The DMZ

Scott Pack

02:48

Blog Reviewers ahoy! QotW draft ready for review.

Stack Exchange

04:14

But then the Ghost of Subjunctive Past showed up and told me to stay strong on 'if it were'.

Jeff Ferland

05:09

@ScottPack Got a conclusions to go with that summary?

AviD

06:28

@JeffFerland Got a conclusion to go with your face?

Andrey Botalov

w3.org/TR/2012/WD-WebCryptoAPI-20120913

Rory Alsop

08:12

@ScottPack Cheers - scheduled. I was wondering whether it needed a picture - maybe of some credit cards or a captcha or something...

M'vy

08:28

Hi there

Rory Alsop

@M'vy morning

CodesInChaos

08:50

Migrate to security.SE and merge?

0

Q: Is the integrity of unencrypted HTTP safe from attackers who don't have the privileged access of authorized network operators?

What vantage point is required for MITMing non-SSL'd HTTP connections? I'm not talking about confidentiality. Firesheep clearly demonstrates that HTTP traffic if unencrypted may be read by anyone on the same LAN. But what about altering requests or responses? (I wonder if there's any more generi...

ssl

Rory Alsop

10:50

@CodesInChaos yep, done

thanks

welcome @jokerdino

jokerdino

hey @RoryAlsop

I clicked on the QOTW event and that brought me here.

I am heading out for dinner now though. Be back a while later.

Scott Pack

11:37

@Rory I could find a couple of pictures throw in, I assume you mean as examples for people who might now know what a CAPTCHA or which kind of card.

Probably wont be until after it publishes, though. It is feeding and dressing time.

M'vy

Hum. I think I can access records of all students in the university now.

Impressive

But what a bad desing

It's at a point were you ask yourself if they even ever heard the word "confidentiality"

Rory Alsop

11:57

@ScottPack I popped in a quick pic of credit cards :-)

Scott Pack

12:10

@RoryAlsop heh, cheers.

Unfortunately, the blog gets published at 8am for me.

@RoryAlsop The first time I read that question and saw "carding" my first thought went to "checking IDs for 21"

Rory Alsop

@ScottPack hahahaha

@ScottPack Yeah - there isn't a time that is perfect, but this time slot gets us a European lunchtime audience, and a US all day...(sorry @Terry :-)

Scott Pack

@RoryAlsop Oh definitely, it's the all around best publication time. Just means no last minute changes for me. :)

Stack Exchange

12:27

Stack Exchange Security Blog: QotW #35: Dealing with excessive “Carding” attempts

scottpack on September 14, 2012

Community moderator Jeff Ferland nominated this week’s question: Dealing with excessive “Carding” attempts.

I found this to be an interesting question for two reasons,

It turned the classic password brute force on its head by applying it to credit cards

It attracted the attention from a large number of relatively new users

Jeff Ferland postulated that the website was too helpful with its error codes and recommended returning the same “Transaction Failed” message no matter the error. …

AviD

12:49

yummy. Just had some pomegranites straight off my tree. Deliciously sweet.

Rory Alsop

@AviD - I just about manage to grow strawberries, chives and other simple plants that like rain :-) Pomegranate would be awesome

AviD

I'm usually not a fan of pomfruit - except perhaps in certain salads, or occasionally in a drink - but this was really nice.

@RoryAlsop wow, I imagine strawberries would be a ton of work to keep alive and well.

pomegranate tree was here when we moved in. We just had to keep it well watered, and occasionally trimmed. Super easy :)

then again, it likely has more to do with the weather and such here.

if you want, I'll send you some - there are a lot ripening now on the tree.

even not counting the ones infected with some sort of bugs :(

Rory Alsop

@AviD strawberries are basically a weed here. Once they survive the first year they just keep spreading. The only challenge is keeping everything else from eating them :-)

@AviD hmmm - wonder how well they travel

AviD

really? cool

@RoryAlsop hahaha

I'll save you a couple for march :D

Rory Alsop

@AviD lovely!

AviD

12:54

IF they last that long....

Scott Pack

I like to put arils in my granola.

I've had lots of problems getting strawberry fruit to grow. Wood strawberries, however, do a great job of working together with the clover to fill in the lawn.

Looks like I was wrong. My lawn is actually full of mock strawberry not wood.

Thomas Pornin

@AviD That's the opposite: strawberries are resilient and spread alone and quite fast. The only way I found to kill off strawberries is to plant something which is even more resilient and spreads even faster (namely: mint).

AviD

@ThomasPornin @RoryAlsop so what kind of conditions are good for strawberries?

I would love to plant some more fruit trees and such, but havent yet had time to figure out the best candidates here.

our neighbors have pretty much almost every fruit possible, but I' dont have much of a green thumb - or interest in putting in too much effort.

I have more of a black thumb. I tend to kill off everything growing.

Polynomial

13:13

@AviD can we migrate this to CryptoSE please? security.stackexchange.com/questions/20193/…

also, @ThomasPornin might want to have a look at answering that one ^

AviD

@Polynomial yes I agree, unless @ThomasPornin has an objection?

(he still counts as moderator... )

Rory Alsop

@AviD Scottish weather - ie, quite damp, annual temp range 0 to 20 celsius, more rain, lots of sun in summer, rain

AviD

@RoryAlsop hmm. not so fitting here, then.

bunch warmer, lots more sun, mostly dryer.

might try to go with mangoes. one of our neighbors has a lovely mango tree, big plump juicy thangs, smells great every time I walk by.

Figs are also popular here, but there are already a couple hanging over my fence, so I dont need more...

Scott Pack

I tend to have gobs of problems with slugs on my strawberries and cucumbers.

Rory Alsop

@ScottPack yup - slugs and birds like to eat mine

AviD

13:24

bastards

Scott Pack

We also made the mistake this year of planting those two crops too closely together.

Thomas Pornin

@RoryAlsop Actually, annual temp range -30 to +25 celsius is fine for strawberries (that's what I have here). They need sun and rain on summer, but have no problem with cold winters.

@AviD Without water, no go. Strawberries tolerate a lot of warmth, but not dryness.

AviD

figured.

berries in general are not overly indigenous to this region at all, though there is a nice crop of local strawberries... I guess up north, in the hills near the sea.

Scott Pack

13:43

@AviD Oh, our local pizza place is running an election season special that's a pretty standard 3 cheese and pepperoni. Except the crust is made of sausage.

Rory Alsop

@ScottPack ...WTF? Sounds awesome, but very weird

Scott Pack

@RoryAlsop I'm trying to find online evidence, but so far I've only seen it in advertised in the paper.

AviD

@ScottPack ooo sounds delish.

is that political commentary?

Polynomial

@ScottPack They should've made an election-season menu with 5 choices, but in reality they're all just different ways of describing the same pizza.

Scott Pack

Polynomial

13:49

And when it arrives, it's anchovies, olives and pineapple.

Scott Pack

@Polynomial And by "5 choices" you mean "2 choices". Have you forgotten how many parties we have?

Polynomial

haha Meat Romney

@ScottPack I thought you could still vote for smaller parties? Or is that senate elections?

Scott Pack

Actually, cheese, olives, and pineapple might not be that bad.

Iszi

@Polynomial We can vote for smaller parties. It's just unlikely that the vote would be worthwhile, since one of the largest two parties always wins.

AviD

@Polynomial there is usually an "Independant" candidate, such as Ross Perot, or Ross Perot's ears. But he's usually not even really in the running.

Iszi

13:51

C.G.P. Grey did a great video that includes that particular point. One sec...

Scott Pack

@Polynomial It's all a technicality really. Each state has their own laws for what it takes to be an officially recognized party. So while it is possible to vote for a "3rd party candidate" what you're really saying is, "I'm going to be one of the 5% of people that picks one of the other 5 names on the ballot thus guaranteeing that I have no impact on the election at all!

AviD

@Iszi yknow, everyone says that, then doesnt vote for the 3rd party. Maybe everyone should start.

Polynomial

^

I vote Pirate Party.

and if there's an election that only allows me to choose between bad candidates, I don't vote.

Scott Pack

@AviD The bigger problem is that I'm not entirely sure any of those 3rd party candidates could be any more or less effective.

Polynomial

I actively veto the situation.

AviD

13:52

@ScottPack to be fair, do you think you have any real impact even if you vote for the Dems or Reps?

@Polynomial where I'm at.

Iszi

►

Scott Pack

Our political system has devolved into the 20% on each end feeling strongly and voting for Their Guy, and then the rest of us voting against somebody rather than for.

Jeff Ferland

@ScottPack Way to prevent critical mass!

@ScottPack True :(

AviD

Though I am seriously considering voting for Scott Adams this time, if he really runs.

Polynomial

@ScottPack So stop voting against, and vote for who you actually want.

if there's nobody you actually want, don't vote.

the statistics make an impact.

Scott Pack

13:53

@JeffFerland I would be all for real actual change to our political system. I just can't figure out a way that actually seems feasible. :(

AviD

@ScottPack by stop voting!

Polynomial

^

Jeff Ferland

@ScottPack I spent a while thinking it about it... came up with a tiered representation system.

Scott Pack

That also only works if you hit the critical mass, which I'm too cynical to think would actually happen.

Iszi

Pertinent part on that video starts around 31s

AviD

13:54

and, at the least, you dont grant your moral backing to a corrupt system.

Polynomial

if enough people actually stop voting for douchebags because they're "the only choice", they'll actually fix stuff.

and you can sleep at night knowing you didn't contribute to a corrupted state.

Scott Pack

@JeffFerland Oh sure, there are definitely ways that our system could get better. I'm more cynical about actually getting the change to happen.

AviD

@ScottPack well, then, stop actively granting your active support to a broken system.

Polynomial

The problem with such long-standing democratic political systems is that they entrench enough procedure and law into the process to protect themselves from actually losing power.

Scott Pack

@Polynomial I was born in the 80s. I'm too jaded to let something like that keep from sleeping well. :)

AviD

13:56

perhaps if it breaks enough, it will have to be fixed :)

didncha read Atlas Shrugged? ;-)

Scott Pack

ugh

I try not to think about it.

AviD

hehehe

Polynomial

@AviD Ayn Rand is awful.

lol

AviD

@Polynomial so's yo momma

@JeffFerland improper usage of mod pinning powers

4

Polynomial

Well said.

haha

it's worth pinning ;)

Scott Pack

13:58

Since this is a community run site based on community standards aren't we supposed to be the ones defining what is proper pinning behavior?

Polynomial

I like how Germany elects their departmental heads.

AviD

on the other hand, she did have some valid points applicable to the current political situation.

Polynomial

basically you get to vote for individual parties for individual departments

Scott Pack

@AviD Lots of terrible people have very valid points.

Polynomial

so the Pirate Party might run for the Information Technology sector

Scott Pack

13:59

That's pretty fantastic.

Polynomial

yeah

AviD

@Polynomial I like how the Baratheons select their department heads.

Usually on pikes.

Polynomial

so you get political parties that are actually interested in a particular field.

haha

AviD

@Polynomial that is pretty cool.

Scott Pack

@Polynomial I can actually see how that would work really well.

AviD

13:59

not just interested, but hopefully expertise.

Polynomial

though I can imagine the running for jobs like Minister of Agriculture is pretty... tumbleweedy.

(pun not intended)

Scott Pack

Monolithic party control means you end up having to pick the party that's the "best" all around, which means some things will definitely suck.

Polynomial

yup

Iszi

@Polynomial You can't throw out a pun like that and honestly expect us to think it's not intended.

Polynomial

@Iszi I honestly didn't notice until I sent it.

right now the political system is in the Unity window manager model - try to do everything well, but end up not actually being very good.

Scott Pack

14:02

@Polynomial You're making a pretty bold statement by saying that Unity tries to do anything well.

Polynomial

haha

well, I imagine their intent was not to suck.

going into the task of writing a window manager with the goal of sucking just seems masochistic.

Scott Pack

I didn't realize you were that imaginative.

Polynomial

heh

Scott Pack

You've used Ubuntu, haven't you?

Polynomial

yep. eich.

Scott Pack

14:03

I think of them as more sadists than masochists.

Polynomial

I killed Unity pretty quick.

then got fed up with messing around, and moved to Debian

Scott Pack

Honestly, Gnome3 isn't really any better.

Polynomial

no, GNOME3 sucks too

I have GNOME2

I dislike KDE.

anyway, I honestly feel that a multi-party system like that could work very well in the UK, assuming we properly handle executive decisions.

Scott Pack

When Fedora made the jump to Gnome3 I made the jump to XFCE.

As a political structure I do like the concept of that model. Getting people to move into it would be tricksome at best, I think.

AviD

there is a possible problem with multi-party systems, but it seems the departmental model in Germany may prevent it.

Here politics become very... partisan.

every little party tries exerting political power over the bigger parties, to offer their support in generating a "majority".

oops, sorry - gotta go.

have a great weekend, everybody.

Scott Pack

14:07

@AviD So you end up with the large parties being the sharks and the small parties being the lampreys?

@AviD Have a lovely weekend!

Rory Alsop

14:53

Hi @Iszi - sorry, I closed that one just as you commented :-)

Iszi

@RoryAlsop These things happen. You're just doing your duty, as I'm doing mine.

(Dunno why, I just wanted a reason to say "doody" right there.)

Rory Alsop

►

obviously

Iszi

That guy's first two questions here are rather disappointing. If the phone call had gone on a bit longer, it might have made for an interesting social-engineering question.

Terry Chia

15:11

hey guys, i'm gonna write my own diffie hellman code for fun. is this: ietf.org/rfc/rfc2631.txt the latest RFC on DH or are there any newer ones?

Polynomial

15:25

that's the latest RFC

DH hasn't had any revisions since '99

it unofficially was revised in '02 to change its name to Diffie-Hellman-Merkel, at Hellman's request, but there were no other changes.

Terry Chia

15:53

Cool thanks.

Scott Pack

16:36

I did not first read that as Merkel.

Iszi

@ScottPack Maybe I'm just slow, but I don't get it.

Michael Mrozek

16:58

Want this shiny new question?

0

Q: Make D-Link router copy all packets to a specific port

I want to use a D-Link ADSL2 router/modem ( DSL-2640B ) to sniff all network traffic (for a security audit. I don't have time to scan all machines there and I want to know if they are quiet or sending 10MB/s of sensitive data to some location ;) ). There will be a net connection on LAN port 1 an...

routing openwrt

Jeff Ferland

@MichaelMrozek Nope.

Iszi

@MichaelMrozek Sounds like Super User material.

Michael Mrozek

@Iszi Ok; thanks

Jeff Ferland

17:47

I can't believe I just answered it anyway.

Iszi

18:01

It's possible my comment here might be just a little off, but either way I'm pretty sure this is NaRQ.

1

Q: Is there any more attacking points for this server?

Here is my situation: I already compromised the webserver. I want to attack the database server which has a IP of 192.168.100.2 which is a network that cannot be reach from outside. Through pivoting, I'm able to reach the database server. 192.168.100.2 have 135,139,445,3306 port open and is very...

penetration-test

Rory Alsop

@Iszi NaRQ/TL - so I closed as TL

Iszi

19:04

Y'know what would be kinda cool? A new close reason: "You're doing it wrong." But, to use this close reason, you must reference (via menu options) one of the 19-20 Security/Security Administration Laws.

This one's a good example. (Thanks @RoryAlsop for the close).

-1

Q: sniff a encrypted channel with the help of evil javascript

This thought/question was inspired/triggered by CRIME - How to beat the BEAST successor? It was posted as a comment but obviously it should have been posted as a question, so here it is again: The question is, suppose attacker can get into a man-in-the-middle situation between victim PC and sec...

mitm

Rory Alsop

@Iszi feature request!

Iszi

@RoryAlsop I would, maybe, if I wasn't so certain it'd be shot down.

Maybe it might be more worth considering if I could dig up a bunch of close-worthy (and/or already closed) questions where citing a Law would be more useful than just using one of our current close reasons.

Thomas Pornin

I am promoted again: networkworld.com/news/2012/…

I reached "cryptography architect" level

Gilles

@AviD I haven't read it, but I've read the hilarious sequel by Matt Ruff

amazon.com/Sewer-Gas-Electric-PUBLIC-TRILOGY/dp/0446606421

Iszi

19:42

@ThomasPornin Did they contact you for that one also, or is that a title of their own presumption?

@Polynomial I'm sure some rootkits can survive a system restore also - why no mention of those?

Jeff Ferland

Urgh. Need to go comment cleanup on Thomas' answer....

Iszi

Wow. How sad is this?

►

Thomas Pornin

@Iszi No contact -- they just inferred.

Iszi

@ThomasPornin Well, we all know what happens when you make inferences... You're in... fer...

Okay, I got nothin'.

Jeff Ferland

@Iszi Brilliant.

I bet it looks more secure too.

That said, a fresh install is probably actually faster.

Iszi

19:53

@JeffFerland Since it's really just a super-small computer, I'm not sure how that rule should be expected to have changed.

Jeff Ferland

@Iszi Well, it does explain how half the comments were "it's faster"

Iszi

@JeffFerland I'm sure we missed seeing the fifty or so fanbois they probably ran into who immediately spotted it for what it was, or at least realized that they couldn't possibly be looking at an iPhone 5 - Apple's own stores won't even have demo units until the release date.

Jeff Ferland

@Iszi Oh, of course.

Iszi

I had an interesting experience in the Microsoft store last night. They challenge you to pit your phone against theirs in a head-to-head competition to complete a task drawn from a set of cards.

In the end, of course, the advantage to the Windows phone is mostly that the contest is rigged - the phone is obviously configured with apps and features specifically optimized to make access to the tasks more convenient, and possibly to improve performance with pre-caching as well.

The same could be done with probably any other decent smartphone, iPhone included.

Oh, and I saw them turn someone away from the competition because they had a jailbroken phone.

David

can the windows phone beat the iphone @ accessing the camera from sleep

i.e. hit home button, swipe up camera icon

Iszi

20:02

On the up-side, you get a $25 Microsoft Store card just for playing even if you lose.

@David Dunno. The card I drew was to find showtimes for a movie at a nearby theater.

David

yeah, seems dumb

they probably know where every thing is

and have it setup to easily access that for all the stuff on the cards

Iszi

I'd be really interested to see if, given knowledge of all the possible assignments beforehand, I could actually set up an iPhone or Android phone to beat them.

David

whereas you have to think and find the app, etc

Iszi

If the competition actually came down to only the difference between raw performance, and perhaps some convenience features the Windows phone has that others don't, then I would be willing to concede a well-earned victory.

Anyway, time to start my weekend. See y'all later.

David

later

Gilles

20:13

5

Q: Security for university research lab systems

Being responsible for security in a university computer science department is no fun at all. And I explain: It is often the case that I get a request for installation of new hw systems or software systems that are really so experimental that I would not dare put them even in the DMZ. If I can avo...

networking security dmz

Jeff Ferland

@Gilles Yes.

Gilles

@JeffFerland what's the question?

Jeff Ferland

Oh, wait, not a migration request.

Gilles

the question may be better suited for Sec.SE, but I refuse to judge what's on-topic on SF

regardless of that, the question is surely of interest to several Sec.SE denizens

David

hate how security falls under SF for the most part

but if you post on SF, your question will get seen way more times

Iszi

21:58

Here's one I'd kinda wanna close under "You're doing it wrong" for Law #1.

1

Q: Is Window's system restoration useful for getting rid of malware?

If your computer has been infected with some kind of malware, could a restoration of the system, using the tool provided by windows, help you getting rid of that malware? We should suppose that it exists a restoration point before the infection, and also that the date of the infection is known.

windows malware tools

Gilles

@Iszi s/close/answer/

why on earth would you close a question that asks “is it reasonable to do X” when X is not a good thing to do? Answer to say “don't do X”

Iszi

@Gilles I'm kinda thinking the "You're doing it wrong" close reason could sort-of be our version of "General reference".

Gilles

@Iszi “you're doing it wrong” is not a close reason

why would it be?

“you're doing it wrong” is an answer

For example, if you feature-requested that close reason on meta, you'd be doing it wrong. I'd answer to say so, I wouldn't vote to close.

Iszi

@Gilles Just the same as "General reference" is. Many things that are asked on here are simply contraventions of well-known and documented security best practices.

Gilles

@Iszi that's not what GR is about

GR is “look it up on Wikipedia”

Iszi

22:04

@Gilles s/Wikipedia/TechNet and you have my proposal for "You're doing it wrong".

Gilles

@Iszi how well-known, reliable and clearly-indexed is technet?

for example, I haven't heard of it, so well-known… probably not

Iszi

See earlier discussion (starred post on the right, 3h ago) regarding additional requirement to make it not be a totally uninformative close reason.

Gilles

clearly-indexed… how do you index security questions?

Iszi

3 hours ago, by Iszi

Y'know what would be kinda cool? A new close reason: "You're doing it wrong." But, to use this close reason, you must reference (via menu options) one of the 19-20 Security/Security Administration Laws.

Gilles

out of curiosity, what's technet?

America's Innovation Economy?

Iszi

22:08

@Gilles technet.microsoft.com/en-US

Gilles

TechNet Blogs?

@Iszi why would I go to a microsoft site to know about security?

I mean, Wikipedia is an encyclopedia, it's GR for, well, general reference facts and concepts. IMDB is a movie database, it's GR for movie facts. A dictionary is a list of word definitions, it's GR for vocabulary facts.

Iszi

@Gilles Research Microsoft product vulnerabilities & patches, get information about security best practices (mostly involving Microsoft products, but some non-vendor-specific)

Gilles

@Iszi that's a specialized resource, not a general reference resource

Iszi

@Gilles For IT administrators, it's often a go-to resource. In our world, it would be general reference.

Gilles

@Iszi general reference involves being able to look things up

MS's site is horrible for that

the only way I can ever find stuff there is by googling it

and even then I usually end up on the wrong product version

Iszi

22:16

GR description: "This question is too basic; it can be definitively and permanently answered by a single link to a standard internet reference source designed specifically to find that type of information." I would call TechNet "a standard Internet reference source designed specifically to find that type of information" from which "a single link" could answer a lot of questions. Two links, in particular, would resolve a lot of issues - never mind the specific product/patch-related articles.

Gilles

@Iszi the GR close reason formulation is a bit of a mess, it's such a good indication of how it's used

I've lobbied to have it changed, but you know how hard that is

GR has several requirements, including being well-known (I would never think of searching Technet), reliability (why would I trust what I read there?), and searchability (the URL to look up should be obvious from the content of the question)

7

A: Introduce a "general reference" close reason

[TL,DR: general reference is “wikipede it”, not “google it”.] I support a general reference close reason, though we need to be careful about the potential for abuse. Having the closer indicate what the reference is is a minimum barrier. However, I don't quite agree with Borror0's flowchart. I t...

Iszi

@Gilles I will say I'm a bit unsure of whether or not I personally like that reason existing at all - at some point, I may have even spoken against it. But, my proposal wouldn't be for a generic "General Reference". My proposal is to have a selection menu that specifically states the applicable Law, and describes a proper best practice.

Gilles

@Iszi yeah, requiring the URL in GR (like you link to a question when you close as duplicate) would be a good thing

but, again, this doesn't make technet anywere close to being a GR site for security

technet could be a GR site for programming questions with MS tools, at least if their site was easier to navigate

I don't think it's possible to have a GR for security

GR, by definition, requires labels

Iszi

Like, for the example question I gave state: Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore Once an attacker has their own code or script running on your computer, anything is possible. That computer should not be trusted until it is fully restored from a known-clean backup imate.

Gilles

want to know the meaning of the word “dog”? Look up the “dog” entry in a dictionary

@Iszi how many questions have we had that were “what's law #1?”

Iszi

22:24

@Gilles It's not that the question is "What's Law #1" it's that the question is asking about or proposing something that's in direct contravention of Law #1. Proper knowledge of and defense against that Law would invalidate the premise of the question entirely.

Gilles

@Iszi then that question can't be closed as GR, because the asker had no way to find out that law #1 applies

Iszi

Another example is any number of questions asking for defense against an attacker who has physical access to the computer. See Law #3.

Gilles

that's in addition to the application of these laws being very case-specific

Iszi

@Gilles That's why I'm not saying implement GR. I'm saying implement a new close reason that specifically requires selection of a Law, and adds a note to the question that describes the Law when it is closed.

Gilles

@Iszi and, again, I'm saying (and have copiously explained why) that this is an incredibly stupid idea

Iszi

22:29

Maybe part of it could be considered a little elitist - we'd effectively be saying that good questions here require that the asker have at least a modicum of basic IT Security sense.

To us, asking a question while assuming a computer can be trusted at all after an infection is equivalent to someone going on Science Fiction and Fantasy and asking "Did Wolverine have claws before he had adamantium?" while tagging it x-men-origins-wolverine.

►

Gilles

@Iszi yeah, or going to Unix and Linux and asking “How to find a file in the filesystem from the command line?”

man, I wouldn't want to waste time answering such a trivial question

Iszi

@Gilles The difference here is that a very small set of canned answers can cover a large number of questions.

Gilles

@Iszi sure. By the same reasoning, on U&L, we could have closed that question as a duplicate of the find man page.

Iszi

@Gilles And I could deal with that, so long as (as you've suggested) the GR close reason require a link to (or description of how to find) the supposed reference.

With my proposal, links and descriptions would be canned and built-in to the process.

Gilles

@Iszi I'm glad I don't write answers for the asker alone. Because having written that two-page answer for an asker who'd have prefered to be refered to the find man page when he asked how to find a page… that would bite

Iszi

22:46

@Gilles I'm not sure I follow. I'm pretty sure I know which thread you're referring to, but I'm not sure I see how that statement relates.

Gilles

for the sake of the transcript, it's your question on U&L, which I answered

4

Q: How to find a file in the filesystem from the command line?

I'm fairly new to Linux, and I've now found myself in a situation where I'd like to find where a file (with a partially-known filename) is in the file system. I'd like to know how to do this from the command line, rather than using a GUI utility. In Windows, I'd run the following: cd /d C:\ di...

ubuntu find ls locate

Iszi

@Gilles Really is disappointing too, that the answer only has 6 up-votes.

Gilles

You say that you want to close such questions with a link to the relevant man page

so you didn't want me to bother answering

Iszi

@Gilles I say that I wouldn't have a problem with it if you did that. I'd understand - as I really did, when asking the question - that I'm a very new user to the system and there are probably some basic things I'm just missing which could be realized if simply pointed to the proper reference.

And, when I think about it a bit, the votes on that question and answer really do reflect a justification for that. It was a very good answer, going well beyond what I'd asked for and in deep detail. Yet, it only has six votes. This shows that it is not really as valuable to the community in general as it is to this one particular asker.

Gilles

@Iszi bullshit

the number of votes is a poor measure of how valuable a post is

if I'd answered a two-liner with “use find”, I'd probably have had more votes

Iszi

22:52

@Gilles Well, that's just representative of a broken system then.

(Or, rather, broken voters.)

Gilles

23:51

1

Q: Is Mandatory Access Control overkill for a desktop/lightweight server?

I have fiddled around with both SELinux and Apparmor recently and found these tools invaluable for preventing a spread of damage from a compromised context via one process, whereby and attacker could exploit a buffer overflow or underflow, eventually pushing a new return address on the local call...

security

@Iszi Now here's a case where I'd like to close the question as “mired in misconceptions”

I don't have the courage to write an answer

> This confuses the hell out of me, that somebody could write a hack to circumvent a local function call, and instead use a payload of code to spawn a root shell for instance. Isn't this situation the opposite of what was intended with OS privilege separation? My guess is that these "flaws" are a result of the flawed design of interrupt handling on x86 systems

wtf???

Oh, hell, I'm voting to close as NC. I don't know if other U&L denizens will agree

If you Sec.SE guys with more courage than me want to answer, or think the question would fare better here, indulge yourselves

Transcript for