The DMZ

Scott Pack

12:57 AM

/me sighs

Yay for summer storms.

What's the point of living in the middle of a city if my power stays out for 5 hours and counting?

Let's find out how long a Smart-UPS 1000 can run a fan :)

Iszi

1:59 AM

Blog writers, here's an idea: Write a post about salts - what they are, benefits of using them, and how they should/should not be used.

nealmcb

4:24 AM

@Iszi I referred to salts in my password post, and linked to questions that say more about them. If that doesn't cover what you're interested in, ask a question.

The context matters a lot as usual.....

But do be careful about eating salts - they can cause hypertension....

Iszi

4:49 AM

@nealmcb Ah, I see the intent of the blog seems more to highlight interesting posts than to contain their own information?

nealmcb

@Iszi Different bloggers may approach it differently, but that makes sense to me. Also note that many posts are already in the queue. You could ask the question here rather than doing an official question also, since it seems a bit vague so far.

Rory Alsop

9:08 AM

The QOTW blog is definitely to attract attention. The other entries could be anything from a list of good questions to an in depth treatise. It's about attracting the right people to the site and building the sec.se brand, but also can be used to build your own brand, and credentialise yourself

AviD

11:04 AM

boat boat boat Boat BOAT boatboat boat boat... boat... boat... boat BOATBOATBOAT boat boat boat boatboatboat BOAT!!

Rory Alsop

11:33 AM

@AviD on a boat?

@M'vy - I'm doing an initial draft for a graduation post, but feel free to update it with content, excitement etc :-)

Stack Exchange

12:03 PM

Stack Exchange Security Blog: Security Stack Exchange Sponsored team wins UK’s White Hat Rally

posted on July 12, 2011 by roryalsop

White Hat Events is a collection of individuals from the UK’s Information Security Industry who get together to raise money for charity. The events each year include the White Hat Ball, Marathon, Golf, Cocktail Party and Rally. The 2011 Carry-On themed White Hat Rally was fiercely fought over the weekend of 1 – 3 July, [...]

M'vy

12:16 PM

@RoryAlsop I do not have access to it ;)

BTW the announcement just before seems nice!

Security.SE sponsored also means with security.SE members?

Oh wait, @RoryAlsop : you were the sponsored team???

Iszi

12:48 PM

@RoryAlsop - For those of us on the other side of the pond... "japes"?

M'vy

@Iszi : some kind of jokes

it seems

Iszi

Oh, hey! I just realized today's supposed to be launch day! Woohoo!

Rory Alsop

@M'vy - hmmm - will see if I can make sure you have access

M'vy

yes @Iszi I was first sad that SE podcast was cancelled today when I remembered this :P

Rory Alsop

@Iszi - japes, capers - fun exploits, practical jokes, adventures

@M'vy - not sure why you can't see it. Must be among the rules around contributors and editors.

M'vy

1:05 PM

@RoryAlsop probably yes

Iszi

@RoryAlsop - What's the permissions on the un-published posts anyway? Can anyone preview them, to jump in here and give input? Or is it more restricted?

M'vy

I never handled permissions on wordpress.

Rory Alsop

(me neither - I use wordpress for a small bit of CMS in a tae-kwon do community page I run, but only the basics)

@M'vy - as a contributor do you see 10 posts, or just the 3 published plus your own draft?

M'vy

Oh yes wait. I have the 10

View link is not appearing until hovering !

Rory Alsop

ah hah

M'vy

1:09 PM

Oh not the drafts though

Rory Alsop

okay, so all you get is visibility of the name, but no access to open it.

M'vy

yes

greyed titles

I know there is a "Storing secrets in software - Draft" but can't access

Scott Pack

Morning Gents

M'vy

I can see scheduled?

Rory Alsop

no worries - I'll complete the 'graduation' post later today, although...

M'vy

1:12 PM

404

Rory Alsop

hey @Scott

@M'vy - the content I have currently scribbled in is:

After 242 days in Beta, we now have over 3000 users and an active community of security professionals, hobbyists and specialists providing input, answers, blog posts and their own time to make the site a global success.

The effort has paid off, and today we join 27 other official sites in the Stack Exchange network, and graduate as a fully fledged member, with our own exciting visual design (created by @Jin with comments and ideas from many of our core contributors.)

*

more content here

*

Let your colleagues know about the site and the blog.

more than happy to take comments and populate them back in

Scott Pack

Morning, @ThomasPornin

Hey :P

Hello

hi @Thomas

1:17 PM

@RoryAlsop Do we have other blogs that mentioned us previously? Maybe we can add some hint to ongoing beta of related proposition, or area51 sites that would be closely related to security.SE like crypto?

Thomas Pornin

@RoryAlsop Congratulations on your 10k rep.

M'vy

Grats!

Scott Pack

What 10k?

:)

Rory Alsop

heh - I'm on 9998

M'vy

ohhh

wait :P

Scott Pack

1:19 PM

Congrats on 10k!

no you got it :P

Huh, weird.

oooo - very weird

Rory Alsop ♦, Scotland, United Kingdom

10k 2 6 45

Rory Alsop

I opened 1 question and was on 9998, then another and it was on 10000

Scott Pack

1:20 PM

Ok, I'll quit now.

M'vy

outch... the picture resizing is bad :P

Rory Alsop

maybe 2 downvotes I gave were removed somehow?

M'vy

Edit?

no

not above 2k

Rory Alsop

@Mvy No that is what I really look like :-)

Thomas Pornin

@RoryAlsop @Scott is playing with your rep

M'vy

1:21 PM

XD

Rory Alsop

hahahahahahaha

Scott Pack

@ThomasPornin Oh come on. It could have taken them hours

Thomas Pornin

@ScottPack What is the delay for cancelling a vote, by the way ?

Rory Alsop

it would have, except that I would have actually given up after minutes, and figured it as 'one of them things'

M'vy

@ScottPack It would not have disturb me in my sleep, rest assured :P

Rory Alsop

1:25 PM

whaddya reckon, offtopic much? :

0

Q: Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the whole dokuwiki-folder + subfolders and files the rights 777. I am the owner of the files / folde...

web-application access-control file-system

@ThomasPornin I tried to catch you up, but it just wasn't happening:-) Still, that's 2 of us above 10k by graduation day, and @AviD is close, so although the permissions will change, much will be BAU

We'll have another 4 past the 5k mark as well (if @GrahamLee gets another 41 rep)

M'vy

BAU?

Rory Alsop

business as usual :-)

Thomas Pornin

@Mvy "Business As Usual" says the Mighty Internet

M'vy

we need a userscript to fetch acronyms :P

Thomas Pornin

@RoryAlsop 10k is enough for access to moderators tools, but "trusted user" requires 20k

Rory Alsop

1:30 PM

one of the things I really like about the 'DMZ' is the new slang everyone ends up learning

M'vy

@RoryAlsop XD

Thomas Pornin

Ooh, crypto.SE reached 100% commit. Hadn't seen that.

Rory Alsop

that must have accelerated quickly - last time I looked it seemed to have slowed at about 80%

M'vy

15 mins ago, by M'vy

@RoryAlsop Do we have other blogs that mentioned us previously? Maybe we can add some hint to ongoing beta of related proposition, or area51 sites that would be closely related to security.SE like crypto?

Thomas Pornin

"latest commit: today"

M'vy

1:33 PM

That is just "à propos" :P

Rory Alsop

We get mentioned in the general stackexchange blog feed - which is RSS syndicated, and we have tweeted/twittered/twatted so will do that again, but I like your idea of mentioning related topics. I think crypto is well related, so will add in a para on that.

@Thomas - what would you say is the core differentiator between crypto questions suitable here or SU/SF and suitable on crypto.se? On SU/SF it is around implementing the application configuration, here assessing risk and choosing the appropriate tool or implementation, and on crypto.se...

understanding the algorithms themselves?

developing the maths?

Thomas Pornin

Generally speaking, any question which will be on subject in crypto.SE could have been posted on either security.SE or cstheory.SE.

Both will have to make a bit of room for the new crypto.SE

Rory Alsop

:-) in which case, as our top scoring resident cryptographer, your opinion counts - what would you like the separation to be? Mine was just a rough idea.

(as our top scoring anything...:-)

Thomas Pornin

establishing a list of rules for knowing which SE is the right one looks like a difficult job

most of the time, it does not depend on the question but on the response

e.g. if the question is "should I use MD5 for hashing passwords ?"

M'vy

I guess that the majority of conflicts resolution on other SE sites is: the sites which gets the question keeps it.

Rory Alsop

1:43 PM

unless it generates few responses

Thomas Pornin

then the crypto.SE response will talk about random oracles and PRF and how no currently known attack on MD5 applies yet but look at MD4 and see that's collisions are still bad news so no, do not use MD5

Rory Alsop

but we do migrate a fair few sec questions from SF, SO and SU - as well as some from Ubuntu and others

Thomas Pornin

while the security.SE response will be more on the line of don't invent your own crypto you dummy, use bcrypt/scrypt/PBKDF2

Rory Alsop

@ThomasPornin :-)

M'vy

lol

Thomas Pornin

1:44 PM

both responses are relevant to the question

Rory Alsop

maybe we wait and see - as someone active in all those groups, and with the required understanding of the topic, you will be very valuable to steer the early days then in terms of migrating new crypto questions on here if they appear that they would be better served on crypto

Thomas Pornin

@RoryAlsop yeah well I will answer to questions in both sites

with a more "let's see into the mathematical details" stance on crypto.SE

Rory Alsop

drafting wording along these lines for the blog:

We have just heard that a closely related site, the Cryptography Stack Exchange, has just reached 100% commit so will be entering private Beta now. While Security Stack Exchange will continue to have as one of our disciplines the understanding and management of risk in crypto implementations, here we steer clear of the mathematical issues and concentrate on security and risk.

Thomas Pornin

This is probably a stupid question, but where is the blog ?

I mean, I cannot find a clikable link from security.SE

Rory Alsop

security.blogoverflow.com

Thomas Pornin

1:52 PM

Should I have to (gasp) type the URL ?

Rory Alsop

we will be getting a clickable link

honest:-)

hang on

security.blogoverflow.com

there ya go - clickable

(but would you trust a link from a security person?)

for folks who volunteer to be contributors or editors we also give access to the adin portal

(you interested in writing a crypto post at some point? could then also point links to crypto.se)

Thomas Pornin

@RoryAlsop ok, count me in

Rory Alsop

will go and do the necessary admin - give it a few mins

Thomas Pornin

@RoryAlsop Time for me to make some tea, then

Rory Alsop

it's always a good time to make tea:-)

Scott Pack

1:59 PM

I haven't made tea in a long time.

I should bring some back in.

Rory Alsop

I'm for for the vitamin/chemical goodness that is a glass of Berocca

Scott Pack

Trying to keep from getting sick, eh? I prefer quinine for that purpose.

Rory Alsop

Quinine rocks!

not least because it glows!

Scott Pack

It does? That sounds a big disturbing.

At what concentrations?

Rory Alsop

anything that fluoresces pleases me on so many levels - the blue glow around ice-cubes in a glass, while sat out in the sunshine

ahhhhhh - bliss

Cherenkhov radiation... not so much

You make yourself a G&T and shine UV light on it - lovely blue glow

it's famous for it

Scott Pack

2:03 PM

I had no idea

I wonder if I have any UV lights at home

Rory Alsop

you're just not drinking close enough to UV sources are you:-)

sunshine works a treat

Scott Pack

Well, that is to say, if the power is back on this evening and I have a UV source, then I'll test it out.

I have enjoyed many a G&T in the sunshine, but never noticed glowing

Rory Alsop

compare a vodka lemonade with a gin and tonic in sunlight or UV light

my work here is done - educating others in the wonders of drink:-)

chemistry.about.com/b/2008/03/20/…

Scott Pack

I was really jonesin for a G&T last night, but didn't want to open up the fridge or freezer. Too bad.

Rory Alsop

from that site: One of the brightest glowing drinks is tonic water or a gin and tonic. Tonic water exhibits a bright fluorescence from the quinine that is added as a flavoring. Another option would be absinthe.

I didn't realise Absinthe glows - so I'm learning too:-)

I have a UV light in the back of my car - will test this later

Scott Pack

2:06 PM

Now that one I did know.

Rory Alsop

I usually drive to gigs so drink tonic water - absinthe doesn't really go with being in charge of anything, let alone a vehicle

Scott Pack

I can't say I've ever had absinthe. I have recently started seeing it in the local liquor store, so they must have done something to get around the ban.

Rory Alsop

they dropped the wormwood

same happened in Europe (although you could find some old-style absinthe in odd eastern European countries)

Scott Pack

Mm....wood alcohol. When you positively, absolutely, MUST go blind by 10pm

Rory Alsop

hahaha

Thomas Pornin

2:12 PM

@RoryAlsop You can find something called "Absint" in Prague, but that's not the same as the scourge of so many bored colonials.

Scott Pack

Do you think he's talking about me, @Rory?

Rory Alsop

@ScottPack dunno - are you bored?

Scott Pack

meh

Thomas Pornin

The Czech absint is a blue liquor with about 70% alcohol, the rest being obviously sugar

Scott Pack

Clearly.

Rory Alsop

2:14 PM

The scariest Absinthe I ever had was from Poland, but usually I go for French and German Absinthes. We do have a tradition in my band, when not gigging, of drinking Champagne, Absinthe and Hendrickse&Tonic

rock and roll, eh

@ThomasPornin it'll burn well then:-)

Thomas Pornin

it is not bad, but not anywhere near the original absinthe, which is close to Anise

@RoryAlsop I got told it works marvels for unstucking frozen locks

Rory Alsop

ahhh - it does sound like it might be better used for that than for drinking...

Scott Pack

I could probably thin it out and use it on the sidewalk

Rory Alsop

what for?

keeping the weeds away? or deterring stray dogs :-)

Scott Pack

So I don't have to shovel in the winter!

Rory Alsop

2:19 PM

that's what having children is for - they almost fight each other to use the shovels

Thomas Pornin

I was in Prague in 1999. Provided that you avoid the central town square (where tourists go), you could have beer which was almost given

something like 3F per pint (that's 0,5 €)

Scott Pack

@RoryAlsop That and mowing. I think I still have a few years to wait, though.

Rory Alsop

I love Prague - but it has changed a lot since 1992 when I first went (and spent about £5 an entire weekend) and 1999 when I was last there. I agree with you that avoiding tourist areas is a good idea (but I did stay in the Intercontinental - it was our 1st anniversary)

Thomas Pornin

@RoryAlsop I was at the Hilton -- where Eurocrypt'99 took place

Rory Alsop

very nice

Heh - just made a connection: That starred comment from @Scott yesterday on Ursine death from above - plus @Thomas and @M'vy's icons in the attendee list. Chuckled to myself.

Scott Pack

2:25 PM

I hadn't noticed that. Very nice.

M'vy

?

Rory Alsop

@Mvy the chat we had yesterday was around the new logo, and having a bear with wings was suggested. This translated into Ursine death from above (ursus being latin for bear) - and your space invader avatar was next to @Thomas's bear avatar

Thomas Pornin

@RoryAlsop I'm in. I cannot view the scheduled-but-not-published posts, I suppose that this is the normal and expected behaviour ?

Rory Alsop

yes - at the moment you are set up as a contributor. We can change this to editor, but then you'll be in the review loop for everything as well - happy to do that if you have the time

Thomas Pornin

@RoryAlsop Looks like work. I don't like it.

Rory Alsop

2:38 PM

LOL - no worries

right - gotta run. This whole kids being on holiday thing - it screws up work hours:-)

will get back on a bit later

see you

Thomas Pornin

bye

Scott Pack

Ta

Iszi

Will you guys stop chattering away while I'm not watching the room? Way too much for me to catch up on, here! Since when did our room get this busy? ;-P

Scott Pack

I blame it on the foreigners.

M'vy

@RoryAlsop Ok, LOL :P

@Iszi Well it's probably a problem with pbr

Scott Pack

3:05 PM

I just noticed a guy who is, apparently, in one of my g+ circles, but I can't for the life of me figure out who he is, or how we're possibly connected

Any ideas?

Iszi

@ScottPack That's the guy I sent you yesterday.

Scott Pack

Heh, ah.

Iszi

Forgotten already?

Scott Pack

I never knew his name!

Just some email address that included racial slurs. I dunno. :)

Iszi

Ah, yeah. I'm pleasantly surprised to see no "screen name" or reference to the e-mail address appears present in the profile.

What's that "Buzz" tab? I thought Buzz was dying/dead?

Scott Pack

3:08 PM

I tried to go through and privatize as much of my profile as I wanted. For personal branding purposes I still wanted some of it public, but I ended up limiting most of it to either extended or my circles.

Iszi

I'm not certain how much I like the "send an e-mail" link there. Is that optional also?

Scott Pack

Hm.

Iszi

Seems like. I don't see it on yours.

Scott Pack

Looks like I need to work on my seo

Stupid firefighters

M'vy

That's funny, on your security.SE link you have the icon, But I can't get the one of the blog on my profile

Even picasa don't have it.. weird

Scott Pack

3:14 PM

I added it to my google profile aeons ago. I suppose they just pulled the favicon and cached it or some such.

The photos tab restriction is not as granular as I would like.

I wouldn't mind it showing up to people in my circles, but it looks like it's on or off.

M'vy

Well it chouls be favicon.. but... well not important

You can assign it to specific people ?

Iszi

Question: Can you restrict posts in G+ to exclude people in certain circles?

Scott Pack

Since I use it for sharing pictures out with family, public (but non-searchable) albums are about the only thing that make sense.

@Iszi It looks like you have to include

Iszi

i.e.: I want to post to this circle, but not to people who are also members of this circle?

Scott Pack

You can have people in multiple circles, but you can't have nested circles.

M'vy

3:16 PM

I wondered about that too...

Iszi

@ScottPack What I'm looking for is something like: Post to "Family", but exclude members of "Family" who are also members of "Children".

Scott Pack

Yeah, that would be nice.

M'vy

You can do that on FB. I guess the feature will come :P

Scott Pack

Based on their current setup I think you would have to have 3 circles: Family, Adults, and Children.

And put everyone in both the Family circle as well as the appropriate 2nd circle.

Significantly less than ideal.

Iszi

@ScottPack You mean: "Family-All", "Family-Adults", "Family-Children"?

Scott Pack

3:18 PM

Sure, whatever. Naming conventions are all local decisions in my book :)

Iszi

('Cause just "Adults" or "Children" is a little too broad.)

Scott Pack

Now nested circles would be awesome.

my @Family = (@Family-Adults,@Family-Children); # or some such

Iszi

Would be very cool.

I'm just itching to see what @Jin has in store for us around COB EDT today.

Scott Pack

Ok, their 'Send Feedback' function is fucking amazing.

Iszi

@ScottPack ?

Did you just suggest nested groups to G+?

Scott Pack

3:22 PM

That's a negative. I'm suggesting that access to the Photos tab should be more granular.

Right now it's either on or off, whereas most other profile data is significantly more granular.

M'vy

meta.plus.google.com :D

Scott Pack

Ok, so whenever you click the feedback button you get a popup that has has two sections the first allows you to either a) Select page elements, or b) black out page elements.

The second is a free text box to type in your feedback. Then there are two buttons, "Preview" or "Send"

I, clearly, decided to preview.

Iszi

@ScottPack Please do also submit for nested groups. Feel free to use the "Family" example we were discussing.

@ScottPack ...and...?

Scott Pack

So what they receive is a description of the problem, a screenshot of the web page (with the appropriate elements highlighted or redacted), as well as an additional information field which contains: 1) a list of any page elements you annotated, 2) full url (as visible to me) for the page 3) metric assload of browser information, 4) "Product Information" (not sure exactly what it is), 5) Full page source as was sent to my browser

Iszi

@ScottPack ...and you get to see this before it's submitted, and prune as appropriate?

That is awesome!

@Mvy That would be only slightly cooler.

Scott Pack

3:30 PM

Prune, no, however you can go back and modify your text and/or annotations/blackouts

Since this is going to the product team that builds and/or runs the web apps/servers, I feel like pruning those 5 pieces of additional information is a bit of a 'too little, too late' kind of thing.

The vast majority of it is information that would either be available to the web server logs.

Jin

3:59 PM

howdy

Scott Pack

@Jin!

Transcript for