« first day (3048 days earlier)      last day (2125 days later) » 
00:00 - 21:0021:00 - 00:00

00:38
stackoverflow.com/questions/54757216/… duplicate "how to get instance and a class from a method call"
01:18
off-topic/ debugging help. User resolved by upgrading to 3.x scraping giving UnicodeEncodeError in 2.x
 
5 hours later…
05:55
cbg
 
1 hour later…
07:11
@shad0w_wa1k3r (or anybody else) mind looking at my code?
rewrote it and made it much more secure, only thing is i haven't implemented my system for salting passwords yet.
Currently the salt is just 'null'
but it is going to be randomized... Not fully though, there will be randomized ones to start but they will be saved and new ones will only be made when needed. So there will never be a limit to how many people can have the same password
fairly barebones atm pastebin.com/Ub4Fu1Vw
07:39
cbg
07:54
@Arne ?
@HunterGuimont Seems quite better than the last attempt :) Good job.
@shad0w_wa1k3r Thanks, anything I could do better?
Since you're using a local file as a database, you could look into sqlite. That would make the querying & updates to db very smooth & you won't have to put up a file read inside a while True block.
You could also make a handy function to print error message along with attempt number, just so code looks even more neat.
I'll look into sql but it does say the attempt number
print(f"\n[Failed: {{ error }} [Attempt {{ num }} of {{ max_num }}]\n")
08:27
oh you mean a seperate function... Not sure how i'd go about that bcause they are all different. Could do like error(1,i) so 1 being the error type and i being the attempt
and have seperate out puts for each type
You can pass the error message to the function along with attempt number (preferably keeping 3 as a max_num default)
yeah that would work
yeah, that'd also do. The function makes it easier to read the code logic.
As well as it's easy to change the formatting if you ever need to.
Yeah thanks, im just learning
the original version of the code was very ugly, i see that now
would it be a good idea to use tkinter to make a gui for this?
@HunterGuimont happy to help :) ugly but working. the latter part is also important :) It's much more neat now.
08:32
Thanks
@HunterGuimont sure, it's upto you.
ive never used it
I like python but its weird not having a ui
especially considering spotify and instagram etc are python
Those are web frameworks though. The UI for that is very different in nature than tkinter.
is it better?
tkinter is a desktop ui right?
For web, the logic is usually split up as "frontend" (client side / browser) & "backend" (server). Whereas tkinter or other GUI interfaces are mainly desktop "applications" / apps.
@HunterGuimont not exactly, because you can't compare the two, since they are drastically different, including where & how they are used.
@HunterGuimont yep
08:36
Okay okay i think i get it
this is all pretty interesting
If you need help, you could ask around for the right "keywords" & keep googling :)
im trying to do as much as i can cause im only in highschool and i want to do computer engineering. Mind if i ask what you do?
okay thanks
I'm a full stack web developer by title.
what did you need to get to where you are now?
08:41
wow a real resume
not a website
suprising
@HunterGuimont ashishnitinpatil.com is the website, I gave a link for the PDF resume
But generally, most developers don't have a website of their own. I like the idea of it, so I do keep a website.
oh really? most ive seen do
rly like it btw
thanks, but it's mostly copied (with requested & correct attribution) :)
so minimal
i'm somewhat of a minimalist myself
i'll have to steal the idea some day hahaha
is there any reason you dont have a logo? like a more individualized one
the avatar is kinda my logo I guess
and rbrb (stepping away), I've got to go hunt for an apartment :)
08:46
alright, thanks again
good luck haha
 
2 hours later…
10:31
@ProdiptaGhosh it is a string. There is a very good reason why I didn't expand those million parentheses in this answer! — Antti Haapala 9 secs ago
Their point is it would crash before the call
You can assign it to show it doesn't (if it doesn't)
@AndrasDeak fix'd
You should tell them that
10:53
The point is, you are first evaluating an expression (the string multiplied a gazillion time, it is an expression, not a string) before you are calling literal_eval, and that string expansion has nothing to do with literal_eval whatsoever. If things go write it gets the expanded string. If it goes wrong, python crashes even before literal_eval is called. — Prodipta Ghosh 3 mins ago
@AndrasDeak ^ I did. Indians...
should I try to post it again with () * 1000000 opened?
@AnttiHaapala you didn't
@AndrasDeak yes I did
their comment refers to your original confusing comment and ambiguous code. Nothing to do with nationality
I don't see "Just to be clear, the string expands fine and the function call crashes" anywhere
@AndrasDeak I don't see "I did try running this example and here's what happen"
irrelevant :P
11:03
instead I see a half-assed attempt at reasoning what's going on and which one is going to crash and a downvote too.
They clearly misunderstood so you only have yourself to blame if you don't try clarifying. I wouldn't run code with suspected memory errors.
Too lazy to ulimit
11:54
@amcgregor @amcgregor excessive?why?
Could someone else approve an edit on stackoverflow.com/questions/54765750/…, please?
you mean reject?
the probable reason why OP didn't post it as code was because the system wouldn't let them post something with just code
12:57
Deer ate my brussel sprouts!
So no cbg for me.
oh deer
13:31
I'm sure you'll be just fine, deer. :-p
13:42
Hmm, what's the correct way to get an AST node representing a function object? I thought about doing ast.parse(inspect.getsource(f)) but that doesn't work for functions whose def has more than 0 levels of indentation.
If docs.python.org/3/library/inspect.html mentions AST objects, I can't find it with ctrl-f since I get a hundred false positives of entries getting the "last" of something
stackoverflow.com/questions/4812144/… had the same idea I did, but doesn't seem interested in granularity finer than per-file.
I guess I could parse the whole file and extract the bits I need.
Now, how to get an object representing the module of the current file...
14:23
Hmm, I'm having a surprisingly hard time coming up with an re.findall-based solution to Finding a sequence of characters in string. print(re.findall(r"(.)\1{4}", x)) matches the correct substrings, but the result is only the first captured character. r"((.)\2{4})" matches the correct substring and the first captured character separately. I could use ?: to indicate that (.) shouldn't be captured, but then I can't refer to it later.
re.findall is built to spew capturing groups though.
Yes. So I need a pattern that doesn't use capturing groups.
r".{5}" just matches any collection of five arbitrary characters, natch
You need the 1-character capturing group to exist because you're referring to it, but then you want to not actually have it show up in the results? im guessing the cleanest findall solution would be to just coerce the output list and filter it to what you want.
print([t[0] for t in re.findall(r"((.)\2{4})", x)]) works, but is conceptually unsatisfying to me
Joke answer:
import re
x = "jhg**11111**jjhgj**11111**klhhkjh111ljhjkh1111"
all_ascii = [chr(x) for x in range(255)]
pattern = "|".join(re.escape(c)+"{5}" for c in all_ascii)
print(re.findall(pattern, x))
Doesn't play nice with unicode, obviously
14:39
What about finditer?
[i.group() for i in re.finditer(r"((.)\2{4})", x)]
That's an improvement, I reckon.
I like to avoid regexen wherever possible. :/ \2 there is a repeat of the (.) capturing group, if I'm reading that right?
Yeah.
lines = open(my_file, 'r').readlines()
#if i need to take lines from STDIN
myfile=raw_input()
#how do i read raw_input() as lines
lines = myfile.readlines()
@pythonRcpp One way of getting a file-like handle on a string is to use StringIO:
C:\Users\Kevin\Desktop>py -2
Python 2.7.11 (v2.7.11:6d1b6a68f775, Dec  5 2015, 20:32:19) [MSC v.1500 32 bit (Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import StringIO
>>> myFakeFile = StringIO.StringIO(raw_input("Enter some text: "))
Enter some text: I've got a lovely bunch of coconuts
>>> print(myFakeFile.readlines())
["I've got a lovely bunch of coconuts"]
>>>
14:49
woo, coconuts!
Compatibility note: Python 3 users will need to use io.StringIO instead of StringIO.StringIO
```
from itertools import zip_longest

x = "jhg**11111**jjhgj**11111**klhhkjh111ljhjkh1111"

>>> list(zip_longest(*([iter(x)] * 5)))
[('j', 'h', 'g', '*', '*'),
('1', '1', '1', '1', '1'),
('*', '*', 'j', 'j', 'h'),
('g', 'j', '*', '*', '1'),
('1', '1', '1', '1', '*'),
('*', 'k', 'l', 'h', 'h'),
('k', 'j', 'h', '1', '1'),
('1', 'l', 'j', 'h', 'j'),
('k', 'h', '1', '1', '1'),
('1', None, None, None, None)]
```
If the OP only wants repeated character groups whose first index is divisible by five, then a pure regex solution is well and truly sunk
In a recent Q, an answerer does for c, i in enumerate(my_string):, which is exactly the opposite of the naming convention I typically use, e.g. c for characters and i for indices. But his code works, so I don't know if I should complain.
Is this now the recommended way to handle too-broad in a be-friendly way?
I haven't caught up on meta for a while
you're not missing out
I dv'd and flagged that answer, for what it's worth.
and that answer is <unwelcoming adjective>
But the better route is probably just to close and delete the question.
15:12
ok, good to know
15:26
Consider the length of the vector resulting from scipy.spatial.distance.pdist It is a flattened version of the upper triangle of an nxn distance matrix. Given that matrix dist, I wanted to calculate the number of original observations. This is the same as the length of either dimension of the distance matrix. I could use the builtin scipy function to do it scipy.spatial.distance.num_obs_y or the quadratic formula or a quick square root and math.ceil. What do you suppose is quicker?
dist = np.ones(4950)

from scipy.spatial.distance import num_obs_y
import math

%timeit num_obs_y(dist)
%timeit math.ceil((len(dist) * 2) ** .5)
%timeit int(1 + (1 + 8 * len(dist)) ** .5) // 2
derp
Is this the linear size of the matrix returned from squareform?
no, but you can get it from the array that is returned
>>> dist = np.ones(4950)
...
... from scipy.spatial.distance import num_obs_y,squareform
...
... num_obs_y(dist),squareform(dist).shape
(100, (100, 100))
no?
The latest two questions on my tag are closed as the same duplicate. :-|
so your work is done :P
15:38
@AndrasDeak can you please help me? I still haven't figured out how to fix my graphlab issue.
@AndrasDeak yes, that works just fine. I was messing around with useless optimizations and noticed that num_obs_y is pretty slow.
compared with just doing the maths myself
# num_obs_y, ceil, quad (respectively)
5.52 µs ± 39.5 ns per loop (mean ± std. dev. of 7 runs, 100000 loops each)
300 ns ± 2.63 ns per loop (mean ± std. dev. of 7 runs, 1000000 loops each)
413 ns ± 87.8 ns per loop (mean ± std. dev. of 7 runs, 1000000 loops each)
Trying to write a parse function , which prints only tracebacks and not non interesting lines, log under traceback is indented by space
i have written this codepad.org/8e9iHMDz for the below log
[Tue Apr 25 14:02:31 2017] [error] Traceback (most recent call last):
[Tue Apr 25 14:02:31 2017] [error]     File abc has interesting error
[Tue Apr 25 14:02:31 2017] [error] Some non interesting log
@MisterGeeky no
@piRSquared so when you said "no" you meant the other "no"?
Hmm; not even quite sure where to begin with my current question / effort. Now that I have a reliable mapping of Python-understood line numbers to source line numbers, I'm expecting I'll need to wrap all declared functions in a decorator that catches and adjusts exception/traceback line numbers, but my Google-fu is weak, here. (Getting nothing but "how to use exceptions in Python" type pages.)
yes... which I'll leave up the reader to decide which "yes" I meant
15:44
@AndrasDeak fair enough.
@pythonRcpp if "Traceback (most recent call last):" in line is a SyntaxError because if statements must end with a colon.
@amcgregor are you writing a debugger?
or will such a rewriting decorator only cost extra work during compile time?
Actually, I misread your statement @AndrasDeak (-:
I was under the impression that Python-understood line numbers were always the same as source line numbers. Is there a corner-case I'm not considering?
cbg \o
15:48
cbg
Not counting, like, SyntaxErrors that say the problem is on the line after the actual problematic line
You can't catch those (from within the same source file) anyway.
Bah, e.__traceback__.tb_lineno is readonly
16:06
@AndrasDeak A template engine. Adjust exception representation to match original source file being the issue involved.
my second message is really what I've been meaning to ask ;)
And I'm expecting the extra work (RLE decompression) to only occur during exceptional processing.
OK, thanks
@Kevin That makes me rather sad, and worried that what I'm attempting to do may be impossible, though surely other template engines do similar work?
don't call me Shirley
16:11
I suspect there is an "I wasn't asking"-tier solution where you force the value to be writable, but ideally we would prefer an approach that doesn't violate OSHA standards
That's difficult to pull of in the written form but I appreciate the effort @AndrasDeak
I'm getting the sensation of watermelon-bandsaw interactions (it's all easy until you lose a thumb) in my attempt to make Python do unholy things. XD
16:34
Maybe instead of changing the exception object, you could write your own traceback display logic. I wonder if the traceback module would be useful there.
Then you only need to do try: whole_program_goes_here() \n except Exception as e: print_custom_traceback(e)
implementing print_custom_traceback left as an exercise to the reader
Cabbage
@Kevin I'm not going to recreate Python 3's chained exception display logic with my own, incomplete and inferior implementation. ¬_¬
@Kevin BTW, you can use io.StringIO in Python 2.6, maybe even earlier.
16:49
cbg
@amcgregor I don't think you'd have to write your own from the ground up, if that's what you're worried about. I'm pretty sure there's some way to get a list of (filename, lineno, name, line) tuples corresponding to the real traceback, which you can then modify, and then pass to some kind of formatting method to get authentic-looking output.
traceback.extract_stack and traceback.format_list look promising. I haven't actually tried using them though.
@HunterGuimont The hashlib module has a couple of good password hashing functions. See docs.python.org/3/library/hashlib.html#key-derivation And take a look at en.wikipedia.org/wiki/Key_stretching and the linked articles like en.wikipedia.org/wiki/PBKDF2
Also, never tell the user that their username is unknown. Get the username & password, test them, and if the test fails say something like "Invalid username or password". Letting attackers test names without having to supply a password is a security hole.
5
17:14
@PM2Ring Thanks, that's what I'm using now to hash. I completely forgot about that thank you, I'll likely rewrite it again today cause I keep breaking things in my code haha
@PM2Ring I believe sites even go as far as to offer to reset a password and send phantom emails even if no username exists.
Will your password-protected database have actual users or is this just for practice?
@piRSquared Alas, at some point there will be an indiciative failure. E.g. allow them to fake-reset, but then what? Log them in under the non-account? After resetting, attempting to authenticate and having that fail gives you the answer, albeit after an additional step.
@HunterGuimont I remember seeing a generalized password hashing adapter library, its sole purpose management of password storage. Can't remember the darn name, though, and pypi searches for "password" are non-helpful. Think I found it searching for the latest hash competition winner… but OFC I can't remember that noun, either.
@HunterGuimont Rightio.
No (I think). Reset instructions go to email that supposedly is attached to account. If attacker is fishing for usernames then they assume instructions went to some email that they can't know. However, by saying that an email is sent for every reset, the attacker can't use that to discern which usernames were valid and which were not. @amcgregor
17:22
What piR^2 said.
@piRSquared Ah, yeah, that's entirely sensible: "neither confirm nor deny." Allowing recovery by e-mail address, and entering your own raises potential concerns, is what I was getting at.
@PM2Ring That'd be the one! passlib
Ah, and that was the other one, with the weird name I can never remember: yosai (says the person who names packages after Lojban gismu…)
17:37
@AndrasDeak it's just personal project, so no users really
Pretty sure it's passlib
@PM2Ring
@HunterGuimont good, good
18:02
How do you guys recommend I make my code more user friendly
I thought you weren't going to have users ;)
What do you mean by "user"? People using your database or people using your library to create a database (assuming the latter is an option)?
@HunterGuimont User-friendly code? Follow the Zen of Python! :D import this (or view online, with addendum) — readability counts, sparse is better than dense, etc., etc. Include comments that don't describe the mechanics of what is going on (the code itself does that), use comments to describe why or the overall what, and so forth.
Some of my own codebases not only have more individual tests than statements to test, but have more lines of whitespace, comments, and docstrings than statements.
"more whitespace, comments [...] than statements" might not be a good general rule of thumb though
(and "good general rule of thumb" might not be a good general use of English, but whatever)
I like to think my code is highly readable and well documented. Not entirely consistent on that, but I'm getting better! :prepares to have soul crushed by other's strong opinions on her code's ugliness: ;^P
(And I'll be the first to admit, there are obtuse things I do tend to enjoy using that make things harder to follow. E.g. the liberal application of metaclasses. I try to keep those very isolated, though.)
18:12
cbg
Here's a tiny example of using Tkinter to get a password. stackoverflow.com/a/31637169/4014959 But as I said in that answer, it's better to not display the password at all.
That's up for debate, actually.
Modern discussion seems to favour the idea of complex passwords that are immune to shoulder-surfing anyway, so masking only harms legitimate use in accurately entering those more complicated passwords.
Ref. Bruce Schneier's article, "The Pros and Cons of Password Masking"
If you do want to use Tkinter, or any other GUI library, you'll need to reorganise your code a little. Typically, GUI programs sit in a loop waiting for events to respond to, so the control flow is different to the usual command line program.
clearly, this guy hasnt seen 90% of the people i work with
:P
18:15
On the gripping hand, password fields are treated specially in more ways than just character masking. E.g. on macOS, accessibility hooks into the keyboard are disabled when currentResponder is a password field. (Similar to "secure keyboard entry" option in Terminal.)
(So, be wary of any website that offers to transform the password input into a text input to "show password" for you. That's insecure, but in way more ways than most people realize, and not typically for the reason most people think, e.g. "eyeballs can see muh passwerd".)
@amcgregor I don't see a torrent of comments (which is a good thing ;)
@amcgregor That's reasonable. I'll read the article shortly. In the days of CRT monitors, it wasn't just shoulder-surfing, since those monitor signals could be detected from a fair distance, unless you're protected by a Faraday cage. But AFAIK that's much less of an issue with modern monitors.
i opened the code, saw WSGI, and i was like... yep, this is above my paygrade.
@AndrasDeak I really try to hold myself back, only putting comments where I feel explanation is actually required for understanding, a la that last line with the done callback hook.
yup :)
18:21
@PM2Ring We've gone from Tempest attacks to cellular phone accelerometer attacks. Pro tip: don't have your phone on your desk. It can key log your keyboard.
also listening to CPU currents or something like that?
@AndrasDeak No, "listening" for physical impacts on the desk via that accelerometer data.
these sounds more like "protecting against mossad" kind of things
@amcgregor yeah I got that, but I think there was something about detecting radio signals emitted from CPUs
Low-level control over the phone's baseband (a "software-defined radio" or SDR) is highly restricted, for FCC/CRTC reasons. Totally reasonable for state actors to utilize, though, because they are the FCC. ;P Other methods of data exfiltration: connected speakers w/ ultrasonics, or even the HDD activity indicator light. (Really. On that last one: really.)
(Then there's the fun idea of using your HDDs as microphones, given they're sensitive to sound.)
m8_
m8_
Hey peps, I'm trying to add a new column to the beginning of my dataframe df['Helper'] = df['Key'].map(str) + df['ID']. Is there anyway to make it the first column in this line of code? Right now I am moving it using: df.insert(loc=idx, column='A', value='Helper)
18:32
How many peps? 8 peps. A ha ha ha ha!
m8_
m8_
lol
@m8_ that is probably the cleanest way to do it. What do you want? A one-liner?
m8_
m8_
Yeah but if that's clean enough I'm good then
df = pd.concat([df.Key.map(str).add(df.ID).rename('Helper'), df], axis=1)
but that makes me want to throw up
m8_
m8_
lol
m8_
m8_
yeah, not very easy to read
ok thanks!
@AndrasDeak I bet you can do a better Transylvannian accent than the Count from Sesame Street. ;)
Hmm, could be. ;)
19:03
@Martijin Pieters Are all new answers to questions which are community-wiki also automatically posted as commity wiki?
yes, but don't ping Martijn with that
also existing answers are also converted to community wiki
(fortunately you misspelled his name so the ping won't work anyway)
Thx, I wanted a mod to convert it back anyway. Existing answers are not affected how it seems.
That would be weird. But only mods can turn a question into community wiki. Are you sure that's what happened?
65
A: Is it possible to implement a Python for range loop without an iterator variable?

Alex MartelliYou may be looking for for _ in itertools.repeat(None, times): ... this is THE fastest way to iterate times times in Python.

I'm not sure what happened and why.
That happened in 2009. I suspect the CW dynamics were different back then. I know that after n edits posts would automatically become CW. Not sure if that applied to questions...
You can try flagging the question but I don't know if it will succeed. There are plenty of good answers there.
19:14
I flagged it, we'll see. OP made the question a wiki I just saw.
Was declined: The question is a wiki and so are all the answers. We cannot change that.
19:25
Is it bad to hash a password before salting it then hashing it again after?
Nvm I'm dumb
Indeed, I hope you realized the err in your question immediately. ;^P Salt is part of what you hash, thus can't be applied later. (If it were a suffix, sure, but salts tend to be prefixes for a reason.) Appending a salt would entirely defeat the purpose; build a rainbow table (hashes for every possible password), then to work around the salt, just "continue" hashing with different salt values from there. (Turns into, effectively, the salt itself becoming the password…)
Technically it would work fine though it would just be double hashing the actual password and if the salt is a randomly generated string then it wouldn't be any less secure
Just unnecessary
@PM2Ring I hate how common this is
19:42
I hate how common it still is for, supposedly woke (highly security-aware) institutions to do things like restrict passwords to r"[0-9]{6-9}" (credit union Mastercard) or outright e-mail you your password in the clear when requesting recovery (won't name and shame, 'cause danger, but also a financial institution).
@amcgregor yep, it's obnoxious. Also Wells Fargo passwords are case insensitive
or at least used to be
yep, still is, just checked.
@AlexanderReynolds On a related note, systems that tell you your new password is too similar to a previous password. How the yam does it know that unless it keeps all your old passwords in plaintext? I guess it could keep hashes of a bunch of substrings of your password to stop you doing pass1, pass2, pass3, etc. But that doesn't catch all forms of similarity.
yeah. yuck. unfortunately you dont even know what sites do that unless you just happen to encounter it
19:49
oh yeah yuck, jeez. thats a good point isnt it
ALSO sites that store your previous passwords. far less insecure from an infra standpoint (not hard to keep your history) but still super insecure on the front of an attacker
"you changed your password 7 months ago" is pretty damn useful information
my uni site did that, but they also made you change it every 180 days...so people that generally only use a few passwords will run through all of them on a service like that, and now an attacker could learn multiple PW histories. blah.
20:03
Restricting the length of the password is bad, but restricting the range of permitted chars is actually ok, if long passwords are permitted. Insisting on digits & special chars doesn't increase the entropy by much, its main purpose is to prevent simple passwords that could be easily generated by a dictionary attack, and that's not really a problem when passwords are salted anyway.
@PM2Ring Symbol-map, hash that, and store separate from the "current password" in a list of "all passwords ever used". Symbol-mapping to make (, [, { equivalent, for example. (Or to make 0, o, and O equivalent, 1, I, l, etc.) Any time the user changes the password, re-map and compare. Also helps to prevent use of "password" the first time, and "passw0rd" the second time → "too similar".
Eg, if the charset contains 32 chars, a 8 char password has 32^8=2^40, so 40 bits of entropy. Doubling the charset gives you 64^8, 48 bits, but increasing the password length to 10 gives you 32^10, 50 bits.
Had an example today of a client giving me e-mail credential information, password was 70% symbols, only three characters were latin letters, the rest numbers. Had quite a bit of back-and-forth with them after repeated failures, because the password began with an =. (And that didn't jive with my .env file parser, apparently.) The random, utterly impossible to memorize password: ~70 bits. An all-Latin letter password (upper and lower case) five characters longer? 160 bits.
I'll take the readable, parseable, more secure version that looks less secure, thanks? ;)
(Talking passwords to the order of thoochu0keekoat3raquohlo6eiC9Fei, here.)
@amcgregor True, and I guess if you just drop all digits, and fold case, that'd catch a lot of password recycling schemes. But I bet doing these kind of things is much less common than simply saving full plaintext passwords (or maybe encrypted passwords, but of course that's only marginally better than plaintext). Especially on workplace LANs that aren't directly connected to the Internet (but I guess there aren't lots of those these days).
Are passwords in the style of xkcd.com/936 still cool? Have hackers devised cunning ways to attack all combinations of four real words yet?
20:15
@Kevin Yep. They're still cool.
Do any of the password apps (one pass, lastpass, etc) have capability for correcthorsebatterystaple passwords?
well i know lastpass doesnt since i use it
but always wondered if others did
Nobody will ever guess my password, "password password password password"
There's many python scripts floating around to generate such passwords
@kevin thats got so much entropy tho
@Kevin It's iffy; I don't say bad, since it'll still be an improvement 90% of the time, but. For example, pick a random number between 1 and 10. Most people will intuitively respond with seven. It is the most random number in that set, as determined by popular vote.
Thinking processes often run rapidly through this: 5… that's perfectly in the middle, not random. 8… gah, even, doesn't really feel random. I know, 7!
and conversely, people that know this will probably never actually pick 7
lol
20:17
its a lucky number though :(
From the comments on that XKCD: … does "four random common words" mean "four common words chosen randomly by the user", or "four common words from a known 2048-word dictionary chosen uniformly at random using a true random number source"?
Because that's the crux of it. Human beings suck at being random. Absolutely take the chrome off.
yea. but either way if the words are unrelated, still probably pretty hard to guess
it just means you can't really analyze their entropy
the point is well made though. as long as someone doesnt have a hint at the correct answer, the bruteforce methods are basically shut down because of the size at work
Heh, here's my WiFi password: excavating 89 foot telecommunications. Two words can be OK, if they're long enough… >:D
20:20
lol
my wifi password is "AssumeACanOpener"
(My sister used the names of Mayan gods… then realized they're hard to spell after re-trying to log in the 20th time after setting them…)
just kidding, I wouldn't use PascalCase.
I have a number of FourCommonWords passwords. I semi-randomly chose them by selecting 50ish words at random from a dictionary, and choosing four that didn't look too obscure.
lol, maybe thats a good password. a common misspelling of a real word.
My homebrew dictionary module has a lot of obscure words, like "footwall" and "hypercholesterolemic" and "youngnesses"
20:23
lol what is a youngnesses
tbh I'm more worried about surveillance nowadays re: cameras looking over places where you might enter a word.
All real examples from my most recent batch of fifty. I would probably go with "flecky preunited snowy paper" for this one.
Another bias: I adhere to real sentence structure. I'm more likely to have three adjectives and a noun, than four nouns.
@AlexanderReynolds That got a chuckle out of me
@amcgregor We did a poll on the xkcd forum a few years ago to demonstrate this effect. The poll asked for the most random number between 10 & 20. "Obviously", odd numbers are more random than evens, but 15 is out because it's a nice multiple of 5, and it's the middle of the range, 11 has repeated digits, 19 is the highest odd number in the range, making it special, so the only number that feels sufficiently random is 17. IIRC, it got over 70% of the votes.
no matter which XKCD pw you end up with though, none seem to be as good as correcthorsebatterystaple tho
20:26
Oh, and 13 is special because it's unlucky. But it got a few votes anyway.
> youngness (usually uncountable, plural youngnesses) The state or qualities of being young or youthful; youth.
@PM2Ring see this is why i'm ok with a little bit of CS education being maybe mandatory in secondary education. lol
ah the "qualities" of youngness. I guess that makes sense.
@PM2Ring Reminds me of the lottery that was like: 1$ entry fee. Guess a number. Whoever is closest to the average of everyone's number wins the pot.
obligatory
i would die if i saw this in code
i'd quit on the spot
Correction: "guess a non-negative number"
If everyone was a perfect rationalist, they would observe that the best guess would be zero. In fact, several people did guess zero... None of them won. The guy that guessed 47 won.
i wouldve guessed 8.
and wouldve lost.
or i would've been the asshole that guessed grahams number or tree(3) or something.
Strategy: your accomplice guesses graham's number, and you guess graham's number divided by num_entrants. The two of you split the winnings.
i was about to suggest that!
LOL how did we get here
I am actually wearing this shirt right now: dftbarecords.tumblr.com/image/133672469085
20:35
@AlexanderReynolds Deconvolution attacks are a thing. E.g. pulling passwords/pins from phones reflected in glasses. (Reflections being the easy example. Reversing blurring of various forms, the other. E.g. "pixel / mosaic blur" is easily reversible and gaussian blurs are also reversible.
The things I learned watching tutorials on NASA image reconstruction. ^_^;
@amcgregor Indeed. I do stuff in computer vision, so I know my paranoia is not unfounded.
I recall reading an article that claimed that real-world semi-diffuse shadows could be used to reconstruct the object's exact silhouette.
maybe for a single light source
or multiple views of a scene that has multiple light sources
@Kevin With the right sensor, you can reconstruct a view of objects around a corner. >:D
otherwise seems like you'd just get some estimate that would only be valid under some many assumptions.
@amcgregor or completely around the horizon: en.wikipedia.org/wiki/Over-the-horizon_radar
20:42
I think it assumed that there was one light source and you know all of its properties.
ya, that makes more sense in that case. i <3 reconstruction.
it's so cool
@AlexanderReynolds Ye gods, OTH radar is the bane of my HAM existence (volume warning as those OTH bursts are SUPER loud). XP
OTH radar: the honey badger of radio gear. It just don't f'in care. ;P
@amcgregor lol yep, shortwave be damned when OTH is like "sup ionosphere"
"could you pass along this message for me"
Hmm, I fudged some of the details, it seems
OTOH all the research that went into OTH is what ended up giving Tesla an easy route to "bounce radar under cars"
20:45
This new paper in @nature is wild. Using algorithms, the researchers were able to reverse engineer an image based on the shadows it produced on a wall (!). More info here & link to article here: https://www.theguardian.com/science/2019/jan/23/creepy-things-ordinary-digital-camera-computational-periscopy-can-see-round-corners
still reconstruction, but ya thats way diff
He said: “I’m not especially excited by surveillance, I don’t want to be doing creepy things, but being able to see that there’s a child on the other side of a parked car, or see a little bit around the corner of an intersection could have a significant impact on safety.”
That's like the guy who invented the handgun saying "I'm not interested in killing people but this is going to make making new holes in my belt a lot easier"
an actually good approach to "child on the other side of a parked car" is: separate parking lots from roadways.
@piRSquared Uh… false equivalence, I feel, given taking pictures of shadows doesn't and isn't designed to injure people. XP
True enough. But my point is the intent of the invention is sometimes irrelevant.
20:53
@AlexanderReynolds We could always go full-Musk… only drive cars underground, below the city. ;^P
@piRSquared sometimes? probably 'always'
It will be used for surveillance regardless if person responsible for the technique thinks that's "Creepy"
"I hope my invention isn't used to do bad things" is as much a defense as "no copyright infringement intended :3" at the beginning of a full episode of Game of Thrones uploaded to youtube
In both cases, I'm thankful that you have given me this thing, but oh boy you have not indemnified yourself from the consequences of your actions
Rule 43: if it exists, someone will use it as a weapon.
@Kevin great word choice!
20:57
I try.
@piRSquared The same goes for code. Here's an example...how many times have you seen a beginner tutorial go "this isn't really the proper way to do it, but, here's a simplified example." ? I see this way too often and it physically injures me.
IDC if the intent is to "help beginners," teaching bad things is bad. end of story.
/shrinks_away_and_hopes_no_one_brings_up_examples_where_I_have_done_that
lol
TY for your snake_case, you are very considerate.
00:00 - 21:0021:00 - 00:00

« first day (3048 days earlier)      last day (2125 days later) »