I have a huge problem. In a nut shell, 2 days ago I noted a strange process going on with httpd, something I never saw before. That then led to me googling it, and OVH came up top with "Examples of a hacked server" So I freaked out, but didn't do anything as the rest of cpanel forums said it wasn...
Do we have a question/answer that explains why hacked servers/computers should just be nuked? I keep seeing such questions popup and they all have the same answer.
@DigitalFire What we noticed was that, by and large, the questions getting closed because they were "black hat" were, in truth, just bad questions. Not Constructive of NARQ was generally still applicable.
I am trying to setup an auto-mounting network drive. The network drive requires a user/pass. In the man page for "mount.cifs" there are two ways to provide the user/pass.
1-[not recommended] put the user/pass in /etc/fstab
2-create a separate credentials file and put the user/pass in the credent...
The documentation for random.SystemRandom() claims that it uses os.urandom(), which uses /dev/urandom or CryptGenRandom(), depending on the architecture, and that's good.
20 characters, and punctuation characters, might be a bit of overkill
@ThomasPornin Ahh thanks. It's just a little piece of code i'm trying to write for fun. i'll add some way for the user to specify length and character choices later on.
Do developers usually restrict the type of special characters they allow in a password for any reason?
Currently we are using Vormetric for Transparent Data Encryption (TDE) in the Oracle Standard product to satisfy PCI-DSS 2.0 requirements. Does anyone have experience with other third party solutions for TDE? Using Oracle Enterprise and the Advanced Security Option (ASO) has been cost prohibitive...
straight close, its a shopping list q, doesnt really matter what you close it as....
@Gilles @DigitalFire clarification re the blackhat questions
the "consensus" was that everybody "agreed" about something different.
turns out that "what is blackhat" is also a subjective question.
@Gilles for example, I would not at all qualify "how can I make an attack work" as blackhat, and therefore it would definitely be accepted here (assuming it was asked as a good question.
it is completely a white-hat pentest question, or could be.
on the other hand, "how can i prevent this attack from working" is a completely different question.
the difference is not one of hat-color, it is like the difference between Builders and Breakers (ala OWASP).
I do agree with your clear statement that "blackhat" is not a topic.
On the other hand, the really black blackhat questions - illegal, unethical, etc - are explicitly forbidden by SE's Terms of Service! So it's not even a question of ontopicness or not, nor would a different SE site be able to handle it differently.
Of course.... "unethical" is again subjective (and "illegal" might be subject to location).
@ThomasPornin Hello. As you have a diploma that says you are a cryptographer, please can you review my SHA3 blog post? I've angled it as a "why did the competition run, what's the history and why do we need a new hash function" post rather than a "oohhh sponges! I like sponges!" type post. I might do that sort of post in the future, for interest's sake :) But yes, it would be good to know I have not said anything stupid please :)
Also, anyone else who wants to review, wants to suggest additional angles please do.
@Gilles If it's a dupe of Computer Security Hacking then, by association, it should be a dupe of IT Security. However, I'm not sure it really is. In any case, the real problem appears to be that most "ethics" questions will be closed for S&M. Most "legal" questions would be closed as Too Localized also.
I had opened a php folder from a friend's web host. I run it on mine to fix some bugs.
Then I tried attaching the code to be emailed and GMAIL stated that the attachment was infected by a virus.
Now I'm afraid if my Apache or OS (12.04) is infected.
I checked the php files and found a base64 ...
One discussion here has already asked if this is a duplicate of the Computer Security Hacking proposal. On that proposal, there's already a discussion of whether it's a duplicate of IT Security.
Making those connections, I was about to ask (or suggest in the existing discussion) whether we shou...
Proposal: Computer Security Hacking!
We already have the IT Security site, and the current definition of this proposal doesn't really seem to differ all that much from it. Furthermore, all of the example questions would be on topic in IT Security. Some would need some minor tweaks, but nothing m...
@TerryChia Just tested Chrome. Looks good. Only problem with this is that it shows what security method is being used. This will (should) always be the most secure mechanism supported by both server and client. What the asker of that question needs to see is how to check the least secure mechanism supported by the server.
I have a huge problem. In a nut shell, 2 days ago I noted a strange process going on with httpd, something I never saw before. That then led to me googling it, and OVH came up top with "Examples of a hacked server" So I freaked out, but didn't do anything as the rest of cpanel forums said it wasn...
So the more I look at things on Area51 the more broken I think the implementation is. I like the idea, but by setting it up as just another SEI site it seems to encourage this notion of a cabal of people appointed to be "experts" in "making new sites" without needing any information about the topics involved.
The Computer Security and Hacking proposals are just the examples I've seen the most of.
@ScottPack Indeed. I don't disagree with the concept of allowing the community to propose sites and such, but I think at the very least the reputation and permissions system needs some tweaking. Instead of granting rep/permissions based on Area 51 activity, I think the rep/permissions should be given by some formula that includes weight for overall SE participation.
The presumption in my scenario being: People who are high-rep participants on other SE sites, probably have a good idea as to what makes a good SE site.
My suggestion wouldn't necessarily prevent crap proposals outright, but it would definitely get them shut down a lot faster.
Example: I hardly ever participate in Area 51, in any way that would gain rep. But I have over 20k aggregate rep across just the top 6 SE sites I participate on. I think the latter should more than qualify me to put close votes on bad proposals.
Security is never 100%. There is a need to balance risk and cost. Risk assessments need to be performed to determine the cost-effectiveness of preventive measures.
There are a few questions I would like answered:
What are the frameworks to follow when performing risk assessment?
How does an or...
@AviD That's good. But my problem is that the rep/privilege portion doesn't take it into account. Also, I just realized that discussion participation in Area51 doesn't count towards rep at all.
Proposed Q&A site for anyone who has a question regarding older video games or systems no longer being manufactured. Similar to Gaming.SE except, with an expanded list of questions, including questions about hardware repair, finding old games and coding for old hardware.
In security.stackexchange.com/questions/21461/… @Rook said that testing using checklist is wrong. However, I also use checklist when testing so I won't forget about standard app vulnerabilities. Is there a better way than using it?
decent pentests should be done via a methodology, not a checklist
checklists are rigid - you have to be more fluid about how you do it
so a checklist might say "verify that 'remember me' tokens are secure"
but that in and of itself has a whole range of aspects to it, and they may be using those tokens for other things, or generating them via a 3rd party (e.g. OAuth)
@AndreyBotalov Question is borderline NaRQ/NC right now. As @Polynomial has said, methodologies are best. However, checklists are helpful to validate that you have covered key components in that methodology. So, checklists aren't really bad - they just shouldn't be your entire process.
AFAIK we have other beginner questions for beginners about pentesting webapps. Usually answers are OWASP top 10 or such. I don't think this question is so bad. Also there are no other question for begiiners about pentesting iOS apps
pentesting iOS apps is an interesting topic, because they operate on a difficult-to-debug device, with all sorts of sandboxing, and difficult-to-monitor networking (3G)
but his question is ill-defined
if he'd have asked "How do I go about pentesting an iOS app that does all of its communications over cellular data?", that would have been a good question
@AndreyBotalov I didn't say the question was too "beginner". I said it was "Not a Real Question" or "Not Constructive". As it is, the question is too ambiguous and quite potentially may result in subjective/argumentative answers about competing methodologies.
@Polynomial Better question, yes. "Good question" would depend on the content beneath that title.
@AndreyBotalov Limitation of what the answer should provide, to a reasonable extent. In this case it's "give me a list of everything I need to do when pentesting iOS apps", or "give me a list of methodologies for pentesting iOS apps" (it's ambiguous already)
whereas the other one you posted basically says "I'm new, got any starting points?" - it gives us an exact idea of what he's looking for, and there's a finite (albeit list-based and subjective) answer.
don't get me wrong, it's not a good question by a long shot
but it's one of those corner cases where we get asked it a lot, and most people who asked it can't string a sentence together.
whereas he was sufficiently eloquent to ask a bad question in a way that wasn't offensive to our sense of grammar.
@AndreyBotalov Strictly speaking, StackExchange sites aren't meant for beginners. Amateurs and hobbyists may have their place here, but raw beginners should get some amount of experience elsewhere before asking questions here.
He shouldn't ask it at all. That's the point. StackExchange is a Q&A site with strict rules. Just because a question exists and has merit does not mean that it can go on StackExchange. That seems to be a fundamental point that a lot of people forget.
The rules are there to maintain the highest quality of information - the maximum signal to noise ratio. Allowing subjective / list / non-definitive questions damages that ratio. Sometimes that means we have to throw out 1% of the signal to remove 95% of the noise.
Which is, partially, what makes chat so great. If someone has a valid question that doesn't fit the Q&A format, they can ask it on here and we can give all the subjective responses we like.
Note that I don't care whether it's for beginners or not. That, as far as I'm concerned, is a list question.
So no, it's not a good question.
I'd close it as NC.
Remember that existing unclosed bad questions are not evidence in the support of new bad questions.
Especially ones that were asked in the infancy of the site - we had lower standards back then, because we were hungry for content. Now we have regular contributors and plenty of questions, so we adhere to the standards more strictly.
The reason we don't allow subjective questions is because 1) answers change over time, 2) different people have different answers, 3) it results in lengthy debate and major headaches for mods.
That's not subjective. It has slightly poor scope (maybe NaRQ) but it's enough to allow people to say "hey, this is what I think is relevant to your question". Voting decides the most accurate answer.
I had exactly this frustration when I first joined StackOverflow. I asked a list question, it got downvoted and closed. I was pissed, so I went on meta and complained. I got downvoted, and someone pointed me to Jeff Atwood's blog entry on the whole Not Constructive deal, as well as some of the longer discussions about it on Meta.SO, and eventually I realised that the reason I was pissed off was that I hadn't grasped the concept that StackExchange is a privilege, not a right.
Just because I have a question does not give me the right to ask it. I have the privilege to ask it, and that privilege can be removed if the rules disagree with my question format.
In Good Subjective, Bad Subjective, we made a pretty solid first stab at defining a constructive subjective question, one that I’ve been happy with so far.
Constructive subjective questions:
inspire answers that explain “why” and “how”.
tend to have long, not short, answers.
have a constructive, fair, and impartial tone.
invite sharing experiences over opinions.
insist that opinion be backed up with facts and references.
are more than just mindless social fun.
tend to have long, not short, answers.
have a constructive, fair, and impartial tone.
invite sharing experiences over opinions.
insist that opinion be backed up with facts and references.
are more than just mindless social fun. …
there's a pile of links to appropriate MSO stuff in there.
Ok dammit, Qubes will have to wait until next week. Blame the fs corruption that has driven me to the point of writing kickstart scripts so I can run an unattended install to restore my desktop, work out how to drive device mapper etc etc.
I lost the ISO when the last fs died
If I disappear where I am, that's what's happened - fs has exploded again.
@DigitalFire Oh, I don't know. It wasn't on special offer. It's one of those ones where Amazon don't actually sell the product, they just act as the middle-man.
Ah, cool. Would be neat to find a DIY reference too, though. Lockpicking ranks right up with hotwiring and hacking on the list of criminal-like activities I've always wanted to learn before I die.
@Polynomial So can I. I've seen so many films where they do it. Reach under the steering wheel. Magically grab a handful of wires. Roughly pull them apart. Find the two that are invariably frayed with exposed copper. Put them together a few times. Swear. Say "c'monnnnnnnNNNN". Try again. Then it works. Then, proceed to drive the car at breakneck speed whilst all police vehicles drive into things, save the girl, save the world and get rich too.
@DigitalFire A lot of the time you need to have complete access to the engine - that makes things difficult, because popping the hood requires the key.
@Polynomial you mean it's not like that? And are you telling me computers don't blink when you're under a hack attack and you don't have to mash the keyboard faster than the guy who's "in your system" and "breached the firewall"?
@DigitalFire Yes, but the latch is usually triggered by a button inside the car, which (on newer cars at least) usually requires that the key is turned enough that the battery is on.
@Polynomial You joke, but I actually double hacked today. Only briefly. We didn't know what the enter setup key for the bios was, so we pressed them all. Only one person can't really do that very easily in time...!
@Polynomial Technically it should be "Aliens", not "Alien". The alien is not called a xenomorph until the second movie (from which the audio clip is also taken, btw).
Thinking of Aliens / Alien : this once made me say, upon learning that the (then upcoming) "Titanic" move was directed by James Cameron: "It is James Cameron, so there will not be one iceberg, but at least a hundred."
Now I just discovered that a remake of "UFO: Enemy Unknown" has been produced. Seen it on a shelf in front of a video game shop. Is it as good as the original ?
@Ninefingers I have looked at your post; it looks fine to me. There is a weird sentence: "Depending on the round...". I think there are words to remove, or words to add, in order to reach syntactic correctness.
Also, you might want to add a few dashes: the proper names are "SHA-1", "SHA-2" and "SHA-3" (but still "MD5", not "MD-5").
I had opened a php folder from a friend's web host. I run it on mine to fix some bugs.
Then I tried attaching the code to be emailed and GMAIL stated that the attachment was infected by a virus.
Now I'm afraid if my Apache or OS (12.04) is infected.
I checked the php files and found a base64 ...
One discussion here has already asked if this is a duplicate of the Computer Security Hacking proposal. On that proposal, there's already a discussion of whether it's a duplicate of IT Security.
Making those connections, I was about to ask (or suggest in the existing discussion) whether we shou...
Security is never 100%. There is a need to balance risk and cost. Risk assessments need to be performed to determine the cost-effectiveness of preventive measures.
There are a few questions I would like answered:
What are the frameworks to follow when performing risk assessment?
How does an or...
