« first day (2232 days earlier)      last day (2718 days later) » 
00:00 - 14:0014:00 - 00:00

user1804599
2:00 PM
cannot cast type integer[] to record
 
user1804599
hmm
 
Ven
Time for an english test again
 
user1804599
SELECT array_agg(series) FROM generate_series(0, 10) AS series returns {0,1,2,3,4,5,6,7,8,9,10}.
 
user1804599
That's a thing you can do.
 
user1804599
And with hstore you could label the fields.
 
user1804599
2:02 PM
Yeah, SQL is statically typed.
 
user1804599
Column names and types must be known at compile time.
 
user1804599
If you want to unpack the result of crosstab, you have to name the columns and their types with AS.
 
user1804599
> SELECT * FROM crosstab('SELECT rowid, attribute, val FROM ct where rowclass = ''group1'' ORDER BY 1,2;') AS c(rowid text, att1 text, att2 text);
 
Ven
@rightfold yy
 
@Ven which reminds me; @rightfold iets om je aandacht te versnipperen onzetaal.nl/nieuws-en-dossiers/weblog/…
 
Ven
2:08 PM
@sehe Oo
 
At least, I recently found he doesn't know how duct tape is spelled
 
user1804599
@sehe oh it's that time of the year again
 
user1804599
I always enjoy it.
 
What time of what year?
 
user1804599
@sehe I do know. But note that "duck tape" is a perfectly fine alternative spelling that worked better in the pun in question.
 
user1804599
2:09 PM
@sehe Groot Dictee
 
Working with crossbar.io, reading the doc: why is there a config named « Manhole »?
 
Groot Dictee? I never follow that. I happen to follow @onzetaal
@rightfold Is it.
 
user1804599
> Op zaterdag 17 december wordt het zevenentwintigste Groot Dictee der Nederlandse taal voorgelezen.
 
user1804599
The page you linked.
 
Ah. I don't read all the intro :)
 
user1804599
2:11 PM
@sehe "Duck tape" was the original spelling, even.
 
user1804599
> Duck tape: From duck ‎(“a tightly woven fabric”), due to the make-up of the tape. The term is a trademark.
 
user1804599
> Duct tape: Possibly a corruption of duck tape due to the relative obscurity of the term duck ‎(“woven fabric”) as opposed to duck ‎(“water bird”).
 
Wow. TIL
 
user1804599
Me too. :p
 
Ven
I always say duck tape :D
 
user1804599
2:13 PM
@Ven what is your favourite way to handle reserved identifiers in Parsec?
 
Ven
wel..
"using not" would be a lie
 
user1804599
 
user1804599
So this is duck. ^
 
user1804599
> From Dutch doek
 
user1804599
lfunc
 
user1804599
 
user1804599
user image
6
 
@rightfold lol
@Abyx For once I agree with you. :)
 
3:15 PM
@Ven I read "duct tape" and it made sense that the more complicated spelling would reflect its origin ("tape to join ducts" or so). As we see, this isn't always the right logic :) (makes you wonder how the popular spelling "duct tape" got introduced. Snobs, likely :))
 
3:27 PM
@rightfold that used to be games and the last one was Dwarf Fortress.
 
@Rerito keepass2android is nice
That's what I used before.
But I don't like Dropbox so I switched to pass
Not entirely happy with it.
I don't recommend it for muggles, for sure. Keepass2android would be my recommendation.
pass is nice, but it uses the clipboard to input the passwords. Not cool.
 
user1804599
@R.MartinhoFernandes Not sure if the new profunctor lenses are easier or more difficult.
 
user1804599
@sehe because people were unfamiliar with this definition of "duck"
 
Yeah. Still
 
3:41 PM
I'm going to write a custom keyboard for pass so it inputs passwords without going via clipboard (keepass2android has that)
There's also a FF extension for KeePass (KeeFox) that automatically fills in passwords without using the clipboard and with minimal user interaction (little more than answering yes/no the first time you use a website or something like that)
I changed to pass cause it's cli and doesn't need mono on Linux
For muggles KeePass is definitely the way to go
 
@LucDanton I look forward to using this
 
4:10 PM
@R.MartinhoFernandes it's a tough call; I tend to trust passive things "under my control" a bit more than... browser extensions.
Of course it would be slightly different if I had actually written the extension myself, but still. Anything browser-integrated triggers my scepsis.
 
Anyway as long as it has a nice gui and it is using best-practices wrt crypto, that's all I ask for
 
It might not be rational, but (a) the extension mechanisms are complex and hard-to-reason about as non-expert (b) it just seems too easy to siphon away credentials when already in a browser
 
Well I don't care about the gui being nice I'm ok for a cli, but my GF obviously isn't :D
 
@Rerito I'm generally said to be a nice gui.
 
@Morwenn All the nuance is held by the generally :D
 
4:13 PM
:p
 
@Rerito I just use keepass. I have started using lastpass for the family (sharing it is a benefit, and it teaches kids to not reuse passwords). I admit use it for low-value passwords sometimes
 
The spec here is really to avoid my GF writing her passwords in plaintext somewhere
 
(Because yes, she does that)
 
maybe get a smarter gf
that also works!
think outside the box
 
4:15 PM
Drop passwords and consider that you accounts are the property of everyone.
 
Ok I'll start
Shall I begin with my bank credentials?
I know some loungers (well the one actually) are ok with sharing that kind of information ( ͡° ͜ʖ ͡°)
 
Hehe
 
What's the correct adjective to describe a "are you serious?" face?
 
Dubitative?
 
reste poli stp
 
4:17 PM
Ok, that's « dubious » in English .___.
 
@Morwenn No, more like "you must be kidding me"
 
@LucDanton see morwenn uses fancy chevrons too
you have so much in common
 
Ok I think I found it: "staggered"
Or baffled
 
Dumbfounded.
 
Oh yeah that's the one
 
4:20 PM
Best one: « flabbergasted » :D
 
You mean flaggerbasted?
 
user1804599
fappergasted
 
Or maybe you wanted to avoid @GundolfGundelfinger the burden of reading the word "flag"
@rightfold faggerbasterd
 
@rightfold fappergusted, when you're a quickie.
 
@Morwenn Or fappergasped if you're into that kind of thing
 
4:30 PM
@sehe sorry, using the clipboard doesn't beat that
The clipboard is publicly readable with minimal privileges
It's essentially broadcasting the password
@GundolfGundelfinger «guillemets»
@sehe also, if you cannot trust the browser, from a security pov it's kinda pointless without 2fa
 
@R.MartinhoFernandes The point is, it's inherently more static and less "mineable".
@R.MartinhoFernandes First, I don't see that. Second, it'll still be less straightforward to abuse for siphoning credentials, IYAM
I hope my browser doesn't get to indiscriminately use my clipboard. I should probably check on that. It's not the browser I distrust. It's the extensions
@Rerito which one
 
@sehe clipboards are public and shared by all apps with almost no privileges required.
That's true for all systems I know
 
4:46 PM
@Rerito disbelief, incredulous, unbelieving
 
If you're using the clipboard basically any process can get a hold of it.
 
@R.MartinhoFernandes I know that it used to be very hard for web pages to put something into the clipboard.
For security (also perchance by portability issues; various browser techs had various workarounds depending on the privilege settings)
 
@sehe but the point is that if you put the password there, any process can see it
It's no longer limited to the browser at that point
 
@R.MartinhoFernandes And my point is that it's probably safer to "hide in plain view" than to try and hide things via special-purpose extensions (that basically wave the flag "HERE BE SECRETS") which need to run in inherently complex-to-secure environments
 
There's no hiding because clipboard snoopers are relatively common, along with keyloggers
 
4:49 PM
@R.MartinhoFernandes I'm okay with that. For the reasons stated. Note, as well, clipboards are not shared across sessions and the password manager is free to clear them after, say, 5 seconds
 
@sehe kinda pointless because the systems provide hooks to get notifications of clipboard usage
 
@R.MartinhoFernandes Yeah well. If you think you might have keyloggers, I don't think securing the transport using a browser extension is gonna help.
Basically, we seem to disagree only about the assessment of which is more probable: security of browser extensions being compromised, or the system's security (like keyloggin/clipboard snooping)
@R.MartinhoFernandes Iff that's true and browser extensions have unfethered access to clipboards, well yeah. Then it amounts to the same things (and that would make clipboard use bad, period)
I'm not sure how keepassx does the text insertion. I suppose it uses Xtest interfaces
Then again, this is likely as broadcasty as clipboards.
 
@sehe that's my point. Clipboard use for inputting passwords requires you to trust all running processes
 
Thing is, if you are in the same session, there's an implicit trust on desktop-related IPC
I think that includes (virtual) input events
@R.MartinhoFernandes I do. My faith in it is weakened learning that processes can simply subscribe to clipboard events
 
and you then have to clear the password out of the clipboard
 
@ratchetfreak That's what keepass does (iff you use the clipboard in the first place)
 
I don't know the specific events for other systems but all relevant ones have some similar mechanism
Anyway, I'm using pass these days
Clipboard is the only oob option.
 
No clue what you mean by "pass"
 
5:05 PM
Yeah
I use hardware gpg with it
Just not happy with the transport mechanism :/
 
is that really better than keepass? just seems like a more cli orientated tool
 
@R.MartinhoFernandes It may seem that way, but it's not actually true. Mostly people configure things that way because they value convenience over security. But, with X, you can (at least theoretically) have multiple X servers running, and the clipboard is shared only between apps running under the same server. Likewise on Windows, the clipboard is shared between applications running under the same window station . Again, rarely done because it's inconvenient.
 
@R.MartinhoFernandes rightly so; I'm curious how KeepassX actually does it.
@R.MartinhoFernandes What device do you use / recommend?
@JerryCoffin Well AppVirt is frequently done in corporate environments, and amounts to this. Employees curse the separation of window stations, but it helps keeping them more security aware (you have to actively send data across, e.g. using email)
 
Wouldn't one of the few safe bets be using a program that can work as a virtual keyboard? It can 'directly' 'type' your password where you want it
 
The reasons for app/desktop virt might not have originally been security, but it's played out that way
 
5:19 PM
obviously runs the risk of anything that can read the keyboard as you types...
 
@thecoshman I'm not convinced that would be inherently more secure.
 
Well, it'd mean that the password is only exposed for a split second...
 
That's true for physical input device events...
 
if it ends up going through the kernel and then dispatched as normal...
it's not safer than normal keyboard
you'd need a way to limit who gets the events
 
I guess you probably need there be some sort of kernal level system that allows an application to say "I want to accept a password" and something else to then provide it...
 
5:23 PM
doesn't need to be a kernel level something just something that can't be mitm'd
and where the thing actually holding your passwords can get proper confirmation from the user that (s)he actually wants to give out a password to an application
 
something akin to the way linux asks for your password when you want to sudo
 
Ven
JS itself can't (or couldn't until very recently)
 
or windows when an application wants elevated privilege
 
5:41 PM
Hey, I need help with hashtable. I have coded all the functions insert,find search etc. but I am having trouble with copy, move, and operator functions
 
@Temptemp2 cool story bro
 
nwp
@Temptemp2 you know, it is not nice to ask for help, get it, ignore it and just ask again
 
@nwp I agree, it's just that a school assignment that's due tonight. I even know the problem but don't know how to solve it. anyway thanks
 
5:56 PM
@sehe Yeah--but there is the germ of a usable idea there (I think). Provide an easy way to run apps in separate window stations, and (for example) a kernel driver that acts as a filter, with (by strong preference) some predefined filter types, so a user can fairly easily run things in ways that a fairly safe.
Big difficulty is something like a browser that's basically an OS in itself, so its security profile changes entirely based on what web site you connect to (and each tab might require an entirely separate security profile).
At least in theory, this probably argues in favor of Chrome's strategy of creating a separate process for each tab. It could also argue in favor of Microsoft's old position that the browser is really part of the OS (but they never really did anything to take advantage of that supposed integration to make the user's life any better).
 
6:16 PM
:34268079 For additional isolation, transport the email via carrier pigeons.
 
And transport the pigeons using fedex.
 
@StackedCrooked Somehow, "never underestimate the bandwidth of a fedex truck full of carrier pigeons" just doesn't have the same ring to it.
 
Yeah, the pigeons are just overhead.
 
@StackedCrooked And (at least in terms of space) a whole lot of overhead at that.
 
@sehe I'm using a YubiKey NEO at the moment.
@JerryCoffin I think Wayland makes this easier, but don't quote me on that.
@sehe not entirely sure about "recommend" but I'm more happy than annoyed.
 
6:21 PM
@R.MartinhoFernandes Wouldn't be terribly surprising, at any rate.
 
My vague understanding is that this is one key motivating scenario for Wayland development, but I haven't really followed it so far.
@thecoshman that's how I used KeePass in Android
There's a keyboard that types in the password directly once I've opened the safe.
No such thing exists for pass yet
 
hello anyone here use visual studio with TFS?
 
@erotavlas This is one of those "doctor, it hurts when I do this." "Then don't do that." kinds of situations.
 
i don't get it :)
 
@erotavlas Using TFS hurts. Don't do it.
 
6:32 PM
yeah i'm kind of regretting it, maybe I should have added the project using Git integration instead
 
@sehe fwiw, I am not upgrading to a YubiKey 4 because they stopped using an open source gpg implementation
 
chat rooms are pretty empty today, is everyone black friday shopping?
 
@erotavlas nah they're just drunk
 
drunk on deals!
 
6:45 PM
First a "thanksgiving" meme now this
 
@R.MartinhoFernandes :sadface:
 
6:55 PM
@R.MartinhoFernandes Reading up a little. It seems to me that this design has a rather large drawback: it would be leaking the domains/realms you have credentials for in the filesystem.
That might be encrypted fs, but still, that's again visible to at least your session. And is easily mirrored in things like the locatedb or backups
 
user1804599
Here I am sitting in a bathrobe in cross-legged position specifying a network protocol.
 
0
Q: Making a C++ keylogger visible

Giacomo LawranceI have the following script for a keylogger I found: #include "stdafx.h" #include <iostream> #include <windows.h> #include <winuser.h> using namespace std; int Save (int key_stroke, char *file); void Stealth(); int main() { Stealth(); char i; while (1) { for(i = 8; i <= 190; i++...

/cc @Mysticial
 
@moltenlava1 @Cuellar360 @lore3440 We don't push each other where I went. And canada is whiter than America
Ouch
@rightfold Is this the nerd equivalent of a selfie?
It's gross
 
7:54 PM
@sehe Reh.
 
My goodness. I'm choosing not to amplify. Though that doesn't remove the shame
 
user1804599
8:11 PM
phi is best empty set
 
9:06 PM
I hate it when VS gives me nonsense errors I cant interpret, and GCC compiles it fine
 
9:28 PM
@sehe Due to lower average temperature there's more snow => the satellite image is gonna be whiter
 
@MooingDuck Its the Duck!!! Hello Duck!
 
@TonyTheLion allo
 
How's life?
 
Ven
hi
 
9:34 PM
@TonyTheLion 'tis most awesome
 
@MooingDuck :)
 
user1804599
9:50 PM
I think a pair should be called a twople.
 
^ I just leave this here.
@rightfold Maybe it started that way but as it evolved the wo got shortened to u?
 
user1804599
:p
 
10:43 PM
How can _Rb_tree_increment wich is a part of std::set<T> be implemented in an object file.
 
It's probably a part of a non-template parent
 
@набиячлэвэли How does the parent use T?
 
@набиячлэвэли Yes, but how?
 
I think it was in Effective C++?
It's a parent that's oblivious to T itself but implements like alloc and stuff
to make cimplolation faster (less codegen from templates)
 
10:56 PM
today I learned that nine months ago I deleted a bunch of customer data for no evident reason
 
inb4 fired
 
it was a pretty minor bit of customer data
we found out now because nobody noticed or complained for all that time
 
user1804599
my gums
 
user1804599
they hurt
 
search dentist
 
user1804599
10:59 PM
goddamn wisdom teeth
 
@CaptainGiraffe when I wrote a tree, the entire node class was non-template, all the tree navigation, rotations, etc. Then the class allocated template objects that inherited from the non-template base class, but also held data, and passed it to the non-template tree to insert/etc.
 
@MooingDuck That seems similar. I'm very curious about the transition set<T> -> RB-tree-code.
 
@Puppy woah. That sounds bad
 
@CaptainGiraffe the only place that cares about the derived/template type is allocation, deletion, and the thin api.
 
user1804599
@Puppy Doesn't matter; just restore the backup. :trollface:
 
11:04 PM
@rightfold That's what I said, but learned they have no backups; felt a bit better after hearing that
 
@MooingDuck Yes. And I hope the RB_tree is compact.
 
@R.MartinhoFernandes Felt better after learning that our tech lead reviewed it and didn't notice either.
 
I should probably ask SO this. Your insight will be appreciated.
I'll ask tomorrow.
 
11:38 PM
somebody post something interesting
 
Would Fritz the Cat vote for Donald Trump?
 
TRUMP TRUMP TRUMP - LONG LIVE TRUMP
 
Can't load the fat web on a train
So, i've been to San Diego and San Fransisco. San Diego feels a lot more habitable in terms of prices, why the hell do people want to live in SF?
 
11:49 PM
@TonyTheLion If he died soon, he wouldn't suffer appropriately
 
Also why fuck do I need to cast my volatile when using std::map?!
	volatile auto retrieval = settings.retrieval;//to avoid a harmless race condition from becoming harmful, ie terrible things if this changes
	auto cycle_patterns = PhaseRetreival_pats.at(static_cast<PhaseRetreival>(retrieval));
 
er
why the flying fuck are you using volatile to try to avoid a race condition?
 
why are you using volatile
 
I got a function that takes a const reference as an argument. The references is to a data structure that is coupled to a GUI. If the user presses a button the structure changes. I don't want one particular member changing during the duration of a function that takes a long time to compute. Other changes are harmless.
 
volatile won't do shit to help you with that
 
11:52 PM
Yes, it will, it forces the compiler to make a copy of that one member. The other members can change and nobody gets hurt.
 
no, it most assuredly does not.
firstly, the copy doesn't have to be atomic- the compiler can legally emit instructions that have tearing and other thread-related failure conditions
 
Tearing isn't a problem, its an enum field.
 
secondly, the compiler only has to respect volatile w.r.t. other volatile members
it doesn't really have to do shit in this case
@Mikhail You're making a completely invalid assumption.
you assume that just because in the simple case, the compiler would emit instructions that might happen to work on your platform, that this means it is safe.
it is not.
the optimizer and CPU have every right to totally fuck you over.
and they will do.
the correct thing to do is to use a thing that actually does what you want, which is an atomic load.
 
I'm pretty sure the volatile keyword was invented for this exact purpose.
 
nope
you're thinking of a completely different language.
volatile keyword in C was invented for hardware which mapped e.g. I/O pins to memory.
it didn't and never did mean shit for threads or threading and doesn't offer anywhere near enough guarantees to be useful in that situation.
you need to guarantee that neither the optimizer nor the CPU will re-order in a super bad way and you also need to guarantee that the instructions emitted are atomic, which means you need to use an actual atomic.
 
11:57 PM
So, I think we can debate if the atomic guarantee is a valid concern. Maybe you are right. But I think the optimizer isn't allowed to optimize out the volatile variable, which is precisely my motivation for using the keyword.
 
it isn't permitted to remove it entirely
but that is nowhere near enough for actual safety for the thing you are attempting to do
 
00:00 - 14:0014:00 - 00:00

« first day (2232 days earlier)      last day (2718 days later) »