341500+ entries in 2.664s
mircea_popescu: i am very curious which will be the 1st bitcoin service to reach
a 5 year stretch w/o hacking.
BTC-Mining: You mean that 8 years old kid who think he has hacked
a website by loading an error page?
BTC-Mining: Or for
a better deal, just buy Finances for Dummies
mircea_popescu: and this idiot is doing "
a review" which consists of spending 20 minutes saying he's gonna do the same thing cause it works well.
chaang-noi: i have asked nefario to make
a large flashing red sign saying dont buy it
mircea_popescu: i guess evoorhees should bankrupt first, then it'll be also
a great ipo. buncha idiots these people.
mircea_popescu: satoshi dice ipoing at
a P/E of 10 was however much too expensive in the oppinion of the same financial wizards.
mircea_popescu: it used to make ~2k
a year before going bust, so this would be
a P/E of ... 33
mircea_popescu: ahahaha this takes the cake : ppl wanting to do
a 75k btc ipo on glbse for
a bankrupt company
assbot: [GLBSE] [PPT.
A] 100 @ 0.32 = 32 BTC [+]
assbot: [GLBSE] [PPT.
A] 65 @ 0.31 = 20.15 BTC [-]
usagi: It might not list for
a while
usagi: As for the 1%, that part of the contract doesn't change; it's
a pass-thru. Kind of like how tygrr.bond-pi stopped paying interest when pirate did
usagi: goat; nope, YARR is not jumping to
a different ponzi.
mircea_popescu: In case it's not clear to the dimwit collectivists, the "creditors who essentially have an open and shut case when it comes to
a lawsuit" are we who have USD held by BitFloor, not the magical internetnerd token owners.
chaang-noi: usagi is yarr jumping to
a differnt ponzi and is the 1% for yarr garanteed each day?
copumpkin: store the root somewhere else, and have it sign
a sub-cert
usagi: Now there's
a scam if I ever saw one
copumpkin: they can act as
a middleman and forward requests to your real site
copumpkin: usagi: the point is, if you use
a self-signed cert, someone else can pose as your site, and nobody will know
usagi: Sign in with
a yubikey
copumpkin: you can do that without
a certificate
copumpkin: but during development, it's fairly common to not pay for
a real one :)
copumpkin: it's
a self-signed root that doesn't match the domain
copumpkin: because it comes from
a feature in format strings that nobody ever even uses, except for exploits
usagi: so that if
a service gets compromised they can't get out of the vm
copumpkin: the vast majority of security holes arise from
a couple of features that many language simply omit
usagi: You can't mitigate security by choosing
a language
smickles: usagi: yes, but java is
a pretty big target
usagi: I'm
a Java programmer. I am writing the backend for my exchange in java.
mircea_popescu: Diablo-D3 just did it cause he's
a programmer at heart, wants the challenge.
usagi: Spoken like
a true ruby evangelist nef :)
mircea_popescu: you should respect me because you had
a market you were shitting all over for
a year
usagi: Programming in lisp is
a lot like programming in 8088 assembly language.
nefario: usagi: lisp in and of itself is not
a problem
nefario: mircea_popescu hired
a lisp programmer?
usagi: mircea is
a lisp programmer :)
nefario: buffer overflow is
a core feature of C C++
Diablo-D3: nefario: yes, but not
a core language feautre having
a buffer overflow.
copumpkin: usagi: admittedly, asking for idiosyncrasies of particular versions of
a specific language isn't exactly testing our security knowledge :)
usagi: I just showed you
a) you don't know what the insecurities are b) you don't know how to fix them
mircea_popescu: there WAS
A buffer overlfow in php preg replace cca 2005
Diablo-D3: if there is
a buffer overflow in preg_replace
usagi: lol theres
a buffer overflow in preg_replace
Diablo-D3: usagi: you're giving
a shit about string size on
a dynamic language?
usagi: $r = preg_replace('/[^
a-zA-Z0-9]/i', '', $r);
Diablo-D3: I can very easily produce
a string that will produce an empty string with that regex
Diablo-D3: [07:56:36] <usagi> $r = preg_replace('/[^
a-zA-Z0-9]/i', '', $s);
Diablo-D3: usagi: so explain to me, again, why you're not using strtoupper with your locale force set to
a unicode one?
Diablo-D3: usagi: the flaw is you're using that regex on user input in
a function named "makealpha"
usagi: IIRC solaris had
a security hole in sendmail until like, 6 months ago
usagi: “When PHP is used in
a CGI-based setup (such as Apache's mod_cgid)..."
Diablo-D3: php has
a fucking fastcgi handler, jesus fucking christ
smickles: usagi: just
a wild guess, would that function fubar when regex special characterw were used?
mircea_popescu: "On Tuesday, the PHP Group plans to release new versions of PHP in order to address the problems with
a previous patch, which was intended to close
a security problem." and on it goes.
mircea_popescu: listen, this is the reason there's not many decent exchanges. 2k
a month ? srsly ?
usagi: There's
a very real problem with the makealpha function
mircea_popescu: regex is
a good ideea if you don't allow FUCKEN CHINESE BS CHARS
Diablo-D3: there is
a security hole BECAUSE SOMEONE THOUGHT REGEX WAS
A GOOD IDEA
usagi: But there's
a security hole.
copumpkin: usagi: so you have
a function makealpha that removes all alpha?
Diablo-D3: doesnt php even have
a fucking function for that
usagi: $r = preg_replace('/[^
a-zA-Z0-9]/i', '', $s);
usagi: $r = preg_replace('/[^
a-zA-Z0-9]/i', '', $r);
Diablo-D3: still, go ahead and write
a provable stm impl\
mircea_popescu: Diablo-D3 i was referencing
a speciffic discussion, i think you weren't here.
Diablo-D3: copumpkin: bullshit, you'd have to use
a language specifically for that
mircea_popescu: so yes, this would be
a solution, but you would need something bigger than currently available
smickles: so then
a theft would have to come from physical theft
smickles: well, if i insured an exchange, i wouldn't allow it to be on
a managed vps
smickles: well, you take
a loss. presumeably, you business can handle an amount of losses
mircea_popescu: if you were in my shoes. you insured the btc/usd rate and took
a loss. what now ?
mircea_popescu: smickles option contracts are insurance, in
a way. i don't even know currently if i got taken for 4.5k or not.
smickles: and i bet the insurance would cost
a pretty penny
Obsi: Someone should write
a how-to security guide for all these exchanges to get up to speed.
smickles: mircea_popescu: it's
a sector of the bitcoin economy that needs to be fleshed out, it seems
mircea_popescu: cpa is the pet project of usagi, who is
a well meaning and far overreaching anonymous english teacher.
mircea_popescu: smickles neither of those could eat
a 25k loss. what else you got ?
mircea_popescu: 1. zhou wrote
a shit algorithm for hedging. it seemed good-enouggh originally, but then started losing money.
mircea_popescu: happened instead is
a consistent equity leak that has remained unresolved