« first day (3011 days earlier)      last day (1936 days later) » 

Wil
12:48 AM
Hi all, feeling like an idiot... I've only done a few small projects in MVC3/EF4 (I think) and they were all backend stuff where looks weren't too important.

I'm getting back in to programming, and, I feel like the whole world has evolved so much and I'm just getting lost,

I got a front end template that I have butchered up and made into layout pages and partials but, I've just linked to bower/other components directly in the wwwroot folder. I have no clue what I am really doing (but it works AND deploys!)... I've tried to run npm/bower commands without luck in VS as articles said it was
 
Wil
1:08 AM
... I've been reading docs.microsoft.com/en-us/aspnet/core/client-side/… - but, I don't have the bower menu options it suggests :/
 
 
5 hours later…
6:01 AM
@Wil Just a note, bower is pretty much deprecated in favor of npm (you can also use yarn if you prefer which also uses the npm package registry)
 
 
3 hours later…
8:38 AM
g'morning
 
V.7
8:52 AM
o/
 
9:26 AM
Mornin kids
I'm back after last week turned into a week of pain
 
@LeeButler Physical or mental anguish?
 
Mostly mental, although a bit physical Friday and Saturday
Tuesday through thursday I spent the entirety of 3 days helping our "purchasing" guys get all their shit together now the company is run by people who aren't retards (because I'm one of the longest serving office staff so I know roughly how everything works) and then the last 2 days I have been moving some bits into my new house
 
9:52 AM
yo
 
yo
Omg why is Windows 10 still so bad at dealing with DPI changes
Brb restarting pc
 
10:14 AM
Can i somehow tell the GC to collect a specific object? Like cleaning up a password string after I'm done with the plaintext?
 
V.7
yo
 
Just set that string to another value and then forget it.
 
Aaand I'm back
And yeah I think that's the best option. I'm know you can tell GC to clear up to a particular generation, but I don't think it can do an individual item. Just set the string to some garbage and you should be good
 
I dont deal with DPI thing because my monitor in office is suck.
 
My office monitors are standard DPI, but when I remote from my surface it mangles everything
 
10:23 AM
This is at the end of a method anyway so the variable is gone after that, just thought I'd give the GC a hint anyway.
 
@Squirrelkiller You could use SecureString as well
 
Not while checking if the password is long enough
 
variable is gone but not in memory
 
Yeah variable is gone and then GC will come around soon anyway, without me telling it to.
Just saying, setting the variable to another string will maybe speed it up by one GC cycle or something, which isn't enough for making extra code..
 
@Squirrelkiller But strings in C# are interned.. They won't be collected at all times, docs.microsoft.com/en-us/dotnet/api/… If you don't want a string to maintain in memory you should use SecureString
 
10:30 AM
But then I have to peel the plaintext out of the securestring and check that and then I'll have a string anyway?
I'm using securestring now, but I'm in the process of making it standard string on the top layer so I can check it for length/complexity
Instead of getting the string from a securestring and checkign that, I can jsut pass plaintext for that one layer
 
Hm, nm. Apparently you shouldn't use SecureString for new development github.com/dotnet/platform-compat/blob/master/docs/DE0001.md
 
Wait what
 
Simply just make your app dont run on un-trusted environment.
 
iDunno, do you guys trust google?
 
Basically, or compare each character in a foreach.
It all depends on how secure you are trying to make it. Timing attacks are a thing as well, so you should probably use a custom string compare that doesn't terminate as fast as possible
 
10:34 AM
It's probably gonna run on a gcp vm
 
Like all the banking app, financial app, pay services, they all blocking rooted/jb devices.
 
I'm just making an application for usage within a gaming clan, shouldn't be much of a problem. Just wanted to use the opportunity to learn how to make it right.
 
I suppose the "right way" is, at least according to Microsoft; Instead of using SecureString to protect passwords, the recommended alternative is to use an opaque handle to credentials that are stored outside of the process.
 
Some games do more than simply blocking, they delete the account if user are confirm in conduct of hacking or cheat
 
@Patrick That's all very nice when you can do that. Often, when accessing 3rd party or legacy services, that's not an option. So a SecureString is better than a plain string.
If you really want to be paranoid, have the code that uses the password run in a separate process - launch it, it decrypts the password, uses it to access some resource, returns the resource to the main app and shuts down - that should minimize the time that unencrypted passwords are in memory.
 
10:41 AM
@AvnerShahar-Kashtan Yes of course. But according to the docs SecureString still decrypts and handles the data in user space, so the timing for attack is merely reduced. It all depends on the level of trust of the machine that the application is running I suppose
 
Just don't forget that nothing is fully secure, and it's really a tossup between the effort required to get a desired level of security
Remember that and you should be good. If you've got a corporate managed internal network and a password which isn't really that important, then your security doesnt have to be that good
 
@Patrick What Lee said - security is always a matter of mitigating risks, never complete security.
 
@AvnerShahar-Kashtan Yes, I am aware of that
 
But then if your password is critical for life or a business or something, and it's running on "foreign" hardware, you'd better invest some serious time into reducing the chance that password could be exposed
 
What the quote says, quite sensibly, is that your architecture should minimize reliance on passwords and other secrets being in-memory. We've recently enabled Managed Service Identity for our Azure app which allow us to connect to other azure services (SQL and Storage) without needing any password or token in-memory. That's a good guidance.
 
11:18 AM
So...how do I transfer a password from a client to a WebAPI controller? Right now I got it as a dict<string, string> for username/password and then maybe rank or something. Would (string username, char[] password) be better in terms of having stuff cached by the framework?
 
Define "transfer". Are you trying to login to a service?
Or are you passing a blob of data to be stored by the controller?
 
Hello. Does Stackoverflow have any area/service where I can pay for C# coding work to be done? I need some help with PayPal and recurring payments. Because it's about money, I'd rather pay some one experienced to implement this work. I'd expect it's around a days worth of work (if they have experience).
Any idea where I can get this type of dev?
 
@Squirrelkiller Generally speaking, your connection to the controller should be HTTPS, so passing a sensitive string shouldn't be a problem.
@MyDaftQuestions Nope, SO hasn't gone into that niche, and probably a good thing too.
 
A good thing? How come?
 
Mixing up volunteer work with paid work is a good way to get your volunteers to stop volunteering.
 
11:30 AM
Ah
I see
Yes
 
There are other places to find coders for hire. SO's business model would probably suffer for it.
 
mr5
@MyDaftQuestions looks for freelance site
 
I am @mr5 but, I trust SO
:)
 
mr5
SO would start losing its reputation if they monetized the site like that
 
Yes, I can see why it's not simple now we're discussing it
I do think there is a difference between help with a specific problem to "do my work for me" and "let me pay" :)
But I do see your point :)
 
11:35 AM
@Avner it's the AccountController to register for and login to our clans team planning app.
And yes, it is https. I just can't pass a SecureString to the controller, so I gotta pass it somehow before converting it.
 
@Squirrelkiller In that case, you'd probably pass some sort of RegisterModel containing the password as a string. What you usually do is convert it to a regular string at the last possible moment, when passing the parameters to the POST call.
 
Compiling-Csharp-Code-at-Runtime Did this code run on Mono .NET?
With this I can load and run codes from web service without let user update the entire app!
Eval()
nyconing.backdoor
 
12:02 PM
You wanna build an applkication that dynamically downloads code from the web and executes that?
That's like, the definition of worm
There's a reason browsers like to execute everything in a sandbox
@Avner what POST call? The POST call arrives at the controller, from the client. Client doesnt exist yet. Not really. It's supposed to be a REST api. Clients are gonna be web and android.
 
Anyone used Live Share for VSCode or other live collaboration tools? We're going to an 'escape the room' coding event and wanna collab real time on the solutions. Group of 4.
 
1) Live share is awesome, although it kinda degraded to one guy being the save monkey - always saved for me when I forgot :D
2) Whats an escape the room coding event?
 
You know what escape the room is?
 
You sit in a room "oh no its locked!!!1111" "the lok is electronic!!!" "Wait I have a laptop on me, lets hack it!"
?
ya seen an escape room
 
ThoughtWorks is doing an event where you have to solve programming challenges to get the next clues to the puzzle.
 
12:06 PM
just hard to imagine with computers
 
But i figure using a live collab tool is better than 4 guys constantly pulling from git
we'd probably do it with 2x2 pair programming though.
so even a 1:1 collab tool is fine
 
live share works well with all counts. You have one pc being the host, everyone connects to that. That workspace is also the workspace. Everyone uses that. Everyone connected can work on different files at once, or the same one. Everyone has their cursor marked like in google docs.
When somebody saves, it saves that file in the workspace.
@Avner RegisterModel is a Razor thing?
Was hoping to not use any frameworks I don't really need
Website is gonna be Angular
Also the transfer is gonna be plaintext over https, can't have the client hash anything, they're not supposed to know the hash function.
And yeah, after the guards are through, at least for login I'm hashing the password as soon as possible
Wait, for registering I can also has it as soon as possible, I'm just storing the hash anyway
 
It's a bit overkill in any case. SecureString protects people who are accessing memory in your app. If someone has that level of access to your machine, youre screwed anyways.
Setting the string to ANYTHING else will eventually make it garbage collected, since strings are immutable, the old string won't be referenced anymore.
but this is all overkill
what are you using for hashing it? that's more important when it comes to security...
 
sha512
 
so... passwords should be SLOW to hash.
 
12:19 PM
I could make it do like 500 iterations, but that's also overkill for this use case
SO I just got one for now
 
PBKDF2 (similar to blowfish) has a work factor, which can increase the time much easier. I think Identity has an option to use this in .net core. But if youre doing it by hand, it's also available in System.Security.Cryptography
and force https, of course.
GPUs can do 100 million+ sha512 per second
 
I don't think there are gonna be any actual attacks here, and if there are, there's no sensitive data in there, so I'm pretty chill about this^^
Also rigth now the pw requirements are: At least 3 characters.
 
2 hours ago, by Squirrelkiller
I'm just making an application for usage within a gaming clan, shouldn't be much of a problem. Just wanted to use the opportunity to learn how to make it right.
;)
 
Damn, beating me with my own weapons. Good job.
 
12:26. Perfect time for breakfast
 
12:27 PM
From someone else, I'd agree on a sunday. From you, Lee? Don't you eat breakfast before work, or when starting?
 
I usually don't eat breakfast at all
But from last week I started eating it for lunch
Because it's cheap and easy and I don't have to leave the office
So it's more like I'm eating SUPER BERRY GRANOLA for lunch
"lunch" usually being whenever I'm hungry
 
@Squirrelkiller could also just use login with google. or a third party auth tool like Auth0 or AWS Cognito so you don't have to worry about reset password, forgot password, etc.
 
@Squirrelkiller No, not a razor thing - simply a POCO that's sent as JSON and automatically deserialized by your controller as an object.
 
My eating habits at work have been a bit wonky too, since I found the app "Too Good To Go", where you can usually get cheap stuff that would have to be thrown out anyway. But across the street there's a hotel. That hotel lets me pay 3,50€ from 10-10:30 to go and help myself on the rest of their breakfast buffet.
So I'll usually go there, get some croissant and a piece of cheese (yes, a piece. No shame in taking it when noone's gonna eat it) for breakfast, and pack the rest of the thingy they give me full of sausages I'll eat over the day.
 
Holy shit that's an amazing deal
 
12:38 PM
@drch Then I'll have a third party hard in my code though
 
3.50 for essentially unlimited hot breakfast each day would be amazing
My only option form breakfast on the way here is Mcdonalds, and that'd be like £5 for a basic meal
 
Which is the reason the waiters and front desk people there start to recognize me :D
How about making a sandwich at home before leaving
 
I barely get out of bed early enough to get here "on time" (10 minutes late)
 
!!giphy aint nobody got time for that
 
I suddenly feel so bourgeois.
 
What do you have for breakfast then
 
12:59 PM
He feels too bourgeois to tell us peasants
 
I get up, put the kids to their various kindergardens, then sit at one of my local cafes, drink coffee and eat a sandwich.
 
mr5
1:17 PM
@Squirrelkiller how do you pronounce bourgeois?
 
That's definitely wrong
 
"boor-jWAH", in the singular.
"boor-jwah-ZEE" in the plural.
 
How can there be a plural
It's an adjective
You can't pluralise an adjective
 
mr5
my teacher taught us it was "berswa"
 
1:21 PM
boor-jWAH sounds right
 
Right, right. it's not singular/plural (brain fart), it's the adjectival vs. noun form.
 
1:37 PM
Bourgeoisies
 
For fucks sake I've tried something twice today and it's spent over an hour on it and then went nah fuck ti thats dumb
Brain isn't working today
 
Today isnt working day.
 
1:55 PM
It is for me
 
 
3 hours later…
Wil
5:21 PM
@Patrick Thanks, just reading that :/ the template I used still has it, and annoyingly, the articles I was reading (even the .Net Core 2.2 stuff) still refer to it and say "right click on project, select bower..." so, I was just getting lost...
I feel so out of date here :/
 
@Wil Yeah. I mean, it's still maintained, it's just not used anymore. They even recommend programmers to not use it anymore on their front page
And the templates that go along with Visual Studio get outdated fast today :-(
 
Wil
Yeah, I read that thanks... lol, my dad did C and other stuff in uni - I was showing him how easy I can do some stuff in .net and he couldn't believe how simple some stuff was... and he went on how he felt like an antique... It's only been ~5 years since I did "serious" programming, and whilst I understand the basics still, the whole ecosystem is crazy and I just can't get my head around it... I feel like the antique now! :(
 
@Wil :D that's why I feel it's important to know the basic structures of programming and not specific details about a framework for instance. Keeping track on programming news also helps of course :)
 
V.7
5:45 PM
So, yup. The same here. Some days ago I've seen here what references are ... in C some stuff might be easier, but in C#, when it's coded correctly, it's powerful.
 
 
3 hours later…
8:55 PM
@Wil You should read this, then. To see you're not alone. :) hackernoon.com/…
 
Wil
Cool - Thanks!
Lol, using this one template I downloaded, and adding one component to it, I'm using two different versions of Jquery, Bootstrap and about 25 different bower packages... I have no bloody clue how it's all working, but, glad it is... I just don't get the front end stuff...
but, trying to learn quick!
 
I don't do a lot of front-end web stuff these days, but from what I gather, a good way to go is to pick a popular framework - say Angular or React - and focus on that, rather than trying to understand all of current web dev concepts.
Don't use the Visual Studio templates, as they're usually pretty out of date, as @Patrick mentioned. There are lots and lots of detailed tutorials out there if you look for specifics - don't look for "web app tutorial", but "angular 5 SPA tutorial".
 
Wil
Sorry if I wasn't clear... I'm sort of ok on that and understand... it's the backend toolchain I don't get... now just trying to figure out moving from bower to libman... but, every time I try to import something, I seem to break everything else! So, thinking I'll just reference the files normally and learn/worry about this later
but thanks... I do have a lot to learn still as well...
 
That's one of the things that focusing on a framework like Angular or React help with - they're not just random libraries you need to pull together and integrate, but frameworks that will usually already have a "standard" way of pulling in dependencies or managing the toolchain. It comes at a price - you now have to do things "the angular way" and have fewer choices, but fewer choices is good, at this point.
 
Wil
ha... I understand!
less choices, you just get on with work!
 
9:05 PM
hey peeps
 
Wil
Hi!
@AvnerShahar-Kashtan Lol, just read it!! ... Exactly like how I feel...
 
And things haven't changed much in hte last two years, from what I've seen.
Although, as I said, I'm not deep into that area.
 
Wil
9:22 PM
still, libman now and nuget, I'm feeling so outdated... just tried to install the AJAX addin I used to use years ago - stackoverflow.com/questions/48848181/… but even answers other people have given aren't helping me too much in understanding why they aren't showing up...
lol, I'm just feeling sorry for myself and like a dinosaur! ... I'm going to give it another few days, but, I'm thinking I'm just going to write ALL my questions down, and I know a few really good devs... I'll just try to pay for consultation for one day and see if anyone is willing to teach and answer all my questions/get me up to speed!
 
10:18 PM
I'm so glad I don't have to be a frontend dev
 
Wil
Lol, I envy you... ~1 hour and I still haven't been able to add my first package...
 
Our frontend is in Angular - quite nice once the general structure is there because if you jsut have to add a column somewhere you just copy the style around you and it works.
I have a colleague who loves Angular. Dude can talk about it all day and what packages to use and combine with what. He also recently discovered gulp.
 
Wil
gulp... I'm going to leave before I start looking in to something else! :P
 
Yeah no he showed me gulp for a few minutes and I'm never gonna touch that
Too much fuzz for not enough gain
 
@Squirrelkiller Recently discovered gulp? :P If it's an angular fellow they should be webpacking all day ^^
 
V.7
10:23 PM
Hey all
 
Honestly I have no idea what other frameworks are in there^^
 
:)
 
V.7
What would be right way?
 
Around three months ago he found Akita, so then we had a (relatively) simple state management. Setup was as annoying as that linked article suggests, but once set up it was nice and easy to use.
 
V.7
I mean, what do you think? Is it okay to have return keywords in try catch block?
Or, create a variable, and return it at the end of a method
 
10:31 PM
I'd create the variable in the beginning. Although that's not really scientifical, it's subjective. Should get more opinions.
 

« first day (3011 days earlier)      last day (1936 days later) »