16,245 reputation
12583
bio website
location Brooklyn, NY
age 32
visits member for 2 years, 11 months
seen 7 mins ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Mar
26
comment What kind of encoding/hash it is
Actually for some reason I copied the first byte wrong in my 192-bit hash (should be '2f') so it is 2f476cf87e06f153fe4610e054b39582424bd9d394bcaee1 hex string. By URL encoding, I just mean percent encoding -- the encoding scheme where you specify some bytes (unprintable ascii, or otherwise want to be avoided) with a % followed by two hexadecimal characters. See: en.wikipedia.org/wiki/Percent-encoding
Mar
24
comment What kind of encoding/hash it is
It's a 192 bit hash corresponding to the hex string 46476cf87e06f153fe4610e054b39582424bd9d394bcaee1 (or in binary (010001100100011101101100111110000111111000000110111100010101001111111110010001‌​100001000011100000010101001011001110010101100000100100001001001011110110011101001‌​110010100101111001010111011100001). They just URL encoded the non-printable ASCII bytes.
Mar
21
comment What are these long www bitnik URL?
@gabe - No I do each query once; note each query returns back two A records (for *.242.12 and *.243.13) telling your browser to use either IP address. This is what DNS servers are meant for, doing ~20 queries is not "excessive" (and a single DNS query is ~100 bytes). Visiting a standard web page typically requires dozens of queries if the domains aren't already hashed. If anything their configuration of having a TTL of only 290 seconds (telling your browser and other DNS servers they should only cache the DNS query for 290 seconds) is the much more significant penalty.
Mar
20
comment What are these long www bitnik URL?
What do you mean its a way to hide where the true server is? It's a public-facing DNS A record. It doesn't hide anything.
Mar
20
revised What are these long www bitnik URL?
added 2 characters in body
Mar
20
answered What are these long www bitnik URL?
Mar
19
comment Is this password generator safe?
It appears to be reasonably secure passphrase. Granted it doesn't use https, so it would be trivial for any network eavesdropper to capture your passphrase by tampering with the http scripts on nxtra.org to something that exposes the passphrase to them.
Mar
15
answered If P=NP, what is still cryptographically secure?
Mar
12
comment Is Salt, IV and Key necessary when encrypting password in a database using AES? If so, how should they be used?
Your answer to #2 depends on both the block cipher mode ( will work with CBC mode, but not CTR mode) and that the unique salt is prepended to each password (if the salt is appended to the ends of passwords, its likely you will leak information on long passwords that have matching first blocks). And with modes like CTR, reusing an IV (even with a varying salt) is completely insecure -- this is the equivalent of reusing a one-time-pad. To summarize, its best to use encryption as intended. That is use salts for hashed pws, and secret keys and random IVs for encrypted pws.
Feb
26
comment Are WhatsApp or Telegram secure enough to use for office communication?
Security from what? Switching from what email provider (in-house, or something proprietary)? It all depends. I wouldn't recommend using WhatsApp or a similar IM service to do wikileaks-type national security information or if your information is otherwise very sensitive (e.g., someone could make millions intercepting your communication by insider trading). I don't believe WhatsApp is particularly secure, but then neither is typical email sent to an arbitrary email address where in general there are no guarantees it is not relayed in plaintext.
Feb
24
awarded  Good Answer
Feb
21
comment Flaw in encryption through pseudorandom number stream (from gpg documentation)
@JonBentley - There's also a difference between broken-in-practice (WEP, WPS, LM-hash, DES, KASUMI, un-keystrengthened MD5/SHA-1 hashes of passwords) and broken-in-theory-but-secure-in-practice. The latter includes things that are still widely used like AES (e.g., best attack on full-strength AES-128 not in a related-key is 2^126.1). I was mistaken categorizing CryptMT as "not broken" 3 years ago--it is broken against indistinguishability from random while maintaining semantic security. Granted, RC4 had biased output that first led to a distinguishing attack and then the bias broke the key.
Feb
21
comment Flaw in encryption through pseudorandom number stream (from gpg documentation)
@JonBentley - Ugh. Dredging this up again. Yes, if the paper wasn't flawed, CryptMT would be broken against indistinguishability from random noise, despite encrypted data being semantically secure and not being broken against either chosen plaintext or (adaptive) chosen ciphertext attacks. However, I still feel its important to stress what attack a cipher is broken against versus merely labeling broken/not broken (the broken property may be irrelevant for your purpose).
Feb
7
reviewed Approve suggested edit on Preventing reverse-engineering of client application
Feb
5
revised Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
added 205 characters in body
Feb
5
comment Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
@VijayendraBapte - Will add that. Note they still have the setting environ['HTTPS'] = 'on' in other places (for example see: github.com/django/django/blob/master/django/http/… ). Granted, I'm not sure the logic if your application makes WSGIRequests or HttpRequests when and if the _get_scheme in HttpRequest is overridden. Probably safest to use both.
Feb
1
answered Defamatory post - obtaining evidence tracing perpetrator right to his laptop
Jan
31
reviewed Approve suggested edit on Is it worth it to get paid anti-virus software?
Jan
30
revised Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
added 1191 characters in body
Jan
30
revised Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
added 1191 characters in body