[00:10] I'm sorry I haven't read the "proper" distro list- could you link me to it? [00:12] Haha, there's no list, really. :p [00:14] Look at Arch if you want rolling releases (no "versions" of the distro, you just run an update command and you're on the newest version, and it's always the newest version of it, as opposed to an old version that only recieves bugfixes) [00:14] Or you could go with Ubuntu if you want a hand-holding, user-friendly distro [00:16] Or finally, you could use Debian, which is rock-solid, and widely used, with documentation on pretty much anything you'd ever think of doing. [00:17] Also Debian and Ubuntu have a lot more packages available than Arch, so that's another thing to consider [00:39] dashcloud: only on desktop [00:39] and it's great for that [00:40] wouldn't recommend it for server [00:40] So, just to make ABSOLUTELY SURE... now that I have the tools, I can start picking FTP sites from the Github project and downloading them, then tarring them and sending them to the Internet Archive? [00:40] SN4T14: opensuse /is/ a proper distro [00:40] :P [00:40] ^ [00:40] one that doesn't continuously break like ubuntu does >.> [00:40] * JohnnyJac is running Warrior on openSUSE 13.1 [00:41] JohnnyJac: I suppose, but you'll want to join #effteepee [00:41] joepie91, pfft, fuck OpenSuSE [00:41] that's where FTP stuff is discussed [00:41] SN4T14: cause? [00:41] Right-o [00:41] :p [00:41] Yeah, why? [00:41] inb4 "because it's not Arch" [00:41] :P [00:41] Hahaha! [00:41] Why use a smaller distro when there's larger ones? [00:42] SN4T14: why use a larger distro when there's smaller ones? [00:42] that's a non-argument :P [00:42] (and I believe I already mentioned at least one reason - plus it's debatable which distros are small and which ones are large) [00:42] Well, not necessarily. It's only a non-argument if size is the only factor being considered. [00:43] Err. [00:43] Yeah. [00:43] larger = more documentation, packages, and more idiots asking questions that solve your problems. :p [00:43] SN4T14: wrong [00:43] largely related to culture around the distro [00:43] not to size [00:43] bigger = more people = more issues = more of what I mentioned [00:43] still wrong :P [00:44] it entirely depends on the culture around the distro, as I said [00:44] despite opensuse having a noticeably less vocal usergroup than eg. ubuntu, the build service has packages for just about everything [00:44] Truth be told, I have never had issues finding answers for openSUSE issues. [00:44] there are forums with quick responses to just about anything [00:44] Yeah, and the culture is always "better ask questions" unless you're running fucking Red Star. :p [00:44] and everything is very well documented on the wiki [00:44] so I'm really not sure where you're seeing an issue [00:45] unless, of course, you weren't seeing an issue, and simply extrapolating that since you hear about opensuse less, there must thus be less support :P [00:45] That's how I feel. There may be fewer Google hits, but when I find an answer, it is quality and just works. And that is only when I have issues. [00:45] ^ Just like my experience with Debian, Ubuntu, and Arch [00:45] Except without the "fewer google hits" part [00:45] Ubuntu I have the same opinion of. I run Ubuntu server, too. [00:46] Can't say anything about Arch. Never got as far as to run it. [00:46] SN4T14: do you know what the opensuse software search is? [00:46] Why Ubuntu server? Why not Debian? The entire appeal of Ubuntu is a user-friendly version of Debian [00:46] (I should note that Arch is excellent in that it apparently has so many issues that every conceivable problem with a Linux distro is covered on the forums) [00:46] (>_>) [00:46] joepie91_, an in-browser alternative to aptitude search [00:47] SN4T14: ... no, not really [00:47] That's literally what it is [00:47] https://software.opensuse.org/search [00:47] Massive search bar [00:47] For packages [00:47] no, it's not what it is [00:47] and this shows a problem with your assessment of opensuse [00:48] Then what is it? [00:48] because what you're missing is that, while aptitude search or apt-cache search only searches through your configured repositories, opensuse software search actually searches the /entire/ build service including home repositories [00:48] which has an absolutely massive amount of packages for just about anything imaginable [00:48] even if they're not in your configured repositories [00:48] it's the AUR of suse [00:49] * joepie91_ twiddles thumbs [00:49] * joepie91_ waits for SN4T14 to finish entering stuff in software search in the hope that it will find no results [00:50] Yeah, and according to Wikipedia, that's *smaller* than Debian's repo, 40400 packages for OpenSUSE, and 48610 packages for Debian [00:50] #archive-bs - 'Dis be war, yo. [00:50] SN4T14: ... you are aware that you're looking at the package count for the official repositories, yes? [00:50] not the user repos? [00:50] nor the extra repos? [00:51] SN4T14: go ahead, enter a package name in software search [00:51] anything you don't expect to be in official repos [00:52] https://software.opensuse.org/package/perl-Teamspeak?search_term=teamspeak [00:52] lol [00:52] first try [00:54] I don't think you can actually host that on OBS [00:54] given that it's prop [00:54] Skype is on there, that's proprietary [00:55] Also, I prefer to know where my packages come from, and that the software in the repo is properly managed, not from any old repo, there's a reason you can't just go "Hey developers! Mind adding my repo?" [00:55] only in a few user repos, with a note saying "install from skype.com", so I don't think those are /supposed/ tp be there :P [00:55] to * [00:56] um, easy solution: you pick a repo with a recent version if no official / extra repos exist [00:56] See, that's exactly the reason why you shouldn't just include EVERY REPO EVER, now you have a version of Skype that's 15 years out of date. :p [00:56] looks like rawporter will be around 12GB [00:56] and if it's really not being updated, and you need a package, you fork the OBS project and update it [00:56] I run a decent number of things from user repos, and they're maintained just fine [00:56] again, culture [00:57] No, if no official/extra repo exists, I prefer to avoid the security risk, and manually downloading it, I don't want someone accidentally adding an old version of OpenSSL to their repo and making me vulnerable to heartbleed [00:57] you are aware that official/extra repo maintainers are not inherently trustale? [00:57] trustable * [00:58] (and honestly, the number of things that cannot be found in official/extra repos is /very/ limited) [00:58] There's more trust there than any old repo, since you can add a custom version of OpenSSL to your repo, but you can't change the official repo's OpenSSL without being the maintainer. [00:59] Same with debian, because it has a bigger official repo [00:59] debatable [00:59] I strongly doubt that extra repos are included in that count [00:59] and your remark is missing the point [01:00] (and no, you can't just "add a custom version of openssl to your repo", there's a vendor lock by default) [01:00] What do you mean vendor lock? [01:00] if you install a package from source A, and source B offers a newer version, then it doesn't magically upgrade to the one from source B [01:01] if you have openssl installed from official repos, it won't magically install it from a user repo [01:01] Got a source for that? [01:02] Because Debian doesn't do that: 'apt-get' defaults to something along the lines of "highest package version wins". [01:02] um, my own usage of opensuse for years? [01:02] you have to explicitly authorize a vendor change [01:02] even if a newer package is specified as a dep of a to-be-installed package [01:02] it will never quietly change vendor [01:03] I'll even make a screenshot for you [01:03] moment [01:05] SN4T14: http://owely.com/9SWZxj [01:05] there [01:05] I tried to downgrade VLC to a version from a different source [01:06] also, http://en.opensuse.org/SDB:Vendor_change_update [01:06] SN4T14: Thanks again, screenshotter is definitely helping. [01:06] https://archive.org/search.php?query=collection%3Aapple_ii_library_games&sort=-publicdate&page=16 [01:06] SketchCow, no problem, happy to help. :) [01:06] We just added the ability to show small screenshots next to items in search [01:07] wow, that's cool! [01:07] Click on an item and the screenshot is an animated gif showing you random captures from the software's operation. [01:08] joepie91_, that screenshot does not scream "security issue!" in any way, that looks like a dependency issue, which 99% of users will click through without thinking [01:08] * joepie91_ wonders when we'll get pornsite-style mouse-over GIFs [01:08] SN4T14: that's kinda besides the point :P [01:09] and it usually /isn't/ a security issue [01:09] Keyword being "usually" [01:09] it also only triggers when you try to change vendor [01:09] not when you update [01:09] because by default it won't switch repos when updating [01:09] Until one guy, someone with a popular repo gets hacked, and now you have 5000 people running a backdoored version of OpenSSH [01:10] and that is not the case for official/extra repos how exactly? [01:10] Those are probably secured by someone half-competent, and the people that maintain your packages are semi-trustworthy [01:10] [citation needed] [01:11] [that goes next to whatever you want a citation for] [01:11] the reality is that the majority of people, /including/ those in supposedly authorative positions, suck balls at security [01:11] yeah, or under [01:11] "those are probably secured by someone half-competent" [01:11] I have not seen any evidence of this [01:11] and have only seen evidence to the contrary [01:11] that is; everybody sucks at security, not just hobbyists [01:11] That's because you only see evidence to the contrary [01:12] You don't see "Debian repos DIDN'T get hacked today" in the news [01:12] * joepie91_ hums captain obvious tune [01:12] SN4T14: I'm not just talking about repos [01:12] I'm talking about security policy [01:12] which is kinda something I get to deal with on a daily basis [01:12] >.> [01:13] Your manual is missing a passive-agressiveness clause. [01:13] no, this is just being annoyed [01:13] I have a very strong dislike for "arguments" that are purely based in unfounded "common knowledge" [01:13] especially where it concerns important topics like security [01:14] You can call it whatever you want, "* joepie91_ hums captain obvious tune" is passive agressiveness [01:14] no, it was me ridiculing [03:11] That's because you only see evidence to the contrary [01:14] as that's literally what I just said [01:14] and I'm getting quite annoyed with where this conversation is headed [01:14] Boys, boys, mom loves you equally [01:14] XD [01:14] heh [01:15] I have two machines playing endless Apple II games and programs and screenshotting them [01:15] It's time to celebrate [01:15] rawporter was a speed bump [01:15] SN4T14: you have to understand that the claims you're making now are claims that I hear on an almost-daily basis, from a never-ending stream of people, who never seem to realize that said claims don't have a basis in reality and appear to be completely false [01:15] justintv was hilarious [01:15] I thought this was #linuxfanboyswar. [01:15] my tolerance for it dries out over time [01:16] I got Warrior running for Justin.TV, but in the last four days. [01:16] joepie91_, you can't seriously think that you can trust bob the amateur programmer as much as a distro maintainer... [01:16] SN4T14: you can't seriously think that you can't [01:16] in both cases, you have nfi who this person is [01:16] you have nfi what their security policies are [01:16] Sure, a distro maintainer is not a security expert, but ol' Bob doesn't even know common mistakes you can make [01:16] and so on, and so on [01:17] and you know that how? [01:17] how can you assess the knowledge of somebody you don't know, have never talked to? [01:17] how do you know that "Bob doesn't even know common mistakes you can make"? have you quizzed him about them? [01:17] how do you know that the distro maintainer /does/ know those things? [01:17] ...This is a fictional, plausible character to support my point, if you want to attach a [citation needed] sign to that, I don't even know how to respond. [01:18] SN4T14: if you're going to make up a worst-case character, then that's not really going to be a very good point [01:18] "amateur maintainers suck because this fictional amateur maintainer I just made up sucks" [01:18] that holds no water [01:19] I mean, sure, in your fictional scenario you are absolutely right [01:19] A worst-case character? So now you're changing your opinion just to try to prove me wrong? That's just ridiculous. [01:19] the problem is that there's absolutely no evidence that your fictional scenario resembles reality in any way [01:20] no, I don't think you understand what I mean [01:20] you just made up a character that "doesn't even know common mistakes you can make" [01:20] that's a worst-case character [01:21] and again, there's no evidence that your fictional scenario resembles reality, so I'm not sure why you're even bringing it up, unless you plan on proving that your fictional scenario /does/ resemble reality [01:21] Your entire argument has been "everyone is an idiot and has no clue about security" and I literally took a typical one of those peopel [01:21] people.* [01:21] SN4T14: I'm not sure what part of "you're making up a fictional scenario to prove a real-world point and you can't do that" is unclear to you? :| [01:21] And now you're contradicting that point by saying that my fictional character doesn't exist [01:21] * joepie91_ sighs [01:21] when I say "most people have no clue about security" [01:21] I am talking about _people_ [01:22] not about _amateur maintainers_ [01:22] and "people" /includes/ "distro maintainers" [01:22] your entire fictional scenario makes no sense [01:22] But not amateur maintainers, according to you [01:22] * joepie91_ sighs [01:22] that is not what I said, nor what I claimed [01:22] My fictional scenario revolves around your point that "most people have no clue about security" [01:22] no, your fictional scenario revolves around "here's a clueless amateur and a distro maintainer that does know his shit" [01:23] Most people implies that the average person is one of them [01:23] On another note, can't believe TrueCrypt is dead. Wow. [01:23] which has nothing to do with what I said [01:23] SN4T14: how about we throw this entire fictional scenario in the bin [01:23] because we're going in circles [01:23] and this is a waste of time [01:23] Yeah, fuck it, this is tiring, it's really just personal preference. :p [01:24] May BRB. Rebooting. Whole drive encryption on new laptop time [01:25] So, SketchCow, you were saying? :p [01:41] SketchCow, looks like there's only about 2 and a half pages of games left. [01:52] Which where what. [01:52] Everything from here: https://archive.org/search.php?query=collection%3Aapple_ii_library_games&sort=-publicdate&page=21 to the end of page 23. [01:53] Oh, I see. [01:53] Sort of. [01:53] That's everything from batch one, in "games" [01:53] Ah, there's more stuff to do? [01:53] There are more batches, there are more genres [01:53] applications, educational, compilations [01:53] And then machines beyond apple ii [01:53] In fact, dozens [01:53] No, this is going to be half a million software packages. [01:53] So yeah, thanks [01:54] So you'll want that third maching soon? :p [01:54] At some point. [01:54] machine* [01:54] Okay, just let me know. [01:58] You might as well give it to me soon, no doubt I'll get the other two whirring and get bored and want a third one attacking [01:59] Haha, okay, I'll PM you the details [02:02] https://ia902508.us.archive.org/30/items/a2_Adventure_Teacher_5_1986_Crackophils_Gang/screenshot_33.jpg [02:03] KILROY WUZHERE [02:07] ohhdemgir.... Why is there a DHCP server running on Arc02? [04:15] what the fuck happened in here [05:50] Two nerds got into a fight. [05:50] I appreciate them both [05:51] But yeah, my two dobermans, Nipsey and Russell, decided to fight over a linux bone [05:51] Nobody died [06:01] https://www.youtube.com/watch?v=PmTUW-owa2w [06:01] oh [06:10] That is great [06:10] Watching it [06:11] yeah, I love this [06:12] I can give you a similar thing to listen to. [06:13] https://www.youtube.com/watch?v=5SaFTm2bcac [06:16] oh cool [06:16] the first place I heard of the Amen Break was Ishkur's guide, so it's nice to see more [06:23] urgh, thats alot of backlog im not going to care about [06:44] heh, I guess more in the "cool youtube video" category [06:44] how ink is made: https://www.youtube.com/watch?v=Fypi6dAJB8E [07:13] my eyes seem to have stopped working [07:13] this is worrying [07:13] similarly worringly, I'm still on the net [07:16] jacked in [08:03] https://archive.org/details/this_is_phil_fish [08:15] nice [09:43] ^5 SketchCow [09:43] btw, awesome GTI [11:50] SN4T14, dhcp server, arc02 FUCK KNOWS! [14:32] DHCP snooping enabled, solves ALL the issues [15:22] 'morning [15:27] ohhdemgir, you should probably shut down that DHCP server. :p [15:31] SN4T14, didn't start it, nothing to do with me, been running since day 1, nope. [15:39] ohhdemgir, you're the one managing Arc02. ;) [15:40] penises [15:41] online.net has the best support [15:41] "Again i can't be more clear that what i said in previous post" [15:41] The reply before that started with "I'm sorry but i can't be more clear than before" [15:41] And the one before that ended in "I can't be more clear than that" [15:42] And every time, I've rephrased what I've said, read it over to make sure there's no confusion, and try to get some answers. >.> [16:06] https://torrentfreak.com/putlocker-rebrands-as-firedrive-user-files-remain-intact-140215/ [16:07] it's a bit sad that more-or-less piracy sites are better at reorganization without data loss than presumably legitimate services [16:07] SN4T14: lol [16:08] ;_; [16:08] SN4T14: perhaps this is the point where you stop being polite and say "I want X and Y" [16:40] joepie91_, they won't meet my demands because they won't acknowledge the issue(s). [16:49] SN4T14: and what is the issue? [16:50] midas, they broke their "sales terms" (ToS) in ~4 places. [17:38] nice [17:42] https://ia902500.us.archive.org/7/items/a8b_Airline_1985_Ariolasoft_DE/screenshot_00.jpg [17:47] is that in a game SketchCow ? [17:47] i need to play that. now. [17:50] damnit, i need a gamepad of some sorts [17:50] XBox 360 controller [17:51] midas: ha [17:51] I have a gamepad [17:51] ... but chrome doesn't treat its input correctly :( [17:52] 3-2 win for the Netherlands! [17:52] midas, https://archive.org/details/a8b_Airline_1985_Ariolasoft_DE [17:52] all thanks to SketchCow's orange GTI [17:52] In-browser emulation: https://archive.org/stream/a8b_Airline_1985_Ariolasoft_DE/Airline_1985_Ariolasoft_DE.atr?module=a800&scale=2 [17:53] midas: please keep soccer out of my IRC thank you [17:53] SN4T14: i know, i need a gamepad to play [17:53] * joepie91_ is going to intentionally call it soccer now [17:53] midas, fuck that. :p [17:53] * joepie91_ grabs his gamepad [17:53] joepie91_: i will not! besides, only the yanks dont call it football [17:54] ^ [17:54] because they have a different game that you dont play with feet but still needs to be called "foot"ball [17:54] not true, in Japanese it's pronounced sakka [17:54] [17:54] :p [17:54] lol [17:55] thats because they loose alot, they sakka at it [17:55] :p [17:55] that game does a lot of nothing for me [17:56] :( [17:56] I played from 2nd grade to my junior year of high school. I sucked the enitre time, mind you. [17:56] midas, lose* a lot* [17:56] ;) [18:04] thanks :+ [18:06] SketchCow: pulled out some 100 year old books, maps and photographs from the recycling bin yesterday. Is that something the archive can save if I send it to them? [18:09] Yes [18:10] awesome, thanks [18:16] SketchCow: is there a scanning center in NL, btw? [18:17] that is, one that accepts book contributions [18:18] I see entire boxes full of (old) books being thrown out here on paper collection day, and it'd be nice if I could just scoop those up and have somebody drive them to a scanning center [18:18] (this seems to be a disproportionately common practice in this city, for some reason) [18:18] thats because your city is on fire most of the time [18:20] lol [18:20] I think it's on fire /because/ of those boxes of books [18:20] books burn pretty well [18:20] i wouldnt know, never sat fire to a city using books before [18:20] :p [18:21] I remember thinking this was neat... http://www.diybookscanner.org/ [18:23] Onto a different topic, how large do you guys think a day's worth of public Pastebin pastes are? [18:23] ask JohnnyJac [18:23] err joepie91_ [18:23] he scrapes pastebin [18:23] joepie91_, how big is it? [18:23] I was like... what? I don't know a damned thing about most things. [18:24] midas: http://rtvdordrecht.nl/nieuws/woning-jaar-gesloten-om-hennepkwekerij/ [18:24] * joepie91_ facepalms [18:24] and um [18:24] SN4T14: let me check [18:26] SN4T14: stats being generated [18:26] please hold :P [18:27] JohnnyJac: let me show you something more awesome, sec [18:28] JohnnyJac: https://www.youtube.com/watch?v=hlOQuuLYavY [18:29] i'm uploading episode 509 of tekzilla [18:29] joepie91_, what is this, an ad from the 90s? [18:30] SN4T14: maybe, but just watch it :P [18:31] shitty music, really zoomed-in camera panning aimlessly, on-screen text instead of people speaking, etc. [18:31] look at the device being shown [18:31] that's a pretty nifty book scanner [18:32] I am, I'm just making fun of their video. :p [18:32] :P [18:32] anyway, it uses suction / air blowing [18:32] for the page movement [18:32] which is pretty clever [18:32] and lets it scan just about anything without damage [18:33] That is awesome. Better than manually flipping the pages with the DIY scanner. Hahaha! [18:33] ...Until the suction tears off a page from a super-fragile book. :p [18:33] or crushes a page [18:33] doubtful [18:33] when correctly calibrated :P [18:35] That was my first thought, too. [18:35] But, honestly, if we have a super-fragile book. [18:35] I don't think this would be the device taking care of it. [18:35] joepie91_, did you figure out how big a day's worth of Pastebin is? [18:36] It would likely be handed off to restoration/preservation specialists, and they would have specific methods for digitizing it. Depending upon book age, material composition, etc. [18:37] No scanning center in NL [18:37] SN4T14: it's still counting [18:37] SketchCow: aw, shame [18:38] SN4T14: you're getting a historical daily paste collection size since late november last year or so [18:38] lol [18:38] with a gap in there somewhere because my scraper was blocked (and later mysteriously unblocked) [18:50] joepie91_, I think you forgot to upload the scraper to Github: https://github.com/joepie91/pastebin-scrape [18:54] :P [18:54] SN4T14: switch branch [18:54] also [18:54] re-counting [18:54] my SSH conn broke [19:00] * midas bangs head while ruby compiles [19:00] i might end up with a concussion [19:03] midas, stop being silly and switch to Python. :p [19:04] i know :< [19:04] im fixing this STUPID idea my work had [19:04] "lets use clip bucket, it looks like youtube!" [19:04] To use Ruby? :p [19:04] need to install flvtool [19:04] needs ruby 1.8.3 [19:04] rubyforce is down. [19:05] forGe [19:05] apt-get install ruby [19:05] :D [19:05] centos doesnt carry 1.8.3 anymore afaik [19:05] apt-get uninstall centos && apt-get install debian [19:05] :D [19:06] didnt check, just went, oh fuck, we need to compile this and this. [19:06] if only SN4T14 [19:06] IF only [19:06] And are you sure it doesn't just require 1.8.3 and up? [19:06] nope [19:06] last supported is 1.8.3 [19:06] It specifically needs 1.8.3? >.> [19:06] ... [19:07] "seems like a great plan this clipbucket, midas can fix that!" [19:08] Their website looks like a 90s web dev tried to modernize the website [19:08] >.> [19:08] Huh, "modernize" is actually a word. :p [19:09] joepie91_, you really should start using tmux (or screen if you're a peasant :p) [19:10] it's running in screen now [19:11] ..... [19:11] curl: (55) Send failure: Broken pipe [19:11] fuck that [19:11] ffs [19:11] fine, no piping to sprunge then [19:14] midas: good thing we archived rubyforge then :P http://web.archive.org/web/20140513230711/http://files.rubyforge.vm.bytemark.co.uk/ [19:14] true :p [19:29] SN4T14: http://sprunge.us/bWOI [19:30] Is that all uncompressed? [19:30] (I'm probably missing pastes atm, really need to look into this) [19:30] yes [19:30] it's not all that much [19:30] :P [19:30] so yeah, seems roughly 500MB per day [19:30] Yeah, but suddenly it dropped down massively [19:30] SN4T14: that's when my scraper was blocked [19:31] and it seems to now be getting some parts [19:31] But it's still now only getting ~200MB per day [19:31] but not all of it [19:31] yes, I wasn't done talking yet [19:31] lol [19:31] Ah [19:31] haven't had time to fix it [19:31] so looks like its Autsim Pride Day today: http://en.wikipedia.org/wiki/Autistic_Pride_Day [19:31] Is that really something you should feel proud of? [19:32] i don't [19:32] i just found out about it on reddit [19:32] Like, I have nothing against autistic people, but "pride" feels like the wrong word [19:32] my thought exactly [19:32] I find "pride" to be a dubious concept in most contexts [19:32] no different for eg. "gay pride" [19:33] I mean, by all means go crazy with a festival in a city [19:33] but wtf does that have to do with pride [19:33] there is also World Autism Awareness Day: http://en.wikipedia.org/wiki/World_Autism_Awareness_Day [19:34] i have the cnn student news episode that talked about that [19:34] godane, does it have an organziation that pockets most of the donations, too? :p [19:35] i think Autism Speak [19:36] JohnnyJac, your internet is dying [19:36] anyways this episode from CNN Student News about autism day: https://archive.org/details/student.news.2008.04.02.cnn [19:36] JohnnyJac, fix your internet! [19:36] >.> [20:10] http://lowendtalk.com/discussion/29401/centralnic-buys-domain-name-registrar-internet-bs [20:10] well fuck this [20:14] SketchCow, the clown makes another victim: http://beta.slashdot.org/story/203503 [20:15] and fucking shitty backup policy [20:16] yup [20:17] "We don't need backups, Amazon does all that for us!" [20:25] i wouldnt be supprised if there was no DDoS to start with [20:25] more a "hey, im going to clean up this s3 bucket. oops." [20:26] or any "durr, im using cloud i no bakup hurr" [20:28] rm -rf /etc "Hey, Bob, I deleted your et cetera folder because we needed some space!" [20:29] "nothing important in there, right bob?" [20:29] to be fair, offline backup is something a lot of companies don't do; this one is just newsworthy because it involved nerds [20:30] yipdw, you wouldn't even need offline backup, just set up another AWS account and do daily snapshots to Amazon Glacier [20:30] yipdw: offline backup isn't even required [20:30] as long as it's write only [20:31] (that is, on the access level of the server pushing the backup) [20:31] ok, so I used "offline backup" incorrectly [20:31] whateer [20:31] "Write only" being no-modify, also. ;) [20:31] your server should only be able to push backups, not delete/change/retrieve/etc [20:31] point is that backup isn't high on the list for a lot of companies, end [20:31] no fucking distro wars again [20:31] sure, and neither is security or ethics or a million other things that are /supposed/ to be high in priority list [20:31] hopefully this will raise awareness a bit [20:32] because lolmoney [20:32] yipdw, way too small-scale to raise awareness [20:32] it's on pedant central [20:33] I'm sure that helps [20:33] Even Adobe leaking their shittily-protected (yes, that's now a word) password database won't be enough to get people to use proper password storage [20:33] to be fair [20:34] there's now a collective "STOP USING MD5 AND SHA1" movement going on in PHP land [20:34] not that I'm entirely happy about the bcrypt recommendation, but okay [20:34] when will PHP move to PBKDF2, then bcrypt, then scrypt [20:34] oh they skipped ahead heh [20:34] yipdw: bcrypt is natively supported, and has been for some time [20:34] pbkdf2 is natively supported from >=5.5 [20:35] scrypt is not natively supported, but pure PHP implementations exist [20:35] as does a C implementation iirc [20:35] the problem wasn't so much in support [20:35] libscrypt heh [20:35] as it was in culture [20:35] sure [20:35] yipdw, fuck those in-between things, just go straight to scrypt [20:35] always the case [20:35] similar to mysql_ [20:35] PDO has been around for a good time [20:35] but only in the past 1-2 years it gained traction [20:35] that is, /real/ traction [20:36] SN4T14: not sure why you're telling me this, I don't maintain php [20:36] heh [20:36] Also, web devs should check this page for changes every month and update their shit: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet [20:36] also, SN4T14, the caveat with scrypt is that it's had relatively little review [20:36] yipdw, probably because you said "move to PBKDF2, then bcrypt, then scrypt" [20:36] SN4T14: it's a joke [20:38] it's like being at any Comic-Con [20:38] heh [20:39] ...Is that an insult? [20:46] 2.1 Do not limit the character set and set long max lengths for credentials [20:46] 2.2 Use a cryptographically strong credential-specific salt [20:46] it's depressing that we have to have that on the list [20:47] Haha, you should meet my bank [20:47] 6-10 letter passwords, upper- and lowercase letters only [20:49] RedType: does it suggest bcrypt? [20:49] because that'd be kinda hilarious, given that all implementations quietly cut off input after 70 chars [20:49] lol [20:49] or 80 or w/e [20:49] joepie91_, it suggests PBKDF2, bcrypt, and scrypt, depending on your use-case [20:50] joepie91_: if you have to HAVE TO HAVE TO have a limit, i'm pretty sure that 80 characters is okay. i mean, "okay" in a specific sense of the word in that if i see that i wont run screaming from your application [20:51] yes [20:51] 50 characters is a nice long password [20:51] RedType: sure, you wouldn't [20:51] somebody else might [20:51] which is kinda the problem [20:52] people have differentt methods of creating passwords [20:52] added problem is that the cutting off happens /quietly/ [20:52] joepie91_: the fact that it [20:52] nm you beat me [20:52] i was going to say that quiet is the problem [20:53] :P [20:53] ref http://pastebin.com/2Kyh8VXn [20:53] confirmed that other implementations do the same [20:54] nice. [20:55] i'm brute forcing nbc clips for news eve 1999 [20:55] *New Years Eve 1999 [20:56] Speaking of hashes doing weird things, PBKDF2-HMAC does something similar-ish: http://mathiasbynens.be/notes/pbkdf2-hmac [22:30] heh, there are some weird grammatical lapses in Apple Developer docs [22:30] e.g. https://developer.apple.com/library/ios/documentation/AVFoundation/Reference/AVAsset_Class/Reference/Reference.html#//apple_ref/occ/instp/AVAsset/duration [22:31] "If providesPreciseDurationAndTiming is YES the absolute precision, at whatever processing cost that entails–and cost can be significant for certain media formats, such as .mpg." [22:32] Sounds like Apple outsources their dev team. :p [22:33] http://www.reddit.com/r/Bitcoin/comments/28h3z6/us_government_accidentally_reveals_private/ [22:33] "oops" [22:34] from the url I was hoping the next word was "keys" [22:34] boooring [22:34] joepie91_: it's okay, we all delete recalled emails in America [22:34] exmic: disappointing click [22:34] yipdw: hehehe [22:37] I saw a "Recall" email once at my old job [22:37] it was really funny [22:38] because if you're not using Exchange (and we were all supposed to, but we stubbornly kept on accessing the mail servers via IMAP) all it does is say "So-and-So Fucked Up" [22:39] I was surprised that that's all it did; certainly it would be possible to e.g. also delete the email from the IMAP store [22:39] but hey, Exchange [23:07] so i found the mother load of nbc news 2000 clips it looks like