« first day (3142 days earlier)      last day (2023 days later) » 
00:00 - 11:0011:00 - 00:00

11:00
!!sandbox
@CaptainSquirrel Please go and play in the Sandbox
11:32
Thanks my dear rodent.
> You have been invited to join the trash can.
Yeah, not even the friendly bin.
> Promoted to unemployed
Sounds similar
(I didnt get an invite tho)
I am now at the stage of hating myself
after eating an entire pizza to myself
11:43
what is an open source project that is simple and one can learn from and contribute to?
TBH, I personally wouldn't contribute to one
Just think of a thing you want to do
and do it
Librelancer!
It was awesome in 2003, and it's gonna be awesome again!
@CaptainSquirrel CENSORSHIP!
DO SOMETHING
squirrels rise up!
11:58
DO NOTHING
o7 o7 o7 o7 o7 o7 o7 o7 o7 o7 o7 o7 o7 o7 o7 o7
DO A LITTLE BIT
WRITE IN ALL CAPS
Got this song stuck in my head:
@mshwf A dysfunctional project
@Squirrelkiller They did that remaster already, it's called Elite: Dangerous
I'll have to try that
WHile waiting for star citizen
@CaptainSquirrel I want to learn from a code I don't write
12:03
@HéctorÁlvarez elitedangerous.com
I like how in evry "secition" they have the "buy" option
@mshwf You can literally read any guide, blog, or whatever for that purpose.
And then the steam link doesnt even work :<
All you need for this game is a Saitek X52 stick or better, and a 4k screen
@HéctorÁlvarez curved screeen*
12:05
actually, use VR, it has awesome integration
I tried Lenovo Explore and the game's gorgeous, can't imagine how beautiful it'd look like in Vive
Actually, is the US blacklist on HTC going to make Vive drop in price?
Who knows
I can't afford VR cuz of kids and time and such ^^
The answer is no, becuase the blacklist is on Huawei
It was a trick question.
squeeks in spanish
@Squirrelkiller kidding? 🤯 This need a master degree in CS
@KendallFrey wat
12:13
DIGGY DIGGY
HOLE
Argh
I used to like Yogscast back when I was a wee little boi
hi
is there a way to use the if else ladder without storing the return type
if(doprocess()==1)
{
}
else if(doprocess()==2)
{
}
you mean terary? return codition? returnTrueValue : returnFalseValue;
here doprocess is called twice
12:28
switch(doprocess())
{
    case 1: /* blurk */
}
int x=doprocess(); can used to reduce the call
is there a way to get around this without using a variable to store the return value
@techno read my answer above :D
ohkay
:)
i just wrote some code to get some stuff done
now there is some interest in learning to code better
25 minutes
and i go home from this job for the final time
12:35
@CaptainSquirrel go now
I cannot
gotta have neutral flexi
actually
15 minutes
@CaptainSquirrel screw that
no1 gonne kill for for 10 mins
especially if you are just dicking around the last mins anways
My boss also isn't here
and he said i canne leave until he is back lmao
I mean, if you can't leave but work time is over, you can still do private stuff
But why can't you leave?
12:45
Prolly cuz boss needs him to do some shoe polish work
You should just leave and next day tell him "I could leave, next time use may instead of can"
Maybe he's locked up
@CaptainSquirrel are you quitting your job?
@Default Handed my notice in 3 months ago, got another job lined up that i start on the 3rd of next month
congrats!
12:52
nice!
then why do you care about 15 minutes?
because he can say he did his duty until the very end
you can't say that if you leave 5 minutes early
You could if you've worked longer the day before
well almost as important is not wanting anyone to think you didn't do your duty until the very end
Shouldn't we create parameter-less classes and move initialization process to instance methods, so DI becomes easier and doable?
12:55
plus it's literally like a few minutes longer
I want to see my boss before i leave
@mshwf And go all java? Nah.
I've worked with him here for 2 years
and then a year and a half at his own company
so
He was the first guy to ever hire me into the IT industry so i want to say bye to him before i leave
IF HE COMES BACK IN TIME
here he is now :D
@Squirrelkiller why not?
Does it makes DI easier and create other problems?
What's the problem with DI in C#?
Just use Unity containers or whatever
ah well whatever
I'm getting out of here
have a nice weekend
13:04
You too Hector, cya!
@mshwf constructors should contain full parameters for the state and services of your class
making the class possibly immutable
@CaptainSquirrel Give a proper goodbye to everyone you worked with, that's important
DI should understand how to pass arguments to a class constructor
You may never see these people again, but if you do, you certainly don't want to be remembered as that guy
Make sure to understand composition and aggregation
13:16
Question about password hashing. It's best practice to create a different salt for every user and store both the salt and the hashed password in the DB record?
what we use is Argon2, which poops out one serialized set of all information of your password required to validate text against the hash
different salts is definitely a must have
@Hypersapien different users, probably not unless you have thousands of users
though might be worth using a different salt for different installations (cracking the salt for one installation doesn't compromise the others)
you wouldn't probably save the salt together with the hashed password
you're supposed to use one-way hashing on a password and save that (so anyone seeing the hash can't recover the password)
to check if a password is correct, you perform one-way hashing on it and confront it with what you saved in the database
we use a different salt per password
(so multiple salts per user, one for every time they change their password)
is there a reason behind that?
@Neil different installations?
13:29
@Hypersapien yeah.. as in you install the software and separate machines
This is for a web site.
@Neil habit?
habit.
Or rather, web sites will use this user data. There will be installed software that uses it too.
it means anyone with access to the database would see both the salt and the password hash
@Hypersapien well in that context, different salt for each different company
The web site won't even have direct access to the database. Only an internal webserver does
webservICE
Only that webservice would be dealing with the hashing and salts at all
13:33
@Neil im not really sure how it works, but its a commonly accepted approach
Time to go home, have a nice weekend everyone! Bye
I just got in
<-- US East coast
@Wietlol hmm, so it would seem
someone even suggested to use a site-wide secret to add to the individual salt so that should the database be compromised, they still aren't any closer to knowing the passwords of everyone without that secret
@Squirrelkiller u3
hash(hash(salt + secret) + password)
13:38
i thought the salt was introduced so that you cant make a rainbow table for your entire database
@Neil Can you elaborate?
instead, you would have to create a rainbow table for each salt
@Hypersapien you generate a salt for each password and save that
but you also use a secret that you apply to all the salts before hashing the password
so salt alone isn't enough.. you have to know the salt and the secret
the secret is just one.. the salt is for each password
13:40
Some random string?
you wouldn't save the secret in the database
That all the logins have in common?
Ok
the salt would be generated
but the secret can be a word or phrase
Put the secret in web.config or something?
in fact might be better so you don't forget
yeah, just somewhere where it won't likely be compromised
if a hacker got hold of the database, he wouldn't have access to the secret
13:42
Right
access to the server itself should be fairly secure
concatenate the salt and the secret, hash the result. Concatenate the password with that hash and hash that concatenation?
None of the websites or software that use this system have direct access to the database.
@Neil i cant find anything about a secret
only salt and the passwordText
30
Q: Do I need a "random salt" once per password or only once per database?

barfoonFurther to my previous question about salted passwords in PHP/MySQL, I have another question regarding salts. When someone says "use a random salt" to pre/append to a password, does this mean: Creating a static a 1 time randomly generated string of characters, or Creating a string of characte...

hmm...
i guess it sort of makes sense
but i would have to understand how argon2 works
and if there is one thing I learned in software engineering, it is that you dont try to understand how cryptography and security works and be thankful for the people that made the system you use
13:53
well I'm by no means a security expert
there's a whole field where you learn about that sort of thing as vast as being a database administrator
like anything, the rabbit hole runs deep
How would logging in work, though? You'd have to run that hash with every salt in the table.
logging?
Yeah, when a person enters their username and password. How do you find out which user record is theirs?
by looking up their username
Fuck. Duh
14:02
@Neil I am a security expert
step 1: delegate
step 2: obscure the delegation
security++
someone has to be the expert. It's not enough to delegate :P
i suppose sarcasm wasnt obvious enough
picked up on the sarcasm afterwards
:)
the same as dealing with timezones and date/time
or language
i am happy someone else has made something I can use so my stuff works
for everything else... I'd probably make it all myself
if someone wanted me to deal with hashing and security, first thing I'd do is suggest for them to find someone else
14:08
hmm... that also works
but I'm still probably more qualified than many, if only because I think unlike other things, you can screw up security and nobody would be the wiser
knowing how you can screw up is definitely important
> A plan is not to get things done, but to understand where you failed.
- My teacher
I'm happy to implement hashing, as long as I can use someone else's algorithm
I'm getting this error in a WPF app. Project-level conditional compilation constant 'DEBUG ^^ ^^ TRACE' is not valid: Character is not valid. I recently switched to a new computer have been getting it ever since I pulled it down from the TF server
It says that the file it's happening in is "vbc", which doesn't exist. Apparently that's a Visual Basic thing, which I'm not even using.
 
1 hour later…
15:21
That's true; vbc stands for Visual Basic Thing
Hello. The first link in stackoverflow.com/tags/ssrs-2008-r2/info is redirecting from SQL Server 2008 Reporting Services to the webpage of SQL Server 2017. Is there any better link for the 2008 edition?
Have you tried Google?
15:40
@Neil You said hash(hash(salt + secret) + password) above. I'm using Rfc2898DeriveBytes() which requires a salt and the thing you're hashing. Would that be Rfc(Rfc(secret + salt, salt) + password, salt)?
the double hash is probably unnecessary
What would you recommend?
8
A: MD5, password hashing and salt position

Kendall FreyFirst question: The position of the salt has no impact on the security of a particular hash. A good hash function has perfect entropy, in that for every input bit that changes, each output bit has a 50% chance of changing. Any possible security benefit from a certain order would be entirely fro...

Rfc(password + secret + salt, salt)?
well
probably (password, secret + salt)
15:43
then store it in the database as hash + salt, since the string lengths are going to be constant?
Normally (without a secret) you store it as work factor, salt, hash
(work factor = iteration count in this case)
the secret obviously does not need to be stored, as it's constant
Yeah, it's going in web.config. I'm aware it shouldn't be in the database at all.
storing the work factor allows it to be non-constant
Wait, what is the work factor? I'm not familiar with that term.
basically how long to run the hash for
slow hashes are important for security
15:47
Oh! The iterations
2 mins ago, by Kendall Frey
(work factor = iteration count in this case)
Oh. Fuck
Shouldn't the iteration be constant as well?
There's no reason it needs to be
So generate a random number within a particular range.
making it non-constant means you can increase (or decrease) as necessary
No reason to generate a random number either
salting provides enough entropy
If you're not averse to third-party code, btw, I recommend bcrypt. Its API is much simpler
15:50
Wait, I assumed that the iterations meant that Rfc2898DeriveBytes() was re-hashing the string that number of times.
kind of but not exactly
So how would I store it in the database if I am using a secret?
Or maybe I misunderstood that bit
> Normally (without a secret) you store it as work factor, salt, hash
Yeah, that's 3 values
per record
bcrypt combines them into a single string that it then parses back out later
bcrypt is basically just string Hash(string password) and bool Verify(string password, string hash)
one method for creating new passwords, one for checking existing ones
what's a good iteration value? I thought I saw 100,000 somewhere?
that depends on how long an iteration takes
I think 0.1s per hash is a decent tradeoff between performance and security
Basically, make it take as long as possible without being disruptive
16:08
I'm confused, you said there was no need to generate a random Iteration count, but you also said for it to not be constant. Where does it come from?
I didn't say it has to vary
Ok, then it's ok for it to be constant
I just mean there's no good reason to lock yourself into a specific value
so complicated
that's why I use bcrypt :)
> Convert.FromBase64String(Key + salt)
uh base64 strings do not append
16:12
I need to use a concat function?
there is no simple way to concat base64 that i'm aware of
concat the byte strings, not the base64
Actually, wait. Those aren't base64 strings
that code is pretty buggy I think
But they are in the CreateNewPasswordHash return statement
One last time, consider bcrypt
16:15
Yeah, it's off the cuff and I haven't even tried to run it yet.
I'll show bcrypt to my manager and we'll see what he says
He's pretty set on using Rfc2898DeriveBytes(). Does Bcrypt use it by any chance?
No, it uses blowfish or something
Are there any good preset libraries that do use it?
16:30
you mean besides the bcrypt library? I don't understand
> preset
oh you mean libraries that use PBKDF2?
I don't think I understand the question at all
Are there any libraries out there that are used in a similar way to bcrypt, but use Rfc2898DeriveBytes rather than blowfish?
PBKDF2 if that's what Rfc2898DeriveBytes uses
What is the reason you're going for PBKDF2? For our company, it was because it doesn't require third party code, which I guess isn't the case with you.
16:57
Like I said. My manager is really insistent I use Rfc2898DeriveBytes().
I think he was looking for a better reason than "bcuz manager"
But I don't pretend to understand the inner workings of his mind
17:15
Playtesting video games is a lot harder than playing video games.
I don't have a better reason for him than "bcuz manager". That's all I've got.
I'd be willing to use bcrypt if he hadn't said no.
I mean the reason the manager has
No idea
Some allusions to things he's read, but that's it
"reason" "manager" one of those words does not mean what you think it means.
17:30
Tell him "I am de captain now" and use bcrypt anyway
It bothers me when people refer to hashing as encrypting.
Obscuring?
When I die, I wish to be encrypted.
Definitely not hashed.
Wow
:slowclap:
 
1 hour later…
19:02
I think I worked the bugs out of that code. I never really worked that much with base 64 strings, at least not recently. But I got them figured out. Just needed to do all of the manipulations as byte arrays.
19:27
@Wietlol how every consuming class would have its unique dependency (if every class should pass different arguments to the dependency's constructor ) via a global injector?
19:47
Hey, I'm looking at some code I wrote a year+ ago, using Xamarin/C#. I just got a notification from Google that I have to build the Android version of the app to support 64-bit architecture, and I found an SO post (stackoverflow.com/questions/54537469/…) that describes how to do that.
However, I can't seem to find the Project settings menu... any idea where that might be located?
I know this is a dumb question, but VS is huge and I've looked everywhere I can think to look for it, and haven't been able to locate it.
That screenshot doesn't look like Visual Studio.
Are they using Android Studio or some VS Code plugin?
Honestly, no idea, but they both do at least imply that they're using VS
(OP and answerer, that is)
Maybe I'll ask over on the Xamarin forums, as they're likely to have a whole bunch of folks who have received a similar email to the one I got. Thanks for your time!
I don't know how people do android development, but the screenshot looks more like VS Code than big boy VS.
The font looks more like AS to me than VS, but I figure cosmetic changes like that are probably possible in VS
20:05
@KyleHumfeld Isn't it Properties> Build> Platform target ?
 
4 hours later…
23:52
posted on May 24, 2019 by Phil Haack

My head is crammed with ideas just jostling to see the light of day. I imagine them pounding the inside of my cranium screaming LET US OUT!. And in response, I say the same thing I always say. Not yet. It’s counter productive.

00:00 - 11:0011:00 - 00:00

« first day (3142 days earlier)      last day (2023 days later) »