« first day (2082 days earlier)      last day (2790 days later) » 

3:11 AM
What is the term for web API (or web app) in which a user can CRUD only her own data? The term that comes to mind is "multi-tenant", but I don't think that's the correct term.
 
 
5 hours later…
8:14 AM
@Aria Most of NLP is normal stuff that humans who are good at this do
 
@Aria Actually I don't know a lot about NLP, merely just the name and I used to associate it to a set of techniques relying on exploiting some psychological bias in order to induce predetermined persistent changes in the mental process.
 
@WhiteWinterWolf there is a lot of NLP that is at a much lower level than that though. As I said, good salesmen have innate NLP
 
It is merely used for for good things like self-improvement, and more dubious or maybe downright creepy things like indoctrination (whether it is in some sectarian or business frame).
 
The social awareness and social leadership skills are a strong part of this
the indoctrination end is very dodgy
but you can spot those who try to use it that way
politicians ...
 
@RoryAlsop As I said, I have a very limited view of what it really, I mean concretely covers. As Aria mentioned, NLP seems also a bit of oversold marketing term promising everything and its contrary. Not only salesmen use NLP, but they also sell NLP ;) !
 
8:22 AM
heh - very true
 
I don't know how much of them can wear the NLP label or not, but in all case the skills you are referring to can be used either for good or bad purpose. It is always the ambiguity of what is usually called "manipulation" techniques. Under one form or another it is always a significant part of the activity of people having to interact with other people.
It can be a salesman (or some politic, if that makes any different) trying to sell their product, it can be a manager trying to raise the confidence of an employee.
It is often a question of saying the right words. I remember this classical example: as a manager, do not tell that a task you would-like a employee to do is easy, this is belittling, instead explain why this employee has all the capacity required to fulfill it.
The idea remains the same in both situation. In the second one however, both people have made a step forward which is a good thing.
Some people are better at it than other. Being on an IT Security website, I guess there might be some experienced social engineers around there that may know a lot about such things ;) !
@Aria Regarding Tor: people always hope to find the ultimate universal panacea. They hope that a firewall will bring total security to he whole network, that Tor will bring total anonymity. Even in the medical domain, new discoveries were always aimed at being the so awaited general solution.
The truth is that the world is complex, and there is no single solution to solve all problems, only a mix of partial solutions can help to advance toward a coherent and sane posture.
This is precisely such kind of wrong hope that some politician try to abuse by presenting the world using simplistic schemes with simplistic solutions.
There is on one side some boring politician telling gibberish about world economy and politics, how it is complex and hard to handle, etc. On the other hand you have some politician presenting such simplistic schemes and solutions.
Some people have the tendency to go toward the discourse they understand, no matter if it is right or not, at least they understand it.
Parkinson's law of triviality is C. Northcote Parkinson's 1957 argument that members of an organisation give disproportionate weight to trivial issues. He provides the example of a fictional committee whose job was to approve the plans for a nuclear power plant spending the majority of its time on discussions about relatively minor but easy-to-grasp issues, such as what materials to use for the staff bike-shed, while neglecting the proposed design of the plant itself, which is far more important but also a far more difficult and complex task. The law has been applied to software development and...
Or how people prefer to argue about the color of a bike-shed instead of having to deal with nuclear plants issues.
@Aria By the way Trump is among the 400 most wealthiest billionaire on earth, his money let him play the "US dream" card, so no you will never hear him say "We have no money". "Not enough", maybe, nobody has enough money, but never "no money" ;)
 
 
3 hours later…
11:57 AM
Law of Triviality: true, but that depends on concrete social setup, but even if the seemingly social setup is OK for solving difficult issues it still may go wrong to different factors
Actually Law of Triviality is good observation of real-world, however it doesn't need to be like this
One thing is that people should not work "like organization" but every single member should be organization within, this kind of approach is good but requires constant learning, challenging and also higher pay
 
 
1 hour later…
1:11 PM
How it feels to browse Stack Exchange sites and hit the Information Security pages
 
 
2 hours later…
3:23 PM
@Aria Hey, where did you put Isis?
It was nice to have a goddess participating on SE ;). Well, I assume that a helping hand is good too!
One thing is that usually people do not like to learn new things. The evolution made us fear new and unknown things, consider them as potential danger, and prefer well-known conditions instead.
A constant learning and challenging means a constant confrontation with the unknown and accepting our own weaknesses and errors in order to progress.
Too much people try to avoid that and prefer to stay in the background, in their own comfortable routine, and are not happy or feel lost when some change may threaten this routine.
Moreover, you say that people should not work "like organization" (I have this image of an ant hill coming into my mind).
It is sad that our current society does not really encourage personal initiatives.
I don't know how it is other countries, but far too often schools are a mere tool to learn conformism to the pupils.
And once grown up some liberal company will hire them for some well-defined job where they will be expected to not discuss anything or do anything outside of their attribution.
This is what I call "martial" management: the CEO decide what must be done, management receives orders from higher layers and ensure that lower layer correctly apply them, and bottom of the hierarchy executes the low-level work, no question asked.
While I can understand the efficiency gain in such setting and the fact that this gain is required for actual military structures (imagine an assault order is given and soldier begin to deliberate about the what and how), I do not feel this is a sane way to live his life (knowing that our professional work constitute a major part of our life).
But sadly, a lot of people get used to it, just accept it and consider this as their own "comfortable routine", as they accept a lot of other things, with the fear that it may be worse.
 
4:06 PM
@WhiteWinterWolf or maybe this way - the good of person is more important then good of the group
Like for example family - if everyone is unhappy and sacrifices oneself for the good of family but does not care of being good himself, then it's wrong
Similarly with the organization, not making initiatives and working for the corporation who is passive-aggressive (there's something like passive-aggressive organization), that person becomes victimized by it, and there's failure on both the employee and organization
employee who did not have any initiative on it's own (which would put passive-agressive organization against him), and organization which did not wanted to invest in individual people but instead wasted them
So some passive-aggressive organizations may simply keep ignoring any initiatives and while there's usually corruption in such usually these are government-supported organizations which receive help in many ways to not sink, so they keep afloat but with near-zero performance
That's the think about helping organizations and not people
 
5:09 PM
@Aria Thanks, I did not know the passive-aggressive organization term :)
I think a right middle has to be found: one should not annihilate himself for the sake of the group, but on the other side one cannot live only by and for himself.
By "failure of the organization", we may pay attention to what we exactly consider as failure.
Often, in such large group, investors and high management first goal is short profit. We do not talk about making the company sustainable in the long run, nor do we talk about producing high quality goods, we talk about quaterly reports and stock market price.
If the company falls, that's not a problem: both investors and higher management can easily switch onto another company. Either management gets fired with high compensations, or they sell the company: in any case they win.
Or, as you rightly said, if they enter in the "too big to fail" class, then they get money from the government.
Fortunately, there are more and more people who are conscious of this, both from management and technical sides, conscious that the initial goal of a company is not solely to make money, but to provide the best service possible to the community and only then, to be paid for this service.
So hopefully with time going on things will evolve in the right direction. My only fear is how much collateral damage will happen (and currently happens!) until we get to this.
By the way, here is a promising book waiting on my reading list:
 
 
1 hour later…
6:38 PM
@uhfocuz if you want to discuss that client side hashing thing further, I'll be in chat for a little bit, but it's getting a bit long winded for comments and the format is making it hard to really address your thoughts fully
I wasn't able to fully clarify in comments, but you are correct that client side hashing would increase the amount of time required to bruteforce the original password without having to expend server resources, but at the same time, it does the site itself no good at all. The password the user enters is not the authentication credential for the website, the client side hash is. It would only protect the user in regards to someone hashing the original password if it was reused on other sites.
it would have no impact on the amount of effort require to compromise the site in question
also, another limitation I realized is that if you are actually going to do it "right" you'd also have to separate the username and password screens as two different requests as you would need a per-user salt which you would have to ask the server for after getting the username. This would also mean you have to store every username ever tried and generate a salt for it to avoid giving away if a particular username is valid. You could cheat it a bit and use something predictable
like username+shared value as the salt I suppose, but that would have a weakness if anyone came up with an attack against a hash using related inputs
and all of that is still for something that would only impact security of other sites and only when the user is not taking their own security seriously
@AJHenderson I still am strongly opposed to your claim that this would provide very limited advantage, it would double bruteforcing times, never could the real password be easily divulged in the scenario our HTTPS protocols are already broken, and XSS, no, tampering, yes but this data originates to the registration, would be just as effective as really using tamper data — uhfocuz 59 mins ago
(for anyone else that was interested)
 
7:11 PM
@AJHenderson Introducing a salt on both hash operations (client side have insecurities obviously) and server sided that can be stored in a database and uniquely generated and possibly some protection mechanism embedded. This would not be a big deal as there will be as few as 10 users total in a closed system intended to be over secured
@AJHenderson currently out and about, on mobile. Hope to discuss later
 
@uhfocuz lol, that was part of my problem earlier as well. I was on mobile so couldn't respond particularly well in addition to the limits of comments
 

« first day (2082 days earlier)      last day (2790 days later) »