16,798 reputation
12785
bio website
location Brooklyn, NY
age 32
visits member for 2 years, 11 months
seen 27 mins ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


45m
revised Python Scripting Question
added 865 characters in body
50m
answered Python Scripting Question
3h
answered What is the problem with multiple encryption and how do you know if you have decrypted a cipher?
2d
comment Which hashing algorithm is ideal for use on the web?
@PTW-105 and SHA-512 will be 2^256 times harder than SHA-256. (That is SHA-512, you have to try for high entropy information would have to try about 13,407,807,929,942,597,099,574,024,998,205,846,127,479,365,820,592,393,377,723,‌​561,443,721,764,030,073,546,976,801,874,298,166,903,427,690,031,858,186,486,050,8‌​53,753,882,811,946,569,946,433,649,006,084,096 different hashes).
2d
comment Which hashing algorithm is ideal for use on the web?
@PTW-105 - The smallest unit of time that makes sense to even think is the Planck time (10^-44 seconds) this is about 1000000000000000000000000000 times smaller than the smallest unit of time we've ever measured. It's only been about ~10^61 Planck time old since the big bang is about ~10^61. Note there are about 3 million billion more SHA-256 hashes than Planck times since the big bang. (So hash ever Planck time since the big bang would have 1 in 3 million billion chance.)
2d
comment Which hashing algorithm is ideal for use on the web?
@PTW-105 All hashes will be brute-forced? That's quite the ridiculous claim. There are 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457‌​,584,007,913,129,639,936 unique 256-bit hashes. Reverse this sha-2 (256 bit -- I was nice even chose the weaker one) f80aca950ca3eabc7ce99d2be088257dec01c9c4f7c841854702acdbb07c76b1. I'll give you $1000 if you or anyone else can do it.
2d
comment Can “cat-ing” a file be a potential security risk?
@IvanKovacevic - echo -e '\x1BZ' works in Mac OS X 10.9 (as well as linux), Terminal 2.4, with my default terminal settings (declared as xterm-256color, don't allow VT100 application).
2d
answered Can “cat-ing” a file be a potential security risk?
2d
awarded  Good Answer
Apr
21
revised SSH: benefits of using hashed known_hosts
added 1169 characters in body
Apr
21
revised SSH: benefits of using hashed known_hosts
added 1169 characters in body
Apr
21
revised SSH: benefits of using hashed known_hosts
added 68 characters in body
Apr
21
answered SSH: benefits of using hashed known_hosts
Apr
18
answered How difficult it is to solve a salt if knowing the original data and the hash output that uses the SHA-2 algorithm
Apr
18
comment Is it possible to use SSH agent for generic data encryption?
ssh-agent (in SSH1) was trained to automatically decrypt challenge messages presented by a potentially hostile server and send the hashes back over the internet. If it sent the original messages that would be a potential vulnerability. gpg-agent doesn't deal with networking directly; it decrypts/encrypts messages locally only with a key that's presumably only used to connect to SSH.
Apr
17
awarded  Enlightened
Apr
17
comment How to sign data with OpenSSL 0.9.8?
While not disagreeing, the 0.9.8 line of OpenSSL was last updated in Feb 2013 (0.9.8y), so some types of major vulnerabilities in OpenSSL were fixed (and 0.9.8 never had features like heartbeats), granted the 0.9.8 line never supported things like the latest version TLS 1.2.
Apr
17
awarded  Nice Answer
Apr
17
comment How to prevent attacks before HSTS is established for the first time?
@KnightOfNi - And training users may not involve simply "sending an email" or making them take an online quiz. Training entails anything that can change the user's behavior. It could involve say serving http versions of pages that as soon as they select the password field to start typing a big warning pops up saying "THIS IS NOT AN HTTPS PAGE. NEVER TYPE A PASSWORD INTO AN HTTP PAGE. This was not a real attack, but attacks like this exist in the wild. (And then logs whatever username/IP address was used there)." Sort of similar to ismycreditcardstolen.com
Apr
17
revised How to prevent attacks before HSTS is established for the first time?
added 612 characters in body