| 00:06.05 | *** join/#utah Hhhhh (n=Hhhhh@158.91.201.220) |
| 00:12.30 | Lone_Wanderer | Anyone here know anything about ringtone file formats? |
| 00:12.59 | nick125 | Lone_Wanderer: what phone? |
| 00:13.06 | Lone_Wanderer | Well, ideally, all. |
| 00:13.11 | nick125 | some use Midi, some use mp3, etc.. |
| 00:13.15 | levi | Some take midi files, some take mp3 files, some have their own format. |
| 00:13.16 | nick125 | I know a few things |
| 00:13.32 | Lone_Wanderer | is it possible to convert between all of them? are the formats open? |
| 00:13.35 | nick125 | levi: mind reader :( |
| 00:14.02 | Lone_Wanderer | or from one format to the others? |
| 00:14.16 | levi | midi and mp3 are documented, at least. I don't know about the rest. |
| 00:14.19 | Lone_Wanderer | I've done some googling but I'm having trouble finding comprehensive info. |
| 00:14.22 | Lone_Wanderer | k |
| 00:15.00 | *** join/#utah linuxalien (n=linuxali@gateway.publicvpn.net) |
| 00:15.03 | levi | ringtones are big business. Even the sites that provide them for free are riddled with obnoxious ads. |
| 00:15.14 | *** part/#utah linuxalien (n=linuxali@gateway.publicvpn.net) |
| 00:15.38 | Lone_Wanderer | I know. |
| 00:15.44 | Lone_Wanderer | I've got an idea that I think will be popular. |
| 00:15.51 | Lone_Wanderer | (No I will not tell you what it is :p) |
| 00:16.58 | nick125 | converting midi->mp3 isnt a good idea though..it will sound just horrible for the file size |
| 00:17.07 | Lone_Wanderer | of course |
| 00:17.15 | Lone_Wanderer | midi is (imho) crap anyway. |
| 00:17.26 | Lone_Wanderer | I'll be using polyphonic anyway. |
| 00:17.46 | nick125 | I think polyphonic tones are midi../me isnt sure |
| 00:17.59 | Lone_Wanderer | I... don't think so. |
| 00:18.15 | Lone_Wanderer | I'm probably wrong but based on what I know about both, I'd be surprised. |
| 00:20.02 | Lone_Wanderer | Maybe I don't mean polyphonic. But I've heard ringtones that play music. Like, an mp3. Which is what I'm looking to do. |
| 00:21.35 | nick125 | the ones that sound like clips of a song are MP3 |
| 00:21.58 | Lone_Wanderer | k |
| 00:22.20 | Lone_Wanderer | so if I want more than just a string of notes, it's got to be mp3? |
| 00:22.53 | nick125 | basically..though polys are pretty decent, not as good as mp3 |
| 00:23.01 | Lone_Wanderer | k |
| 00:23.28 | levi | polyphonic means multiple voices at once, which is possible with midi. Midi may be played with digital samples of instruments or generated waveforms, so the quality of the sound will depend on the phone. |
| 00:23.44 | nick125 | yeah |
| 00:23.46 | Lone_Wanderer | ok |
| 00:23.47 | nick125 | what levi said |
| 00:23.56 | Lone_Wanderer | But you can't have someone, say, singing along in midi. |
| 00:23.58 | Lone_Wanderer | afaik |
| 00:24.12 | nick125 | correct.. |
| 00:24.17 | levi | No, but that usually sounds like crap when it's coming out of a ringing phone anyway. |
| 00:24.30 | Lone_Wanderer | People seem to be willing to pay for it! |
| 00:24.34 | nick125 | yeah |
| 00:24.38 | levi | Indeed. |
| 00:24.45 | Lone_Wanderer | And that's all I care about. |
| 00:24.55 | Lone_Wanderer | Collecting dollars from idiots with too much money to spend. |
| 00:24.59 | nick125 | usually the ringing speakers are pieces of crap in sound quality |
| 00:25.00 | Lone_Wanderer | I mean... |
| 00:25.08 | nick125 | Lone_Wanderer: hahah |
| 00:25.14 | Lone_Wanderer | Strategically placing products in an active market rife with disposable income. |
| 00:25.14 | levi | I hope you are considering royalties and such in your business model. |
| 00:29.22 | Lone_Wanderer | Well. |
| 00:29.27 | nick125 | Lone_Wanderer: I liked the first one better! |
| 00:29.37 | Lone_Wanderer | I'm deliberately skewing what I say here so as not to give away my idea. |
| 00:29.42 | Lone_Wanderer | It's really ridiculously simple. |
| 00:30.09 | Lone_Wanderer | Which presents the problem of "What if a big company duplicates it and stomps me into oblivion." |
| 00:30.25 | nick125 | has anyone done the idea before? |
| 00:30.45 | Lone_Wanderer | not as far as I know |
| 00:30.49 | nick125 | if so, how many patents is your idea violating? |
| 00:31.03 | Lone_Wanderer | but I just came up with it yesterday, so. |
| 00:31.18 | nick125 | Lone_Wanderer: is it a web app btw? if so, what are you gonna develop it in? |
| 00:31.23 | *** join/#utah jakea (n=jakea@128.187.189.244) |
| 00:31.25 | Lone_Wanderer | not a web app |
| 00:31.32 | Lone_Wanderer | but if it were, probably... well, I dunno. |
| 00:31.43 | Lone_Wanderer | I know PHP pretty well but I don't think it has any mp3 editing capabilities *shrugs* |
| 00:31.51 | nick125 | is it WAP? |
| 00:31.58 | Lone_Wanderer | so perhaps python |
| 00:32.06 | nick125 | (aka are people going to access it from their phones) |
| 00:32.10 | Lone_Wanderer | nah |
| 00:32.32 | nick125 | well, how do people access it is what I'm wondering.. |
| 00:32.40 | nick125 | (providing ti doesnt give your idea away) |
| 00:33.10 | Lone_Wanderer | Eh. |
| 00:33.17 | Lone_Wanderer | Better not say too much 'till I've got a prototype going. |
| 00:33.34 | levi | Being secretive about your idea is kind of silly, unless it's something trivial that someone could throw together in a week. |
| 00:33.41 | Lone_Wanderer | It's pretty trivial, honestly. |
| 00:34.07 | nick125 | I wouldnt want to steal your idea anyways because I'm not like that |
| 00:34.09 | levi | Well, then other people will be doing it a week after you do, then, if it's successful at all. |
| 00:34.19 | Lone_Wanderer | I expect to have a prototype together within a week, maybe more if I have to do some research. |
| 00:34.30 | Lone_Wanderer | levi: exactly. |
| 00:34.56 | Lone_Wanderer | Not sure how to deal with that. |
| 00:35.58 | nick125 | If you tell us hte idea, we can help you by improving your idea. |
| 00:37.10 | Lone_Wanderer | I'm pretty paranoid. |
| 00:37.16 | Lone_Wanderer | But... okay. |
| 00:37.31 | Lone_Wanderer | It's pretty simple. |
| 00:37.48 | Lone_Wanderer | People have their friends call a number that connects to a server and they record a message. |
| 00:38.02 | Lone_Wanderer | That message becomes their ringtone. |
| 00:38.27 | Lone_Wanderer | So when Bob calls, the phone plays Bob saying "Ring ring!" or something. |
| 00:38.49 | nick125 | maybe you should market it more as a "make your own ringtone!" thing |
| 00:38.58 | nick125 | actually.. |
| 00:39.07 | Lone_Wanderer | Well, you can make them now. |
| 00:39.15 | Lone_Wanderer | But as far as I can tell, it's just notes. |
| 00:39.29 | nick125 | your idea might be slightly better, as some phones, you can change the ringtone based on whos calling |
| 00:39.41 | Lone_Wanderer | Or a celebrity or something. |
| 00:39.59 | Lone_Wanderer | Well, that's the idea - you set their ringtone to their message. |
| 00:40.05 | nick125 | okay, for the whole calling in thing, use asterisk with some AGI scripts. |
| 00:40.14 | Lone_Wanderer | ok |
| 00:40.18 | Lone_Wanderer | ahhh |
| 00:40.24 | nick125 | what I would think would be cool is a little WAP interface so they can choose what tone they want to download and such |
| 00:40.45 | Lone_Wanderer | yeah |
| 00:40.50 | nick125 | WAP isnt *too* hard to do, its more or so a weird version of HTML |
| 00:40.51 | Lone_Wanderer | well there's obviously a way to download ringtones |
| 00:40.56 | Lone_Wanderer | I've done it before. |
| 00:41.02 | Lone_Wanderer | It's pretty simple. |
| 00:41.03 | nick125 | yeah, they are like regular files on a web server |
| 00:41.19 | Lone_Wanderer | I'm thinking of adding some bells and whistles. |
| 00:41.40 | Lone_Wanderer | An auto-fix to get rid of things like the bump if you hand the phone to someone before they start talking, etc. |
| 00:41.40 | nick125 | use django for the wap interface ;) |
| 00:42.01 | nick125 | basically to post-process the ringtone? |
| 00:42.04 | Lone_Wanderer | yeah |
| 00:42.15 | nick125 | one thing would be to try to remove background noise |
| 00:42.54 | Lone_Wanderer | Just clean it up so it sounds better. |
| 00:42.54 | *** join/#utah elg (n=fugalh@falcon.fugal.net) |
| 00:43.00 | nick125 | maybe make it dynamic? so, the downloader (whos downloading the ringtone) can choose if they want such and such post-processor applied |
| 00:43.09 | Lone_Wanderer | Well. |
| 00:43.17 | Lone_Wanderer | The idea is you'd call in and record it, then it'd play it back. |
| 00:43.32 | nick125 | yeah.. |
| 00:43.48 | Lone_Wanderer | Then you'd get "Push 1 to auto-correct the message. Push 2 to apply special effects to this message. Push 3 to..." |
| 00:43.58 | *** join/#utah spr (n=spr@c-67-169-251-207.hsd1.ut.comcast.net) |
| 00:44.19 | nick125 | I think it would be cool if you offered a deluxe package where the person downloading it can choose the filters applied and can add special effects |
| 00:44.27 | Lone_Wanderer | I'm also thinking of adding a web interface where people can download the messages and mess around with them for more fine-grained control. |
| 00:44.46 | nick125 | basically, on the wap interface, it would be like this: |
| 00:44.52 | nick125 | o Remove background noise |
| 00:44.58 | *** join/#utah wps (n=wps@65.73.113.162) |
| 00:45.08 | nick125 | o Trim |
| 00:45.11 | nick125 | [ Download ] |
| 00:45.32 | nick125 | of course, theres more then that, but, I was just giving an example |
| 00:45.33 | Lone_Wanderer | I wonder how quickly you can send an audio file to a cell phone. |
| 00:45.46 | Lone_Wanderer | Probably pretty quick since they're designed to receive audio in realtime. |
| 00:45.47 | nick125 | depends on phone, carrier, congestion, etc |
| 00:46.03 | nick125 | if its ev-do or edge, its pretty quick |
| 00:46.16 | nick125 | if its gprs or 1x, its basically dialup |
| 00:46.22 | Lone_Wanderer | huh |
| 00:46.30 | nick125 | plus, you have proxies in the mix, so, they could "pre-download" it or something |
| 00:46.43 | Lone_Wanderer | Oh, if it's WAP sure. |
| 00:47.05 | Lone_Wanderer | But if they were calling the server directly... hmm. That may be too much for the phone to handle. |
| 00:47.11 | Lone_Wanderer | Oh. |
| 00:47.16 | Lone_Wanderer | T-shirts are out of the dryer. |
| 00:47.24 | Lone_Wanderer | Need to hang them up for wrinkle-free shirts. |
| 00:51.55 | Lone_Wanderer | And now I need to run to the store. |
| 00:51.59 | Lone_Wanderer | Thanks for your input. |
| 00:52.10 | Lone_Wanderer | Oh. |
| 00:52.17 | Lone_Wanderer | How do I get a phone number assigned to my Asterisk server? |
| 00:53.38 | nick125 | Lone_Wanderer: go to a DID provider and get one from them |
| 00:53.44 | Lone_Wanderer | k |
| 00:53.44 | nick125 | what kind of number are you looking for? |
| 00:53.48 | nick125 | tollfree? |
| 00:53.52 | Lone_Wanderer | Umm. |
| 00:53.58 | Lone_Wanderer | I... don't know. Probably? |
| 00:54.28 | nick125 | I get my tollfree number from asterlink, they are pretty good, and its around 2 cents a minute.. |
| 00:54.37 | Lone_Wanderer | ok |
| 00:54.48 | Lone_Wanderer | how does it work? |
| 00:55.09 | nick125 | asterlink gives you a sip account, then you setup your asterisk box to register with the sip account |
| 00:55.17 | Lone_Wanderer | ok |
| 00:55.31 | nick125 | you only need probably $5 for an account |
| 00:55.35 | Lone_Wanderer | so the asterisk box goes "Hey I'm the one you send 800-xxx-xxxx calls to" |
| 00:55.37 | Lone_Wanderer | sweet |
| 00:55.57 | Lone_Wanderer | what about the server? do I need anything special? |
| 00:56.07 | Lone_Wanderer | I've got a cheap linode server now. |
| 00:57.11 | nick125 | I would be worried about running out of IO and such, I don't know how much IO asterisk uses |
| 00:57.22 | Lone_Wanderer | That's what I was thinking about too. |
| 00:57.23 | nick125 | I would suggest getting something that runs on xen too ;) |
| 00:57.30 | Lone_Wanderer | But for now, I just need something I can run a demo on. |
| 00:57.35 | nick125 | *hint* *hint* |
| 00:57.44 | Lone_Wanderer | virtual machine monitor? |
| 00:58.09 | nick125 | xen VPSes usually perform better then VZ and UML ones.. |
| 00:58.15 | Lone_Wanderer | ahhhh |
| 00:58.23 | Lone_Wanderer | is that your company or something? |
| 00:58.28 | nick125 | UML emulates IO, etc |
| 00:58.50 | Lone_Wanderer | Or rather - is that what your company does? |
| 00:58.53 | nick125 | Lone_Wanderer: I run a VPS provider that utilizes xen, yes.. :) |
| 00:58.58 | Lone_Wanderer | ok |
| 00:58.59 | Lone_Wanderer | cool |
| 00:59.08 | Lone_Wanderer | what company? |
| 00:59.20 | nick125 | atarack communications |
| 00:59.26 | nick125 | the site is in progress.. |
| 01:00.26 | nick125 | I'm gonna make a new site using django thats dyanmic and such |
| 01:01.08 | Lone_Wanderer | k cool |
| 01:01.19 | nick125 | Lone_Wanderer: for a demo, I would suggest a low end plan, our low-end is 64MB, 4GB disk, 50GB bandwidth, 256MB of swap, and is only $9.99/$13.99 (dependnig if you prepay or not) |
| 01:01.27 | Lone_Wanderer | Yeah, "in progress" is a good way to say it ;) |
| 01:01.51 | Lone_Wanderer | What's the first 64 MB for? |
| 01:02.01 | nick125 | ram, sorry, forgot to add that in |
| 01:02.03 | Lone_Wanderer | ahh ok |
| 01:02.29 | Lone_Wanderer | where's your datacenter? |
| 01:02.32 | nick125 | you can run asterisk pretty well on that, the main thing that is going to kill you in a production setup is the encoding/decoding |
| 01:02.47 | nick125 | Lone_Wanderer: we're colocating at vr.org |
| 01:02.50 | Lone_Wanderer | k |
| 01:03.33 | nick125 | I can get a VPS provisioned ni probably..an hour or so too |
| 01:03.37 | Lone_Wanderer | how easy is it to scale up? |
| 01:03.56 | nick125 | to get more RAM/disk/swap? |
| 01:04.00 | Lone_Wanderer | yeah |
| 01:04.04 | Lone_Wanderer | or to move to a dedicated machine |
| 01:04.17 | nick125 | to upgrade the plan, it would be a quick 2 minute reboot |
| 01:04.21 | Lone_Wanderer | k |
| 01:04.51 | Lone_Wanderer | I've got to go eat. Can you email me - dcrookston@gmail.com ? |
| 01:04.57 | nick125 | pull the VM down, resize the partitions, resize the FS, edit the little config file really quickly, pull it back up |
| 01:05.06 | nick125 | Lone_Wanderer: sure, providing my outbound mail is working correctly ;) |
| 01:05.09 | Lone_Wanderer | k |
| 01:05.12 | Lone_Wanderer | thanks for your help! |
| 01:05.23 | nick125 | Lone_Wanderer: sure thing |
| 01:09.44 | *** join/#utah wps (n=wps@65.73.113.162) |
| 01:43.16 | *** join/#utah elg (n=fugalh@falcon.fugal.net) |
| 01:45.53 | nick125 | damnit why don't people listen to me when I say "dont put sodas in the freezer" :/ |
| 01:57.03 | *** join/#utah BL4 (n=Bl4QKUBA@3-1-15.ore.fiber.net) |
| 01:57.14 | nick125 | NO MORE PUTTING PEOPLE IN THE FREEZER!! |
| 01:57.22 | *** join/#utah synic (n=synic@pdpc/supporter/student/synic) |
| 01:57.24 | nick125 | it leaves such as mess.. |
| 01:57.32 | nick125 | next time someoen does it, I'm making them clean it up.. |
| 01:57.35 | BL4 | well, only if you thaw them nick125 |
| 02:28.51 | *** join/#utah RyanE_ (n=ryan@rberick.dsl.xmission.com) |
| 02:46.03 | *** join/#utah RyanE (n=ryan@rberick.dsl.xmission.com) |
| 03:05.40 | *** join/#utah JoeyDay|wgu (n=JoeyDay@c-24-10-190-36.hsd1.ut.comcast.net) |
| 03:06.00 | *** join/#utah BL4 (n=Bl4QKUBA@3-1-15.ore.fiber.net) |
| 03:06.18 | BL4 | wow, I really suck at bzflag |
| 03:06.32 | BL4 | ~lart BL4 |
| 03:07.52 | *** join/#utah RyanE_ (n=ryan@rberick.dsl.xmission.com) |
| 03:09.32 | *** join/#utah elg (n=fugalh@falcon.fugal.net) |
| 03:26.22 | maquis | BL4: you suck enough to get owned by a girl? |
| 03:26.44 | nick125 | lol |
| 03:26.52 | nick125 | that happened to me..once.. |
| 03:27.14 | maquis | nick125: i believe i knew that :) |
| 03:27.54 | nick125 | hehee |
| 03:38.34 | *** join/#utah neybar (n=jalance@thelances.net) |
| 03:42.43 | BL4 | I got owned by a girl? |
| 03:42.52 | BL4 | maquis, whats that about ? |
| 03:43.02 | maquis | BL4: no... i'm asking if you suck enough to get owned by a girl |
| 03:43.13 | BL4 | um, probably in bzflag |
| 03:43.16 | BL4 | wow, I got trashed |
| 03:43.21 | maquis | :) |
| 03:44.22 | *** join/#utah atoponce (n=aaron@c-24-2-85-66.hsd1.ut.comcast.net) |
| 03:44.41 | nick125 | maquis, BL4: how about we test that and see.. |
| 03:45.13 | nick125 | okay, okay, its company server, but, so what |
| 03:45.20 | BL4 | lol |
| 03:45.35 | maquis | nick125: i say we should go for it |
| 03:45.41 | nick125 | how mcuh b/w does bzflag take anyways? |
| 03:46.10 | maquis | nick125: not too much, i believe |
| 03:46.30 | maquis | i'm fairly certain that a lot of the big stuff happens on the client side |
| 03:46.39 | nick125 | I'm uhh..busy with important things... |
| 03:46.42 | nick125 | you know.. |
| 03:47.53 | maquis | alright... what server? |
| 03:48.02 | nick125 | hold up!! its still emerging |
| 03:48.06 | maquis | lol |
| 03:48.08 | BL4 | lol |
| 03:48.28 | nick125 | damnit how do you start the server (so I can start it once its done)? |
| 03:48.38 | maquis | phantom2 is still up if you want to go there |
| 03:48.47 | maquis | phantom2.cs.byu.edu:5154 |
| 03:48.49 | nick125 | its almost done.. |
| 03:49.03 | BL4 | I suppose we could do phantom2.cs.byu.edu |
| 03:49.25 | maquis | nick125: i'd have to look at the scripts running on phantom to help you with starting the server |
| 03:50.17 | nick125 | blah :/ |
| 03:50.33 | nick125 | i think I know how to start a server, its just the configuration of it |
| 03:50.35 | maquis | nick125: BL4: c'mon... just join in at phantom2 |
| 03:50.41 | BL4 | okay |
| 03:50.45 | maquis | nick125: you coming? |
| 03:50.48 | BL4 | I gotta leave here to come... |
| 03:50.49 | BL4 | bye |
| 03:51.56 | *** join/#utah atoponce (n=aaron@c-24-2-85-66.hsd1.ut.comcast.net) |
| 03:52.59 | *** join/#utah jsimpson (n=dataw0lf@64.122.115.184) |
| 03:54.20 | *** join/#utah BL4 (n=Bl4QKUBA@3-1-15.ore.fiber.net) |
| 03:54.42 | BL4 | hmmm |
| 03:55.37 | BL4 | maquis, what was the server name again? |
| 03:59.21 | BL4 | gr... |
| 04:01.15 | *** part/#utah BL4 (n=Bl4QKUBA@3-1-15.ore.fiber.net) |
| 04:01.20 | *** join/#utah BL4 (n=Bl4QKUBA@3-1-15.ore.fiber.net) |
| 04:04.14 | BL4 | ~lart maquis |
| 04:06.33 | *** join/#utah levi_ (n=levi@levi.dsl.xmission.com) |
| 04:07.54 | BL4 | whats up levi |
| 04:08.00 | levi_ | Geez, this government textbook is awful. |
| 04:08.22 | BL4 | well, since you said government and textbook in one sentence, I must agree. |
| 04:12.45 | levi_ | Heh, the little blurb on Hobbes isn't very kind to him. |
| 04:13.06 | BL4 | thats too bad.....Calvin and Hobbes are my favorite :-P |
| 04:14.27 | levi_ | Not that Hobbes. :P |
| 04:14.37 | levi_ | And there's a picture of Saddam looking goofy in the courtroom. |
| 04:15.44 | *** join/#utah JoeyDay_ (n=JoeyDay@c-24-10-190-36.hsd1.ut.comcast.net) |
| 04:15.51 | levi_ | And this table of government types is just wrong. |
| 04:15.56 | BL4 | lol |
| 04:17.13 | levi_ | On one axis, there's the number of people doing the ruling, and on the other there's 'whose interests are represented' |
| 04:18.34 | levi_ | So, apparently, if one person is ruling it's only a monarchy if the interests of the people who are ruled are looked after. And if many people are ruling, it's a citizenry if the interests of the people who are being looked after, but a democracy if the interests of the rulers are being looked after! |
| 04:19.43 | levi_ | And democracy is redefined to include representative governments as well as pure democracy. Which is, of course, necessary if you're going to portray the US as a democracy. |
| 04:20.02 | levi_ | And that definitely seems to be on the agenda. |
| 04:20.51 | *** join/#utah linuxalien (n=linuxali@c-24-2-85-20.hsd1.ut.comcast.net) |
| 04:27.12 | levi_ | Hmm, now there's a longer description of Hobbes and Locke, and it /still/ misrepresents Hobbes. I don't even know why they bother mentioning him. |
| 04:28.39 | levi_ | So, where is everyone tonight? |
| 04:31.24 | mheath | Here :) |
| 04:31.35 | levi_ | Heh, Hobbes clearly must be an agent of the devil, for he made people fear democracy! Or something like that. |
| 04:43.01 | levi_ | Oh geez. This book has a picture from Desperate Housewives. |
| 05:00.47 | jsimpson | would there be interest on a possible presentation at any ug about installing linux on bootable removable/portable media (usb keys, mp3 players, etc) |
| 05:02.06 | maquis | dataw0lf: you're jessica simpson? |
| 05:02.08 | maquis | that's scary |
| 05:02.29 | nick125 | that was good... |
| 05:02.42 | maquis | nick125: you still breathing? |
| 05:02.55 | BL4 | that was very good |
| 05:02.57 | maquis | *cough* |
| 05:03.09 | BL4 | ~lart nick125 |
| 05:03.12 | BL4 | ha ha ha |
| 05:03.16 | maquis | nick125: you must've caught up mighty fast... |
| 05:03.21 | *** part/#utah linuxalien (n=linuxali@c-24-2-85-20.hsd1.ut.comcast.net) |
| 05:03.24 | BL4 | nick125 got his butt kicked |
| 05:03.27 | nick125 | BL4: I don't use wine, nor windows, so, thats impossible |
| 05:03.33 | BL4 | lol |
| 05:03.38 | BL4 | well, I force you to anyways |
| 05:03.38 | nick125 | BL4: yeah, the team score was..7/-1 |
| 05:03.40 | BL4 | bwa ha ha ha |
| 05:03.47 | BL4 | yeah, so my team score sucked... |
| 05:03.48 | maquis | nick125: team score, perhaps... |
| 05:03.49 | BL4 | but I had more kills |
| 05:04.01 | maquis | but... the individual scores had a slightly different story |
| 05:04.08 | nick125 | maquis: oh shut up |
| 05:04.10 | maquis | anyway... i pwnd you both |
| 05:04.17 | nick125 | and I pwned BL4 |
| 05:04.19 | nick125 | so, I'm happy |
| 05:04.20 | nick125 | :P |
| 05:04.23 | BL4 | well, actualy maquis...I caught up to you |
| 05:04.31 | maquis | BL4: true... |
| 05:04.32 | QBFreak | arrr, my palm no longer powers on |
| 05:04.38 | maquis | but i was pwning you the whole time :) |
| 05:04.40 | BL4 | ~lart the palm |
| 05:04.52 | QBFreak | placing it on the charger does not cause it to beep anymore either |
| 05:04.56 | nick125 | QBFreak: thats not good.. |
| 05:04.57 | maquis | nick125: thanks for getting his flag so many times |
| 05:05.03 | BL4 | I was pwning nick125 the whole time |
| 05:05.08 | nick125 | BL4: right.. |
| 05:05.13 | QBFreak | I opened it up, and I can't even see the batteries |
| 05:05.20 | nick125 | >>> games-action/bzflag-2.0.4.20050930-r1 merged. |
| 05:05.21 | maquis | it was quite nice to be able to have him spawn right back at his base while i waited |
| 05:05.21 | nick125 | mmm.. |
| 05:05.33 | BL4 | yeah, that sucked.... |
| 05:05.34 | QBFreak | I really don't want to take the main board out, I'm afraid of disconnecting the display and not being able to get it back on right |
| 05:05.40 | maquis | i just wish my lag wasn't so bad |
| 05:05.59 | BL4 | my lag wasn't bad today...but it being at byu, is like a hop away from me |
| 05:06.08 | nick125 | maquis: whats your ping to noc.atarack.com ? |
| 05:06.17 | QBFreak | you know you're a geek when you take it apart before remembering there's a reset button... |
| 05:06.22 | QBFreak | which did nothing :( |
| 05:06.25 | nick125 | QBFreak: LOL |
| 05:06.26 | maquis | 64 bytes from 64.147.188.69: icmp_seq=0 ttl=49 time=45.461 ms |
| 05:06.58 | nick125 | mmm..I get close to the same pings from byu.edu and noc.atarack.com |
| 05:07.07 | nick125 | maquis: whats your ping to byu.edu |
| 05:07.16 | BL4 | 198 here to noc.atarack.com |
| 05:07.29 | BL4 | 64 bytes from 128.187.22.132: icmp_seq=0 ttl=57 time=172.592 ms |
| 05:07.34 | BL4 | I suppose I'm not maquis... |
| 05:07.55 | nick125 | from noc.atarack.com to byu.edu |
| 05:07.55 | nick125 | 64 bytes from acs2.byu.edu (128.187.22.132): icmp_seq=8 ttl=46 time=23.2 ms |
| 05:08.08 | BL4 | I have horrible pings |
| 05:08.08 | QBFreak | BL4: you're not? wow, that actually explains a lot... |
| 05:08.33 | maquis | 64 bytes from 128.187.22.132: icmp_seq=1 ttl=46 time=62.043 ms |
| 05:08.47 | BL4 | QBFreak, I suppose I'm not QBFreak either... |
| 05:08.51 | BL4 | what is my world coming too? |
| 05:08.54 | nick125 | so we're playing noc.atarack.com next time :p |
| 05:09.03 | QBFreak | which is a relief, if you were I'd have no idea who I was |
| 05:09.08 | maquis | nick125: sounds good :) |
| 05:09.21 | nick125 | by then, I'll figure uot how to set it up |
| 05:09.28 | nick125 | until then, I got to finish this website up |
| 05:10.26 | BL4 | well, that was fun everybody....night all |
| 05:10.31 | nick125 | night.. |
| 05:10.36 | QBFreak | laters BL4 |
| 05:11.25 | nick125 | QBFreak: what business? |
| 05:11.30 | nick125 | like, what field? |
| 05:11.37 | QBFreak | computers |
| 05:11.39 | QBFreak | :) |
| 05:11.58 | QBFreak | contract programming, maybe some hardware related things |
| 05:12.12 | QBFreak | I just want to be able to do things on the side and not have to get paid under the table |
| 05:12.21 | nick125 | QBFreak: need some hosting for your site? :) |
| 05:12.41 | QBFreak | nope, I've got more bandwidth and disk space where qbfreak.net is than I seem to be able to use :) |
| 05:13.04 | QBFreak | just need to register a new domain :) |
| 05:13.08 | nick125 | but, you don't have root access there, do you? |
| 05:13.17 | QBFreak | nope, and so far I havn't needed it |
| 05:13.31 | QBFreak | the shell access they give me has been adequate |
| 05:13.40 | nick125 | how much are you paying them and for what? |
| 05:14.07 | QBFreak | lesse here... |
| 05:15.28 | QBFreak | 19.95/mo (prepaid for a year) for 60GB of disk (grows by 480MB/week), 1.6TB of bandwidth (grows by 16GB/week) |
| 05:15.44 | nick125 | not bad.. |
| 05:15.47 | QBFreak | 12000 email accounts, 375 shell/ftp users |
| 05:16.06 | QBFreak | unlimited domains/subdomains |
| 05:16.11 | nick125 | if you ever need a VPS for testing and such, or if you have a customer that is looking for a cheap way to get root access, send them my way, okay? :) |
| 05:16.23 | QBFreak | I'll keep it in mind :) |
| 05:16.45 | QBFreak | personally I like being able to pay someone else a reasonable amount to handle all of the server upkeep :) |
| 05:17.00 | nick125 | we offer managed services too :) |
| 05:18.35 | QBFreak | the price and the space and all that, was a special they were (actually still are) running, even if they go back to the original prices and quotas, I get to keep what I've got at waht I'm currently paying, for the life of account |
| 05:18.51 | nick125 | not bad.. |
| 05:19.14 | QBFreak | and if that wasn't enough, they quadroupled the disk and octopuled the bandwidth right after I signed up, and they gave me (and everyone else on this plan) the new quotas |
| 05:19.28 | QBFreak | not just new customers, but all the existing ones too |
| 05:21.20 | QBFreak | I seem to have won a yahoo lottery, organized by "MSN & YAHOO LOTTORY INTL INC." in the UK, but somehow it all has to go through africa... |
| 05:21.36 | maquis | QBFreak: lol |
| 05:21.39 | QBFreak | this isn't just fishy, there's like a whole aquariam in this thing... |
| 05:21.51 | *** join/#utah dataw0lf (n=dataw0lf@64.122.115.184) |
| 05:21.58 | QBFreak | yahoo partnering with MSN? like that will ever happen |
| 05:22.03 | nick125 | lol |
| 05:22.11 | QBFreak | I never purchased a lottery ticket |
| 05:22.15 | QBFreak | and they can't even spell lottery! |
| 05:22.20 | QBFreak | (either that or I can't) |
| 05:22.24 | nick125 | lottory..mmm |
| 05:22.28 | elg | so who's recording an album this month? |
| 05:22.35 | nick125 | yeah, its spelt lottory |
| 05:22.38 | elg | http://narmo.org/ |
| 05:22.39 | brac | [NARMo] |
| 05:23.16 | QBFreak | google definitions has a lot more hits for lottery than lottory |
| 05:23.57 | QBFreak | it changes back and forth through the email |
| 05:24.04 | elg | ~spell lottery |
| 05:24.13 | elg | ~spell lottory |
| 05:24.25 | elg | there you have it, the final word. |
| 05:24.45 | QBFreak | heh, there's a warning at the bottom about 'fradulent emails' |
| 05:25.27 | QBFreak | where oh where are the periods! "YAHOO, collects all the E MAIL I D of the people that subscribes to yahoomail, msn, hotmail, aol, altavista, and others online, among the billions that subscribe to us only five people will be merge for winnings we only select five people every Month as our winners through electronic balloting System without the winner applying, we are congratulating you for having been one of the lucky people that w |
| 05:25.44 | elg | um, are you sure this is from yahoo? :) |
| 05:25.47 | *** part/#utah elg (n=fugalh@falcon.fugal.net) |
| 05:25.49 | *** join/#utah elg (n=fugalh@falcon.fugal.net) |
| 05:25.57 | QBFreak | elg: I'm pretty sure its NOT :) |
| 05:26.15 | elg | oh, I hadn't been paying attention. you did imply that i guess |
| 05:26.39 | QBFreak | who wants to provide their bank info to collect the 450,000 for me? I'll give you 450.00 for the trouble :) |
| 05:26.47 | QBFreak | assuming of course I get my money... |
| 05:27.31 | dataw0lf | so i timed out, what about the removable media pres? |
| 05:27.35 | QBFreak | oh wait, I'm disqualified: "ANY BREACH OF CONFIDENCIAL DISQULIFIES YOU FROM GETTING YOUR PRIZE." |
| 05:27.46 | nick125 | QBFreak: haha |
| 05:27.59 | QBFreak | so much for getting rich quick... |
| 05:28.00 | nick125 | what is CONFIDENCIAL |
| 05:28.09 | QBFreak | I'll have to wait for another wealthy person to need my bank account |
| 05:30.41 | QBFreak | there is a lottery.yahoo.com but it appears to only be lottery results, not an actual lottery |
| 05:31.33 | QBFreak | gotta love companies that lie to try and hire you... |
| 05:31.43 | QBFreak | "After reviewing your resume on Careerbuilder, I feel that you possess many of the qualities that we are looking for at this time." |
| 05:31.59 | QBFreak | how on earth does my resume reflect that I have good qualities for _sales_ ? |
| 05:35.49 | dataw0lf | Commission rates |
| 05:36.06 | dataw0lf | employee awards, achievements |
| 05:36.33 | dataw0lf | 'Led the 2005 fiscal year in sales' |
| 05:36.41 | QBFreak | none of that is on my resume :p |
| 05:37.06 | dataw0lf | oops. I misread :| |
| 05:37.30 | QBFreak | did you even look at my resume? :) (its out there, not hard to find) |
| 05:38.24 | dataw0lf | no, no, I thought you meant how could a resume represent talent in sales. |
| 05:38.44 | QBFreak | I have no talent or experience in sales :p |
| 05:38.47 | dataw0lf | I don't usually look for resumes, I just receive em. |
| 05:38.48 | QBFreak | and no desire |
| 05:39.01 | dataw0lf | QBFreak: ok, I didn't say you did. |
| 05:39.03 | dataw0lf | And don't care. |
| 05:39.04 | dataw0lf | shower time. |
| 05:39.05 | QBFreak | hehe |
| 05:39.07 | QBFreak | laters |
| 05:43.04 | *** join/#utah nick125_lappy (n=nick@dsl093-220-003.abq1.dsl.speakeasy.net) |
| 05:43.09 | nick125_lappy | mmm |
| 06:01.16 | tensai | very interesting. http://www.linux.com/article.pl?sid=06/05/01/2235242 |
| 06:01.36 | tensai | brac: you awake? |
| 06:01.36 | brac | who knows? |
| 06:01.50 | tensai | article on new features in vim 7 |
| 06:03.32 | maquis | ~dog tensai |
| 06:03.34 | ibot | ACTION stares at tensai until tensai whimpers and pees all over himself. |
| 06:03.52 | tensai | ~bite maquis |
| 06:03.53 | ibot | ACTION takes a big bite out of maquis's jugular vein |
| 06:06.33 | maquis | the undo looks interesting... |
| 06:06.56 | maquis | tabs don't look all that interesting... |
| 06:07.40 | tensai | code completion and undo branches. I'm excited to see how it works. |
| 06:08.45 | maquis | yeah... |
| 06:08.51 | maquis | those are the same ones i thought sounded interesting |
| 06:09.20 | maquis | i'm still waiting for them to implement an undo that doesn't die when you quit or close the file |
| 06:10.42 | tensai | the term undo branch makes me think of rcs style branches where you can track different versions. sometimes I juggle multiple changes and it gets complicated. |
| 06:11.29 | tensai | maquis: stop closing vim. problem solved. |
| 06:12.08 | maquis | tensai: yeah... hard to do on laptops, though |
| 06:13.19 | tensai | especially when you plug your laptop into a port controlled by a lightswitch |
| 06:13.22 | *** join/#utah JoeyDay_ (n=JoeyDay@c-24-10-190-36.hsd1.ut.comcast.net) |
| 06:13.39 | tensai | haven't figured out why the lamp wasn't plugged into that one instead |
| 06:15.10 | levi_ | Hmm, vim 7. |
| 06:15.18 | levi_ | I'll stick with emacs, thanks. :) |
| 06:18.05 | tensai | benadryl |
| 06:54.18 | *** join/#utah xbmodder_lappy (i=nobody@xbmodder.us) |
| 07:25.24 | *** part/#utah bertbob (n=bertbob@c-67-166-126-128.hsd1.ut.comcast.net) |
| 07:51.29 | *** join/#utah SpecialK (n=Bob@63-226-97-120.slkc.qwest.net) |
| 08:22.30 | *** join/#utah bertbob (n=bertbob@c-67-166-126-128.hsd1.ut.comcast.net) |
| 12:50.21 | mheath | ew, whites... |
| 13:22.11 | *** join/#utah elg (n=fugalh@falcon.fugal.net) |
| 13:37.08 | *** join/#utah RyanE (n=ryan@rberick.dsl.xmission.com) |
| 13:51.13 | *** join/#utah Cubeyfreak (n=qbfreak@cpe-069-132-229-120.carolina.res.rr.com) |
| 14:35.18 | *** join/#utah tiwula (n=lane@208.64.90.18.utahbroadband.com) |
| 14:40.59 | *** join/#utah Kuyaedz (n=Crister@65.106.115.194.ptr.us.xo.net) |
| 14:41.08 | Kuyaedz | anyone good with iptables in here? |
| 14:44.33 | ScytheBlade1 | Depends |
| 14:45.03 | Kuyaedz | I know the basic syntax to DROP by IP, how can I expand that to country-wide IP? |
| 14:45.14 | Kuyaedz | I keep getting hit by damn turkish hackers |
| 14:45.26 | ScytheBlade1 | Heh |
| 14:45.29 | ScytheBlade1 | So that's you |
| 14:45.47 | ScytheBlade1 | Unless you know every IP used by that country |
| 14:45.48 | Kuyaedz | got hit again last nite by different IP. I'm pissed |
| 14:45.54 | ScytheBlade1 | Or their subnet |
| 14:46.04 | ScytheBlade1 | It's... rather hard to "block by country" |
| 14:46.14 | Kuyaedz | can't you open it up like XX.XX. -j DROP |
| 14:46.24 | ScytheBlade1 | Well, that means knowing their subnet |
| 14:47.18 | ScytheBlade1 | (How can you be sure that XX.XX.XX.XX/16 is them?) |
| 14:47.43 | Kuyaedz | any way to find out the subnet? |
| 14:48.18 | ScytheBlade1 | Not that I know of |
| 14:48.33 | Kuyaedz | ...its going to be a long day |
| 14:48.50 | ScytheBlade1 | I'd just find out what they're breaking |
| 14:48.52 | ScytheBlade1 | And fix it ;) |
| 14:48.55 | Kuyaedz | they're using a vhcs vulnerability that's a mile wide. I'm going to have to drop it |
| 14:49.20 | ScytheBlade1 | Ouch. |
| 14:49.33 | ScytheBlade1 | Stick vhcs under password protection? |
| 14:49.42 | ScytheBlade1 | Not like login, like htaccess/browser sessions |
| 14:50.39 | Kuyaedz | they've got some javascript hack that can create an admin user in the vhcs Db--any vhcs Dv |
| 14:50.55 | Kuyaedz | from there he creates ftp users and starts replacing index pages |
| 14:51.13 | ScytheBlade1 | Right, so you stick the page in question under htaccess |
| 14:52.02 | ScytheBlade1 | That'll at least keep it from happening again, until you can get it fixes |
| 14:52.38 | Kuyaedz | just simple .htaccess login prompt? ..that would work for now |
| 14:52.44 | ScytheBlade1 | Yup |
| 14:52.56 | ScytheBlade1 | If you have customers, just drop them all an e-mail with the user and password |
| 14:53.08 | Kuyaedz | I've got people buggin' me about their web design not being finished and I want to rip their freakin' heads off. |
| 14:53.13 | Kuyaedz | I've got other things to worry about right now |
| 14:53.13 | ScytheBlade1 | if it happens again, well, then you have bigger problems, as it's your customers butchering your services ;) |
| 14:54.14 | ScytheBlade1 | But that ought to work fine for now |
| 14:54.14 | Kuyaedz | http://www.rs-labs.com/exploitsntools/rs_vhcs_simple_poc.html |
| 14:54.33 | Kuyaedz | can you say FA-REAKIN' huge security hole? check the link. care to hack ANY vhcs page? |
| 14:55.04 | ScytheBlade1 | " |
| 14:55.04 | ScytheBlade1 | <PROTECTED> |
| 14:55.04 | ScytheBlade1 | perhaps the best known professional control panel software being open source |
| 14:55.04 | ScytheBlade1 | and an excelent choice for shared, reseller, virtual and dedicated server |
| 14:55.04 | ScytheBlade1 | management." |
| 14:55.07 | ScytheBlade1 | And they have this |
| 14:55.17 | Kuyaedz | no kidding |
| 14:55.31 | ScytheBlade1 | "The vendor issued a new security patch (a.k.a. "v.2"), correcting the XSS |
| 14:55.31 | ScytheBlade1 | problems, and refused to explain what the real bug supposedly being fixed was, |
| 14:55.32 | ScytheBlade1 | either publicly neither privately. Moreover, they didn't inform its own users |
| 14:55.32 | ScytheBlade1 | of the problems with security patch v.1 and indeed they simply replaced the |
| 14:55.32 | ScytheBlade1 | old patch (v.1) with the new one (v.2), without changing filename nor issuing |
| 14:55.32 | ScytheBlade1 | any kind of warning. I'm differentiating them here by adding the "v.#" suffix." |
| 14:55.39 | ScytheBlade1 | I'd almost say switch products |
| 14:55.41 | Kuyaedz | my vhcs install is two days old |
| 14:55.45 | ScytheBlade1 | ... |
| 14:56.23 | ScytheBlade1 | wow |
| 14:56.23 | ScytheBlade1 | When the administrator reviews the logs, his/her password will be automati- |
| 14:56.23 | ScytheBlade1 | cally changed to "hackme". |
| 14:56.27 | Kuyaedz | I will switch products although I do like the functions available so far. |
| 14:57.01 | ScytheBlade1 | Be glad that's all your being hit with... |
| 14:57.01 | ScytheBlade1 | http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt |
| 15:11.56 | Kuyaedz | well back to the drawing board I guess. I don't have time for this |
| 15:27.00 | Kuyaedz | .htaccess is in place.. |
| 15:27.19 | Kuyaedz | hopefully that'll give me enough time to get off the mirror server (which is slower) |
| 15:32.27 | *** join/#utah spr (n=spr@c-67-169-251-207.hsd1.ut.comcast.net) |
| 15:36.30 | Kuyaedz | thanks for the tip ScythBlade1. |
| 15:37.05 | ScytheBlade1 | Sure |
| 15:37.10 | ScytheBlade1 | Note that you're still rather broken... but... |
| 15:37.12 | ScytheBlade1 | it works for now |
| 15:38.01 | Kuyaedz | Yeah, I figure I'm partially crippled either way but this should give me enough time to get back on my feet. |
| 15:59.10 | tensai | Kuyaedz: looks like turktelekom has 85.96.0.0/12. that would go a long way toward blocking the whole country. |
| 16:00.01 | tensai | but heck, if this server is just for people in the states you could block all of 85/8 which will all be in Europe |
| 16:01.43 | Kuyaedz | I could get occasional expected traffic from france.. |
| 16:03.29 | Kuyaedz | I'll try the turktelecom subnet in iptables--thanks |
| 16:12.28 | xbmodder_lappy | why france? |
| 16:12.58 | Kuyaedz | have a brother in france right now. He rarely does, but occasionally checks the family blog |
| 16:23.34 | tensai | 85/8 won't cover all of europe, but there's no way to tell which part without enumerating all the subnets. yuck. |
| 16:23.57 | tensai | well, I guess I ought to head off to work... |
| 16:24.01 | tensai | ~lart maquis |
| 16:24.05 | Kuyaedz | thanks |
| 16:26.27 | elg | -lart tensai |
| 16:52.11 | *** join/#utah RyanE_ (n=ryan@rberick.dsl.xmission.com) |
| 17:10.45 | *** join/#utah amcnabb (n=amcnabb@c-67-169-251-207.hsd1.ut.comcast.net) |
| 17:17.08 | *** join/#utah SpecialK (n=Bob@63-226-97-120.slkc.qwest.net) |
| 17:33.45 | maquis | -lart SpecialK |
| 17:43.53 | *** join/#utah linuxalien (n=linuxali@gateway.publicvpn.net) |
| 17:46.44 | SpecialK | ~lart maquis |
| 18:20.10 | *** join/#utah TacoJockey (n=linuxali@gateway.publicvpn.net) |
| 18:28.15 | *** join/#utah tristanbob (n=tristanb@c-24-2-87-219.hsd1.ut.comcast.net) |
| 18:52.21 | *** join/#utah linuxalien (n=linuxali@gateway.publicvpn.net) |
| 19:28.22 | maquis | zsh: command not found: vim |
| 19:28.26 | maquis | hmmm |
| 19:31.03 | nick125_lappy | is that a good or bad thing? |
| 19:31.11 | maquis | bad... but it's fixed |
| 19:31.42 | nick125_lappy | mm.. |
| 19:31.45 | maquis | *grumble* |
| 19:40.00 | *** join/#utah hatchmt (n=mhatch@63-230-17-89.slkc.qwest.net) |
| 19:40.14 | *** join/#utah nick125_ (n=nick125@unaffiliated/nick125) |
| 19:49.26 | *** join/#utah tristanbob_ (n=tristanb@c-24-2-87-219.hsd1.ut.comcast.net) |
| 19:59.24 | *** part/#utah linuxalien (n=linuxali@gateway.publicvpn.net) |
| 20:15.00 | maquis | hmmm |
| 20:15.10 | maquis | most overused phrase in my vocabulary: |
| 20:15.12 | *** join/#utah amcnabb (n=amcnabb@c-67-169-251-207.hsd1.ut.comcast.net) |
| 20:15.15 | maquis | "it shouldn't be that hard" |
| 20:15.22 | nick125_ | haha |
| 20:15.37 | maquis | i'm serious |
| 20:15.44 | maquis | i've used that phrase *so* much recently |
| 20:15.49 | maquis | and the problem is... |
| 20:16.08 | maquis | i usually end up saying it because i'm wrong |
| 20:35.47 | *** join/#utah RyanE (n=ryan@rberick.dsl.xmission.com) |
| 20:42.34 | goozbach | ok this is cool!!! |
| 20:42.43 | Kuyaedz | whats that |
| 20:42.51 | goozbach | I'm IRCing on my TV |
| 20:43.00 | Kuyaedz | right on |
| 20:43.33 | maquis | goozbach: lol |
| 20:44.33 | goozbach | with PIP |
| 20:45.00 | *** join/#utah hatchmt (n=mhatch@63-230-17-89.slkc.qwest.net) |
| 20:45.25 | findlay | pip |
| 20:45.31 | findlay | ~pip |
| 20:45.32 | ibot | well, pip is the sexiest nerd... only a little out of Jen-ni's age range =oP |
| 20:46.32 | goozbach | picture in picture |
| 20:46.54 | emcnabb | goozbach: I bet you're getting a lot more use out of your TV now :-) |
| 20:49.07 | goozbach | emcnabb: yup |
| 20:50.33 | findlay | hey goozbach look at that! VVV |
| 20:51.15 | findlay | sweet I'm special enough to get screen time on goozbach's TV. I feel so special |
| 20:51.32 | goozbach | <PROTECTED> |
| 20:51.36 | goozbach | <PROTECTED> |
| 20:51.42 | goozbach | problem solved |
| 20:51.51 | ScytheBlade1 | /ignore findlay |
| 20:51.54 | ScytheBlade1 | I can do it without the space ; |
| 20:51.56 | ScytheBlade1 | * ;) |
| 20:52.33 | findlay | now that's special |
| 20:55.16 | nick125_ | haha |
| 20:55.30 | nick125_ | I can do it without the space too! |
| 20:55.37 | nick125_ | whoops |
| 20:55.40 | ScytheBlade1 | Good job |
| 20:55.43 | ScytheBlade1 | You ignored him ;) |
| 20:55.49 | nick125_ | 13:56 Ignoring ALL from findlay |
| 20:56.42 | *** join/#utah levi_ (n=levi@levi.dsl.xmission.com) |
| 20:57.42 | emcnabb | I ran that command several months ago: one of the best decisions I ever made |
| 20:57.56 | nick125_ | really? |
| 20:57.59 | nick125_ | does itwork well? |
| 20:58.04 | emcnabb | I'm just kidding |
| 20:58.18 | nick125_ | I should try it |
| 20:58.24 | emcnabb | I've thought about blocking findlay, but I never had the heart to do it |
| 20:58.27 | emcnabb | :-) |
| 20:58.35 | nick125_ | http://atarack.com/ < what do you think of that layout? any suggestions? |
| 20:59.02 | Kuyaedz | uhm.. no .css? |
| 20:59.13 | nick125_ | huh? |
| 20:59.38 | Kuyaedz | I'm assuming its not supposed to look like what I'm seeing.. let me try IE |
| 20:59.39 | ScytheBlade1 | Wow |
| 20:59.44 | ScytheBlade1 | You're broken good and proper |
| 21:00.02 | ScytheBlade1 | <PROTECTED> |
| 21:00.02 | ScytheBlade1 | <PROTECTED> |
| 21:00.02 | ScytheBlade1 | <PROTECTED> |
| 21:00.02 | ScytheBlade1 | <PROTECTED> |
| 21:00.03 | ScytheBlade1 | <PROTECTED> |
| 21:00.30 | nick125_ | oh be quiet..Iknow that stupid thing is broken |
| 21:00.42 | Kuyaedz | sorry bud. looks proper busted in IE and FF |
| 21:00.54 | nick125_ | I think its the stupid php breakin :/ |
| 21:01.05 | goozbach | ha ha |
| 21:01.08 | ScytheBlade1 | static.atarack.com = DNS unresolvable |
| 21:01.36 | nick125_ | wtf |
| 21:02.15 | nick125_ | what the.. |
| 21:03.00 | Kuyaedz | nick125_:this is why we ask these questions, so we make sure its all workin' |
| 21:03.13 | nick125_ | some stupid moron broke PHP, thats first |
| 21:03.24 | nick125_ | second, the stupid DNS isnt working |
| 21:03.42 | nick125_ | and, because php is screwed up, I cant access PMA |
| 21:04.04 | ScytheBlade1 | That's why I don't trust resellers with their control panels |
| 21:04.12 | ScytheBlade1 | I'd rather do it myself over SSH, thanks |
| 21:04.21 | nick125_ | lol |
| 21:04.35 | nick125_ | thats why I've only sold 1 directadmin license |
| 21:04.59 | nick125_ | well, not sold, but, are leasing for use on a VPS.. |
| 21:05.39 | *** join/#utah dilvie (n=dilvie@c-67-161-255-229.hsd1.ut.comcast.net) |
| 21:05.57 | dilvie | w00t |
| 21:06.02 | dilvie | http://www.makepassword.com/ <-- new design |
| 21:06.06 | dilvie | what do you guys think? |
| 21:06.36 | nick125_ | not bad.. |
| 21:06.38 | Kuyaedz | cool |
| 21:07.09 | *** join/#utah zzzirk (n=lzirkel@c-67-164-251-162.hsd1.ut.comcast.net) |
| 21:07.19 | dilvie | any of you guys ruby on rails developers? |
| 21:07.27 | dilvie | I'm going to add some neat functionality with RoR. |
| 21:07.36 | nick125_ | no..I do use django though.. |
| 21:09.51 | Kuyaedz | I'll use that page next time I need to change passwords |
| 21:09.59 | dilvie | cool... I don't know much about python. |
| 21:10.03 | dilvie | what's it like? |
| 21:10.20 | goozbach | http://www.friocorte.com/talam/photo?photo_id=8343 |
| 21:10.27 | dilvie | kuyaedz: thanks. =) |
| 21:10.43 | nick125_ | dilvie: its somewhat like RoR, except its python, and its not as automatic as RoR on some things |
| 21:11.03 | Kuyaedz | dlvie: Last time I just used the random password generator in gnome, but thats a nice page. good job. |
| 21:11.27 | dilvie | nick12_: yeah, I figured that much, but what is _python_ itself like? |
| 21:11.39 | dilvie | what are the defining features of python? |
| 21:12.01 | nick125_ | its pretty clean syntax, its widely used, it has a ton of modules |
| 21:13.04 | dilvie | Kuyaedz: there's a posix command line tool called makepasswd that I used to use frequently, but I got sick of it because I often didn't like the password it gave me. |
| 21:13.13 | dilvie | I'd have to run it six times to find one I liked. |
| 21:13.26 | dilvie | =P |
| 21:13.29 | dilvie | that was lame. |
| 21:13.35 | nick125_ | how does it generate the passwds? |
| 21:13.35 | levi_ | dilvie: Python is like Ruby with stricter indentation-based syntax and no closures. |
| 21:14.14 | nick125_ | yeah, that works too.. |
| 21:15.00 | nick125_lappy | I wish PMA was ajax.... |
| 21:15.46 | dilvie | nick125_: MakePassword uses common english constructs, like word prefixes, dipthongs, consonant pairs, postfixes, etc.. |
| 21:16.12 | nick125_ | there, static.atarack.com works..try http://atarack.com again |
| 21:16.22 | nick125_ | dilvie: what's it written in now? |
| 21:16.49 | dilvie | nick: it picks a random prefix, selects a random vowel or dipthong, then consonant, then postfix |
| 21:17.02 | dilvie | right now it's 100% client-side |
| 21:17.21 | dilvie | so passwords are never transmitted over the wire. |
| 21:18.32 | nick125_ | interesting... |
| 21:19.52 | nick125_ | what is your plan for using RoR? |
| 21:20.25 | dilvie | That's a secret. ;) |
| 21:20.44 | dilvie | ehehe, actually, it's pretty obvious. I've only solved half of the password problem with tihs. |
| 21:20.48 | dilvie | this, rather. |
| 21:20.53 | nick125_ | aw, come on..tell |
| 21:21.01 | dilvie | the other half is an online password manager. |
| 21:21.09 | nick125_ | oo..sounds cool |
| 21:21.42 | dilvie | yeah.. there are some other online password managers out there, but they all suck. |
| 21:21.46 | dilvie | Mine won't suck. |
| 21:21.48 | dilvie | =) |
| 21:22.01 | nick125_ | can I help with making it not suck :P |
| 21:22.24 | nick125_ | are you going to use MD5 or SHA1? |
| 21:22.26 | dilvie | How can you help? |
| 21:23.01 | nick125_ | no clue :P |
| 21:23.09 | dilvie | I'm not sure about encryption, yet. I need 2-way encryption for password storage, of course. |
| 21:23.33 | nick125_ | blowfish with a per-account hash maybe? |
| 21:23.38 | dilvie | I'll use a one way hash for login authentication. |
| 21:23.44 | nick125_ | so each account has a different blowfish hash |
| 21:24.30 | nick125_ | so if one blowfish hash gets exploited somehow, it only exploited one account |
| 21:24.32 | dilvie | I'm not familiar with the peer account hash concept. |
| 21:24.38 | dilvie | ah. |
| 21:25.19 | nick125_ | each account in your system has a blowfish hash, that is used to encrypt the passwords in blowfish for that account. |
| 21:25.29 | elg | dilvie: hey, I'm a rails dev |
| 21:25.31 | dilvie | yeah. |
| 21:25.34 | dilvie | elg: w00t |
| 21:25.50 | nick125_ | then, to decode the password,it grabs the account hash and password hash, and decodes it |
| 21:25.54 | dilvie | elg: yay, now I know who to spam with newbie questions. ;) |
| 21:25.59 | nick125_ | dilvie: I seriously think you should code it in pythonthough ;) |
| 21:26.35 | dilvie | nick125_: well, one of the reasons I want to code it in RoR is that a lot of my freelance clients are looking for RoR developers. |
| 21:26.46 | elg | shoot any time. there's a utah ruby users group with one of the core rails devs too |
| 21:26.48 | dilvie | demand for RoR is crazy. |
| 21:26.53 | nick125_ | yeah.. |
| 21:27.02 | nick125_ | RoR is the ONLY reason ruby is where it is today.. |
| 21:27.09 | dilvie | no doubt. |
| 21:27.15 | elg | Ruby is the only reason RoR is where it is today. ;-) |
| 21:27.16 | levi_ | I'm going to have to break down and learn Ruby and RoR. |
| 21:27.28 | dilvie | ruby was just futzing along until RoR blew up. |
| 21:27.29 | nick125_ | if something such as django got to the market first, ruby wouldbe nowhere |
| 21:27.35 | elg | it's symbiotic |
| 21:27.48 | levi_ | nick125: Not necessarily. |
| 21:27.50 | nick125_ | without RoR, Ruby would have never gone anywhere. |
| 21:27.54 | elg | ruby was steadily growing, but yes, rails has really brought it to the forefront. I'm just saying it's not a mistake rails is written in ruby |
| 21:28.13 | nick125_ | levi_: not exactly, but, it wouldn't be where it is today.. |
| 21:28.29 | elg | nick125_: that's like saying without Windows C++ wouldn't be where it is today |
| 21:28.30 | levi_ | nick125: I don't think you have any way of knowing that. |
| 21:28.34 | dilvie | there's a team working on an RoR clone for server-side javascript |
| 21:28.50 | dilvie | laugh all you want, but javascript actually has some neat oo features. |
| 21:28.53 | levi_ | There are people working on RoR clones in all sorts of languages and platforms and such. |
| 21:28.54 | dilvie | prototypes rock. |
| 21:29.19 | levi_ | Javascript is a cool language hampered by the fact that its implementations are largely web browsers. |
| 21:29.20 | elg | yeah, js has some surprisingly neat features |
| 21:29.29 | dilvie | levi_: absolutely. |
| 21:29.39 | nick125_ | yeah |
| 21:29.44 | elg | it's like finding out one of the kernel hackers has been incognito in your local LUG |
| 21:29.55 | dilvie | elg: haha |
| 21:30.08 | nick125_ | lol |
| 21:30.38 | elg | anyway, if you want to pick up rails, get the book from the pragprog |
| 21:31.04 | elg | if you want to be efficient about it, that is |
| 21:31.07 | dilvie | elg: incidentally, I don't think your C++/windows analogy fits. C++ was already hugely popular, with few serious contenders when windows took off. |
| 21:31.15 | dilvie | elg: that's not the case with RoR. |
| 21:31.20 | elg | yeah, you're right. I was lazy in my analogy :) |
| 21:31.34 | dilvie | elg: ruby was about the same level as python before RoR |
| 21:31.36 | elg | but the point is, as popular as rails is, ruby was and is growing independently |
| 21:31.47 | dilvie | it really was the killer app that brought it into the limelight. |
| 21:31.57 | elg | actually they would have loved to be considered on par with python. Python was the smug big brother who always stole the limelight |
| 21:31.57 | nick125_ | I'm not saying that ruby or rails aren't any good, I find them really cool, and, I've programmed ruby before, but, I'm just saying that RoR is the thing that made ruby popular, and took it to where it is today |
| 21:32.08 | elg | what limelight there was for dynamic scripting languages |
| 21:32.16 | levi_ | And the popularity of RoR was not just based on its technical merits. |
| 21:32.39 | nick125_ | correct. I blame those cool screencasts. |
| 21:33.02 | levi_ | No, it's not just screencasts. |
| 21:33.05 | elg | right nick125_, but what you can't say is ruby would never come out of obscurity without rails. it just gave it a turbo boost |
| 21:33.17 | dilvie | levi_: I agree -- they had the whole basecamp launch hype, and some killer marketing. The screencasts and such came online pretty quick, and as a newbie developer, I find them very compelling. |
| 21:33.37 | elg | that's all good for getting people hoked |
| 21:33.39 | elg | hooked |
| 21:33.43 | nick125_ | lol |
| 21:33.44 | nick125_ | yeah |
| 21:33.50 | elg | but what makes rails loveable is deeper |
| 21:33.57 | levi_ | RoR wasn't built to create a framework, it was factored out of a codebase for a company that had a successful product. |
| 21:34.02 | elg | and you have to consider the tireless evangelism of DHH |
| 21:34.19 | nick125_ | levi_: I've noticed that most frameworks are likethat |
| 21:34.20 | dilvie | all the newbie tutorials and stuff, walking people through their first RoR app -- if other development platforms made the barrier to entry so low, they'd do well, too. |
| 21:34.25 | levi_ | Not just a successful product, but cachet in all the right web development circles. |
| 21:34.33 | elg | nick125_: they should _all_ be like that. although they're not |
| 21:34.53 | elg | ~dict cachet |
| 21:35.05 | nick125_ | turbogears isn't factored out of a codebase last time I checked |
| 21:35.13 | levi_ | The state of being respected or admired, prestige. |
| 21:35.43 | nick125_ | I don't get turbogears though. they find adding ajax support more important then identity management :/ |
| 21:36.13 | dilvie | nick125_: gotta cash in on the hype. |
| 21:36.36 | nick125_ | I know, but, what good is ajax without identity management..heh |
| 21:36.57 | dilvie | dunno. |
| 21:37.20 | nick125_ | I personally rather have identity management then ajax |
| 21:37.56 | elg | i don't know anything about turbogears, but I agree with the sentiment that a framework created ex nihilo is probably a broken framework |
| 21:38.30 | elg | or at least, a lame framework |
| 21:38.35 | nick125_ | I like django because it works and it has enough features I need |
| 21:38.55 | elg | did you already know python? |
| 21:39.02 | nick125_ | yeah |
| 21:39.12 | elg | that's another major reason then. and a valid one |
| 21:39.35 | nick125_ | I tried both turbogears and django. |
| 21:39.40 | elg | I just happened to be a ruby convert before rails came along, so I have no "but it's not in _my_ language" dilemna. :) |
| 21:40.00 | nick125_ | With turbogears, I spent more time getting turbogears working, instead of my app |
| 21:42.46 | dilvie | Nick125_: Can you explain to me more about the peer blowfish plan? |
| 21:43.54 | nick125_ | dilvie: each person has their own randomly generated blowfish key, and, when they add their passwords, its encrypted with that unique key |
| 21:43.56 | dilvie | Nick125_: What I thought was that users would authenticate using a one-way hash, and that hash key would be used to encrypt the passwords with blowfish, or something like it. |
| 21:44.34 | nick125_ | it would be a randomly generated hash key that would be associated with the account |
| 21:44.46 | dilvie | wouldn't your plan require storing the keys with the encrypted data? |
| 21:45.12 | nick125_ | no, it would be stored with the account |
| 21:45.19 | nick125_ | each account would have a unique blowfish key |
| 21:46.07 | dilvie | sure, but the passwords have to be linked to the account somehow, right? So the key is stored with the account, the account is associated with the encrypted password... |
| 21:46.11 | dilvie | what am I missing? |
| 21:46.30 | nick125_ | I think you have it right.. |
| 21:47.21 | dilvie | but can't the key be used to unlock the passwords? In other words -- say somebody cracks the database.. they've got the keys, they can see the password/account associations... what's to stop them from making off with the loot? |
| 21:48.09 | nick125_ | okay, lets do it like this: lets say theres 1 key for the entire database. someone getsthat key and the hashes, and they got all the passwords |
| 21:48.26 | dilvie | I'm not suggesting a single key for the whole database. =) |
| 21:48.49 | nick125_ | tell me your idea.. |
| 21:49.25 | dilvie | I'm suggesting that the one-way hash key is used to encrypt the data... the user supplies that key to login to their accounts, and -- only while they're logged in -- that key is stored as server-side session data and used to unlock the user's passwords... |
| 21:50.06 | dilvie | the one way hash key in the user's auth password |
| 21:50.30 | nick125_ | so, their password is the hash key? |
| 21:51.14 | dilvie | yes, or their password unlocks a bigger hash key using public-key encryption |
| 21:51.57 | nick125_ | maybe blowfish their blowfish key with their password? |
| 21:52.01 | dilvie | people will be storing bank account logins on this thing. |
| 21:52.20 | dilvie | I want it to be an iron safe even if somebody manages to get the entire database. |
| 21:52.41 | elg | well that proposal sounds as safe as the password |
| 21:53.23 | elg | i.e. not very. but what else can you do without requiring them to store the private key themselves? |
| 21:53.27 | nick125_ | one thing you could do is salt the MD5 passwords so they can't be cracked, first of all |
| 21:53.44 | nick125_ | with least a 256 bit salt |
| 21:54.10 | elg | but if someone gets the db, it's just brute force password attack |
| 21:54.29 | nick125_ | it would take them FOREVER |
| 21:54.49 | dilvie | Yeah, I'm certainly salting it. |
| 21:54.51 | elg | in general yes |
| 21:55.06 | elg | but if they just want into george's account, and george is poor at picking passwords |
| 21:55.37 | nick125_ | lets say the password is this: $tnb5tBR?gbreR$GBTB$%TB%TB%THBNY@$password |
| 21:56.14 | nick125_ | the $tnb5tBR?gbreR$GBTB$%TB%TB%THBNY@$ part is the salt |
| 21:56.16 | dilvie | well, my goal is to make it practically impossible to steal all the passwords all at once |
| 21:56.22 | nick125_ | it would take them forever to crack the password |
| 21:56.23 | *** join/#utah jnbek (n=jnbek@c-67-166-97-223.hsd1.ut.comcast.net) |
| 21:56.43 | dilvie | ie, somebody gets the database, there's little chance they're going to get much out of it. |
| 21:56.53 | nick125_ | dilvie: so, use their uncrypted password with the salt as the key for the blowfish key |
| 21:57.01 | nick125_ | (encrypt the blowfish key) |
| 21:57.39 | elg | not forever, they _couldn't_ crack the password based on that info alone. it's a hash, that's what hashes do |
| 21:58.09 | nick125_ | it would take a extremely long time to crack a 256 bit salt |
| 21:58.12 | elg | but if they have something to test whether the password they have is correct, |
| 21:58.30 | elg | then it doesn't matter how big your salt is, except in the amount it slows down the brute force |
| 21:58.38 | nick125_ | this could work too: $<256 bit salt>$<password>$<256 bit salt> |
| 21:58.49 | elg | no, a hash doesn't get decrypted. you see |
| 21:58.57 | dilvie | elg: how will they know? even unencrypted, passwords generated by makepassword.com will still look like gibberish. |
| 21:59.17 | nick125_ | http://www.lockdown.co.uk/?pg=combi&s=articles |
| 21:59.19 | nick125_ | look at that |
| 21:59.21 | elg | all printable characters is a good indicator |
| 21:59.22 | brac | [Password Recovery Speeds] |
| 21:59.28 | elg | not foolproof, but a good start |
| 21:59.57 | elg | but that's a good point - if you don't store anything recognizable, e.g. it's just another binary key, then that's much much better |
| 22:00.25 | nick125_ | look at the 26 character example |
| 22:00.35 | elg | nick, if users picked good passwords we wouldn't have to worry as much about brute force |
| 22:00.40 | nick125_ | each salt is 32 characters |
| 22:00.43 | nick125_ | theres two salts |
| 22:00.57 | elg | but that's not what salt does |
| 22:01.02 | elg | the salt is right there in the open |
| 22:01.13 | elg | all salt does is keep you from reusing calculations |
| 22:01.19 | nick125_ | if a 20 character password takes 631 billion years to crack..lol |
| 22:01.32 | nick125_ | yeah, thats true..hrm |
| 22:01.42 | nick125_ | thats a problem.. |
| 22:01.59 | nick125_ | though, you got a point |
| 22:02.04 | nick125_ | it does prevent rainbow tables |
| 22:02.23 | elg | that's its only use |
| 22:02.35 | elg | it doesn't make the password magically bigger |
| 22:02.35 | Kuyaedz | you guys must not have seen Sneakers.. that rad blind guy can crack any password you got ;) |
| 22:03.19 | nick125_ | well, theres going to be really no way around this except people using smarter passwords |
| 22:03.44 | elg | unless you can have them generate and store the private key on their box |
| 22:03.54 | elg | but i'm guessing that doesn't fit the usage reqs |
| 22:03.57 | nick125_ | elg: that still won't fix it |
| 22:04.09 | nick125_ | because someone could "hack" the key from their system |
| 22:04.16 | dilvie | local key storage is out of the question |
| 22:04.16 | nick125_ | and it wouldn't be nearly as cross platform |
| 22:04.26 | dilvie | users need to get to their passwords from any computer |
| 22:04.29 | elg | no, private/public key encryption is another story |
| 22:04.42 | nick125_ | yeah, dilvie, I was trying to type out what you just say :P |
| 22:05.33 | dilvie | I suppose they could carry around a USB drive |
| 22:05.40 | dilvie | but that would make the UI lame. |
| 22:05.42 | nick125_ | thats really lame though |
| 22:05.47 | elg | you might could offer that for the truly paranoid |
| 22:05.47 | nick125_ | most users won't use that |
| 22:05.52 | elg | but yeah it won't fly for most people |
| 22:06.54 | dilvie | _if_ this thing takes off, I'll add some neat features like a biometric ID option |
| 22:07.19 | dilvie | but right now I'm going for bare minimum that is actually safe (assuming the user isn't dumb about their password) |
| 22:07.56 | nick125_ | If you write it in django, I might help you with it ;) |
| 22:08.21 | dilvie | I think we already discussed that. =) |
| 22:08.46 | dilvie | I'm writing it in RoR to get some experience with it, because it's in high demand, and I'm a freelancer.. |
| 22:11.43 | elg | dilvie: the weakpoint will be the passwords. Make it hard to recognize if they've got the right password, should they get the db, and use ssl, and use strong enough encryption, and I think you're doing pretty good |
| 22:12.34 | nick125_ | hrm.. |
| 22:12.46 | elg | if you could keep the db on a separate box and use asymmetric encryption on the db as a whole, that could be nifty too |
| 22:12.49 | elg | but tricky |
| 22:12.58 | nick125_ | maybe a 15 minute lockout for 5 wrong passwords? |
| 22:13.02 | elg | and do use salt of course |
| 22:13.12 | elg | well the point is if they get the db. there won't be any lockout at that point |
| 22:13.40 | elg | for interactive logins, a few seconds delay on a wrong password is enough to make brute force infeasible |
| 22:13.49 | elg | that's why your linux box waits 3 seconds when you get the password wrong |
| 22:13.52 | nick125_ | well, this will prevent people from bruteforcing against the login |
| 22:13.53 | nick125_ | yeah |
| 22:14.09 | elg | not to mention you don't end up with a processor DoS :) |
| 22:14.48 | nick125_ | it would require a bunch of bandwidth too.. |
| 22:14.58 | elg | dilvie: there's a few very knowledgeable security/crypto types on plug, you might want to post your question there for even better insight |
| 22:16.40 | elg | nick125: I'm concerned that that page you linked to shows figures for " maximum time required to guess each password using a simple brute force "key-search" attack" |
| 22:16.58 | elg | what matters is the _expected_ time |
| 22:17.21 | elg | although maximum is nice for telling people how weak a password is, it's not very nice for telling them how strong a password is |
| 22:17.40 | nick125_ | it would be prettyhard to crack a 20 character password though |
| 22:23.42 | *** join/#utah dilvie (n=dilvie@c-67-161-255-229.hsd1.ut.comcast.net) |
| 22:23.56 | dilvie | d'oh |
| 22:24.02 | dilvie | firefox crashed. |
| 22:24.08 | dilvie | I use chatzilla. |
| 22:24.10 | dilvie | lame. |
| 22:24.13 | dilvie | anyway. |
| 22:25.34 | dilvie | Where did everybody go? |
| 22:26.52 | zzzirk | maybe the presence of a chazilla user scared them away |
| 22:26.53 | zzzirk | ;) |
| 22:28.02 | dilvie | haha |
| 22:28.23 | dilvie | okay.. just came up with a scary scenario.. what if a user forgets his password!? |
| 22:28.24 | dilvie | haha |
| 22:28.32 | dilvie | they'd be screwed. |
| 22:31.13 | dilvie | I don't want to store their password on the server, but maybe there's a way to encourage users to store ther password in a safe place. |
| 22:34.36 | elg | dilvie: tell them how long it will take to crack it. :) |
| 22:35.29 | dilvie | yeah, well we don't even know that for certain -- we don't even know how many characters there are. |
| 22:35.34 | elg | you might could encrypt new passwords and store them somewhere where they get copied to offline storage nightly and the file gets shredded after |
| 22:36.10 | elg | that's a hard reality fact, they may not forget their password |
| 22:36.15 | dilvie | too much maintenance cost. |
| 22:36.49 | elg | most sites will be able to reset passwords, but that won't work with stuff being encrypted like you'll have |
| 22:36.54 | dilvie | yeah, there's just no way I can reset the password with this scheme. |
| 22:37.20 | elg | the only thing you can do is beat it into their heads that there's no way to recover from a lost password |
| 22:37.24 | dilvie | is there a way I _could_ enable a password reset feature? |
| 22:37.51 | elg | no, not with the password being the key to the encryption |
| 22:38.18 | dilvie | then they can't be the key to encryption... |
| 22:38.35 | dilvie | there's got to be a better way. |
| 22:38.43 | dilvie | One that enables password reset. |
| 22:39.03 | elg | maybe the third login, tell them the password is incorrect and tell them there's nothing you can do about it, and after five seconds pop up a "ha, april fools" window. that'll burn the feeling of dread into them. :) |
| 22:40.53 | elg | you could have passwords used for authentication against an omnicsient system that is separate from the db, and protect that omniscient system with your life |
| 22:40.57 | elg | :) |
| 22:41.07 | dilvie | okay, here's an idea... |
| 22:41.54 | dilvie | what if we use a question and answer pair ... similar to a password hint thing |
| 22:42.16 | dilvie | the question is used to encrypt the skeleton key |
| 22:42.34 | dilvie | in a public/private key pair |
| 22:42.41 | dilvie | the answer is the private key |
| 22:44.11 | dilvie | they login, they answer the question, and their data is unlocked |
| 22:44.12 | elg | so all the private keys are encrypted with a skeleton key, which isn't unencrypted on disk? |
| 22:44.29 | dilvie | if they forget their login, we can give them the question, and if they get it right, they can reset their password.. |
| 22:45.15 | elg | i'm not sure I follow |
| 22:45.18 | dilvie | well, the question / answer pair are public/private keys that both need to be available to unlock the skeleton key |
| 22:45.31 | dilvie | the skeleton key uses blowfish to unlock the stored passwords |
| 22:46.05 | elg | so this skeleton key unlocks everyone's passwords? |
| 22:46.12 | dilvie | no |
| 22:46.25 | dilvie | just the current user's stored passwords. |
| 22:47.03 | elg | but how do you unlock it if they forget their password? |
| 22:47.36 | dilvie | their password isn't used to encrypt the skeleton key |
| 22:47.47 | dilvie | the question/answer pair is. |
| 22:48.32 | elg | but what makes the key a skeleton key? how do you have two keys, does blowfish allow that? |
| 22:48.32 | dilvie | the question is a public key |
| 22:48.37 | dilvie | the answer is a private key |
| 22:48.43 | *** join/#utah Kuyaedz (n=Kuyaedz@kuyaedz.fttp.xmission.com) |
| 22:48.47 | elg | in a loose sense of course |
| 22:49.14 | dilvie | the skeleton key is encrypted with gpg |
| 22:49.31 | dilvie | or something like it. |
| 22:49.42 | dilvie | public key encryption |
| 22:49.56 | elg | well, public/private keypairs don't usually let you choose what the keys are, since the math doesn't work that way |
| 22:50.49 | elg | so you'd really just be creating a passphrase from two parts, one part you have the other they give |
| 22:51.10 | elg | and I still don't see how the skeleton key works in conjunction with the normal password |
| 22:51.37 | dilvie | the skeleton key _doesn't_ work in conjunction with the normal password. |
| 22:51.42 | dilvie | that's the whole point |
| 22:51.59 | dilvie | so if the user forgets their password, it can be reset, without losing access to their stored passwords. |
| 22:52.25 | elg | right, that's the part I don't get. how do you do that? |
| 22:52.34 | elg | encrypt something that can be decrypted using one of two different keys? |
| 22:54.06 | dilvie | no. Encrypt it with a question/answer pair. The user should be able to answer the question no matter what. |
| 22:55.00 | dilvie | anyway, the question/answer pair doesn't have to be used _directly_ as keys to the public-key encryption. They can be used to generate the keys. |
| 22:57.14 | dilvie | I'll have to do some research to see if there's an existing public key algo I can use. |
| 22:57.36 | elg | ok, so the same key they would create with their password normally is stored encrypted |
| 22:57.37 | dilvie | because you're right -- public keys are usually generated. |
| 22:57.51 | elg | and you get to it with a question/answer pair if needed |
| 22:58.33 | elg | think you're gonna draw a blank on the public/private pair, but you could just use symmetric encryption with the question and answer together as the key |
| 23:01.08 | dilvie | elg: duh. |
| 23:01.15 | dilvie | that's a simpler answer, anyway. |
| 23:01.27 | dilvie | it'll work, with less math. |
| 23:01.31 | elg | :) |
| 23:02.37 | dilvie | sometimes we miss obvious things. =) |
| 23:02.39 | elg | if you wanted a longer passphrase to give you minimal protection from blind brute forcing you could throw in their username too |
| 23:03.15 | dilvie | that's not a bad idea |
| 23:03.27 | elg | the trick of course is that you're basically down to a weaker password with this scheme, should the whole thing be found |
| 23:03.35 | elg | a weaker password with a hint, even |
| 23:04.10 | elg | but if you could keep the skeleton keys separate - on a different server maybe |
| 23:06.18 | dilvie | This is a tougher problem than I thought it would be. |
| 23:07.20 | elg | yeah, it all comes down to those darn users memories. ;) |
| 23:07.55 | dilvie | from the login perspective, a user needs his password to login. if he doesn't have his password, he's presented with the question. If he can answer the question, he can reset his password via a method sent to him using stored contact info. |
| 23:08.59 | dilvie | we can't use the password in the encryption scheme, because the password can change. |
| 23:09.14 | dilvie | What if the user wants to change the question and answer pair? |
| 23:09.34 | dilvie | say they set it to "what is my birthday"? and they want something stronger? |
| 23:09.47 | dilvie | haha |
| 23:10.10 | elg | you could store two copies of the key, and when they change either password or question/answer the appropriate one gets reencrypted |
| 23:10.39 | dilvie | it would need to rebuild their entire password database. |
| 23:10.53 | dilvie | or not. |
| 23:10.55 | dilvie | no it wouldn't. |
| 23:11.00 | elg | i recently came across a site I had forgotten the password to, and it gave me one of those question/answer things |
| 23:11.13 | elg | and I for the life of me had no idea what I meant when I typed that cryptic thing for the question |
| 23:11.30 | elg | no, not if the key is just some long binary thing that needn't change |
| 23:11.42 | dilvie | well, we could forgo the question answer thing and ask a series of prescribed questions. |
| 23:11.49 | dilvie | stuff there's only one answer to |
| 23:12.12 | dilvie | like "what are the last four digits of your social security number?" and "what year were you born?" |
| 23:12.17 | elg | i like the free-form question/answer as a user. I just need to be less clever |
| 23:12.51 | elg | the problem of course is case and whitespace, and that some questions have more than one right answer and what if they can't remember which answer they gave |
| 23:13.09 | elg | but if questions have only one right answer, it's the sort of thing someone could steal |
| 23:13.12 | elg | id theft |
| 23:13.51 | dilvie | well, that's the problem with free-form questions -- there's a good chance that, left to their own devices, users are going to ask questions too tough to remember the answers to. |
| 23:14.00 | dilvie | I know I've walked into that mistake. |
| 23:14.33 | dilvie | I think a series of fixed-answer questions is better. It's pretty tough to screw up the answer to "what year were you born?" |
| 23:15.09 | Kuyaedz | I always use the same answer to those questions, despite the question. |
| 23:15.30 | elg | dilvie: unless you're a woman. |
| 23:15.33 | dilvie | the id theft point is the reason for the question series. Somobody might get hold of your birthday, but if they get hold of your birthday, and your ssn, and your driver's license number, you're in trouble already. ;) |
| 23:15.44 | elg | Kuyaedz: yeah, I do that a lot too |
| 23:15.51 | Kuyaedz | not that its hard to remember my social or birthplace, but I always use 'none' for all of those. All I have to remember is nothing |
| 23:16.03 | elg | haha |
| 23:16.49 | dilvie | Kuyaedz: as long as you can remember it, and it's tough for other people to guess, you're in the clear. |
| 23:17.30 | Kuyaedz | I don't usually have problems remembering my passwords, but I don't change them as often as I should |
| 23:17.48 | elg | i'm digging through the ardour code. i'm absolutely stunned |
| 23:18.22 | elg | it's like strolling through a well-manicured bonzai garden. not the usual pile of steaming compost that I'm used to when i crack open a big opensource project |
| 23:18.52 | dilvie | elg: awesome. =) |
| 23:19.37 | elg | still not a lot of comments, but you can't have everything. :) |
| 23:19.37 | dilvie | you know how to create well-manicured bonzai garden code? |
| 23:19.58 | elg | yes |
| 23:20.37 | elg | although my code is probably more like a well-tended southwest rancho or something |
| 23:20.44 | dilvie | haha |
| 23:20.52 | Kuyaedz | hehe. mine would fall under the steaming compost category |
| 23:20.59 | elg | my style is different from his, but the important thing is a consistent style, good variable names, and good design |
| 23:21.03 | dilvie | the key is that you're never done. |
| 23:21.05 | dilvie | refactor |
| 23:21.25 | dilvie | refactor until everything is beautiful. |
| 23:21.29 | elg | yup |
| 23:21.30 | dilvie | a little at a time. |
| 23:21.39 | elg | some of my one-off school code looks like a steaming pile |
| 23:21.48 | elg | i'm a pragmatist too, after all. :) |
| 23:22.04 | elg | but at least it starts out well |
| 23:22.05 | dilvie | it's one-off. You think you're never gonna touch the code again, you make a mess.. |
| 23:22.21 | dilvie | but when you go back and change something, do some housecleaning. |
| 23:22.23 | dilvie | =) |
| 23:22.46 | dilvie | that's generally how I work. |
| 23:22.53 | dilvie | my one-off code is usually pretty ugly. |
| 23:23.12 | elg | getting something that does something is usually a good first step |
| 23:23.20 | dilvie | it's not until I've had to go back and add more features, or fix some bugs, that things start looking pretty. |
| 23:23.21 | elg | no matter how ugly. just refactor earlier than later |
| 23:23.35 | elg | because when it's as big as asterisk, nobody will want to refactor it |
| 23:24.05 | dilvie | well, that's an important point. |
| 23:25.15 | dilvie | if you're always thinking about how you can refactor the code to solve the current problem when you're adding features or squashing bugs, it doesn't ever have the chance to evolve into a really large steaming pile. |
| 23:25.31 | elg | exactly |
| 23:26.06 | dilvie | I tend to favor the right way over the easy way. |
| 23:26.31 | dilvie | because the right way tends to become the easy way in the long run. |
| 23:26.56 | dilvie | being lazy is a virtue for coders. |
| 23:27.19 | dilvie | you think, "if I do a little extra work now, I'll save a lot of work in the future", and that's your motivation for doing it right. |
| 23:27.53 | elg | :) |
| 23:29.44 | elg | man I love this binaerpilot song |
| 23:30.22 | dilvie | "Goof"? |
| 23:30.28 | elg | yeah |
| 23:30.31 | dilvie | he's working on a new album. |
| 23:30.33 | goozbach | hmm more pork chops |
| 23:30.38 | elg | the middle part esp. |
| 23:31.51 | dilvie | I assume you grabbed "Bend" as well? |
| 23:31.52 | dilvie | http://www.knobtweakers.net/mirror/Binaerpilot_-_Bend.mp3 |
| 23:32.34 | elg | no I haven't. was that a recent song on the podcast? I got juice but this week I haven't had a chance to even use it |
| 23:32.49 | dilvie | http://www.knobtweakers.net/2006/03/binaerpilot.html |
| 23:32.58 | dilvie | I posted that March 1st |
| 23:33.21 | elg | cool, before i started following carefully |
| 23:33.26 | elg | i'll definitely check it out |
| 23:33.37 | elg | but I'm too lazy to get off the couch again for at least 10 minutes |
| 23:33.47 | dilvie | hahaha |
| 23:34.47 | dilvie | the vocals in bend are using haas effects. |
| 23:35.14 | elg | and I haven't figured out how to control quodlibet from my laptop yet |
| 23:35.16 | dilvie | note how they shift around in the stereo field without mono panning. |
| 23:35.21 | elg | and I'm also too lazy to figure that out |
| 23:35.29 | elg | cool, I'll definitely look for that |
| 23:35.36 | dilvie | speaking of haas, I need to check that haas plugin. |
| 23:35.45 | elg | and get me a demo. :) |
| 23:35.53 | dilvie | I've been so overwhelmed with freelance projects lately, I haven't had time to think straight. |
| 23:36.03 | dilvie | cool, I'll do that. |
| 23:36.11 | dilvie | what sort of demo do you want? |
| 23:36.15 | dilvie | minimal, or musical? |
| 23:36.21 | dilvie | or both? |
| 23:37.13 | elg | maybe something minimal at first, that turns musical. or both |
| 23:37.31 | elg | let me know if anything doesn't seem right - esp. the detuning |
| 23:37.45 | elg | the dsp board detuning sounded terrible - some kind of mysterious beating going on |
| 23:38.04 | elg | i didn't notice that with the vst plugin, but it could be the stuff I was testing it with in renoise didn't make it obvious |
| 23:38.27 | dilvie | I'll use some raw sine and square waves |
| 23:38.36 | dilvie | that should make any serious errors pretty noticeable. |
| 23:38.41 | elg | yeah |
| 23:39.14 | elg | the beating was very obvious on the music from my mp3 player, so I think I probably would have noticed it in renoise, but I haven't had a chance to go back and listen closer |
| 23:39.19 | dilvie | "Goof" is so awesome. |
| 23:39.24 | dilvie | I had almost forgotten. |
| 23:39.25 | elg | it's probably some wacky numerical error |
| 23:39.26 | dilvie | ahhaa |
| 23:39.44 | elg | that part in the center where he kicks (yells, whatever), that's the bset |
| 23:39.59 | dilvie | it just kindof grabs you and makes you groove whether you want to or not. |
| 23:40.01 | dilvie | ahaha |
| 23:40.59 | dilvie | "Bend" is really good, too, but "Goof" is my favorite. |