The DMZ

12:06 AM

Guys, Lets try to push to get
http://area51.stackexchange.com/proposals/40927/hacking
into the commitment phase. Don't know if anyone of you are "Following" it. But it only requires **17 more 'good' questions** to get there.

Gilles

@DigitalFire What? It's a poorly-defined site that is either some kind of hangout for an unspecified community or a duplicate of Sec.SE

Digital Fire

@Gilles It does need moderation but I believe that the Sec.SE site is for a different set of question types.

Gilles

@DigitalFire what question types?

all I see are security questions and chatting about “hackers-I-don't-know-what-the-word-means-but-it's-cool”

Digital Fire

Well, I believe that posting exploit code is important for Security as a whole. If I went and found a 0-day and wanted to answer a question with it. I would probably get flagged (Thats if the question doesn't get removed first from being too localized.)

Gilles

@RoryAlsop area51.stackexchange.com/proposals/40927/hacking shows that there's clearly some interest for black hat content

Some of that proposal is about ZOMG Im a hakers LOL, but some of it is more serious

How about a black hat week in the contest?

2

Sec.SE is sorely lacking black hat content

Digital Fire

12:20 AM

I think a certain 'darker' shade is required to be able to be the best 'white' hat possible.

Gilles

@DigitalFire definitely. You need to understand how exploits work in order to defend from them

I'm a white hat professionally (developer), and occasionally I find a bug in my code and I wonder if it's exploitable, and I don't really have the right intuitions for that

It's not something that can be fixed in 5 minutes, I need to find time to learn, but having some tidbits to learn from would help

Black hat content on the web sucks

It's all semi-private, lacking information, buried under LOLZ I HAXXORS YOU...

Digital Fire

IMO, I also think that the classification of a 'Black Hat' is typically someone who hacks with the intent of financial gain. If we can teach people a skill set that will empower them to make more money professionally. We would inevitably have more 'White Hats'.

Gilles

@DigitalFire hey, I work for a private company, I assure you that we work with the intent of financial gain

We want to sell our products. And we'd rather our products didn't get cracked, because it's bad press.

Digital Fire

@Gilles Yes but its essentially a controlled environment. The web isn't like that..

Gilles

@DigitalFire what do you mean?

Once our product is out there, anyone can try to attack it

Digital Fire

12:27 AM

@Gilles Example: Someone hires us to pen-test their network. Or create a product that we hope is secure.

Crowd-sourcing is one of the best ways to test your "security".

^IMO of course..

So.. in a controlled room. If I gave you code, and said.. "Break It"

That's very localized. Ergo, probably not a good fit for the current Sec.SE.

Gilles

Digital Fire

This again is specific to it being "CODE"

Gilles

@DigitalFire well, yes. What else did you want? You can't expect people to test whole systems. Ok, there's network configuration as well.

xce

12:46 AM

@DigitalFire, release your program as GPL and then people can pentest it in a test lab to find vulnerabilities rather than screwing with your real servers

Digital Fire

I think that if I gave an entire scenario that required several skill sets (Coding, Hardware, Social Engineering, etc) there isn't a site that I can do that.

hackaserver.com

^ a very smart business

This is how i believe it would fit best as additional site to the SE family.

xce

> A Geek Girl is Sexy, a Hacker Girl is Pure Awesomeness

Digital Fire

Was just reading the same thing. =D

xce

lol

Digital Fire

:ugh: Living with two women can be stressful when they're both bickering.

Terry Chia

3:23 AM

Good morning peope.

Rory Alsop

7:48 AM

morning all

Terry Chia

@RoryAlsop Afternoon Rory.

Rory McCune

(UK) Mornin' All

Rory Alsop

happy diurnal isomorphism

Rory McCune

yeah one of those too

Terry Chia

Well, got myself the 2.5k rep privilege although its a pretty boring one. Just 500 more before i can cast close/reopen votes.

Rory Alsop

8:11 AM

@TerryChia :-) yeah, the 3k one is very useful

Terry Chia

8:23 AM

0

Q: unix config scanner

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds PermitRootLogin yes in the ssh config file . What I was able to find so far is: Vulnerability scanner Nessus supports UNIX Configuration Auditing. As far as I could see, it reads onl...

Flagged it, does this qualify as a shopping list question?

Rory Alsop

8:55 AM

@TerryChia have commented - to see if the user can salvage. Your + @Polynomial's comments along with @RoryM's answer are good, so I'd rather it gets amended than deleted

Rory Alsop

9:34 AM

@DigitalFire and @Gilles - the conversation on this has been gone through many times. The two biggest issues seem to be: Black Hat guidance/code/exploits etc could leave us open to lawsuits; and Black Hat hacking sites attract an awful lot of noise/script kiddies/give me the codez type posts.

In addition, that sort of content would drive away some of our existing users, and block some corporate users, as filters would end up including us in blacklists

there is already one page which my firm blocks on Sec.SE

Gilles

9:59 AM

@RoryAlsop black hat sites include a lot of noise -> that's why I don't want a dedicated black hat site, I want a security site that provides value to me (a white hat guy) by including some black hat content

Lawsuits: I don't propose to accept posts like “how do I hack into $website”. But “how do I turn this vulnerability into an exploit”

or “how do I try harder fuzzing this interface”

regarding filters: the UK blocked Wikipedia at some point due to a Renaissance painting of a nude woman who may not have been 18 years old... Sure, you have to be pragmatic, but you can't censor everything

Having black hat content on a non-dedicated site means that you can have a better argument for complaining about the filter

Rory Alsop

11:00 AM

@Gilles to be honest, where questions have come up with a very black hat topic, but look to be by a white hat, we have tried to keep the content of the question alive but change it around a bit to avoid giving away exploit codes, how-to's etc. but I don't think we ever managed to agree on precisely where that threshold should be

@Gilles Yeah, I'm following to see what happens

Gilles

@RoryAlsop to give an example that's closer to home: when I search for crypto stuff, sometimes I find sci.crypt threads. And some of the sci.crypt mirrors with high SEO lack the messages by bear #1. Because it's obviously unacceptable to have messages by someone called Thomas Pornin.

If you decide to ban any content that would be filtered away, you have to forbid bear #1 from posting.

Lucas Kauffman

11:36 AM

@RoryAlsop what page are they blocking?

xce

good morning

Transcript for