The DMZ

12:02 AM

@Ninefingers Community is important, but topic matters too. Mathematics works very well around a topic. Programmers suffers from having a clear community but fighting over topic.

Still, I think most successful SE sites do have a fairly clear community, or at least a panel of communities with sufficiently common topics. E.g. Unix and Linux is for unix users and admins and hobbyists. IT Security is for pros in a bunch of IT-related security fields.

Ninefingers

12:16 AM

@Gilles I must admit, I've avoided programmers...

Gilles

@Ninefingers You're not missing anything, unless you like drama

Ninefingers

Haha, I don't, that's why I like stackexchange on the whole, because a lot of the noise and nonsense just don't happen.

@Gilles I don't disagree - both are important, but I think who you want to serve is more important as it sort of defines the topic. On SO, for example, there are many different types of developer, but developing is more or less the same idea across languages. By contrast, server admin doesn't fit so well.

Mana

The problem is, of course, how to react when it does!

Ninefingers

Another example is Ubuntu vs Unix/Linux. I personally think the two sites are fine as is, because Ubuntu as a distribution often serves people new to Linux. Whereas, I think for Unix/Linux, the question level is likely to be slightly more advanced... more of the hows and whys of Unix-systems than just "how do I do X in Ubuntu?" It's a subtle difference with a fair amount of overlap, but there are different senses I think - correct me if I'm wrong @Gilles, you know more about U&L than I do!

I think the physical security/it security question is the same... are the communities sufficiently overlapping? Or do you serve two different needs... one for defending computer networks and all that entails, and one for physical access like bank vaults, security personnel, lighting etc.

I don't necessarily know the answer to that I don't think

Gilles

U&L is ok with basic questions too

But there's a difference in the kinds of answers you get on Ask Ubuntu versus Unix and Linux

AU tends to give you an answer that works out of the box on Ubuntu, often through the GUI and with screenshots, requiring little effort to apply on Ubuntu but possibly not applicable to other distributions or other desktop environments

U&L tends to give you an answer that might require a little more effort (e.g. you might need to translate “install the program foo” into the appropriate package installation method for your distribution), but can be distribution-agnostic

Ninefingers

12:32 AM

That's what I thought... different needs. People new to Linux/just using Ubuntu want that kind of answer Ask Ubuntu provides. Perhaps "advanced" is the wrong word really. So the question is, on this site, would physical security people get the kind of answers they come looking for?

Gilles

@Ninefingers I think they would, as long as there's enough of a subcommunity on the particular topic

I don't think adding physical security to this site's topic will harm IT security people in any way

Iszi

@Gilles I was just about to pose that question: How many of our active users regularly deal with PhySec from more than just an auditing perspective?

Gilles

The rejection here is mostly “I don't care about it so it shouldn't be on my site”

I'm more concerned about physical security people: at least initially, they'll be drowned in the mass of questions they don't care about, and it's hard to bootstrap that way

Iszi

@Gilles A little of that, and because this site through its entire maturation has been specifically geared toward just IT Security, with a little sprinkling of more general infosec here and there.

Gilles

@Iszi I have no idea, and that's one of the key issues for a successful scope extension: there needs to be people who can bridge the gap, ask borderline it-sec/phys-sec questions, judge the answers of new participants, generally make phys-sec people feel welcome

@Iszi That's why I pushed the broadening early on, but let's not rehash that

Iszi

12:39 AM

To make that far of a departure from the site's definition this late in the game (post-graduation) is just a little preposterous. If there was a real need for those questions to be here, it would/should have been noticed and acted upon in the months-long public beta phase at the latest. As it is, it wasn't and so it is probably more appropriate for those questions to be on their own site, or at least one separate from here.

Scott Pack

@Iszi I deal with physical security issues fairly regularly.

Design review, recommendations, managing physical access control, etc.

Ninefingers

@ScottPack when you say design review/recommendations, what of? The reason I ask is because if it's just buildings, as in any building, that's a different thing to "server farm" or some other computer network setup

Scott Pack

@Ninefingers Well, this partially goes back to my dislike of the T in our name :)

Yes, it could be as obvious as, "The door leading from the loading dock to the data center floor has a gap large enough to slip a pen knife through. Installing a plate thusly will mitigate that risk."

Or talking to an academic department about how to control physical access to the file cabinets that store their student records.

Ninefingers

Hmmm ok. I honestly don't know the answer myself - both are clearly security, but one clearly involves information systems in the electronic sense where one doesn't involve the electronic bit

Gilles

@ScottPack Interesting. Would your job be significantly different if you were protecting a warehouse storing trade goods, or a vault containing precious jewels?

the answer to that is a very strong argument for or against the I in the name

Scott Pack

12:50 AM

@Ninefingers To me it's all just information that needs to be protected. Student records or healthcare information is information is information, whether it's on paper or on a hard drive.

Iszi

I can definitely say that, while I deal with physical security on occasion from a compliance auditing standpoint, my position probably wouldn't even exist (let alone would I be qualified for it) if the organization didn't have computer systems.

Scott Pack

@Gilles Probably, yes? It's hard to say conclusively. The level at which the physical security goes would be a big deal.

I don't deal at all in man power security, for instance.

@Iszi I can say that as well, but that's because my department didn't really exist before The Great Computer Breach of 2006.

Ninefingers

@Gilles @ScottPack I can see the generic case for there being overlap... I guess my question is would someone looking to protect a warehouse have enough in common with a (currently) IT focused crowd and would a discussion on such measures fit alongside the questions we already have?

Iszi

@ScottPack Yeah, you could pretty much substitute "position" for "department" in my statement as well. Not sure when/how my department specifically was formed, but I know a few people have been in the group for a while - especially the firewall guys.

Scott Pack

@Gilles I don't deal with surveillance either, however I would get involved in the design of a surveillance system to protect the system itself.

Gilles

12:54 AM

@ScottPack What's the difference then? How is protecting access to a warehouse different from protecting access to a datacenter (assuming they're of comparable value)?

@ScottPack Ok, you don't, but surely surveillance of a datacenter is already on-topic here. So why not accept surveillance of other kinds of buildings?

Ninefingers

So I guess my point is: like U&L/AU serve slightly different needs, and SF/SU serve different audiences, and MO/MSE serve different audiences, is physical security like surveillance and personal physical security and bank vault design a different audience to what we have already here?

Iszi

@Gilles In my world, the people protecting physical access to "the warehouse" are an entirely separate organization (different company for that matter) than the people protecting the datacenter.

Scott Pack

@Gilles I'm probably the wrong person to be asking those questions, really. I seem to have a broader view of Information Security, than a lot of other guys here :)

To me the distinction primarily comes down to what you're protecting, and those can certainly drive the how.

Iszi

@Ninefingers I think that, if there can be a divide between SF/SU (and even there has a good bit of overlap) then there's definitely a case for dividing PhySec & ITSec.

Scott Pack

The only "security" people outside this field I've dealt with were police, so I'm not really sure exactly what the differences would be.

Gilles

12:58 AM

@Iszi SF/SU is essentially pro/amateur. That's very different from physec/itsec.

Iszi

@Gilles Arguably. I see it as more client/server distinction.

Even then, we managed to somehow get our own separation from SOFU.

Gilles

@Iszi It isn't. For example, the SF FAQ says it's for “system administrators and desktop support professionals”.

Scott Pack

@Iszi Given the discussions I've had with full time sysadmins and developers, we have extraordinarily different points of views on most things :)

Iszi

@ScottPack Oh, that is definitely agreed.

Gilles

and conversely questions about running a server on a home machine are within SU's domain, not SF

Scott Pack

1:02 AM

@Iszi And also, as clearly discussed, covers more than SF/SO.

@Gilles As per sysadmin1134's recent blog post, also depends on the purpose behind the home server as well.

Iszi

I just know that when I want to ask a question about a client OS, I go to SU. If I'm asking about a server OS, I go to SF.

If either has to do with security, I come here.

Ninefingers

I'm personally just sitting on the fence asking the questions at the moment. On the whole splitting things different ways, it doesn't matter what it is, but more the perspective. That's what a target audience has. Do IT security people have a different perspective to physical security people? Are different bases of knowledge required, or are the processes really all very similar. Who is the target audience and what do they want in terms of questions? It's all very much shades of gray,

Iszi

And then there's the odd occasional Mac/Linux/Ubuntu question that for some reason each have their own domain...

Ninefingers

I don't think or expect there'll be a definite answer to those questions

I say perspective because server admins/desktop support see things differently to a home user building a gaming desktop, even though it's all running computers

Gilles

@Iszi That is not a distinction between SU and SF. Most major OSes (any unix, Windows) can be both anyway.

Scott Pack

1:06 AM

@Ninefingers Can be quite different. Talking to the folks that actually run and operate the Key Shop (i.e. cut keys, manage cores, etc), we see quite a bit totally eye to eye.

Iszi

@Gilles XP as a server? You make my head hurt.

Scott Pack

However, physical access management is the only thing we actually have in common, professionally. Nothing else I do relates to them, and vice versa.

@Iszi Don't get me started.

Oo, the kid's finally down, so it's time for me to get some quality wife time. G'night Gents.

Gilles

@Ninefingers I think it's like SO. I can't code in C# or Java or Objective C or C++, so that means I don't really understand most questions on SO. Yet we can all live on the same site, we have enough in common. As Joel puts it, it's all the same university department.

I think it's the same for security. Of course you can be a pentester and know nothing about locksmithing. But the core issues are close enough that the two can cohabit.

Iszi

@Gilles You can't code in those languages now, but you have the same basic knowledge level and skill set to learn to do so relatively easily. In fact, you probably could answer some questions in languages you don't really know with just what you know about coding in general. The same doesn't hold true for an IT Sec guy looking to be a locksmith or police officer.

Ninefingers

Anyway, I also need to disappear. Have fun working this one out.

Iszi

1:11 AM

@Ninefingers Oh, this'll probably take days at least - if not weeks. We'll have plenty of fun left for you to share when you get back, I'm sure.

Gilles

@Iszi Doesn't it? Programmers raised on imperative languages tend to have a lot of trouble with Lisp or Haskell. Not everything is straightforward.

And it's waaaaay past my bedtime, so I'm going to quit for the ~~day~~ night too. TTYL

Stack Exchange

5:03 AM

Stack Overflow Blog: Supporting Community Conferences

Posted by Jeff Atwood on August 3rd, 2011

One fun way to promote your community is to consider what upcoming conferences, seminars, conventions, events, or meetups appeal to your community and would be a good opportunity to attract new, high quality users who love this stuff as much as we do!

There are a bunch of ways the community team can support you in this; to date we’ve done the following.

One simple method of promoting your community is to have a one-page color flyer available to hand out to interested folks at events. We’ve created a few of these already, such as this one for gis.stackexchange.com …

nealmcb

@Gilles I see the BlackHat and Usenix Security conferences as more evidence that IT Sec and physical security folks do well in community together. I think phy sec folks would really benefit from the attitude of the infosec crowd - from what I've seen the phy sec folks can rely way too much on tradition and silly theatrical rules

@Iszi And physical security certainly came up in the beta period, without much controversy either. certainly a base to build on, as we choose

Ori

6:31 AM

bsides seems to be much more interesting to me. I've attended Black Hat for a few years and always found most of the topics interesting, but the talks rather lacking. There are some exceptions to the rule, but I think next year I will forgo the BH talk schedule and attend the greyhat conferences since they contain much more relevant information.

From a phys security perspective anyways.

M'vy

7:42 AM

@Iszi you should link the transcript in your twitter post. Not the chat room.

Graham Lee

@AviD thanks AviD, though I don't think I need sorrow/commiserations. I want to do things that I can't do on my own, so I'm going to find somewhere I can do them ;)

Transcript for