday, opened up dungeon
 
11:33 AM
ez
 
@KendallFrey Terraria?
 
ping me when you play next time, would be cool to give terraria another spin
 
But Terraria isn't really fun in single player mode :(
 
yes it is
more fun than MP
 
I played almost only single-player
once I started a new game, joined a server, and some random ppl gave me the most powerful weapons in the game
 
11:33 AM
@Neoares because you have no friends
 
@KendallFrey Is that so? It wasn't last I tried, which, admittedly, is measured in years.
 
and I was like.. ok? game over?
 
Next time we should do the old one's army (the tower defense)
 
@Ikari that's the point of terraria and minecraft
we could do a terraria server
question: does my dynamic IP change if I don't reset the router?
 
The best MP game is borderlands 2 imo
 
11:35 AM
@Neoares It could, yes
 
fak :/
 
anyways, I'm going to do some OW comp, if anyone wants to join in, feel free :D
 
can't
 
would yall be ever be up for some Borderlands 2? cc @ssube @rlemon @KendallFrey @Luggage @everyoneelse
 
I know nothing about it other than the name and logo
 
11:37 AM
are you serious
dude
its like, the best adventure, ever.
 
same
 
same here
the guy aiming to his face
 
Easily my top 3 game
 
best adventure game is harry potter and the philosopher stone
 
no
bah
maybe ben is interested in a lego variant of it.
 
11:38 AM
I'm joking
 
The loot, the immersion, the climate of Borderlands is incomparable.
 
best adventure game is the last Zelda, probably
btw someone here is a Super Smash Bros fan?
 
I don't think I have time to learn a new game
 
I didn't mean 'adventure' as a game genre. I meant adventure as an experience.
 
I am going to play FO4 again soon. Some new mods to add :3
 
11:39 AM
Reading you guys talk about games is quite an adventure as well
 
I need a couple days to finish Factorio, and KSP expansion comes out in 5 days
 
good morning!
 
oh oliver. I saw a tropico 5 complete edition for sale. Thought to tease you with it :P
 
You can finish factorio?
If it's not a sandbox game, I might play it
 
Also ugh, I cannot seem to find Eccentric anomaly values for planets in KSP. Only Mean anomaly
 
11:43 AM
wait shit i forgot the date, it's releasing today
 
now I gotta calculate the stupid series
@KendallFrey what is?
 
KSP Making History expansion pack
 
ah 1.4
oh wait no
its something different
its a DLC
 
@Cereal You can play it in a bunch of styles, but the regular one is to defend your base from occasional animal attacks while researching the tech tree and then launching a rocket
It's pretty sandboxy even like that
 
Are we talking about factorio or rimworld
 
11:45 AM
But I prefer even more sandboxy by playing without animal attacks
@Cereal factorio
 
guys how would you do a password change feature? These are the options I've come up with:
1. send the passwords over as plain text, encrypt in backend, and store. Looks good because it's encripted server-side, but it can still be intercepted with pretty simple attacks, like MitM.
2. Salt password before sending, still encrypt in the server. Adds some obfuscation but can still retrieved if the attacker has access to the client I think?
3. Encrypt in client, send to server, decrypt and encrypt using different method. Adds confusion in the middle?
 
but like rimworld, you can just choose to play forever
it's kinda pointless to have a factory with nothing to produce though
 
@HéctorÁlvarez send them a link with a token in the url, get them to set a new password with said link. Send the new password + token, use the token to validate who's doing it/expiry/whatever
 
@KendallFrey Ever played Death World Factorio?
 
no oh hell no
 
11:47 AM
:D
 
@HéctorÁlvarez Use the same way as a normal sign-in, send the passwords plaintext over https
also, passwords should not be encrypted but hashed
 
@KendallFrey you know plenty about orbital mechanics. Do you know if there are equations for true anomaly, knowing the mean anomaly but not the eccentric anomaly?
and I dont want to calculate the eccentric anomaly
 
@HéctorÁlvarez Use TLS, first and foremost.
 
@Cereal No, that's password recovery. I do that exactly for password recovery with a custom token all the that stuff. This use case implies the user has logged in the system successfully.
 
Second, hashing on the client is meaningless, it just means that the hash is now the password the attacker needs to find
The usual gist is like this
 
11:50 AM
@MadaraUchiha I could hash a second time afterwards using a different method
 
@HéctorÁlvarez Then it's meaningless
 
@KamilSolecki I... think so according to wiki
 
last chance to look at me hector
 
Wait, are we talking about "I forgot my password" kind of change password, or "I've logged in and want to change my password"?
 
@MadaraUchiha The latter.
 
11:51 AM
@HéctorÁlvarez There are two general ways
 
dat moment when there are 4 doomfists in a deathmatch ffa, and three tracers; and you switch to junkrat to get a pentuple kill in a bomb + mine combo XD
 
One involves sending a magic link to the user's email or other form of second authentication
 
The first one is more a password recovery than a password change. Even if the mechanism implies setting a new one (or I believe so).
 
Clicking the link, which contains a token (we'll discuss specifics later), allows for a one time, time limited, password change.
The second, is allowing the user to change the password from their profile page or some similar thing
Without extra authentication
 
the latter usually comes with session revalidation
 
11:53 AM
A middle ground is requiring a normal re-authentication to be able change the password
That ^^
 
just to secure the account from, say, people changing your pword on the computers you left yourself logged in.
 
You can't change the password off of a "remember me" cookie or off a session, you have to enter your password again at lease once.
As for the details themselves
 
@MadaraUchiha Exactly. I've already coded the first one, this is about the 2nd one, and I don't believe in client-side security at all, I usually delegate that task to my webAPI and make sure every input comes from the body, gets sanitized and is safe to run before starting to do anything. But then again, I know nothing about client-side stuff.
 
1. Use TLS
2. Don't hash on the client, it's meaningless.
3. Hash on the server, with a good hash and a strong cost parameter.
The hard part is making sure the user is allowed to POST to /changepassword
If you're past that part (either via second re-authentication, or via secret token sent to the user's email), changing the password is just a matter of hashing the new password on the server, and replacing the old hash with the new one.
 
If I was making the whole design I would go with SHA-256 password hashes, but the project manager has stated we will be using MD5 hiss
 
11:56 AM
@HéctorÁlvarez Use neither.
The project manager is a moron, and users might sue you for using MD5 as a hash.
 
@MadaraUchiha what would you use then, a custom algorythm?
 
@HéctorÁlvarez HELL NO
 
@MadaraUchiha
 
never use custom algorithms for security
NEVER.
 
Rule #1: NEVER implement your own algos
Use bcrypt
With a good cost parameter
 
11:57 AM
Being able to to a cost parameter is important
 
The secret token, by the way, is as good as a password to an attacker, so it should be hashed and guarded the same way.
 
I know MD5 is retarded, easy to break like WEP in wifi networks, but they have that in their specification and I've tried to talk them out of it, I got scolded in return, and they don't pay me enough to care about that myself.
 
SHA and MD5 hashes are designed for insecure hashes, like download verification. They're too fast.
 
The reason why, is that popular hashing algorithms are tested. You know what to expect from them. When it comes to custom algos, you have not the slightest idea.
 
@MadaraUchiha Give me a moment to read a bit about that, IDK what that is.
 
11:58 AM
@HéctorÁlvarez Why does anyone else cares how you hash your passwords?
That's an entirely internal detail that shouldn't be of interest to any of your partners or customers.
 
except
 
google OAuth 2.0 question: if I try to revoke an authorization with an expired code, if gives me error. Do I need to refresh the token and try again the revoke? what if I don't have refresh token?
 
2 mins ago, by Madara Uchiha
The project manager is a moron, and users might sue you for using MD5 as a hash.
 
@KendallFrey Yeah, if I discovered that details I cared about were stored in plain text or MD5, I'd consider suing. I actually have a shot at winning too, depending on the country.
 
@MadaraUchiha I told them MD5 is the oldest tric in the book, but they wouldn't listen. Too busy implementing NHibernate and forbidding Linq queries
 

« first day (2705 days earlier)      last day (2258 days later) »