19,223 reputation
23291
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 2 months
seen 3 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Jun
10
revised Timing-safe string comparison in high-level languages
added 4 characters in body
Jun
10
answered Timing-safe string comparison in high-level languages
Jun
9
awarded  Enlightened
Jun
9
awarded  Guru
Jun
9
comment How is this XSS attack working?
@RahilArora - XSS prevention will prevent you from escaping out of the attribute tag. E.g., if you had <img src="{{ somevar }}"> you wouldn't be able to escape to get to <img src="#" onload="alert('XSS')">. The problem in this case is inserting untrusted input into the middle of a JS function in an HTML attribute.
Jun
9
answered How is this XSS attack working?
Jun
8
comment A manual function for hasing identity?
The original study (Sweeney 2000) found 87% of people are identifiable by zip code + gender + year/month/date of birth and a followup study found 63% identifiable by those criteria.
Jun
6
comment How can I secure my wireless network from neighbor's password-cracking attempts?
@D.W. - I'd suggest using your favorite search engine and search for (name of router) + "backdoor". Granted you may want to be careful doing this, could be used as evidence you tried to hack someone. Alternatively, use a router with open-source firmware like DD-WRT / OpenWRT, which presumably do not have obvious backdoors. (Granted OpenSSL is open-source and had heartbleed and several more recent problems for a long time, so open-source while preferred isn't perfectly secure).
Jun
6
awarded  Nice Answer
Jun
6
awarded  Generalist
Jun
6
revised How can I secure my wireless network from neighbor's password-cracking attempts?
added 529 characters in body
Jun
6
answered How can I secure my wireless network from neighbor's password-cracking attempts?
Jun
5
revised In there any point in passphrase-protecting an SSH private key that is used by a service account?
deleted 8 characters in body
Jun
5
revised In there any point in passphrase-protecting an SSH private key that is used by a service account?
deleted 8 characters in body
Jun
5
comment In there any point in passphrase-protecting an SSH private key that is used by a service account?
@Kal - Sure. But I usually just run the cronjob as root. E.g., sudo crontab -e add a line where the command is 34 1 * * * /usr/bin/ssh -i /root/remote_host_cron_job_id_rsa user@remote_host and have the private key pair only root readable. This of course assumes I have root access. Yes this opens up an attack surface (if an attacker could replace the binary /usr/bin/ssh with something malicious, you get to run a binary as root when the cronjob next executes). It's better to set up another limited account client side that runs the cronjob and is the only user to read the key.
Jun
5
revised In there any point in passphrase-protecting an SSH private key that is used by a service account?
added 12 characters in body
Jun
5
answered In there any point in passphrase-protecting an SSH private key that is used by a service account?
Jun
1
revised Is a passphrase-protected SSH private key susceptible to a dictionary attack?
Added in necessary superscripts for exponents.
May
31
comment Are there any reasonable TrueCrypt forks?
@ignis the only concerns that I have seen that are shown to originate from legal council talk about the state of the license in 2.5 in Oct 2008. The two so-called trap paragraphs were significantly changed to specifically address those concerns. See comments to IstvanChung in other thread. Granted, as I pointed out above paragraph VI.2 seems questionable. But then its not a question of being able to fork truecrypt, its being able to legally use truecrypt.
May
31
comment Are there any reasonable TrueCrypt forks?
Again, legal discussion of an old version that was significantly changed is largely irrelevant. Similarly analysis of whether you are free to create a forked version (subject to some potentially annoying constraints) versus whether its sensible for a commercial entity to include it in their linux distribution (that they reserve the right to charge for) is a very different matter.