« first day (3392 days earlier)      last day (1571 days later) » 

12:27 AM
@RaghavSood
0
Q: Emails and Timing Attacks

JBisI am building a web app that allows login with an email and password. I understand that I need to use a timing safe function to compare the passwords to prevent timing attacks. However I realized that the emails might be vulnerable to the same attack. I am unsure how to prevent timing attacks on...

 
You usually avoid that by immediately showing the user a page saying something like "If an account exists with that email, a password reset link has been sent to it"
And then doing the query+emailing in the background
 
alright you solved one issue
 
This also has the benefit of not disclosing whether an account with that email exists in the first place, which prevents people from first building a list of valid login emails, then bruteforcing those
 
I have noticed, however, many sites including very large ones do not do that. Instead they will tell you a couple chars of the email they sent it to (if theres a username) or just flat out say we sent it to x email if it matches or that they didn't find an emai;.
 
It's not usually the most important requirement tbh
For most reasonable deployments, the jitter in handling requests will depend on more factors, such as load, route-to-server, etc.
 
12:32 AM
@RaghavSood I disagree.
 
Ok.
 
@RaghavSood there have been studies showing that this isn't an issue
 
Timing attacks are really not an issue for web facing services - the time for comparison is very small compared to the network overhead. You'd need thousands of requests to get a reasonable estimate in most cases, which should be blocked by a general rate limiter much before you get there
Plus, no sane site does plaintext comparisons, and password hashing schemes are usually constant time comparisons
I'm not saying it is impossible, I'm just saying it is irrelevant at your scale
 
passwords aren't the issue here
 
And an async approach solves the issue here
 
12:36 AM
Rate limiting doesn't help if you have multiple attackers
@RaghavSood huh?
 
If you send emails in an async fashion, your request always returns immediately, regardless of whether the email exists or not
 
Again, that only solves the issue of password resets. Not logins.
 
You can add an artificial delay to your login/register endpoints
Or enforce a minimum response
So do your checks, then just sleep for 50ms always
 
That is something I also thought of however I am sure there are issues with it.
 
So the response always completes at about 53-60ms or so, depending on network factors
Random delays aren't perfect, they increase the number of measurements needed tho
A minimum response tends to be the better option, since you will fall in a very narrow distribution for all responses
 
12:41 AM
yep
11
Q: Can I prevent timing attacks with random delays?

Iain DuncanI read recently about profiling for valid user accounts with timing attacks, IE the application-under-attack takes a predictably different amount of time to process say a login on a non-existent user from an existent user. Yet I've never seen in any examples or framework code any protection again...

 
1:17 AM
@IvanMilisavljevic
I'm doing some triggers and having some issues. :(
PostgresSQL
CREATE OR REPLACE FUNCTION update_modified() RETURNS TRIGGER AS
$BODY$
BEGIN
    UPDATE question SET last_modified = now() WHERE question.id = NEW.id;
END;
$BODY$
    LANGUAGE plpgsql;

CREATE TRIGGER modified_trigger
    AFTER UPDATE
    on question
    FOR EACH STATEMENT
EXECUTE procedure update_modified()
i am getting a "stack depth limit exceeded" because the update in the trigger is recursively calling it self
How can i prevent?
 
a recursive function needs two things to operate correctly
which one are you missing?
 
I am not making a recursive function
the trigger is calling it self
 
so don't define the trigger to call itself
 
"On update call trigger which updates which calls trigger which updates..."
@DaveS huh
 
1:32 AM
And if anyone was wondering, like me, whether this will recursively call itself, there's a RECURSIVE_TRIGGERS database option that you'd normally have off which prevents a trigger like this from calling itself. msdn.microsoft.com/en-us/library/ms190739.aspxRory Feb 4 '13 at 18:23
92
A: How to: Create trigger for auto update modified date with SQL Server 2008

marc_sMy approach: define a default constraint on the ModDate column with a value of GETDATE() - this handles the INSERT case have a AFTER UPDATE trigger to update the ModDate column Something like: CREATE TRIGGER trg_UpdateTimeEntry ON dbo.TimeEntry AFTER UPDATE AS UPDATE dbo.TimeEntry SE...

so look for something like that
 
Very helpful considering i'm using postgres not sql server
 
are you just terrible at using google?
don't be sassy look it up
 
I have Google for a while and found contradicting answers
 
80
A: Prevent recursive trigger in PostgreSQL

agnessaThis is what I do in PostgreSQL 9.2, although I must admit I did not find this approach documented. There is a function pg_trigger_depth() documented here, which I use to differentiate between original and nested calls in the trigger. CREATE TRIGGER trg_taxonomic_positions AFTER INSERT OR UPDATE...

 
yup saw that
 
1:34 AM
ok so what's the problem
 
80 upvotes right?
2
A: Within a trigger is there a way to tell if an update or insert came from a trigger or not?

Ziggy Crueltyfree ZeitgeisterThere are several ways for determining if the trigger is recursing. Checking the trigger depth (pg_trigger_depth()) is not one of them, because you don't know if the trigger itself is recursing or is being fired from another trigger. The only direct way to know analysing the execution stack duri...

 
2 votes vs 80 votes
 
1
A: Is pg_trigger_depth() bad to use for preventing trigger cascading (recursion)?

Evan CarrollYes, it's always bad to make make behavior dependent on pg_trigger_depth() Maybe I'm a little less averse to blanket statements, but what good could it do? There is no argument I can see as to why you would want such a feature. The primary purpose of a database is to ensure data integrity. And a...

that one explains why and it makes sense
 
multiple triggers could be going on at the same time
 
1:36 AM
so, you only want to update the timestamp on user triggered events in most cases
 
1. Dont use triggers
2. Update updated_at in the same query where you update your data
 
or that ^
 
1. Why? I thought they are used very often and very efficient. And prevents WET code.
1b. So whats the point of triggers?
 
1. Wrapper function
2. Update other things
 
For example, do something on this table when something is changed in that table
Triggers are something you should avoid at all times
 
1:39 AM
Other db's (as we saw SQL server) has built in fixes of this issue, shouldn't postgres?
@IvanMilisavljevic is this just a rule of thumb of dbing?
 
yes, and they should be used with caution
and basically in your case, you are getting stack overflow exception
and there is no proper solution to the problem
 
I agree with Ivan here you want your DB to be dumb and not have undocumented behavior not in the primary code base
 
well in that case i'll go with your #2 and daves #1 and build the abstraction in node
thanks for the help
although i'm surprised. I thought triggers were good.
 
Also, for that specific usecase, ts going to be faster to do it in a single query than doing it with triggers
182
Q: Are database triggers evil?

WW.Are database triggers a bad idea? In my experience they are evil, because they can result in surprising side effects, and are difficult to debug (especially when one trigger fires another). Often developers do not even think of looking if there is a trigger. On the other hand, it seems like if...

 
contradicting answers
the second one
> No, they're actually a good idea. If there's a problem with your specific triggers, then you're not doing them right, but that usually means there's a problem with your implementation, not the concept of triggers themselves
 
1:43 AM
nah
there is shitload of articles going really deep into why triggers are evil
One good use case would be, something like an AuditLog on db changes
 
so much of programming is littered with grey areas, specific use cases etc there are no hard and fast rules of never use x but as Ivan is saying they can cause a lot of issues and until you need them it's best to avoid them
another way to do your Trigger JBis, is enumerate the column names you want to update on
excluding the updated_at column so it doesn't recursively fire itself
 
^ thats a good idea
but for postgress it would require two triggers which makes me sad
So i'm going to trust ivan on this and not use a trigger
thanks again for the help :)
christ, the comments on that article
 
night all
 
night o/
 
 
5 hours later…
6:56 AM
o/
 
7:37 AM
Goooooooooooooooooooooooooooooooooooood Morning Everyone!!!! :D
 
Greetings!.
 
8:42 AM
Hell-ow
 
8:59 AM
o/
 
@javadroid Welcome! Please read, confirm reading, and follow the room rules before you do anything else: room-15.github.io
 
Online since 29-01-2020 09:05 (UTC). Running on develop@355b70d. Uptime: 0h
 
Good morning
 
9:16 AM
morning
 
stefita requested access. Rep: 1659 - Questions: 13 - Answers: 65 (ratio 4:20)
 
!accept
 
@stefita welcome. Please start by reading the rules and confirm you have read them before saying anything else.
 
I have read and understood the rules
Good morning
 
Morning everyone
 
9:31 AM
thanks and welcome stefita
o/ Chulo
 
9:42 AM
Greetings, people-who-are-not-handing-out-emails-and-website-links-tomorrow-to-a-domain-with-no-MX-records-or-A-records-and-must-set-everything-up-right-now
 
Tim
9:54 AM
what up daghs
 
'sup T.
 
This was the most starred message last year on this day:
Jan 29 '19 at 11:24, by Tim Castelijns
take the hint CF
 
@Tim doing ok, what about you?
@RaghavSood hell\o
whatever happened to Jordy?
 
10:11 AM
Jordy doesn't have a SO account anymore
well... his old one as far as i know
 
Tim
I am doing fine
enjoying some ranja
 
that ascii surprised pikachu
xD
 
`⢀⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⣠⣤⣶⣶
⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⢰⣿⣿⣿⣿
⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧⣀⣀⣾⣿⣿⣿⣿
⣿⣿⣿⣿⣿⡏⠉⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿
⣿⣿⣿⣿⣿⣿⠀⠀⠀⠈⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⠉⠁⠀⣿
⣿⣿⣿⣿⣿⣿⣧⡀⠀⠀⠀⠀⠙⠿⠿⠿⠻⠿⠿⠟⠿⠛⠉⠀⠀⠀⠀⠀⣸⣿
⣿⣿⣿⣿⣿⣿⣿⣷⣄⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⣿
⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠠⣴⣿⣿⣿⣿
⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠀⢰⣹⡆⠀⠀⠀⠀⠀⠀⣭⣷⠀⠀⠀⠸⣿⣿⣿⣿
⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀⠀⠈⠉⠀⠀⠤⠄⠀⠀⠀⠉⠁⠀⠀⠀⠀⢿⣿⣿⣿
⣿⣿⣿⣿⣿⣿⣿⣿⢾⣿⣷⠀⠀⠀⠀⡠⠤⢄⠀⠀⠀⠠⣿⣿⣷⠀⢸⣿⣿⣿
⣿⣿⣿⣿⣿⣿⣿⣿⡀⠉⠀⠀⠀⠀⠀⢄⠀⢀⠀⠀⠀⠀⠉⠉⠁⠀⠀⣿⣿⣿
⣿⣿⣿⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠈⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⣿
⣿⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿`
5
@W0MP3R color me suprised
 
10:26 AM
is that.... sarcasm?
 
Tim
confirmed
 
👍
thanks, I'm really bad at detecting it >.<
 
You need to work on your meme-kung-fu
 
I know TT^TT
 
@Tim you sure it's not limonade?
 
Tim
10:45 AM
yes
 
>:(
 
@twiz XD
 
11:00 AM
out of the blue: duplicate class exception during build. [class name] class already in class path... clean build helped....
> "I can't remember the last time I made a clean build" ~ Stupid Gradle Dev at DroidCon Berlin 2018
 
11:11 AM
It's only out of the blue if you started to trust gradle to do the right thing
You have only yourself to blame
 
I have no trust in gradle, the fun part still begins when you haven't touched gradle before it starts to complain anyway
 
turning off gradle.cache (if kotlin) and gradle.incremental usually helps when dealing with cache corruptions
ofc this will kill your build times
 
11:37 AM
How do I comment out lines in the layout.xml
I have this case where a View with wrap_content pushes out other Views
I use RelativeLayout, is there a flag which says every view has to be seen in the view?
 
@IvanMilisavljevic what's your thoughts on procedures? Should my sql functions be stored on the db side or the application side?
oh and morn o/
 
you shouldn't have stored procedures, you can absolutely live without them
 
What's the reasoning?
is the idea to abstract everything away from SQL?
 
it's a nightmare to debug and track bugs when something strange happens
imo, decouple everything, business logic in code, and only data in the db
 
Alright thanks
 
11:54 AM
user image
5
 
Where that from lmao
 
:D
 
reddit, of course
 
The sooner you will get affected, the sooner your body will learn how to deal with it
Also, essential oils can prevent that virus
 
I don't think that's how viruses work Taseer XD
 
11:58 AM
Viruses are like tag. If you give it to someone else then your cured.
 
when it gets inside your organism, you cannot "get rid" of it because it's usually intra-cellular
so you treat the "symptoms" (cough, fever etc...)
it's like people who have herpes, it's always there, they just treat the symptoms when the virus decides to act
 
China is building hospitals from scratch to be completed under a week.
 
so hope they create the vaccine asap :)
 
Remember Ebola? Coronavirus would soon get off the hype train
 
I don't understand the point you're trying to make, honestly
 
12:03 PM
Not really, I am just light-headed right now
Oh yeah one thing, one a general note, if your hands/fingers are dirty, keep em away from your eyes
I keep a pocket hand sanitizer with me all the time
 
user13267 requested access. Rep: 5383 - Questions: 185 - Answers: 8 (ratio 4:0.2)
 
!reject
 
@user13267 you currently do not meet the requirements to chat here. You can find our requirements in the rules.
 
@Taseer this is the nerdiest thing I have seen written in this room so far
And I have seen people describing anime in full detail
@MuratKaragöz wasn't it <<!-- >> ?
 
Tim
<!-- -->but you can only comment out entire tags, not inline lines
 
12:16 PM
just store the inlines in a notepad
 
@WarrenFaith I consider buying a plush bat, embroider 'I <heart> Wuhan' on it and sell it on auction
maybe instead of heart a biohazard icon
or icon inside heart
 
@MwBakker does not work for inlines
solved the views pushing outer views with the linearlayout and layout_weight
thx room
 
Also, people often use the wrong type of masks to 'protect' themselves, often those surgical ones
 
you're useless
 
Invalid Number of args
 
12:45 PM
@JBis you ever seen "workaholics" ?
 
nope
 
eehm modern family then?
 
yes
great show
 
you look like that actor that becomes the boyfriend of .. hayley?
I dk his name, just these shows he appears on
 
Lol. I don't think so but ok.
 
12:48 PM
I googled the one I meant
Adam devine
 
Oh that one
yeah I guess a little bit
 
yes
fun fact: the "ping" sound from stack is coming from the first 'ping' at the song: ATC - Around the World
 
o/
 
@MwBakker super fun indeed :D
 
1:05 PM
I am trying to make a curved view, what I tried -> hastebin.com/xudujukaxe.xml
This much of curve I am trying to achieve
 
maybe easier to use a custom view with the Path API and draw half a circle?
 
This is the end result of what I did, that curve is agressive
@Mehdi I did not think about that, I will look into it now
 
the end goal should be to stop using XML built-in UI components, rather have everything as custom views
that's how you establish dominance in the android community
 
true, I suck at UI
 
 
1 hour later…
2:21 PM
@Jbis lol adam devine
 
indeed
 
2:41 PM
how's you all doin?
 
Hiya bB!!!! :D
 
@ballBreaker certainly not leaving work at 4pm.
 
hehehehe >:)
heya wompy!
 
@tim we use jenkins.io/projects/blueocean with jenkins, for a much more pleasant UI experience
 
hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
 
2:49 PM
Mehdi, we have that but I haven't really used it. It's the same as just using plain Jenkins but with a different UI, right?
 
Do I do my actual coding work, or spend all day fixing an issue that's plaguing the office
 
hhhhmmmmm
Valid points geis
 
Just spend 2 hours fixing the office issue then get back to coding work
 
yes, cM, but much more intuitive and easy to track the pipeline stages / steps
 
Tim
2:50 PM
same mehdi. I find myself going back and forth
 
Maybe I should look into it more then ;)
 
@codeMagic I like this idea, but maybe I'll do 2 hours of work then work on the office issue
Other way around I'll probably never get aroudn to coding
 
I approve that
 
bless
 
@ballBreaker what is the office issue?
 
2:59 PM
Hi bb
 
@MwBakker ugh it's been an ongoing issue for about a year, our internet routes through our IP desk phones, and like 1% of the time it completely drops people's connections and you need to completely reprogram the phone
I found a fix but it involves me reprogramming every single IP phone in the office which means 1 for every employee
 
and you don't know why it drops?
 
I finally made a big enough fuss that the CEO of our company demanded that the network engineer come in and figure it out
and we're also having WiFI issues at the same time so there were days when people just had to go home because they couldn't connect lol
 
It sounds like the phones have a static IP adress, and the range for dynamic IP collides once in a while with a static address
 
No the phones have a dynamic IP address, it's an issue where the phone was conflicting with the DNS
and not assigning people the proper IP address and then the network would toss them off our internal network onto the guest network
so they'd lose all intranet
 
3:07 PM
heh nice
 
and 70% or more of our employees require it
@Nyakouai hey dude
 
3:22 PM
I've started talking to this girl with the name
Ula
what a weird name
 
Ula la?
(Don't mind me, I'll proceed by myself to the nearest exit ASAP)
 
HAHA no I wanted to make that joke to her
but I assume she's probably heard it her whole life
 
Then I'll hold the door for you as well
 
heheh thanks
ladies first
 
But yeah, unconventionnal
Has she any origins?
 
3:28 PM
Not sure, pretty early into talking so far
My guess would be some sort of Slav tho
She's got one of those looks that's really classically beautiful but she seems to not wear makeup so it's kind of weird
 
Some people are naturally beautiful, is that that weird? :P
 
I guess what's weird to me is that with makeup she'd be like a solid 10
but without she's like an 8
so I guess the weirdness to me is just that she doesn't care
Which is odd/refreshing in a sense
 
An effortless 8 is better than a tryhard 10 imo
 
I'm with you
It's just throwing me off lol
You see so much of one thing that when you see the opposite, even if it's the better choice, it still feels weird
 
Cause you can't flatter her about her makeup, so your classic approach method is ruined? :P
Ah. I'd like to say I know the feeling
Unfortunately, I do not. Not with women :P
 
3:32 PM
hehe but you have in other areas, yea?
 
Yes
 
Okay as long as you at least kind of know what I mean
@Nyakouai lolol I never really comment on makeup
except the other day some girl had way way way way too much, she was a makeup artist I guess? I said her orange eyes makes it look like she eats too many carrots
didn't go over well
 
How surprising
 
Really? Telling people they're ugly always works out great for me.
 
lmao I mean, in my defense I was just commenting on her makeup not on her
 
3:36 PM
@twiz I like your chat style :D
 
^ same
I love when people TWIST my WORDS to make me look DUMB
jk I make myself look dumb, and I do enjoy it
lmao
 
hehehe
 
@ballBreaker Really? Telling people the work they take great pride in is terrible always works out great for me.
 
@ballBreaker And we love like tolerate you for it
 
well then... you're welcome I guess. LOL
 
3:37 PM
@Nyakouai ---
 
Thanks
 
~(-.-~)
 
that was the most unexpected comment XD
 
Low-on-energy-Womper?
I'm typing like a drunk man. I'm not drunk. Just sick of my work
 
yeeeeeeah... I'm tired
 
3:39 PM
should listen to an energetic song, may I suggest: gucci gang gucci gang gucci gang 🎶🎶🎶
 
@ballBreaker This time, at least, there is 0 chance you screw up in the same way
 
I've basically just been staring at my laptop with a confused look for like 3 days straight.
 
@Mehdi Flagged for obvious reasons
Couldn't decide between hate speech, terrorism or heresy
 
:O
 
@twiz It's called negging BRO
jk, I was just being a total dick that day
 
3:43 PM
D:
 
I enjoy reporting military ads for violence. I mean they can't argue with that...
 
Negging? Isn't that a NLP trick or smth?
 
lol negging
 
Scratch that, google answered me
The french term for "pick up artist" is "artiste de ramassage"... ... ...
 
4:11 PM
haha yeah it's some lame-o PUA tactic
It can work but usually just on people with low self esteem and it's pretty scuzzy and mean
 
Can only work if you go talk to the girl, ifyouknowwhatimean
 
dont think , juust do
 
o.o?
 
is my advice there
 
@ballBreaker Do not pass go, do not collect $200
 
4:16 PM
Overthinking the approach is the biggest killer of actually approaching lol, count your steps if you have to but just get there
 
Second biggest killer is not being smooth... Hmmm: cjeck
Aaaanyway
Don't call Ula a carott and it's all good, right?
 
Has anyone ever submitted a react-native app for iOS?
 
I almost did, but then I didn't.
 
nu hu :(
 
@Nyakouai I won't
 
4:23 PM
Any idea how "archive" works? I have ENV vars and stuff when using react-native run-ios
 
probably
we'll see
 
Atta boy
Time to go, have all a good evening/rest of the day
 
Have a good night brochacho
 
I'm confused if xCode's "archive" is taking the build I already made and packaging it or if its doing it's own thing.
I have a feeling I'll end up submitting my dev version pointing to the wrong URLs and such.
 
Didn't get that far. Not sure.
 
4:26 PM
Yeah, literally the final step. haha
 
> Everything gets rebuilt every time an archive is made
5
Q: How to create XCode archive without a clean build

I have no catWe have a fairly large code base that takes a long time to clean build. Whenever we archive the build (Product->Archive) the archive process first cleans all, then builds. This seems unnecessary and time-consuming, we would like to be able to create an archive without a clean build. Incrementa...

 
Ha I guess my google-fu is failing me today. thanks for the links.
 
np :)
 
I'm not sure if that's the right way to go or not... Maybe I really just need to figure out how xCode is even capable of building react-native at all...
 
yCode when u can xCode hahaha haha ha
6
 
4:35 PM
Jan 17 '18 at 12:42, by Tim Castelijns
hahahahahhhahaahahahahahahahhahahahahhhhahahahahaahahahahahhhahaahahahahahahahha‌​hahahahhhhahahahahaahahahahahhhahaahahahahahahahhahahahahhhhahahahahaahahahahahhh‌​ahaahahahahahahahhahahahahhhhahahahahaahahahahahhhahaahahahahahahahhahahahahhhhah‌​ahahahaahahahahahhhahaahahahahahahahhahahahahhhhahahahahaa
 
x'D
 
he he he
 
hardy har
 
HMmmmmmmmm nahhhh hahaha
I can't find any clips of that laugh online so just imagine it
 
 
4:42 PM
lmao that last frame
This is how I laugh
So I'm trying to remember this old school point-and-click game from when I was a kid.. I believe you were like investigating something
and it's really hard to google and find
 
can you give a bit more of information???
 
Unfortunately no lol, I'll only recognize it when I see a picture :\ I can't really remember any details
It's driving me nuts
 
the first one that pops in my head is freddy fish 2 but I doubt is that one xD
 
heheh nope, definitely would never forget freddy fish
 
uh myst? lol
 
4:47 PM
No it was more childish than myst
gah
I wonder if it came as a prize in a box of cereal
that might help
 
Leisure suit larry?
 
hmm no not that either D:
oh wells. Thanks for trying everyone :)
 
hi
 
Time to go~~
 
bye
 
4:59 PM
Cya later/tomorrow people!!!! :D
 

« first day (3392 days earlier)      last day (1571 days later) »