271600+ entries in 1.91s
jurov: maybe you'll get
a surprise ;)
jurov: it clearly shows they don't give
a fuck
mircea_popescu: water4ll listen, there's
a difference between "i don't want X to be true and therefore i'll say things" and "X is surprising".
water4ll: seems
a lot of inflated volume
mircea_popescu: water4ll yes, the fact that mpex is
a respectable exchange makes it have consistent volume
water4ll: well it's
a higher barrier to entry than say havelock
water4ll: I'm just
a little surprised at consistent trading volume
nubbins`: anyway, time to strap myself to
a torture machine for an hour, seeya
KRS-: pankkake: probably because the CA cert won't complete the certificate chain for the general public. The cert would have to be signed by
a custom CA I think.
nubbins`: i should take
a dump before the gym
pankkake: CACert allows you to authenticate with
a browser certificate, though. I don't know any other website allowing it
nubbins`: years ago i did maintenance on
a lottery corporation website
KRS-: One exception was the Florida Turnpike Enterprise (
a private business implementation of
a government roadway function to accept tolls and what not)..they had
a firm grasp on I.T. security from their payment processor to their wireless roadway nodes..I was very impressed.
KRS-: pankkake I've done
a lot of consulting...from the private sector to government..none of them got it right. I imagine the big guys do like BOA, Google, etc.
pankkake: 1) it's
a bank 2) it's
a FRENCH bank 3) their website reeks incompetence
nubbins`: when i lived in korea, my bank required that i ran an activex control, had
a cookie stored on
a usb thumb drive, and asked for two separate five-digit codes from
a list of about 50 that were provided as
a wallet-sized card
nubbins`: if you're that worried, just let the auth cookies expire after
a half hour.
pankkake: when I did implement that thing, it was more because I wanted cookies to expire in
a smarter way
pankkake: it's
a way to ensure you only have fresh cookies - stealing old cookies cannot work
nubbins`: so you can verify it's the same user logging in each time, unless they perform
a relatively common, semmingly benign action, like clearing their cookies
KRS-: unless like pankkake said, its just
a signed cookie not session
KRS-: ya its hard to find work as sysadmin where I live, but the work lasts
a very long time.
pankkake: but the auth cookie thing is interesting. it wouldn't be so hard to write
a more secure implementation that most of what's out there
KRS-: This is my kind of it work, not much of
a developer..love this stuffl.
pankkake: it's
a poor's man stateful over stateless crap
KRS-: I've dealt with this problem before. You have to carefully pick
a load balanced strategy or pick another session persistence.
nubbins`: had to troubleshoot
a web app once where there was
a round-robin load balancing setup. each new page request launched
a new session, up to
a max of 3 (the number of servers)
pankkake: unless you store session data in it, but usually it's just
a secret ID
pankkake: but usually the process is that you have an auth cookie (lifetime = high), and
a session cookie (lifetime = short)
pankkake: KRS-: it's
a signed cookie, not session cookie; and managing sessions over multiple servers is possible too
mircea_popescu: eventually he asks
a supervisor : so when do you skewer their meatflaps already ?)
mircea_popescu: (guy walks into
a girlscout cookie clambake. as the festivities progress he keeps getting more and more excited
pankkake: if you add
a signed timestamp to the cookie, maybe you can limit logins from old stolen cookies
pankkake: mircea_popescu: most websites, and almost all frameworks I've seen, only use
a cookie that isn't refreshed, and is either left to expire stupidly, or never expiring
mircea_popescu: amusingly, it reads like
a square with f0f0 written in it, which'd be
a short form of
a romanian euphemism for... cunt, of course
KRS-: "cleaning
a rug" is
a euphamism here, commonly paired with "laying pipe".
nubbins`: also known as "having
a scuff"
nubbins`: "cutting
a rug" is
a euphemism here, but not for what you'd think
nubbins`: anyway, people were much less impressed with my wa'alaykum salaam when it became clear that i didn't need to buy
a rug
mircea_popescu: and upon each subsequent login you
a) check if the user has the old cookie ; b) hash the salt, store it, increment the nonce, store it ; c) send
a new cookie
mircea_popescu: wouldn't the best practice be, that upon user registration you generate
a user salt and
a nonce, send these as
a hashed cookie,
mircea_popescu: inasmuch as you're going to do
a site with accounts, which people can log in over
http (stupid as this may be)
mircea_popescu: so since pretty much anyone here has
a better knowledge of webstuff than i do, here's
a question :
herbijudlestoids: jurov: i put it on reddit, but im not really
a bitcoin person so i dunno where is good to share it to generate some discussion, if theres anywhere you think might be interested pls feel free to repost it there
Duffer1: i wish dooglus hung out in b-
a herbijudlestoids: not sure there is
a positive kelly criterion value so the best bet is to "invest" with the house
gribble: Error: "seenGraet" is not
a valid command.
gribble: Error: "see" is not
a valid command.
Vexual: thats why theres
a lip on the lid of the pot, for coals
Vexual: on
a fire in the garden?
Vexual: unless theyre draped on
a porterhouse
Vexual: im not all that much of
a mushroom afficianardo to be honest
herbijudlestoids: Vexual: ooo did i tell you that i am
a fine grower of pleurotus eryngii?
Vexual: its
a delicious clump of pluerotus mushrooms
herbijudlestoids: mircea_popescu: my trilema buffer is now at 5 articles, if you want me to read more you will have to pay 0.01BTC for
a subscription to my HTTP GETs :P
cazalla: i just sat down with
a cuppa
cazalla: i don't know any aussies that buy
a family deal from maccas
mircea_popescu: last burger i had was at some irish restaurant in boston. i ate it with
a knife and fork, much to the waitstaff's delight
Vexual: can one get
a good burger there mp?
mircea_popescu: last time i ate in
a popular joint i left like 40 dollars there iirc.
Vexual: your girl is supposed to get
a salad and eat some of your chips
mircea_popescu: "remember that it’s the individualists who seem to work together best towards the collective — the BIG collective — society as
a whole —
a nation, for instance. meanwhile, the “collectivists” (as hofstede calls them) — or the clannish groups (as i call them) — don’t manage to handle, or even to create, commonweals hardly at all."
decimation: Interestingly Hungary is
a major outlier in Eastern Europe
decimation: the individualist are better at coordinating things on
a large scale
mircea_popescu: and it's
a well known fact that the more connected model always emerges victorious.
mircea_popescu: in the end, this all yields
a richer conenctivity in society,
Vexual: youtube thinks im
a french tween
decimation: yeah in frat houses in us universities there is often such
a person
mircea_popescu: much like average people going out to drink have
a designated driver, these cvasi-familial arrangements have
a house mother
mircea_popescu: ownership is
a muddled thing anyway. so you own your house. you can't set it on fire. you can't dig
a hole in the livingroom. etc.
herbijudlestoids: i have heard
a number that the richest 100% own
a lot, but the number i heard was like 8%
herbijudlestoids: nowaybro, if global assets includes say,
a cashflow positive farm or car factory or whatever then that piece of ass(et) doesnt matter who you bank with
mircea_popescu: yeah, of which 69`999`923 people do banking with
a select few :)
Duffer1: herbijudlestoids it's
a lot better than lessons from Labcoin :P
mircea_popescu: in general, the problem is vast. the day your average us citizen has decided that politics is
a problem that other people should solve for him, so he can focus on w/e his job is
mircea_popescu: i don't have
a fully polished, drop-in alternative in any sense.
Duffer1: i should have added
a few more lines
mircea_popescu: everyone involved has
a definite interest to muddy them
mircea_popescu: that's wishful thinking in
a bowstring. what the fuck.
mircea_popescu: decimation something like that. you're basically saying "it should be done", like
a govt.
decimation: I guess I'm pushing it into the black boxed labeld "competent bank", and you are saying such
a bank would have to charge enormous fees to employ the right people
mircea_popescu: sadly there is no such thing as
a "verifiable true financial"
mircea_popescu: it's basically the equivalent of driving
a car by touch.
mircea_popescu: herbijudlestoids yes. if you want to do all the work, you don't need someone to do the work for
a group of "you".
decimation: what if you wanted to divide
a loan amoung
a few others to reduce the risk?
herbijudlestoids: well what would i need the bank for, if i can for example loan 10 day money in
a liquid market to some business directly, and then when i need some money sell the appropriate amout of 10 day loans back into the mkt?
mircea_popescu: that's my point. if he wants
a self-service thing he doesn't need the bank to anything.