dr jimbob

11,749 reputation

1656

bio	website
	location	Brooklyn, NY
	age	31
visits	member for	2 years
	seen	19 mins ago
stats	profile views	275

Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).

	11,749 reputation	bio	website		visits	member for	2 years
1656 badges		location	Brooklyn, NY		seen	19 mins ago

summary answers questions tags badges favorites bounties reputation activity

863 Actions

suggestions reviews revisions comments badges posts accepts all

1d	awarded	Yearling
1d	revised	Is there a dictionary of visibly similar Unicode characters for Spam processing? deleted 22 characters in body
1d	revised	Is there a dictionary of visibly similar Unicode characters for Spam processing? added 26 characters in body
1d	revised	Is there a dictionary of visibly similar Unicode characters for Spam processing? added 705 characters in body
1d	answered	Is there a dictionary of visibly similar Unicode characters for Spam processing?
2d	answered	Is KeePass a good defense against keyloggers?
May 19	awarded	Nice Answer
May 16	answered	Touch Screen Password Guessing by Fingerprint Trace
May 10	comment	Is showing your IP address in the URL a bad practice? @Xander - Agree that you have less flexibility by exposing an IP address. However, if you have a domain name its trivial to find the underlying IP address (`dig www.example.com`). The DNS record often has a TTL of a 10000+ seconds during which time you can attack a specific IP. Load balancing will help, but again if you are using a load balancer you wouldn't be pointing people to a specific IP.
May 9	comment	Is showing your IP address in the URL a bad practice? But browsers/routers/OSes usually cache DNS queries for hours; so there's effectively no difference. Also, unless you were using DNS round-robin/load balancing, its not like you could actively prevent an attack. That said, I avoid linking via IP addresses when possible as (1) IP addresses are typically harder to remember, (2) if you have (or ever want) more than one server running at the same IP browsers need to specify a domain name (to put in the `Host:` header of the HTTP request) and (3) if your server moves/changes IP addresses, you can keep the same domain name at the new IP.
May 9	awarded	Pundit
May 9	comment	What is the difference between SSL vs SSH? Which is more secure? SSH's binary packet protocol is encrypt-and-MAC where for every plaintext message (m) it sends the ciphertext E(m)++MAC(m) (concatenate encrypted message with MAC), versus SSL which does E(m++MAC(m)). However, SSH is much more than just its binary packet protocol (key management, remote shell client/server, does file transfer, etc), while SSL (now called TLS) is just the transport layer protocol that is used in other protocols that add in the necessary functionality (e.g., HTTPS, FTPS, IMAPS etc.). Also see comparison of EtM, E&M, MtE at: crypto.stackexchange.com/questions/202
May 8	revised	Is salting a hash really as secure as common knowledge implies? added 226 characters in body
May 8	answered	Is salting a hash really as secure as common knowledge implies?
May 6	comment	Is it okay to reveal database's table names? @Krystian - I agree. Use good names in your application for your own sanity, but there's no reason to expose the name of a table to a client in a web application. It is ok to use the same word (e.g., your table is naturally called 'comments' and your URL and website also naturally has the same word in it). But you are vulnerable to SQL injection if you take a client-side variable (even if its set by your code) that has a table name that eventually makes it to an SQL command as a string for a table name (unless your server side input sanitation is perfect--but this is easy to screw up).
Apr 25	comment	How to determine hashes/second in password cryptanalysis openwall.info/wiki/john/benchmarks E.g., use the `--test` flag.
Apr 25	awarded	Nice Answer
Apr 23	comment	Writing a script to tell which users are currently typing? lsof as in list open files? Something like: `pids=$(pidof python); lsof -p ${pids/ /,}` maybe?
Apr 22	comment	LT codes with Homomorphic hashing This is probably should be moved to crypto.stackexchange.com as it doesn't really focus on security side of things. (Still a good question; and finding the most appropriate SE is sometimes difficult as subjects like hashing span several SEs).
Apr 22	comment	LT codes with Homomorphic hashing @makerofthings7 ⊕ is one customary way of writing xor (exclusive or).