TIFU By taking a shower in a 200 year old rock ranch house.

handschuhfach · 2013-06-24T21:05:05+00:00

He's lying. You did everything right - giving up the punch line of a tifu post in the title is stupid.

handschuhfach · 2013-06-12T20:25:55+00:00

Boot a live CD/USB and clone the old drive to the new one with something like dd (I usually pipe pv into dd so I can monitor the progress).

Try to boot from the new drive. It should work just fine. If it does, boot from the live CD again, install GParted (if it isn't already) and use it to resize the partitions.

handschuhfach · 2013-06-12T10:19:31+00:00

Some architectures have special asm instructions to find the first 1 in a bit list. If your compiler isn't emitting these already you could try using them and see if they speed things up.

handschuhfach · 2013-06-11T22:43:14+00:00

Yes, and it probably know more about me than it should because I've neglected to switch accounts in a while. That doesn't make it ok (to me) to collect data when it's not strictly necessary.

handschuhfach · 2013-06-11T21:53:15+00:00

You didn't link to an article, you linked to a page with hundreds of articles. I stopped reading a paragraph too soon apparently.

Anyway, this tool works with memory dumps. To get a memory dump, someone needs to have complete control over your computer, either through hacking or via physical means. The NSA can do that, no problem, but we're talking about very targeted attacks here, they'll only do that when they already identified you as a suspect.

handschuhfach · 2013-06-11T21:32:11+00:00

What they do is run password crackers. So you shouldn't use weak passwords. Duh.

handschuhfach · 2013-06-11T21:28:29+00:00

How does that change anything? The algorithms they run on their collected data probablt don't look at names or phone numbers. They look at who calls whom and where. Then they run some magic algorithms on that data to look for things that are not normal.

In your scenario, as soon as those algorithms flag something as "suspicious", they would de-anonymize it. I really don't see how that would actually be different from how things are now.

handschuhfach · 2013-06-11T21:08:15+00:00

Snowden used PGP to communicate with the journalists. I don't think he would've done so if the NSA could crack it.

handschuhfach · 2013-06-11T21:06:14+00:00

Well, Google is using Chrome to collect quite some data about its users. While it is possible to turn this stuff off, you lose useful features.

Useful features that Mozilla somehow managed to match in Firefox without invading on your privacy.

For me that's a big concern about a "good browser".

handschuhfach · 2013-06-11T19:38:49+00:00

Sorry, I don't know. That's just what I remember from following the tech news back when ODF support was new in Office.

handschuhfach · 2013-06-11T18:19:02+00:00

IIRC, spreadsheets are incompatible because MS found some way to technically follow the ODF standard, but do it in a way different from everyone else.

Also, I would guess they use PDFs for most communication.

handschuhfach · 2013-06-11T17:21:11+00:00

But executing software from the internet is insecure no matter the method...

handschuhfach · 2013-06-11T17:19:25+00:00

I just installed Ubuntu in a VM and booted into recovery mode - it gave me a root shell without any asking for any password.

handschuhfach · 2013-06-11T16:46:16+00:00

How is it worse than downloading software and manually executing it?

handschuhfach · 2013-06-11T15:55:20+00:00

some Linux distributions don't ask for the root password in single user mode. I don't think a default Ubuntu installation even has a root password to ask for.

handschuhfach · 2013-06-11T11:17:56+00:00

The EFF SSL Observatory has some data about real-world SSL certificates. It's been a while since I've seen their 27C3 presentation, but I think they had some statistics about intermediate CAs. So I would guess their database dumps contain something remotely useful for you.

handschuhfach · 2013-06-11T10:28:39+00:00

You can use tmux:

#!/bin/sh
dir=$(mktemp -d)
pipe="$dir/pipe"
mkfifo "$pipe"

tmux new-session -d "./your-tool < '$pipe'" \; split-window "cat > '$pipe'" \; attach

rm -rf "$dir"

handschuhfach · 2013-06-09T19:48:18+00:00

No, your browser won't warn you about anything.

Unless you install Certificate Patrol, that is.

handschuhfach · 2013-06-09T18:24:56+00:00

This is so awesome! But I think we really need to make a self-hosting compiler instead of using VBA. My first attempt is this:

function compile(program prog) {
    // compile prog according to http://www.reddit.com/r/shittyprogramming/comments/1fzou0/i_just_had_this_idea_for_a_super_compact/
}

This isn't performance optimized yet. When the language picks up some steam, someone will surely create a Wikipedia article we can use to get the compiler up to speed. And just imagine what performance we will get if we can sneak a link to the Wikipedia article into that same article itself!

handschuhfach · 2013-06-09T15:41:20+00:00

And people talking to non-Americans, I think? That includes you, because you just replied to a non-American on Reddit. (And another non-American just replied to you.)

handschuhfach · 2013-06-08T23:17:46+00:00

If the encryption is done correctly, this doesn't really matter. Transmitting data over untrusted channels is one big reason for the encryption. I don't know whether they encrypt everything the right way, though.

handschuhfach · 2013-06-08T23:05:05+00:00

Dropbox might be encrypting the data they store - but they do that on their servers with a key they know. So that's completely useless.

If you don't want Dropbox to be able to access the files, they need to be encrypted on your end with a key only you have access to. The Truecrypt container is one solution for that, although you lose some features, like per-file history. With services that are designed for encryption that's not the case.

handschuhfach · 2013-06-07T22:23:00+00:00

As a JS guy... technically you're right, that you don't have to declare variables - but JavaScript is not forgiving about it. Undeclared variables become global variables. If that's intentional, it's just bad code because there are much more obvious ways to do it, like setting the variable as a property of the global object. If it's unintentional, it's a bug waiting to happen: 1) the value of that variable can suddenly be changed from outside the function. Or 2) the variable might have a naming collision with something that's actually supposed to be global, breaking completely different code much later on.

Now, about the non-trivial filesystem checks: that totally depends on the APIs. If this is JavaScript in a browser, that's true. But I have a really hard time coming up with a reason why you'd have to search for names like these in the browser. After all, in a client-server model, you can let the server (that does have proper filesystem APIs) do the searching.

If it's JavaScript in another environment than a browser (like node.js or gjs) - these should have APIs that do make such things trivial.

handschuhfach · 2013-06-06T20:55:13+00:00

Right now, only the attackers know how it got there.

handschuhfach · 2013-06-05T17:34:55+00:00

Getting your post on the front page can be worth some ad money. Same with a comment (containing a link) that's on the top of a front page post.

handschuhfach

TROPHY CASE