« first day (272 days earlier)      last day (4613 days later) » 
00:00 - 18:0018:00 - 00:00

12:34 AM
Incorrect. It is, in fact, time to drink Manhattans and watch Warehouse 13.
 
12:48 AM
I'm feeling like this
1
Q: There's a lot of spam, and hacked sites are often used to distribute it

My production application receives a lot of emails and I can easily detect spam from it. From that spam, I can parse the dangerous URLs found in the emails. What can I do with this list of hacked sites? Can it be submitted to any organization to help protect from those sites? I know about phi...

is a dupe of
5
Q: What are common/official methods of reporting spam/phishing/nasty-grams to organizations?

HolocrypticA user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?

Comments, complaints?
 
 
3 hours later…
4:05 AM
 
away for a few days and someone starts a popular revolt
 
4:29 AM
@ThomasPornin FedEx and other delivery servers have very interesting traffic models. Their goal is not to get you your package as fast as possible, but it get your package to you before the deadline at the lowest cost to them. I have suspected that there is an element to their model to add a lower bound to the delivery time; that of the next less expensive option.
 
 
2 hours later…
6:08 AM
Inactive chat makes me think chronological activity dispersion would be a nice goal for moderator election.
 
 
2 hours later…
7:47 AM
@ScottPack I think you are right.
@thisjosh That sentence took me far too long to parse:-)
 
8:01 AM
still only 31 people have visited the election page:
@avid - you going to stand?
 
It'S only up since yesterday late evening.
 
I know - I've had too much coffee today I think:-)
@HendrikBrummermann how are you this morning
 
8:58 AM
gmorning all you relatively normal people
@ScottPack why is everybody trying to get rid of me??
@ScottPack @RoryAlsop I believe the hive mind is already a moderator on crypto.se, no?
@StackExchange thats actually a great way to explain the necessity of examining the full cost/benefit ratio, for any proposed solution.
@RoryAlsop I'm thinking, probably yeah. Just need to find time to write up my intro...
past few weeks have been crazy. big new client demanding lots of work; right after finishing off a long project; ramping up a partner I'm just taking on; and of course, the big conference end of this week, together with actually preparing my talk this time.
then of course, last week my hard disk crashes.... :@
havent been around much lately, just checking in for flags, inbox, suggested edits, close votes, etc....
 
9:15 AM
goodness, there've been pages of questions I havent seen yet....
 
@AviD :-) mornin'
 
@RoryAlsop howarya?
 
nae bad! Enjoying a brief day of summer (the last two days were autumn and winter, and tomorrow is forecast to be winter again)
 
oyy
really? in the middle of september?
its actually jsut starting to cool off here - dipped below 30C today....
thats "warm" for you gringos americanos
 
9:31 AM
yesterday was 15, force 8 wind, lashing rain - today 17, no wind, blue skies, lovely
 
well, you in the wintery north.... "Winter is coming...!"
 
we can always tell - it starts to get dark:-)
 
heh
 
in summer it doesn't really do dark anywhere north
 
wait, even at night?
 
9:33 AM
aye - you can easily read a book without light anytime round midsummer
the sun does set in the north for about an hour and a bit
I remember a gig in Orkney years ago, and at midnight the band (Runrig) got everyone to turn round and look at the cool sunset:-)
right - off to see a client for an hour or so
 
nice
enjoy
 
 
2 hours later…
11:32 AM
What was this question about?
That shows up in my profile on in Ji's tool.
 
@RoryAlsop Not enough 'oy's and 'wotwot's ?
@AviD My mid-May week in Edinburgh was quite disconcerting. I spent the first 4 days waking up every morning at 4:30am for some ungodly reason. Eventually, I figured out it was because of the sunrise. The sun setting nearly 10pm was actually fairly reasonable to me.
 
@HendrikBrummermann erm? which?
 
question 7132
It's not important, but i am curious.
 
The tool says I "answered 14 hrs (no title)"
 
11:42 AM
hmmm - wonder what that means
(I can't mod the tool till I get home - am on a corporate build)
 
Ah, so it sees the nomination as a normal response
 
@HendrikBrummermann Yes, I think so
 
12:20 PM
hahahaha - today's Cyanide and Happiness:
wut - no onebox?
 
12:48 PM
I very nearly posted that one as well.
 
@ScottPack Same here.
 
So far, I do like dealing with G+ a lot more than I do Facebook. We'll see how that changes if the demographic shifts.
 
I would not know, I have never tried Facebook.
 
I haven't yet fully sussed G+, but then I haven't sussed facebook either - but family and non-technical friends are unlikely to leave it
 
@RoryAlsop I'm in pretty much the same boat. What I've been doing is getting more aggressive with blocking stuff on facebook.
That way I can more reasonably check it no more than a couple of times per week and not feel like I'm missing things.
DEBUG: checking for dumbnet.h... no
DEBUG: ERROR! dnet header not found, go get it from
DAMN YOU!
Apologies for the outburst. I find that packaging snort rather tries my patience.
 
1:06 PM
@ScottPack They're flying me down in 2 weeks. I'll let them know. :P
 
@JeffFerland LOL - name-dropper
 
@RoryAlsop Yeah. I don't really have much else going for me this month for entertainment.
 
I like how you slipped that in there :)
Mostly it's just incomplete BuildRequires statements in the spec file. I should probably submit a patch for that.
 
So, excitement is turning down other offers and keeping your current job... only to write a letter suggesting that your primary client for the past year should be disengaged on ethical grounds.
 
That does not seem like a pleasant letter to pen.
 
1:13 PM
Sep 6 at 22:57, by Jeff Ferland
Or, as a client of mine once said, "The auditors will never check for that."
those guys
 
Oh nice
 
@ScottPack This, on my anniversary. Thanks, guys.
 
@JeffFerland I interpreted that as a past client at the time.
@Iszi Hey, congrats, guys! You're up to, what, 5 happy years?
 
@ScottPack Thanks. 8.
@ScottPack Yeah, I'd kinda presumed the same.
 
@JeffFerland like @Scott said - nice
Congratulations @Iszi
so, are you taking an early finish to the day? Doing anything nice?
 
1:18 PM
@RoryAlsop Nah, we pretty much covered that Monday & Tuesday. Tuesday was her birthday, so I just turned it into a four-day weekend. Spent time together at home, and went out for lunch yesterday.
Coming back though, I'm thinking I should have done a five-day weekend. ;-)
 
excellent!
heh - then before you know it, it'll be a 7 day
 
Now that you mention it, a paid 365-day would be nice...
 
@RoryAlsop Hey now, I'm the civil servant here!
 
they call that a sabbatical:-)
@ScottPack hahahaha
 
Heh, what @Rory said.
 
1:20 PM
@ScottPack Guess that makes me the wannabe, eh?
 
So, @Iszi - didya see we have our mod elections starting? Sec.SE is growing up
 
Look at it this way. What we give up in salary, retirement, and respect we make up for in paid time off :)
 
@RoryAlsop I did see. You've definitely got one vote from me. How many votes do we all get on those, anyway?
 
@ScottPack :-)
 
We know @RoryAlsop has it... I wonder who the other two will be.
 
1:22 PM
@Iszi ah, now you are asking things beyond my ken. I will go and look at meta - there is a page on this.
 
So is it 3 votes with instant run-off?
 
@ScottPack well, it says: After 8 days, the top 30 nominees, ordered by reputation, advance to the primary phase. However, if there are 10 candidates or less, we skip directly to the election phase.
I'm thinking we'll be skipping directly to election
 
I think everyone except for SO does.
 
@JeffFerland now that's not really fair:-) I enjoy doing it, and I think I do an okay job, but other folks do an awful lot too. And I'm sure I wind people up on occasion, so I don't think I'll have their votes
@JeffFerland - although I like your guidance to"vote for Rory first" :-)
 
@ScottPack Crap. I was about to write a reply to this, and then totally forgot what it was or what I was going to write about, and now I only have this reference number...
 
1:25 PM
Speaking of the awesomeness that is our Scottish Overlords, I don't suppose you ever had a chance to check on shipping for me?
 
@RoryAlsop I ran for state office once, and dropped out to endorse one of my opponents. To run is to serve... I think you do better than I would. Three slots gives me room to stay in it, though. :)
 
@Iszi Drink a bubblegum shooter, or whatever you kids are calling your niacin flush inducing swill.
 
@RoryAlsop Hey, who can resist voting for Rory "13k" Alsop ?
 
@ThomasPornin You're what, 2 days from being our first trusted user?
 
@JeffFerland I have already been trusted, during beta (it was at 4k)
To get to 20k in two days is theoretically feasible, even without a bounty
but it depends on the existing questions
I may have to dig up a few old cryptography-related questions
 
1:31 PM
@ScottPack I did - works out at about £6, which is nearly the price of a CD. Thinking what I will do is take the shipping cost myself:-)
@Thomas - are you planning on standing? Going for the double? Crypto and Sec?
 
@RoryAlsop No, I think there are already enough high-quality nominees
 
You'll have full powers any moment now anyway :-)
 
Mod-powers are a bit more extensive
 
@RoryAlsop What's sad, is that even at £12, it's still about the price of a mainstream cd in the States.
 
really? Wow!
(you mean I should up the price? :-P
 
1:34 PM
Well, at least that's what I remember from the last time I actually purchased a physical cd. That's been quite a while.
 
admittedly the online version from itunes etc is cheaper
 
In my head cd prices are roughly $15-$20 which works out to be about £9.50 to £12.60
I think the last time I bought an mp3 album the price was ~$10 (£6.30)
 
@ThomasPornin Yeah, even trusted users don't get the hammer.
 
what, no hammer for @Thor-mas?
 
This hammer?
 
1:38 PM
A trusted user can edit posts and tag wikis at will, be he cannot Smite the Unworthy.
 
hhahahaha - that's a good name for a guitarist. Smite - the Unworthy
 
@RoryAlsop So when you pick up your 4th backup bassist, will that be his name? :)
 
@Scott - if you want one in physical form at that price, simplest is probably something like paypal with your address and I'll get one sent over asap. It looks like delivery under 3 days is expensive, but over that it is reasonable
 
...165...
..175...
 
@RoryAlsop Gimme a paypal address and a price and it'll be on, like donkey kong, or whatever.
 
1:41 PM
@ScottPack you do need backup bassists:-)
they die so fast
 
@ThomasPornin There. One away from rep-cap. Also, I read just about everything you have that's scored 5 and lower.
 
@JeffFerland Thanks ! But beware of the sock-puppet-alarm (the one Rory triggered when massively upvoting AviD)
 
Well, we all know that Rory is just Avi's sockpuppet anyway.
 
takes out his fake eyes and wool mouth
 
@RoryAlsop I think the problem is that you dont wind people up often enough, but you'll get my vote anyway ;)
 
1:50 PM
@AviD :-) (note to self - take more testosterone)
 
yeah, I have to work up my aggressiveness, for my owasp talk tomorrow.
 
@AviD topic?
 
the first half is actually designed as the equivalent of a "yo momma" fest.
@JeffFerland Agile+SDL - Concepts and Misconceptions
 
@ThomasPornin yeah - it wasn't even that close to rep-cap
@JeffFerland ewwww
 
oh sorry, thats the title, not the topic.
@ScottPack lol. but considering that the rory user has like 50% more rep than the avid user, wouldnt it make sense that I am really his sockpuppet...?
 
1:53 PM
Ahh - the pace of chat is picking up more today....
 
@AviD So, "Agile does not mean you can run around wild and call it progress"?
 
@nealmcb You mean as opposed to the last five days that have had about 3 lines per day?
 
@JeffFerland funny, we DO mention that :)
howd you know?
 
@AviD Well, if your talk is based on observation, you're guaranteed to see that.
 
1:55 PM
@JeffFerland or just reading dilbert....
so, I'm still undecided which track to take, for some of the slots....
 
I'm working one to submit this week for Shmoocon. I decided to base it on taking some of my favorite starred comments from this chat.
 
hehe
that... wont really make much sense, will it?
 
@HendrikBrummermann - I found ctrl-shift-I on the chrome install I have on this work machine was enough. I altered the url as per your thoughts, and ran the 'audit' function - lovely stats on the nominees:-)
 
@AviD Actually, so far it's pretty good. I've got some great ones on cost / benefit, ethics, competence & training...
Sep 7 at 1:38, by this.josh
@Iszi Security has internal conflict: Availability quarrels with Confidentiality. Every aspect of security gets balanced against cost, human factors, operational philosophy, and other resources. If security is your business, do your mental stretching, because frequent though contortion is in your future. For Certificate Authorities, where the end user is so poorly represented, it seems inevitable that cost becomes highly visible and security becomes a series of post-business hallway meetings.
 
@JeffFerland okay, but thats more the exception than the rule.
 
1:59 PM
out of all the nominees I have the lowest rep per post :-( but the highest rep per day :-)
 
I would guess that the majority of stars here deal, unsurprisingly, with various forms of alcohol, foods, boobies, and @Iszi's gender.
4
 
@AviD That's always the case... of the 424 comments I've probably picked 20 to start with.
 
@AviD LOL
 
@JeffFerland 425
 
@RoryAlsop Is that a sign for inefficient use of time?
 
2:00 PM
@AviD And now we have one that seems to cover all of the above.
 
@AviD Just made a slide for that last one -- appropriate filtering of information. :)
 
ROTFL!!
 
@HendrikBrummermann definitely
or that I just spout enough nonsense that some of it sticks
 
@RoryAlsop Where are the stats for that? Did you have to use the tools on each, or is updated on some page now?
 
3
Q: Information on the moderator candidates

Rory AlsopYi Jiang has put together a nice site that use the Stack Overflow API to display information on the moderator candidates. Click here to see all the information. The information presented is: The nominees election Answers/Questions on the main site and it's meta Up-vote/down-vote ratio Average...

but follow the guidance by @HendrikBrummermann
the tool will get sec.SE at some point but until then @HendrikBrummermann's workaround works a treat
(it's all gone quiet - is everyone off playing with the election tool?)
 
2:07 PM
@RoryAlsop So getting those stats is sort of a low-level test of professional competence, eh?
 
@JeffFerland yah - pretty much:-)
@HendrikBrummermann looked at the code. I wouldn't have if he hadn't said it was easy...
and then I actually searched on SO for a chrome equivalent to firebug:-)
welcome @weezybizzle
and an appropriate one for security:
 
Well, I just thought good software developers are lazy and so it's likely that the site-name is some kind of parameter.
 
Jesus. I step out of the office for like 10 minutes and I come back to 5 days worth of chat!
 
Did you approach the speed of light while stepping out?
 
@ScottPack that'll teach ya. I sent you an email with my paypal email - as they are different:-)
@HendrikBrummermann good call. I am obviously lazier than a dev:-)
 
2:17 PM
@RoryAlsop That's saying something.
 
well I hadn't bothered to even view source - admittedly I didn't have a pressing need...
gotta go - got a consult with my family tattooist :-)
 
Isn't it great when two vulnerability scanners running supposedly identical scans, turn up different results?
 
always used to compare nessus and retina, back in the day
always different
 
Oh, no. I mean identical - as in, same scan configuration and same scanning software.
 
Are you doing credentialed scans?
Firewalls?
 
2:31 PM
@RoryAlsop lol, gotta luv ol' smbc...
@Iszi you mean, two instances of the same scanner product?
 
@AviD Good news, we'll soon get to leave our shoes on. Bad news, they've discovered ways of smuggling things in the large intestine that don't show up in metal detectors or x-rays.
 
hehehe
 
@AviD Two separate systems, running separate instances of the same scanner product. And isn't this just beautiful: A third has returned results different from either of the first two!
 
@Iszi First guess: IPS. Second guess: Insane product.
 
which scanner?
can it be a network or authentication issue?
 
2:36 PM
@AviD McAfee Vulnerability Manager, FKA: Foundstone.
 
another thing that I've run into - non-identical nodes in a cluster.
 
@AviD These are non-credentialed scans. And, the scanning systems aren't different from one another in terms of network placement or configuration in any way which should be significant.
@AviD Oh, right. That could be an issue.
 
so it depends which server you hit - if you're lucky theres some form of affinity, and its only different between clients. otherwise its just reeeheeely instable and unpredictable.
 
It may or may not be noteworthy that the last scanner hasn't been updated in awhile. I'm going to do a re-scan after updates to see if that's significant.
 
Ah, so they're not identical!
Cock.
 
2:39 PM
oh, so we're back to the gender thing, now?
or is that food?
 
Oh, that's right, you don't twitter.
 
@ScottPack they ARE identical, for very large values of "identical".
@ScottPack umm... no?
why, what did I miss?
 
@AviD "rounding"
 
@AviD I'm so tempted to star this one, but I hate starring things that won't be understood out of context.
2
 
@Iszi That's what the "permalink" is for. almost everything that's more than one line is out-of-context as a star
 
2:40 PM
At a bar with a male claiming to be @IsraelZulu. Gender confirmed to an acceptable margin of error.
 
loool
"acceptable" is a risk analysis statement.
"for your specific requirements, the margin of error is acceptable."
 
@AviD When gender is a requirement, the acceptable margin of error is usually pretty damn small.
 
More correctly would have been "to within an acceptable margin of error", however texting is hard.
 
@JeffFerland What did you say about my margin?
 
2:43 PM
@Iszi possibly inadequate for the purposes of those who would concern themselves with it.
 
That reminds me. I should probably change my twatter picture to match, you know, everything else.
 
@JeffFerland why? if you're just having a beer with some dude, the margin of error is much larger than, say, wanting to date him.
@ScottPack no no, go back to the eye. its spookier.
 
I feel like I'm losing control of this conversation. :/
 
iiiiii'm waaaaatchiiiing youuuuuuu
 
@AviD Exactly. In such circumstance, I don't concern myself.
 
2:45 PM
ah, you're saying gender becomes a non-issue.
ok, what if you're playing basketball? most guys would be rougher than non-guys. its the type of thing thats good to know ahead of time....
 
Phaw. I figure roughness should be returned in kind.
 
Okay, back to topic number.... uhh... three, it looks like... I've finished updating the last scanner. Running a re-scan now. Then I'll look at the detailed reports to try to figure out what's gone wrong.
 
I don't care who hipchecks or elbows me. By god, if they're willing to dish it out, they best be willing to take it!
@Iszi How verbose are the logs?
 
@ScottPack I rarely mess with the logs, 'cause they can be pretty verbose. Mostly, I deal with the CSV reports. Once in awhile, I'll have to dig into the HTML reports for more detail.
 
@ScottPack sure, but wouldnt you rather know to expect it?
well, gots to go.
 
2:49 PM
@AviD It's been lovely seeing you again!
 
plan on getting an early night, too - have to wake up freakishly earlier to get to the conference grounds in time....
@ScottPack you're such a sweet talker....
 
@Iszi I can relate. Verbose logging on Nessus is really goddamn verbose.
Good luck tomorrow!
 
Wow. Scan #4 (Scan #2 on Scanner #3) comes out with a whole new number!
Re-firing scanners 1 and 2 to see if they can at least stay consistent within their own scans. Also, e-mailed a knowledgeable SA to see if I'm targeting any cluster nodes improperly.
 
@Iszi On the plus side, you may have found a cryptographically solid source of entropy :)
 
@JeffFerland I lawled.
 
3:02 PM
It's been my experience that clusters are very rarely anything more than servers with a shared filesystem. Sometimes certain jobs can be shifted between them.
 
In my crazy mind: cluster = multiple servers working a same goal. could = cluster that can be easily provisioned.
 
Well, finally we've got scanners agreeing with one another... Even though one of them doesn't agree with itself. headdesk
 
@Iszi So what you're telling me is that consistency is more important than correctness? You really are an auditor!
2
 
@ScottPack Can correctness be shown without consistency?
 
This problem is left as an exercise for the reader.
 
3:12 PM
@ScottPack Way to step up.
 
:)
Hey man, I'm prepping for a SIEM bake-off.
 
@ScottPack Deep philosophical questions about security... or cookies. (COOKIES!)
 
@JeffFerland Of course. Heisenberg showed that consistency can be impossible to achieve.
 
@JeffFerland My concerns, precisely.
 
Well, in this case, our bid process involves bringing the finalists in and presenting their product according to our script. Although, hopefully, there will be cookies.
 
3:14 PM
Fortunately, this particular scan is pretty narrow. So, it only takes about 5 minutes to re-run.
 
Did you say that it is or is not credentialed?
 
@ScottPack It's not credentialed, and I'm only running a half-dozen checks on a few dozen systems.
Longest run-time on this scan so far is 00:05:11. (HH:MM:SS)
 
Excellent.
 
4:16 PM
Wait, when did we get the flag notifier?
I just had a notifier tell me there was a spam/offensive flag on a post in the UX chat.
I don't even think I've ever been in the UX chat room.
 
4:37 PM
@Iszi That's a good question. I thought only mods got those.
 
4:52 PM
Bah. I just tweeted a reply to @GrahamLee but it looks like he's not following me.
 
Yeah, he's like that.
 
Regarding...
On the security thing, AV vendor grousing about Win8's AV has missed the point that it's better at defending third-party AV from rootkits.
...what "Win8's AV" is he referring to? Did they bundle MSE now?
 
They might. I mean, right now MSE is license available on all personal and small business installs. Forefront is included in the CoreCAL
So maybe they've taken it one step further
 
5:14 PM
@RoryAlsop I can build you a better parser. What version of English are you running?
3
@nealmcb Uncertainty was defined at the quantum/subatomic level. For large enough scale uncertainty goes to zero. For example there has yet to be a reported case of someone driving into a wall and missing.
@ThomasPornin You don't have to try mercury to know it will make you ill, despite it's shiny appearance.
@RoryAlsop Aparently the problem is your children. "Fatherhood Leads to Drop in Testosterone"
 
5:45 PM
@thisjosh So what you're telling me, is that science has proven that I am more manly than @Rory.
 
If you have less than 3 (I think it was) children then yes.
 
Excellent.
 
@thisjosh It would seem it's not the quantity of children that matters - it's the amount of time the father invests in them. Though the two can have a direct relationship, it's not always the case.
 
Yes, I don't think there was enough data to correlate with number of children, just none or some. The study only covered 5 years, which allowed for a significant population of men without children to have them. However I don't think there were enough men who had a second or third child to draw a resaonable conclusion.
 
@Iszi Yup. If you make enough children, they can begin to coach one another, and the whole thing becomes self-sustainable.
 
5:53 PM
@ThomasPornin This works - I now no longer make packed lunches for them - that is the role of the Hamish
:-)
 
Also, Genghis Khan had more than 100 children, and you cannot be more manly than Genghis Khan.
(No, really, don't try, you'll just hurt yourself)
 
Warning: Correlation is different from cause and effect!
Just because A and B are correlated does not mean that A causes B, or B causes A. They may both be a product of C!
 
@thisjosh It depends on how the events in question interact. E.g. the butterfly effect shows that for some processes like the weather, quantum uncertainties are sometimes magnified to large scales. E.g. quantum fluctuations determined where galaxies are now. Depending on which sorts of inconsistency @JeffFerland is encountering, they may or may not be evidence of incorrectness.
 
00:00 - 18:0018:00 - 00:00

« first day (272 days earlier)      last day (4613 days later) »