« first day (4523 days earlier)      last day (430 days later) » 

1:06 AM
Phew, that was a complex edit (I finally got around to cleaning up the information I solicited about Tkinter image format support). Quite satisfied with the results, though: stackoverflow.com/a/75542859/523612
 
 
2 hours later…
3:02 AM
@PaulMcG Sounds interesting, can you post an animated GIF so people can see what the spinners look like?
 
 
2 hours later…
4:56 AM
Here is a GIF of 4 spinners: FlashingLights, RandomChars, FlashingLEDs, and standard rich spinner using "dots2".
The first 3 are from the gist I posted earlier, the fourth is defined in the rich _spinners.py file as dots2.
 
5:12 AM
I also wrote one called WanderingCompass, which "spins" by showing a single character taken from the 8 XXX BLACK ARROW Unicode characters, updating every 1/2 second. When it updates, the spinner doesn't just pick a character at random, but selects from the current character or the two adjacent to it, so that it appears to wander instead of just pointing in random directions.
I've used the RandomChars spinner when either creating a PGP key, or when appearing to be hashing some data, or some other crypto-ish thing. Of course, the characters displayed in the spinner have nothing to do with the cryptoing going on, but it looks like that scene in a movie where the computer is brute forcing a PIN or a security code or something.
As I mentioned before, the linear row of red dots looks just like the leds on the HP3000 minicomputer at my first job out of school. HP hooked these LEDs up to the address bus, so that they would flash randomly, showing you that the computer was doing important work. Completely useless for any actual troubleshooting or diagnostics.
 
 
3 hours later…
8:23 AM
@PaulMcG Do you remember the alien countdown timer from 'Predator'?
 
 
2 hours later…
10:49 AM
Yes I do - are there any Unicode characters that would pass for the Predator digits?
 
 
6 hours later…
4:53 PM
With the latest "fun" with LastPass I started wondering whether there is a point at which the potential for hash collisions exceeds the entropy of the password itself, meaning that you would get no added security by adding more characters to the password itself
I don't seem to be able to research it at all, though. I can find the max len of algorithms but not whether such a tipping point even exists. I guess I either don't know how to search this stuff or the concept doesn't even exist in a practical sense, but I can't decipher which it is
It strikes me, though, that the fact you search for the avalanche effect in your hash algorithm that it's at least somewhat decoupled from the strength of the password you choose. I could make a hashing algorithm that takes any string and gives it a "hashed" value from 1 to 9, no matter its length. Is there an official name for comparing the entropy of the input to the output?
 
Not entirely sure what you mean, but there is definitely a point where it's more efficient for an attacker to brute force the password hash rather than the password itself
 
Hmm, it seems I rubber-ducked myself into the question I was trying to ask and the answer is somewhat complex
@Aran-Fey That's pretty much what I was trying to get at. At some point, longer passwords will not avail you. I was just curious as to whether that restriction actually arises in practice
 
I doubt it. Hashes tend to be fairly long, and passwords tend to use a very small alphabet
 
5:10 PM
But, in a hypothetical example, this hash contains 10 characters. There's 0 chance of any particular 10-char string colliding with anything other than itself, but there is a non-zero probability of an equally-sized hash colliding with the hash of another string. There must be an inflexion point
The elephant in the room is obviously that the hash is, well, a hash and not the raw password, so it at least has to be discovered but still; I'm just in my whimsical world of hypotheticals about password strength where the entirety of War and Peace isn't any stronger than CorrectHorseBatteryStaple
Inflection* Quite the typo :/
 
5:25 PM
@roganjosh this is why I usually recommend using your own self hosted/offline password vault. There are a lot of existing ones that are small and secure enough that you can see how it works. I personally use password-store. It uses gpg, and has a lot of options (and you can add your own too). The official one is in bash, but there is a python wrapper: github.com/xolox/python-qpass.
If you want an easier one, I guess keepassx is good enough and work offline
note that, if keepassx is open (I know this can be done on Windows at least), it's still possible to retrieve the private key in the ram. I remember seeing some github repo and CVE about this
 
Hmm. As I see it, there are 2 variables that are relevant for password cracking: The number of unique passwords (or password hashes) and how likely it is for any given password (hash) to be the correct one. Hash collisions affect the latter - without collisions, every hash is equally likely. I would assume that modern hash functions distribute their hash collisions quite evenly though
 
@NordineLotfi I don't use a password manager and have been wary about them from the start. I've never seen how having a single point of failure would ever be beneficial for precisely this reason. If you crack my social password, you could take over my, e.g. SO account, but you wouldn't get at my email, my bank, my servers or anything else. It's actually quite a bit to keep in memory but I prefer it that way.
 
That's fair. I used to be like that too, but at some point, having to remember or keeping written note for them is a bit tedious. There are ways to mitigate "single point failure" for what you said above, but I won't try to change your mind if you prefer not using it :)
 
It feels like swings and roundabouts sometimes. The reason I know about the LastPass breach is because our head of security has posted about it. In the past he has said "Even if they put a gun to my head, I wouldn't be able to give them the AWS keys". Now he's posting about how everyone needs to think about passwordservices they use. I've been thinking about how to store connection strings for 3rd parties and have been looking at AWS KMS but all this stuff just keeps finding new ways to scare me
 
6:25 PM
Little did I know that the most time-consuming task in my project would be to make a button in an excel sheet that starts a subprocess
Me, the fool: "I should add a button here for convenience. How bad could it be?"
Narrator: "It was very bad."
 
7:10 PM
Closed
 
7:44 PM
Why is it that so many tutorials seem to teach new programmers to use globals in functions instead of just passing the values to the function as arguments? I don't get it.
 
8:18 PM
Incompetence
it's convenient until they have to change the value
I first thought you meant globals(). Just accessing global names is less bad. Question is why the names are global in the first place.
 
 
2 hours later…
10:23 PM
@PaulMcG Not that I found from googling, but see the gist 7-segment rendered via Braille Unicode ⡇̱̄⡇⠀⡇⡅̵̱̄⡃⡁̵̱̄⡇⠃̵⡇⡃̵̱̄⡅⡇̵̱̄⡅⠁̄⡇⡇̵̱̄⡇⡃̵̱̄⡇ ⠆ ⡀. See also Alien language (Enderman language substitution cipher)
...dcode.fr's list of symbols dcode.fr/symbols-ciphers should keep you going for months
(dcode.fr stuff is mostly not Unicode symbols. Enderman language symbols are ⏃⏚☊⎅⟒⎎☌⊑⟟⟊☍⌰⋔⋏⍜⌿⍾⍀⌇⏁⎍⎐⍙⌖⊬⋉)
 
11:02 PM
that encoding logic seems like a lot more code than a simple lookup would be :/
@MattDMo because otherwise they would have to actually explain how functions work up front, instead of pretending they're goto targets until all the other million ways that breaks
apparently people think flowcharts are an easier conceptual model?
BTW: today is the 20th anniversary of the timeit standard library module.
stackoverflow.com/questions/75630699 This seems to be something slightly different from the standard "my Python distribution didn't include tkinter problem. It particularly seems to be Pycharm specific, but other Q&A I found don't seem to address it head-on either. Anyone recognize the problem?
 
11:19 PM
@KarlKnechtel which part seems different? They are using linux mint, which is ubuntu-based if memory serves, which has a habit of stripping out core components from python packages.
I don't see OP acknowledging anywhere that they have the python3-tk package
 
11:53 PM
Hello, is there any tutorial about how can i make a python package and then publishing to pypi.org? The package will have a .exe file and a .py which will communicate with the .exe
 

« first day (4523 days earlier)      last day (430 days later) »