The DMZ

Simon

13:00

@RoryAlsop @AviD (even if he doesn't care) @schroeder, I flagged these 2 questions as off-topic and my flags were declined: security.stackexchange.com/questions/82426/… security.stackexchange.com/questions/115943/…

I think you need to have a talk with those who review close votes because they seem to not understand that we're not a support forum for products.

AviD

the nmap isnt offtopic, but is closeworthy. the sqli question is a good one.

I am not at all sure why you think those are offtopic. I think we need to have a talk with @Simon about not understanding what VtC as offtopic is for.

Simon

Product support is off-topic.

If, especially the nmap one, is on topic, why did these two flags (which were flagged pretty much at the same time) were approved: security.stackexchange.com/questions/115976/… security.stackexchange.com/questions/114642/… ?

AviD

@Simon because it was by somebody else?

somebody we trust?

Simon

So you're saying that if I'm having issues using Burp Suite, it's absolutely on topic to post a thread here asking what's wrong with it?

Adi

@AviD Or, god forbid, you'd give him a mod answer

AviD

13:07

but yes, I misspoke - it is offtopic, but not plain "offtopic", its "offtopic because belongs on another site"

Rоry McCune

whaaaaaaaat security tool discussion is off topic

Simon

@RоryMcCune Oh look, the voice of reason.

Rоry McCune

y'all are just messing with me now

AviD

@RоryMcCune no no not at all

Simon

@AviD WTF

AviD

13:08

its "I dont know how to use this tool", thats SU

Rоry McCune

@AviD surely the mods aren't going down that line for Metasploit/nmap/burp etc are they?

what do you think the odds of a good answer on burp are in Sec.SE and SU?

realistically

AviD

@Simon that depends. Is the issue you're having like "it dont work, I get an error" or, "I am running Intruder and the results are not what I expect blabala"

@RоryMcCune see ^

same as always, no change here

Rоry McCune

@AviD that's a bad idea, really, the security specialists are on Sec.SE, the security tool Q's should be on Sec.SE

AviD

at least AFAIK

@RоryMcCune yeah but again, if its about the security part of the tool then yes. If its "I double click and it tells me I need Java whaadodidooo", thats outa here

Rоry McCune

well if that's the case you mod types have some migrating to do... security.stackexchange.com/questions/tagged/metasploit

Simon

13:11

Also, I'd like to say that I did not dig for those questions, they were on the main page.

Rоry McCune

@AviD and who's got the experience of things like what versions of JAva Burp likes/dislikes.... Sec.SE or SU?

AviD

@RоryMcCune first handful I saw fits here just fine

@RоryMcCune pffft, still

Rоry McCune

0

Q: ms03_026_dcom not working on Windows XP Sp1

I have been trying to use metasploit and kali linux when I came across the idea of using windows XP sp1 (checked the service pack with winver.exe on XP). I used the famous ms03_026_dcom and payload of shell_bind_tcp. The brief response I got was the usual: Started bind handler, Binding, Bound, ...

AviD

I dont think you really want to be accepting questions as to what version of java...

Rоry McCune

^my tool doesn't work

6

Ohnana

13:12

@RоryMcCune OT, we're not PortSwigger

AviD

@RоryMcCune just saw that...

borderline imo

Simon

12

Q: Browsing exploits with Metasploit console

Is there any way to browse certain exploits in MSFconsole? The show exploits command shows too many and I cannot find a way to show just Windows file format exploits, for example.

tools vulnerability-scanners metasploit

^ You're saying that's on topic?

AviD

hey come on now guys, I only meant to be picking on @Simon, I dont have time now for a philosophical discussion!

@Simon no, but @RоryMcCune is.

why dont you two discuss amongst yourselves?

Simon

wat

Rоry McCune

meh I'm not a mod but I'll give the same warning I did when everyone reckoned product recommendation q's were not on-topic 'cause they "change too quickly" (unlike all other areas of security ?!?!?) new users will be turned off by this attitude

Simon

13:13

Because we literally have no power on the matter, how is it relevant to be discussed between the two of us?

AviD

@Simon POWER TO THE PEOPLE!

Simon

-.-

AviD

POWER OF THE COMMUNITY

M'vy

AviD pours gasoline, cracks a match, drops the match and leaves

3

AviD

@M'vy heh, that's my special move

@Simon besides, IMO the real answer is somewhere between the two of you.

You're both sensible adults, I'm sure if you discuss it you can reach a reasonable conclusion.

@AviD WAT

you must have been sniffing that gasoline too much there mistah tiggah

Simon

13:15

Through my 940 helpful flags I thought I had learned that anything discussing an issue about a tool was off-topic.

It looks like I learned crap according to ovid.

AviD

@Simon no no, only discussing your tool .

Simon

-.-.-.-.-.-.-

AviD

@Simon I learned "Crap According to Ovid".

Thanks, man.

Rоry McCune

well look at the first one simon flagged for nmap, he got someone who sounds like an actual nmap dev answering

on Sec.SE

would that be likely on SU?

AviD

@RоryMcCune really? awesome!

Rоry McCune

13:16

I would suggest less-so

@AviD read bonsai viking's answer

M'vy

Time for... META!

AviD

cmoooon I dont have time right now!

last day of month, have stuff to finish...

Rоry McCune

1

A: nmap says "variable 'keys' is not declared" when trying to run ssl-ccs-injection.nse

The script is written for the current development version of Nmap, not the released version. In r33651, I moved several different implementations of the same function into the stdnse library. You should be able to copy that library into your nselib/ directory just like you did to copy the ssl-ccs...

me neither as it happens :) must run

Simon

@M'vy Looks like it.

Is anybody not lazy enough to make a detailed post about it?

Terry Chia

@Simon Can you VTC questions yet?

Simon

13:18

@TerryChia TORRY SHUT TOP

Terry Chia

@Simon That's a no? :P

Simon

:(

M'vy

3k priv?

Simon

Yeah.

Terry Chia

Probably earned more passive rep last year than @Simon's rep total. :P

Rory Alsop

13:20

@RоryMcCune yeah, the GCHQ guys had a couple of cool swag items. I especially like the bat signal torch and the colicky clicks addictive colicky thing

Terry Chia

Ok, i should stop now. Getting mean. :D

Simon

@TerryChia o ffs

Rory Alsop

^interesting autocomplete I got there

Simon

I'm not even sure if I posted an answer last year.

@RoryAlsop RORO DID YOU READ THE WHOLE PRODUCT DEBATE?

Rory Alsop

Nope

Simon

13:21

pls do it ovid is madness

Rory Alsop

Product? Which one

diagprov

@RoryAlsop Summary: are security tool questions on or off topic on sec.se

Simon

@RoryAlsop Start from here if you have time: chat.stackexchange.com/transcript/message/27906572#27906572 but that's pretty much what @diagprov asked.

Ohnana

@TerryChia REKT

AviD

> colicky clicks addictive colicky thing

@RоryMcCune I think we need to add that ^ to the room description

Rory Alsop

13:22

Oh - that's one of those grey areas. Think we said a bit of both - crappy "my tool doesn't work" questions will get gubbed, but a good question with the usual info on what the OP did and the specific problem should be ok

AviD

I dont even have any idea what you actually meant

@Simon is funny - everyone is calling me mad, for opposite reasons

Rory Alsop

Clicky clicky addictive clicky thing

diagprov

@RoryAlsop @RоryMcCune did they ask you if you have ever tried to overthrow a parliamentary democracy? If you said yes to that you are definitely on a list. If you said no, you're all good.

AviD

@diagprov but dammit guys, @schroeder already posted a great answer on meta about this.

Rory Alsop

@diagprov Nah - they asked if we were at the afterparty the night before

@AviD yeah - that was supposed to be the canonical one, right?

AviD

13:24

@diagprov did they ask about your colick?

Simon

@AviD Don't bother linking it, we're magicians who remember every single post.

AviD

@RoryAlsop yeah. Every 6 weeks this gets reopened up all over again

@Simon ah okay

Simon

MAAAAGIC

Rory Alsop

@AviD which does imply we haven't got it right yet...

Simon

I DID NOT RECEIVE MY DAMN SE SWAG YET

IT'S BEEN LIKE 3 WEEKS

Rory Alsop

13:25

Le swag

AviD

@RoryAlsop or maybe we should just post that answer here, every 5.5 weeks.

Rory Alsop

I haven't received my Skeptics swag yet, @Simon, patience...

diagprov

@AviD Got a link? Might help the others. I was just summarising for Rory.

Simon

@RoryAlsop Really, it's a slow process?

I answered on February 5th.

Rory Alsop

6 to 8 weeks, dude

You know that

426

A: The Many Memes of Meta

Meme: 6 to 8 Weeks Originator: Jeff Atwood First Heard: May 13th, 2008 Cultural Height: In about 6 to 8 weeks Definition: The time estimate given "off the top of my head" when the Stack Overflow team has only a vague idea of how long a task will take because they have little-to-no formal sche...

Simon

13:27

o pls

AviD

11

Q: Lets allow tool recommendations in specific circumstances

In general, Sec.SE bans questions on tool recommendations. This answer appears to be the most recent statement by a moderator. I propose we reconsider this ban and allow tool recommendations in specific circumstances. In particular, when the question is "How do I...?" and the answer is "Use ... ...

discussion

I think thats the one

diagprov

@RoryAlsop How dull.

Simon

It'd be really funny if I'd it within the 6-8 weeks.

AviD

no thats recommendations

Simon

@AviD Even if it was the right topic, there was literally no discussion on the subject.

AviD

13:28

ah this one:

8

A: Contradiction towards the policy regarding on-topic subjects?

A: "I'm using this tool to do X, but I have general questions about its use." vs B: "What tool do I use to do X?" vs C: "Tool X isn't working. How do I use it?" A is on-topic. It shows knowledge, understanding, and context. It is possible for questions to survive the use of the tool into m...

Rory Alsop

@diagprov but then they distracted us using clicky toys!

Which we haven't disassembled to check for trackers :-)

AviD

@RoryAlsop yeah the afterparty can cause colick

Ohnana

@RoryAlsop lol the best minds in infosec defeated by clicky toys

Simon

I know what I'll be doing: post 20 questions a day about tools not working as intended.

AviD

@Simon is that A or C ?

because I think you're confused again.

Still?

Either way.

diagprov

13:31

@RoryAlsop When you say clicky toys... are these in any way related to infosec?

Simon

@AviD C: "Tool X isn't working. How do I use it?"

Rory Alsop

Nope. Not at all :-)

Simon

Don't you think that's exactly what I just typed?

Rory Alsop

They are pure marketing. Cube things with advertising on

diagprov

@RoryAlsop How even more boring!

AviD

13:34

@Simon as @schroeder said, that is borderline at best.

Rоry McCune

@AviD well paj is right, tool recommendation questions should be allowed, but that's not what we're talking about at the moment that's "what tool to use" not "help I can't get this tool working"

AviD

@RоryMcCune scroll down to my correction ;-)

Rоry McCune

@AviD I'll call bull-crap on c) we provide product specific answers all the time, without the need for product specific forums

91

Q: Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?

webserver hardening configuration apache

^did we tell them to go RTFM?

BTW there's 271 questions with the Apache tag alone

30

Q: How to fix SSL 2.0 and BEAST on IIS

As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs. I'm using IIS 7.0 with the latest patches, and can't seem to find the answers to these questions: What is the risk impact of th...

tls iis beast

41K views specific information on IIS configuration

AviD

@RоryMcCune it depends

@RоryMcCune thats not support

Rоry McCune

@AviD it should be RTFM, I'll bet Apache have a hardening guide

AviD

13:41

@RоryMcCune so what? @schroeder was particular about what kind of question it is, not about it being product-specific.

@RоryMcCune so? Who says thats best?

Rоry McCune

@AviD also I didn't say support, I said product specific guidance

AviD

for that matter, who says it fits all scenarios.

@RоryMcCune @schroeder did.

Rоry McCune

@AviD PRECISELY my point about why those questions are on topic here

AviD

@RоryMcCune I agree.

Simon

I really, really, really don't like how much if it is on-topic or off-topic is huge matter of opinion.

Rоry McCune

13:43

@AviD then why did you point to that answer to justify a position that that kind of question isn't usually on-topic here

and should be punted to SU

AviD

On the other hand, there are other types of questions, that are NOT ontopic here.

which is exactly the point that @schroeder was making.

urrm

@RоryMcCune huhwut?

I didnt point to any answers

Matthew

My general approach is that if the person has done some research, and the question has some security relevance, and I know the answer, I'll answer it

Rоry McCune

@AviD @schroeder 's bar is to me extremely hard to assess, how does a mod know that the question isn't in the manual/product support site

AviD

I am far too lazy to do that

@RоryMcCune I agree

there is always subjective grey area

and its not just a mod

Thomas Pornin

@RоryMcCune At some point, someone gotta google things up.

AviD

13:45

dammit, man! I really gots to finish this today.

Matthew

If it is general server config, I suggest it gets kicked to serverfault. General programming to stackoverflow. Crypto specifics to crypto. Anything that mentions viagra to the bin!

AviD

my chances of making it out before yoga are quickly dwindling...

Rоry McCune

@ThomasPornin sure a bad question is a bad questions, but it being related to a product shouldn't be a factor that determines that badness (IMO)

AviD

@Matthew no no, those go to workplace.se

@RоryMcCune its not

no one ever said it was

well, @Simon did

but I mean, noone apart from @Simon

Rоry McCune

@AviD and you agreed with him at least in part

right I really don't have time, gotta run...

AviD

13:46

@RоryMcCune not because its related to a product

Thomas Pornin

What's up with these people who keep on telling that they don't have time and must go, and still linger around to repeat it a dozen times ?

AviD

but because its a suport question, or a crap question, or a giv meh teh codez

@ThomasPornin I CANT HELP IT

I LOVE YOU GUYS

Ohnana

@AviD GO DO YOGA

AviD

naw gots to finish this task firzst

and the next one

but THATS IT

Mark Buffalo

chroot /home/@Ohnana

Ohnana

13:53

@MarkBuffalo excuse you

Mark Buffalo

@Ohnana my bad, I meant to say "good morning"

"good morning" @Ohnana

AviD

@MarkBuffalo I thought you were gonna say "wrong window"

which would be really creepy

TildalWave

@Simon answered what?

Simon

@TildalWave An email saying "pls give us your address"

Mark Buffalo

@AviD Oh, it was the wrong window. I just can't tell you that. && chroot /home/@AviD

oops

TildalWave

13:58

@Simon but you have like 2.5k rep total on SE, what are you supposed to get swag for?

hahaha

Simon

@TildalWave JELLY

Transcript for