« first day (3590 days earlier)      last day (1341 days later) » 

3:50 AM
cbg, can anyone tell me how the following works? I dont get it
>>> from passlib.hash import sha256_crypt
>>> password = sha256_crypt.encrypt("password")
>>> password2 = sha256_crypt.encrypt("password")
>>> password==password2
False
>>> (sha256_crypt.verify("password", password))
True
>>> (sha256_crypt.verify("password", password2))
True
if password and password2 are different, then how are they verifying successfully?
I am planning to use hash in my flask app db, so I needed to understand this
 
4:28 AM
@python_learner ...because they're both the hash of the string "password"? It does, contrary to what I understand about sha256, seem to produce a different hash for the identical string each time I do it. It's not that it's a different string object (I tried a string variable).
It's probably throwing in some kind of random/variable salt into the algorithm? Such that the algorithm produces a different hash each run, but will verify the correct string?
 
yeah I think it had something to with the salt, I was not sure how it verified, does it try all salt combinations or something?
I will end up saving these hashes in a table, so login will work the way it should if it is verified, I was just not sure how it happened
 
4:40 AM
@python_learner I've no idea. I presume (given my very rudimentary knowledge of these things) that it's using some randomness to salt the algorithm. I don't know what math is involved in the sha256 algorithm, but it's plausible that a string verifies against several hashes, much like 3 is a factor of 3, 6, 9, 12, 15 etc.
Why don't you just use python stdlib rather than a 3rd party package?
 
that makes sense, thanks! I didnt know python has a stdlib for this, I was just following a standalone hash tutorial, I also saw werkzeug.security
 
@python_learner I don't know the precise packages, but I know python has crypt: docs.python.org/3/library/crypt.html
 
I will see if these suit my needs
 
hashlib doesn't seem to have the issue you're seeing, but it does require passing a bytes string, so you have to decode/encode strings:
 a= hashlib.sha256(b'password').digest()
 b= hashlib.sha256(b'password').digest()
 a
b"^\x88H\x98\xda(\x04qQ\xd0\xe5o\x8d\xc6)'s`=\rj\xab\xbd\xd6*\x11\xefr\x1d\x15B\xd8"
 b
b"^\x88H\x98\xda(\x04qQ\xd0\xe5o\x8d\xc6)'s`=\rj\xab\xbd\xd6*\x11\xefr\x1d\x15B\xd8"
 
that wont be a problem, I wouldnt really call it an issue tbh, its just I lack some understanding so I cant figure out why it works
 
 
3 hours later…
7:53 AM
@python_learner the password will be stored in the db along with the salt used to generate the hash
 
whoever is using kubernetes: github.com/lensapp/lens
pretty cool
 
So yes, the issue you're seeing is that a random salt is added each time but the salt can be stored in plain sight along with the hash
 
8:09 AM
@toonarmycaptain isn't hashlib the "roll your own crypto" which one should never do?
I'd be careful handing out crypto advice with "very rudimentary knowledge of these things" (I know even less about the subject)
 
Speaking of passwords, I like how pgAdmin for postgres tells me that my password is wrong on the first submission every single time. I like to think of it as an added layer of security
@python_learner I use from werkzeug.security import check_password_hash, generate_password_hash for password hashing. You'll get something like pbkdf2:sha256:50000$t8eIOKts$902feab95d7255c22575b046ddb84aace4fef100f786d6c83747eec9a4bc44f2 where 50000 is the number of iterations and t8eIOKts is the salt
 
8:32 AM
@roganjosh thanks for clearing that up
also not sure if you mean pgAdmin as a joke or not, but if it is true it is a clever way
 
I meant as a joke. I was trying to get you an example of the hash and every single time I fire it up, I have to enter the password twice. It's pretty lousy as a security "feature", it's just a bug :P
 
ahh, too bad :p
 
Over 50% of the users of my dashboard have forgotten their own password and are now on 1234 or use other people's accounts. Thankfully it really doesn't matter too much - the worst they can do is tell me a machine is running another product and it'd mess up my shiny progress bars until I just reset them. But it's an interesting insight into user behaviour - get a "password reset" feature in early :)
And one more sophisticated than just setting the password to 1234 :P
 
@roganjosh Security through aggravation
 
A promising field of research :P
 
8:44 AM
is it bad design if I plan to have a db.PickleType that stores an encrypted ssh (username,password) tuples?
all the SO answers suggest its not the way but I just want to have some username and passwords associated with an user
 
Why would you do that?
I'm also not sure what SSH has to do with a Flask app
 
its for a college course assessment, so when a user logs into my flask app he or she can run any command he or she has access to (the list of tuples), I use paramiko to ssh and execute the command
that is not the probelm though, I just want a way to associate users and the systems where they can ssh, I am aware someone can do rm -rf but its not a problem
 
Storing tuples in a database is a bad idea when you can just store them in separate columns
@python_learner look into database normalization for a quick overview. Access permissions are stored in a separate table (you'd probably have a one-to-many relationship). Storing the data as a tuple is a bad design for sure
 
ahh the foreign key concept?
I will look into that, thanks for the suggestion
 
cool kidz use nosql
use nosql
 
8:53 AM
ugh
@python_learner yes, exactly that
 
I have a lot to read up on then
 
@khajvah I'm assuming this is a joke but if it's not, please back it up because it's not useful to give misdirection like that to people that are earnestly learning
 
I think its a joke
 
it sure is
 
"cool kidz"
 
8:56 AM
Sure, but you'd be surprised how people can read things in chat sometimes
 
I am conservative, so I wouldn't even try to diss years(decades?) of R&D in relational dbs
 
emojis could make things clear, :p or something
 
You'll also need to think about how you're going to enforce these permissions btw. The user logs in, fine, then what?
 
then there is a text box for the linux command, there are radio buttons down which are populated from the ip's in "list of tuples (ip,username,password)", so you select the ip and submit buttons runs the command using paramiko and display the output
I have this part working, though now I have to change the list of tuples part
there might be systems like this in place, the professor wants us to learn flask while we do this in case anyone is wondering if I am reinventing the wheel
 
9:12 AM
I don't think you're reinventing the wheel, I'm just curious how developed you want/need the app to be :) You said "college" which in the UK implies 16-18 year olds, while I suspect it's what we would call University
 
bachelors program, if that makes it clear, after high school
as for how developed, there is a grading scale, in simple terms no obvious design flaws gets you 80% of the marks, the remaining is ui and others
 
 
1 hour later…
11:10 AM
@NicolasGervais it really isn't worth poking around with questions that old. It's already been closed several times
@ologn13 welcome :) Please note the room rules that ask that you wait at least 48 hours before bringing a question from the main site to chat
 
user1663386
(y)
 
1:57 PM
I can't remember if flagging a newish-account's post as spam aids in them getting question-banned any quicker than just closing
It'll be roomba'd, I just wonder whether it's worth also raising a flag or whether that's more strain on mods. It's not actively harmful, just garbage
@KamalMuradov hello :) Please be mindful of the room rules in regards to bringing questions from main into chat (you should wait 48 hours)
 
2:13 PM
@roganjosh OKay, sorry
 
2:24 PM
I should use state machines more.
If your program doesn't contain a state machine, how can you even be sure it's turing complete?
 
From wiki: "Simple examples are vending machines, which dispense products when the proper combination of coins is deposited". Lies; where does elbow-barging factor into that to get the kitkat precariously balanced on the edge of the dispenser?
 
A precariously balanced kitkat might look as though you have a chance of it falling in your favor, but since state machines are deterministic, it will stay stuck 100% of the time
 
But it took my money!
 
I recommend investing in a glass cutter's kit, it will pay for itself after only a few thousand kitkats
 
2:40 PM
I'm almost certain there's a blog post about how whacking things with hammers is actually proven effective to make them work, but I'm in an undecided state as to whether I can be bothered to search for it
 
Huh, leaking trade secrets
It's quite a big loophole. They could learn from ATM's and immediately explode with indelible ink. Gobstoppers would be hard to shift on the black market then
 
@Kevin The legend of the Gordian Candy Machine (where Alexander the Great wanted some bubble gum but had only bills and no change).
 
Only with an unlimited supply of bubblegum could Alexander the Great have kicked as much ass as he did
 
2:55 PM
Film and TV has taught me that all the best guys in the military need to be aggressively chewing, so it's probably true
 
 
1 hour later…
4:05 PM
Link header pagination is the shiznit!
 
4:32 PM
yeah, that much code is better left in a code paste site
 
5:46 PM
@AndrasDeak Fair enough. Wasn't trying to hand out advice, merely trying to shed light on what @python_learner was seeing, and that I didn't see the same thing with hashlib's sha256 implementation. >>>I should not be relied upon for production security advice.<<<
 
@toonarmycaptain if you want things to be extra secure, it's best to copy/paste from SO where it's been ultra-vetted :P
 
6:11 PM
Still salty about the time I needed crypto and there were exactly zero pre-existing solutions for what I was trying to do
And since you should never roll your own, I just gave up on the project...
 
it's not like you to accept something like that at face value
 
6:24 PM
crypto doesn't light my fire because there are too many unknown unknowns
You could spend your entire life inventing SHA-4 and the feds crack it the next day
Compare to, say, proving a mathematical theorem, which can't be unproved by your nemesis no matter how many beowulf clusters he has
 
Even with the libraries implemented, I still have a level of discomfort because I don't properly understand how it works so it's in their hands, not mine :/
 
@roganjosh I'm pretty sure there was some study /paper/article showing that there were tons of badness in SO answers
 
6:39 PM
@WayneWerner I guess my sarcasm didn't translate well, sorry :/
 
What's next, a study about the color of the sky?
One look and you know
 
In a single day, I've pulled someone over how their comment might be read out of context, and then done exactly the same. Ouch.
 
 
1 hour later…
7:51 PM
@roganjosh Naw, you cut and paste from SO into google, pick the 3rd git repo in search results that has less than contributors + commits + stars + forks < 10, then you copy only 3 of every 4 lines.
 
yo guys, howdy
I'm having a really hard time trying to convert values from a orderedDict to an array, and having consistent orders in the array
It's an OrderedDict containing multiple nested dictionaries inside it, but seems like those values are ordered aswell when I print them out.
 
Ok, and presumably we have an MCVE forthcoming
 
I thought you might have some idea on why it would be happening even without an mcve
 
Magic and witches
 
cause the mcve is somewhat hard to create
I'll do it if it's needed anyhow
:P
 
8:05 PM
@PedroSpinola dicts are ordered as of python 3.7 (and cpython 3.6 as an implementation detail)
note sure why values happening to be ordered is "a hard time trying to convert"
A dict inside an ordereddict is just a dict, you can't expect anything.
If you want consistent (well-defined!) order, make one. Sort the keys/values in an unambiguous way when you convert.
Dicts being ordered only means insertion order, which is not what you usually want to rely on when converting to an array.
for anything more than this we do need the MCVE
 
that's very helpful knowiing about py 3.7 Andras, I appreciate!
I'm trying a workaround here but if it doesn't work I'll need to write the mcve.
Thanks fellas =D
 
8:37 PM
I think I solved it. I have taken "ordered" for "sorted", but I see now it's two different things. The dictionary was sorted most of times when created, but there were exceptions that were putting everything off.
 
8:51 PM
Nothing like a blue screen that occurs exactly as you press ctrl-S on a document you've been writing for thirty minutes
 
that's why I only use notepad++ and sublime both with very intensive backup routines :P
 
9:42 PM
Good old Wing IDE restores files-in-edit after a crash. It's saved my bacon a couple of times.
 
10:22 PM
@roganjosh /s helps :P
 

« first day (3590 days earlier)      last day (1341 days later) »