off to bed time - 'nother conference tomorrow: Community Resilience

some interesting speakers

@AviD your profile says you're of same age I am, that's why I asked ;) No disrespect, obviously LOL

@AviD Avi would you mind giving your opinion on my question here? I know you dig web application security a great deal more than I do, so any suggestions would be much appreciated! I've just updated my question a bit, I hope I didn't make a mess out of it like the usual LOL

@AviD Ahh I see.

@allquixotic Intel is really making gains on the GPU side. I would bet on Intel beating AMD in GPU sooner than AMD beating Intel in CPU, mostly due to Intel's enormous resources....

Hmm, I realize github no longer offers hosting of binary files.

> The small town of Clay received seven of them to serve a total population of 491 people... and all seven routers were installed within only .44 miles of each other at a total cost of more than $100,000.

Interesting: arstechnica.com/tech-policy/2013/02/…

@RoryAlsop I wrote a blog post on my own blog about a question that was on the QOTW meta question. infosecstudent.com/2013/02/…

Do you think it should be cross-posted on the sec.se blog?

@Tinned_Tuna it's right here, we will be colaborating in team from this very website, check the meta post for more info (still need to add the ctf)

@LucasKauffman Morning.

I'm quite bored.

@TerryChia hi there terry ^^

@TerryChia oh btw have you already bought your vps?

@LucasKauffman Yup, I got one from Linode.

if you have you can try to do this ipv6.he.net

if you manage to do all the challenges, you get a free t-shirt with Hurrican Electric IPv6 certified Sage

plus it's really interesting

@LucasKauffman Ahh that seems interesting. Shall give it a try in a few days.

@Terry - that should be fine. If you draft it up, there is no problem also having a link on it to your own blog.

@RoryAlsop Alright, I'll get on it in a few hours. :)

Dumping Dumping and I hope you like Dumping too!

About to do my monthly book shopping. Any recommendations? ;)

@TerryChia 50 shades of grey

@LucasKauffman Heh. Seriously though. :P

Is The Shellcoder's Handbook any good?

@TerryChia I bought the Shellcoders handbook, Liars and Outliers, Rootkit Arsenal, Metasploit,

yea I think it's good, but it's a steep learning curve

@LucasKauffman Yeah, Liars and Outliers is sitting in the shopping cart waiting for me to checkout.

especially if you aren't familiar with assembly

@TerryChia You already have Computer Networking: A Top-Down Approach

it's one of my favorites, all though a bit steep in pricing

@LucasKauffman Not yet. Wow that's an expensive one.

I think I'll pick up The Shellcoder's Handbook. Should keep me occupied this holidays.

@TildalWave If I understand the question correctly, I don't understand what you're trying to do.

that is, more of "why" you're trying to do it.

I think Tom said it best, the benefit is so slight that its not worth bothering with.

that said, I'm not sure I totally understood your question.

@AviD Yeah I thought it might be a bit over the top model and yes Tom did give me a good enough reply (that made me re-think my position regarding enabling such filters). I guess I'm mostly after blocking spam bots down the application end before they find themselves in lower level blocks. A sort of an intermediary honeypot (I don't have a name for it). I think I need to redo my filters completely for such niche methods to be of any use, probably with some weighting algorithms...

@AviD Anyway, cheers for looking into it, as I said it's not exactly my area of expertise and any suggestions are welcome (even if there's nothing to suggest, that might not have been obvious to me before) ;)

If that's all you're trying to achieve, I would give you the same answer I give regarding CAPTCHA attempts at blocking spam: Don't Bother.

(for almost all scenarios, with a few exceptions).

Dont worry about source, intent, etc - just block the misuse. It doesnt matter who is doing it.

I'm looking to implement some heuristics into my algorithms and thought to run them through as many of various detection methods as I'm able to. My main problem is that it takes too much time off me to go through them manually as they evolve.

Personally, I've found that adding an empty text field on the form that's hidden via CSS and checking that it's not populated on submit has stopped most automated bots.

since they're usually programmed to fill in junk for unknown form fields. so they fill in the junk and send it off, and no real user would ever be able to do that.

then I just manually block any human spammers and smarter bots

@Polynomial It's a good idea. I think I read about it in an answer here. Was it from you?

@Polynomial That's a neat trick

probably.

I read it on Webmasters.SE somewhere originally, I think.

gave it a try and it seems to do the job.

won't help you against targeted attacks and smarter spambots, but they're a fraction of the population.

and then you can just block the offending IPs / accounts.

even better if you've got community spam flagging like we do on StackExchange. saves you a whole bunch of time.

that's what I'm doing now but I'd like to move back to actually developing and it takes too much time off me

elect moderators that can do it for you?

I realized some time ago that the best thing I implemented was blocking hosting companies' ASNs completely... I can't afford moderators at this point in time, sadly

@TildalWave Ah see. StackExchange doesn't pay their moderators. ;)

All you need is a large enough community! :P

most people like the idea of being a moderator.

Maslow's Hierarchy and all that.

That's not up to me in most cases, where these solutions would be used on third-party servers and their business, all I can do is update my code to be more effective and propagate the most notorious spammers to local filters

one thing you can do is have a threshold for auto-hiding of posts when a certain number of flags are marked against a post by users with a certain "quality" threshold (e.g. >50 posts, >100 rep, etc.)

otherwise known as flag weighting

@TildalWave It's a stupid trick. But as @Polynomial says, it does block the unwashed masses, who are stupid.

I have flag weighting already in place

/me nods

@TerryChia that's what you are led to believe, yes. ;-)

I'm looking to expand on automation, but yeah one way to do it is to 'empower' individuals and give them 'cookies' LOL

again, it really depends on your use-case.

so, for example, I have ~27k rep and ~100 helpful flags, and I've been around for about a year and a half, so my flag weight is pretty high. if I mark something as spam, it only takes one other user of similar rep to automatically hide a post as spam.

I've seen attempts to use CAPTCHA to protect the login screen for a large bank.

whereas if a couple of 400 rep users with 2 or 3 helpful flags each do the same, it doesn't count for much.

@AviD Well there were posts about banks protecting their pages with blocking right-click LOL

a simple cat forum, on the other hand, doesnt even need CAPTCHA, @poly's stupid empty field trick will do well enough.

yup

@TildalWave heh, yeah... I remember seeing those.

@TerryChia disgraceful.

@AviD Indeed.

so much truthiness in those truths.

half-way decent answers to horrible questions always get the most rep.

If I could +1 that comment any harder, I would.

@Polynomial heh, yeah, me too.

I'm quite embarrassed about my top 2 answers as well.

Ditto

@AviD I think it's because we often define "horrible questions" as those with bad practices in them, which generally brings the "OH NO HE DI'NT!" crowd in.

and usually the answers to such questions include some humour or snark, which helps with the upvotes.

case in point, my Don't Be A Dave answer.

@TerryChia is why I barely answer any more... the gamification worked against me here.

@Polynomial and the robot injection.

@Polynomial Or this one

Only it's all snark.

@Polynomial but yeah, it probably has a lot of truth to that, but my problem is - its brainless. I dont feel that questions - or answers - like that improve the internet in any way.

@AviD I don't think that one counts. That was a good question, because it's valid to a lot of people and happens to be something most pentesters have to do in their career at some point.

no added information beyond the obvious.

@Polynomial sure, but its been done dozens - if not hundreds - of times before.

@AviD Of course, but not on StackExchange, and the goal is to make SE a one-stop-shop for quality high-signal low-noise answers.

I mean, that's literally the reason SE exists.

and, forgive me my stuck-up-ness, but if you dont know how to be doing that, you have no business doing that professionally.

of course.

but some people might struggle to explain it in an optimally simple way. they might be able to explain it, but not in the best way possible.

@Polynomial of course, but I dont see that Q as a high quality signal.

@AviD No, the answer is. That's the point.

yes, I do see a need for 101-type questions, but those are hardly our best Q's.

you could answer that question with Google and a few minutes of looking around, but you might find some bad advice on a site that doesn't have a feedback system, e.g. w3schools.

whereas if SE is your first port-of-call, you know that the advice has been vetted by a bunch of people if the upvote count is reasonable.

@Polynomial its a good answer, but again not what I would consider our exemplary questions.

like the kind they would print on cards to give out.

I wouldn't consider it exemplary, but I wouldn't consider it bad.

like the satellite question.

It got a huge number of upvotes because it has public interest, but I largely consider question upvotes to be a measure of popularity rather than a measure of quality.

@Polynomial dint say bad, I said "not high quality signal".

W3School is one of the main reasons SO exists LOL

@Polynomial I'm not opposed to the question or the answer being on site, I'm opposed to that point.

question downvotes are a measure of bad quality, but question upvotes aren't really a measure good quality.

@AviD That's fair.

upvotes should be mostly about quality.

there's no way to enforce that, though.

sure, there is some aspect of visibility, but it shouldnt grab lots of votes just because its easy to understand.

@TildalWave and SexChange.

most people are gonna browse to highest upvoted questions for leisure purposes, but actually search for shit they want to know for a specific situation.

@Polynomial or controversy.

indeed.

so I don't think the high upvotes on alright questions with public interest are a bad thing, really. they don't detriment the site. if anything, they just serve as a way to improve the "leisure reading" aspect of the site.

it's a shame some of the really important questions in security that are well written don't get more upvotes, but the only way to change that as an individual is to upvote the good quality questions and ignore the sensationalist stuff.

thing is, a huge portion of the voters here dont know much at all about security, nor do they try. So they grab the "popular" questions, if they can understand it easily they mgiht vote for it, but the quality answers should make you think. Hard. About security. So those usually wont get a lot of votes.

@AviD that naming snafu was hilarious.

@AviD :O you mean Exchange?

@AviD Those are the ones that immediately get my upvote.

@TildalWave Expert Sex Change.

now known as "give me money for what StackExchange does for free and better".

aka "the hyphenated site".

@Polynomial oh, I do ignore them. Often downvote them, because they are usually not good questions.

@Polynomial I don't get it... I know it's supposed to be funny but I'm not long enough here to get it :(

@TildalWave Experts-Exchange.com didn't used to be hyphenated, and it used to trigger off people's content filters.

@TildalWave So tech people would browse to EE at work, and they'd get told off by their managers for trying to go to gender reassignment sites.

@Polynomial it was also highly ranked for the other google search terms.

@AviD Indeed.

I got a call this morning from customs. Seems my Korean monitor is being held up for taxes, now I have to drive in there to pick it up. And they are already closed.

Gorramit.

it was like the precursor to StackExchange really, except it was full of cargo cult programmers and Indian outsourcing coders, and eventually went pay-to-use with a caveat that you could get free access by providing a certain number of accepted answers per month.

@AviD fail.

@Polynomial Ah so that's why I had to whitelist it in my Apache config. I didn't pay much attention to my referral filters... still, not as funny as 'susanalabumparty' :D

they are also asking a ridiculous amount of taxes for it too - 35%.

@TildalWave That one was marketing genius.

*susanalbumparty

the funny thing is EE is still around, and people still use it. hilariously, people still pay for it, even though the answers are visible for free if you scroll to the bottom of the page.

@Polynomial and usually pretty bad.

@AviD Yup.

the only time I've found it useful is when trying to solve problems with legacy hardware, 'cos they've got answers going back to ~2002 or something

and even then there are better resources

^

I hate that so fucking much.

If you have a problem, and you ask about it online, then find the answer yourself, POST THE DAMN SOLUTION

@Polynomial People move on, if they didn't - they'd be experts

@TildalWave Sure, but it takes like 5 minutes to post a quick solution and say "Here's what worked for me"

@TildalWave sex changing each other all over the place.

no warranty, no expectation of having to give further advice or clarification

just a pointer in the right direction

I remember years ago there was some problem with Steam, and it meant loads of people couldn't get onto their friends list, and couldn't invite people to join their game. Was a massive pain in the arse, and Valve didn't patch it for about 4 months because they couldn't reproduce. Anyhoo, some dude found a solution and actually came through with something that worked for him (it was something to do with unicode settings screwing up requests). Valve patched it about a week later.

Was something to do with having a particular text renderer option enabled in Valve's config file, which caused it to mis-detect your system language sometimes, and it made it use UTF-16, but on some locales it wouldn't actually copy the string in as UTF-16, and it'd fuck up the requests to look up your friends by name (so 'Po' would become 0x506F, which would be interpreted as a multi-byte unicode char) and therefore broke everything.

Right, I hate encoding bugs.

but some dude figured it out and posted it to the forums and everything got solved :)

so I'll re-iterate. If you have a problem, and you ask about it online, then find the answer yourself, POST THE DAMN SOLUTION.

@Polynomial You're used to sharing your knowledge because you have plenty to share. That's not true for most, and they'll protect what little they know for as long as possible. I think that's one of the reasons why some don't share their solutions to common problems. Either that or they're just mean and wish for others to go through same trouble they had to

@TildalWave I think a lot of the time it's because they spend a long time looking for a fix, then it works suddenly and they just wanna go play with whatever it is they fixed.

so that overrides their altruistic impulse.

@TildalWave That's misleading. He's just a repwhore. ;)

Kidding of course.

haha

@TildalWave I think that actually works the other way around.

I've done that before though. I had a problem with getting Portal to run, and when it was fixed I immediately played Portal and carried on doing so for ~16 hours.

by that point I just couldn't be arsed to post the solution.

these days I probably would post it though. I have more restraint.

@Polynomial That's OK because I posted it for you LOL

Unless it was SC2:HotS. Then I'd be all over that shit - fuck everyone else!

Also, that's why reputation systems are important. They encourage people to answer.

^

I'm a bitch for gamification. Hell, I should probably get on one of those sites that gamifies exercise. I'd be 30lbs lighter and fit as a fiddle within two months.

While we're on gaming subject, does anyone know of anything similar to Space Rangers?

(actually I'd probably just sleep and watch cartoons, then lie about my exercise)

@TildalWave EVE Online and the X series of games are probably the closest.

e.g. en.wikipedia.org/wiki/X3:_Reunion

@Polynomial doesnt work for me. In fact, most often I rebel at the manipulation, and reverse-gamification goes into play.

I've barely posted any answer here in months. (I am embarrassed to say...)

downside of the X games is that they've got a huge learning curve but ZERO instructions, which ruined them for me. EVE was pretty sweet until I got bored.

@Polynomial No I didn't think of space sim / strategy. I meant with at least close to having same sense of humor... Space Rangers had for example tons of text only riddles in it that were extremely fun to solve

oh right, I dunno then

erm

Monkey Island? :P

hehe

Portal / Portal 2?

they've got some sweet hidden stuff

same with the Half Life games. plenty of hidden gems.

@Polynomial Yes that's more like it, but I've played them through :(

Space Quest...

@AviD I don't mind it. I consider rep to be "I like this", similar to Reddit, and that's fine by me. If my answer is helpful to someone or if they found it interesting / accurate, then I get an upvote. And that makes me happy. I don't mind other people getting rep for lesser quality stuff, unless it's actually wrong.

as far as space sims go I liked Nexus - the Jupiter incident

Nexus was ok.

I wish someone would make an EVE-quality game with a single player campaign.

I like narrative. EVE lacks that.

one of the only reasons I still play AAA titles is that they actually bother to do narrative. too many indie games suffer in that regard.

Heavy Rain is a great example.

great as in you'd recommend it or great as an example of why you wouldn't?

great as in I'd recommend the hell out of it.

@Polynomial I dont really mind rep-imbalance, I'm just saying it doesnt really work on me, at least not the way it should.

duly noted cheers

I probably stay away less than I would otherwise.

it was largely made as a demonstration for how the PS Move could be used in interactive storytelling, but it ended up being a really really good game.

if it comes down to - "I'm going to answer this question to get rep", then I won't bother.

has to do with intrinsic vs extrinsic motivations, I guess.

there's not much "game" to it really, but it's got a gripping storyline and has some really fucking HOLY FUCKING SHIT moments.

so many games throw killing and gore at you so much that you become desensitized and bored by it. they don't bother to create a connection with the character. so when a game makes you physically wince at something a character's doing, you know it's doing its job right.

@AviD But getting loads of rep is actually really easy, even I noticed that I'm here what, a month? All it takes is having 2-3 top Google search results ready and fish for matching questions.

@TildalWave That's exactly my point.

@AviD Still, that doesn't really add much to the site

exactly.

insight is important.

just rehashing what wikipedia says isn't much use. adding your own insight and tying in knowledge from other areas is what makes a good answer.

@Polynomial absolutely.

@Polynomial But these tend to result in most jealousy down-votes I've noticed

@TildalWave Really? I've yet to see that becoming a real problem.

@TildalWave That's what I mean, like "why bother?" whereas if rep was de-emphasized I would probably be doing it more.

@Polynomial I'm only pissed when people basically repost the exact same content as a previous answer then gets upvoted for it.

@TerryChia There's one like that on my SQL answer. It amused me.

@TerryChia actually, according to the FAQ it is okay, sometimes.

basically copied my answer but replaced robot with something else.

it got +1 I think.

f.e. if the complete solution is spread over 3 answers, there is value in collating it all into one mega-answer.

I just found it funny.

@AviD I'm only annoyed when the answer contributes nothing new. Basically a rewording of an existing answer.

And not even a better one.

@TerryChia or a wikipedia entry...

@AviD I've been picking brains with some graphics designer yesterday about what location is most suitable for CMS installation. I've only written a few hundred of those and am still developing the framework of mine, and he's done what... design a few icons for them? Anyway, it was actually my fault as I assumed readers would get what was in my head... it's really tricky to answer simple questions actually

@AviD I submitted in the end and congratulated on his insight (without being too obvious LOL). That resulted in a few up-votes almost immediately

@AviD Frankly, that's not a reason I'd like to gain rep at all. It just feels wrong

@TildalWave Having it CW-ed is an option in that particular case.

I wouldn't mind at all if it was CW-ed.

@TildalWave I don't like doing that, but often I'll summarise a few bits from existing answers that I'd have written in my own answer anyway, then add more to it. But I'll only do that if I actually have something new to bring to the table.

I don't disagree.

in those cases, I would most likely comment on one of the answers (either the already-accepted, highest voted, first, or otherwise best answer) to include the missing bits.

I feel that would improve the solution more than adding another answer.

@AviD My follow-up was too long and wouldn't fit in the comments section

@AviD Depends really. If there are 3 answers with 4 or 5 really good separated points, and I have a couple more to bring to the table, I feel it's appropriate to summarise the existing points (and give credit via link) and then properly flesh out the extra points.

I mean, the accept is only +15, and other answers are likely to get upvotes too.

@Polynomial sure, if its not all covered already.

otherwise a comment will do.

@AviD Anyway the most up-voted comment was more or less simply replying with this under a partial quote of the question, which I found ridiculous as it didn't give any explanation for it whatsoever. Not sure if I should mention that was on Webmasters... I've noticed not all SE sub-sites are quite the same in quality

Hmm, this is an interesting Cracked article. cracked.com/blog/…

The new mobile Intel chips look interesting. I wonder if they can effectively compete with ARM this time.

@TerryChia This one from Wikipedia made me laugh the most (NSFW)

what the fuck is happening?

> It's like everybody survived a plane crash and celebrated with an orgy.

@AdamMcKissock ALL THE PORN

@AdamMcKissock Your mom.

@TerryChia Wow, never heard that one before...

@AdamMcKissock Heh. Type that into the search bar.

sighs

@AdamMcKissock It's a DMZ meme. We make "your mum" jokes because why the fuck not.

they're largely sarcastic.

@Polynomial so's your face.

also, this terrifies me (again, very NSFW)

@AviD *pulls sarcastic face*

@AviD hahaha. i thought of typing that. but it didn't seem like a good insult.

I am amused that someone put a fucking black binliner on their hand to fist a dude's ass.

ARGGH!

YARRR!

Is it talk like a pirate day again already?

@Polynomial yar know it is matey!

@TerryChia ARRRR YE SCURVY CURR!

A gold dubloon to he who first spies the white whale!

we... really did not need a graphic explanation.

I think @Iszi is gonna have another DAFUQ moment when he comes in and looks at the starred wall.

@AviD You know we did.

I could've added details about the visible stretching of the anus, but I didn't want to be disgusting or anything.

@Polynomial Starred that just to fill the wall up.

haha

Now would be a bad time to tell you guys that I'm off to go take a shower. But yeah, bbiab, shower.

hehe, I wonder why that is.

@Polynomial Is it true that British MPs cannot resign due to a law?

@TerryChia That's a real 180 on the conversation, haha

@Polynomial Just came across it in a cracked article and found it weird.

@TerryChia tbh, I'm not entirely sure. If I remember correctly, they're working in appointment to the United Kingdom as an entity, under the service of the Queen, similar to how you would be in the military. So you can't resign under the same employment law as normal workers, but you can still tender your resignation and it can be accepted by the government in charge - it's just not really a resignation in the normal sense.

> You see, due to a 300-year-old piece of legislation (because that's just how England works), no sitting MP can resign his or her seat, unless they accept another office of profit under the Crown. Which means that the government, to accommodate the fact that MPs do sometimes need to resign, is forced to give these MPs a new "job," specifically the Steward and Bailiff of the Manor of Northstead.

From the cracked article: cracked.com/blog/…

Yeah, it's complicated.

Of course, cracked isn't known for it's vigorous adherence to facts so i'm just checking.

If you hold a seat in parliament, you can't give up that seat because otherwise it skews the parliamentary voting process.

so you hold a seat, but you can still no longer work in a position

on paper you'd still work for the government, but in reality you don't actually do anything

We have a similar system here in Singapore (it was a british colony after all). When MPs resign for whatever reasons, they hold another election within a couple of months.

usually what they do is put you on permanent leave until the next election

another reason they do it is that it forces the MP to remain under contractual obligations, so they can't go an join an opposing party or disclose any political information.

until the next election, that is. by which point the policies and operational details are often moot.

Interesting.

of course some things continue on for life, like the Official Secrets Act. so even if you leave the govm't, you can't reveal anything that's protected by the OSA.

my dad had to sign the OSA when he was working on a govm't project that was only ever referred to as "the item".

in reality everyone knew it was part of a missile or rocket. but it was just "the item".

so he can't tell anyone any details about what he worked on, other than it was "the item".

right, actual shower time now.

brbbliab.

@AviD Gordon Moore himself predicted, back in 1997, the end of his "law" for about 20 years later (i.e. 2017 or so).