The DMZ

The numbers of flags per number of messages is actually incredibly low (can't share that bit of info) but as the number of messages has skyrocketed, so too have the flags

HamZa

@silverpenguin finally I could pwn it by jumping to a specific function and for the fun tried retlibc

@RoryAlsop let's talk in relative terms. Did the flags raise relatively?

Terry Chia

12:18 PM

Contest: How many tech buzzwords can you squeeze into a single pitch? The prize is I write a tweet praising you lavishly.

Tweeted by mims on April 6, 2016 at 1:59 PM

/cc @AviD, @RоryMcCune

AviD

heeyy whaaat

leave me alone, I aint no buzzword hipster

okay I'll think about it

Simon

@TerryChia Did you get the Slack link?

Terry Chia

@Simon What Slack link?

Simon

20 mins ago, by Rоry McCune

@Ohnana https://offtopic-dmz.slack.com/shared_invite/MzI3MzIzMzAwMDAtMTQ2MDAxNjQ1Mi02NjM‌xOTA2ZDhk

bilbo_pingouin

@SmokeDispenser it's my first answer on SecSE... I tried to be helpful... not necessarily a lot of focus on being nice though... :)

Ohnana

12:21 PM

@bilbo_pingouin well, helpful is priority #1

M'vy

@M'vy, cannot upvote enough;) — SmokeDispenser 8 mins ago

^ Lol :)

SmokeDispenser

@M'vy It was exactly what I thought.

Xander

1

Q: What are the factors that determine how long whisky is aged?

Whisk[e]y varieties often have significant differences in how long they are aged. While there are always exceptions, Bourbon is often aged for 5-10 years. Scotch, on the other hand, is more commonly aged for 10-20 years. Why is this?

Rory Alsop

@HamZa difficult to say - there is a specific cut of data I don't have. But extrapolating the invisible bit, yeah - they have increased more than the influx of new folks would suggest

SmokeDispenser

@Xander it that on topic at beer?;)

Xander

12:24 PM

@Ohnana And: beer.stackexchange.com/q/4929/37

HamZa

@RoryAlsop I see... Thanks

Xander

@SmokeDispenser It is now!

7

Q: Shaken, not stirred; let's expand the site!

The state of Beer SE has been on my mind for quite a while now, and after another user suggested that the site expand our scope, we've decided it's time to shake things up. In its current state, Beer is averaging 0.4 questions per day. While we have two active moderators who are keeping the si...

discussion featured scope site-health

SmokeDispenser

@Xander I see. I'm not drinking, so it's probably still not for me:)

Rory Alsop

@Xander ooooh - I might be able to start getting my rep up on drinkies.SE (that's what we're calling it now, right?)

Ohnana

@Xander wow fancy

Journeyman Geek

12:25 PM

@JukEboX glad to be of help ;)

@TerryChia I have a phone interview at (south american river) web services :)

Xander

@RoryAlsop I suggested "Libations Stack Exchange" We'll see what the final vote is for. :-)

Terry Chia

@JourneymanGeek Yay. :)

SmokeDispenser

@JourneymanGeek have fun :)

Ohnana

@Xander if you get libations we're all gonna invade

Xander

@Ohnana Please do. And ask (and answer!) some questions.

Journeyman Geek

12:27 PM

@SmokeDispenser more importantly, impress folks with my skills. Least enough that I make it through more rounds

Terry Chia

@Xander Maybe they should merge with Security since drinking is basically a job requirement for infosec guys. ;)

SmokeDispenser

@JourneymanGeek I tend to have better results at interviews when I just try to have fun.

Mark Buffalo

@kalina I don't mean "tolerate" as in you're overbearing. I think my way with words is a bit derp

SmokeDispenser

last time, I engaged a discussion with the boss of my in-spe boss, ending it with "we can discuss that between the two of us the next time we meet"

Mark Buffalo

@kalina either way, I like having you here... I think you're funny sometimes

SmokeDispenser

12:30 PM

@bilbo_pingouin just saying, no offense:)

Xander

@TerryChia I know, right?

SmokeDispenser

@TerryChia a high level of sarcasm does the trick, too.

bilbo_pingouin

@SmokeDispenser none taken. But you have to admit there's a bit of work to do for the OP :)

SmokeDispenser

@bilbo_pingouin hell yeah. a bit might not suffice.

Ohnana

@TerryChia this is what i've been told

bilbo_pingouin

12:35 PM

@SmokeDispenser a bit might be already enough to prevent them from cutting a cable in the middle of nowhere and trying to "listen" to it :)

SmokeDispenser

@bilbo_pingouin yeah. would've worked though, exactly like that at bell labs.

Mark Buffalo

@TerryChia Boy did I pick the wrong career then

SmokeDispenser

e.g. with the first iteration of ethernet

Mark Buffalo

damn I've lost 17lbs in nearly 2 weeks

it's visible too

Journeyman Geek

@SmokeDispenser talking about hardware is fun ;)

Mark Buffalo

12:41 PM

3 more days until 2 weeks ends

SmokeDispenser

@MarkBuffalo what's that in a reasonable meassuring system?

and what are you trying and why?

Mark Buffalo

7.71 kg

SmokeDispenser

that's a lot

I'd look like a crack addict then.

Mark Buffalo

reddit.com/r/keto - tired of being fat

SmokeDispenser

I see.

Good for you then:)

does it have negative impact on your concentration levels, though?

Mark Buffalo

12:52 PM

it did during the first week

but not anymore

Adi

Anybody knows if OpenSSL uses any known PRNG?

Or is RAND completely their own?

SmokeDispenser

1

Q: Is this good/secure method for client-server communication encryption?

Something came to my mind, and I wonder if this is proper method for client-server communication, and if this method is wide-used. On connection, client generates seed, encrypts it using asymmetric algorithm(RSA for example), and sends it to the server. Using CSPRNG, both client and server gene...

encryption cryptography rsa random prng

is that crypto.SE-material?

Terry Chia

@Adi IIRC the default RNG is their own and based on md5.

M'vy

@TerryChia you sure about that?

Ohnana

@SmokeDispenser is it way too technical for someone who has a normal background in infosec? do you need a crypto nerd?

Terry Chia

1:06 PM

@M'vy Pretty sure.

M'vy

hm

There should be a way to change it though

Terry Chia

It seeds from urandom and feeds it into a PRNG.

@M'vy Yup, the PRNG used is configurable.

@M'vy This is the default though: github.com/openssl/openssl/blob/master/crypto/rand/md_rand.c

M'vy

wiki.openssl.org/index.php/Random_Numbers

you're right

Adi

@TerryChia Are you aware of any issues with it?

A coworker just said "Don't use OpenSSL RAND because it's not good. Use /dev/urandom instead"

Which confused me a bit since OpenSSL's RAND seeds itself with /dev/urandom

Terry Chia

@Adi Not that I know of but I'm not the best person to give an answer on that. :P It's mostly just hashing and xoring seeded data from /dev/urandom which usually doesn't make things worse.

Adi

1:12 PM

@TerryChia Exactly what I thought while I read the source code

I thought "Yeah, Terry is not the best person to give an answer"

:D

Terry Chia

@Adi Can't argue with that. :P

Adi

But yeah, thanks for the input. Off to arguing with coworkers ->

Terry Chia

I'd just feed /dev/urandom into Yarrow or Fortuna if I really want a userspace PRNG though.

SmokeDispenser

@Ohnana Well, I did answer it without crypto-nerding. we'll see. I left the security of OPs stream cipher draft open, as that is for crypto to say "nope":)

@Xander, and there I went, thinking 'a comment will do' on the MAC question;)

have an upvote;)

Ohnana

@SmokeDispenser ahhh the comments trap

Xander

1:26 PM

@SmokeDispenser Thanks!

M'vy

1:42 PM

Do HSM helps with PRNG issues?

Some Guy

1:53 PM

@AviD Haha, no idea. It makes for great stories, though!

Adi

@M'vy What are the PRNG issues you're referencing?

My initial thought is no.

M'vy

@Adi do they offer PRNG generation

Some Guy

What really is random?

SEJPM

@M'vy yes

Adi

@SomeGuy Not this, please.

Some Guy

2:02 PM

Haha, okay :P

Nipped it in the bud

Adi

@SEJPM What do you mean "Yes"?

HSM is just a blanket term

There are hundreds of different kinds

Different implementations

Different features

SEJPM

@Adi FIPS certified HSMs must have a TRNG AFAIK and it's good practice for uncertified ones to have one too

if they need to / can generate keys, they usually have a TRNG

go and find a HSM that can't generate keys

silverpenguin

closing all the windows and doors of a small room to hot box.... the smell of pizza does a line of dominoes mixed herbs

Adi

@SEJPM Do FIPS certified HSMs give you the random number?

Or are they internally used

and stored

If you want a replacement for your PRNG, you don't want something that keeps the generated number/key from you.

SEJPM

@Adi they are used internally and may expose the RNG to the outer world

Adi

2:07 PM

@SEJPM Alright, this sounds very good.

Any source on the second part?

So far, I've never seen an HSM that exposes the random numbers it generates

and I've worked with a few

SEJPM

@Adi wrong API?

Adi

Man, I'm not saying you're not giving correct information.

You're making a claim.

Just give me the name/model of this HSM

SEJPM

Funfact: If everything fails, just let the HSM generate keys and use the exported wrapped keys as random numbers

@Adi I don't have any at hand

Adi

and you don't remember which manufacturer?

@SEJPM Would that work with something like OpenSSL? (it supports outside sources of entropy)

Rory Alsop

@RоryMcCune - just thought...with Beer.SE turning into AllDrinks.SE, your NAS thingy might make for a question or two over there. What day reckon, @Xander?

SEJPM

2:12 PM

csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf#38 <- HSM RNG requirements

Adi

@SEJPM I currently OpenSSL fed with OneRNG

Rоry McCune

@RoryAlsop yeah I could do that

SEJPM

@Adi I didn't work with one yet, but I'll see what I can find

Adi

So if you can tell me the name of one HSM that I can use instead of OneRNG, I'd be very greatful

So far you're only talking about standards and how they're supposed to be

CodesInChaos

@Xander I think if you want to vote about the title, you should use a different meta question for that, instead of doing so on the announcement of the scope change.

Adi

2:14 PM

@SEJPM I'm well aware of FIPS 140-2. Nothing in it regarding exposing RNs

@M'vy Anyway. PRNG issues are two kinds: Good sources of entropy, and good RNG logic that doesn't fuck up your already good entropy

SEJPM

> Both CAPI and PKCS-11 have random number functionality which can be used to access the TPM RNG.

^ metzdowd.com/pipermail/cryptography/2006-June/011162.html

so the APIs should support RNGs and now it's only a question to find a HSM that allows supports the functions...

Adi

@SEJPM Yup, they do. Like I said, this is what I currently do with the OneRNG ("True" RNG)

SEJPM

while it doesn't offer PKCS-11 / CAPI access, did you look at RDSEED and RDRAND?

Xander

@RoryAlsop Sorry, not sure what a NAS thingy is (outside of network attached storage)

@CodesInChaos Yeah, that's a good idea.

Rоry McCune

@Xander Non-age-statement whisky, basicaly distillers putting out "single malts" without an age on them

as opposed to blends which usually don't have those

the concern being that they're using younger spirit and trying to charge a premium price for it

Mark Buffalo

2:24 PM

Most aged alcohols are purchased from a distillery that already has the process going, I believe

silverpenguin

can anyone send me some motivation?

Xander

@RоryMcCune Ah, yes, definitely a fit!

SEJPM

@silverpenguin so you want money?

silverpenguin

@SEJPM lol i dont need money I have enough :P

@SEJPM I just want motivation :( CBA to study, play games, clean my house... CBA

Rory Alsop

@MarkBuffalo well, you certainly can't do it if they haven't ;-P

SEJPM

2:29 PM

@Adi the Luna HSMs look like they may support RNG access (they support PKCS#11 v2.2, CAPI, CNG,... ) all interfaces that should allow for RNG queries

David Freitag

6

A: Time Delay Relay and Flyback Diode

There are a few questions in there, so I will try to address them all. The Bueler Time Delay relays are unlike the vast majority of other relays you will find. The difference is that these relays are so-called "smart" relays. They have embedded circuitry that handles the triggering as well as the...

Shameless plug

Adi

@SEJPM Thanks. I'll give them a call tomorrow

Mark Buffalo

@RoryAlsop Unless you trick someone!

SEJPM

@Adi beyond that Rohde & Schwarz' HSMs ("CryptoServer") have certified RNGs and may also offer access via the common APIs

Shog9

@diagprov "internally" as in... Within the company? Or as in, normal usage?

We have a different chat server for internal use; we use chat.se the same way most folks do: to talk to other SE users.

Mark Buffalo

2:40 PM

uhh

schroeder

@MarkBuffalo plasma is fine

@MarkBuffalo hmmm, unless they changed the rules, there is a question on the form to ask if you have communicable diseases

Mark Buffalo

He's not donating, just checking his blood level

But someone made it look like he was donating blood

SmokeDispenser

oh, has brent's Q-ban yet again worn off?

@RoryAlsop, you were faster dupehamming it than my RSS reader.

RoraΖ

2:56 PM

@MarkBuffalo No way they can't put anything on the internet that isn't true

schroeder

@SmokeDispenser looks like

SmokeDispenser

@schroeder (s)he is pretty consistent with trying again, nonetheless. and the Qs do become better.

maybe (s)he is on the way to a good question.

.. how did this earn a bounty? It doesn't solve any of OPs problems.

diagprov

@Shog9 Ok yeah I thought so, there was a room like TL but for SE staff way back when I was blue. But it doesn't exist any more. I wondered if it 404'd for us normal people because you'd got fed up of people asking for access for a joke, but then, also, 1 room for the size of SE these days would be quite tough.

Asking if you used SE chat via SE chat... well I know I'm a bit slow sometimes ;)

Iszi

@Shog9 More specifically, I think the question was intended to be about whether or not SEI actually uses the SE chat platform internally, as opposed to another product like Slack.

Shog9

@Iszi oh. Yeah, we use this same system internally. We did try Slack for about a month, and mostly hated it.

IIRC, the designers still use it, because they're designers.

diagprov

3:11 PM

@Iszi I was being nosey mostly :)

Mark Buffalo

@RoraΖ true

Iszi

@MarkBuffalo Umm. Wow. My initial assumption was "twisted April Fools joke". But that's like a week early. For that matter, being that it's three years ago I'd expect we could find a fair amount of detail about it online by now.

SmokeDispenser

@Shog9 haha.

Iszi

Blah. I should have known to check Snopes first. snopes.com/media/notnews/magicjohnson.asp

diagprov

@Shog9 hipchat isn't much better either tbh.

Iszi

3:23 PM

Love this: troyhunt.com/2016/03/the-world-needs-more-stupid-security.html

Shog9

@diagprov yeah... Different design goals, really.

SO/SE chat was pretty much, "how can we make a web-based IRC-like system that's usable by folks on our sites and scales with them".

So you get things like a robust transcript, and replies that actually... Link back to the message they're replying to. So folks don't have to camp in chat 24/7 to be a part of it.

You have moderation that's a bit more nuanced than "ban".

(cue complaints about how it's not nuanced enough...)

In short, it's geared toward serving an auxiliary social role for Q&A. NOT at replacing a hodgepodge of IM and hallway conversations in your average dysfunctional workgroup.

Folks who like Slack tend to really like IM. Mostly-immediate, mostly-private interactions.

SmokeDispenser

Oh, I do happen to see that only now: @Shog9, are you wearing an blue diamond cap in you profile picture?

Shog9

yes

SmokeDispenser

thats feels like at least a tad too much;)

Shog9

Hey, some folks like to dress up as their favorite cartoon characters. I like to dress up as a moderator. Don't judge.

M'vy

3:31 PM

Slack seems to go more in the side of "all-in-one" communication tool for your team

diagprov

@Shog9 yeah, it does that v well (I was user Ninefingers in an old life and remember pre-chat SE).

Iszi

@Shog9 Let's see you dressed up as @RoryAlsop. Not the "day job" @RoryAlsop though. Talking the "nights & weekends" form.

Shog9

@diagprov Oh, I remember you then. You wrote/inspired a bunch of helpful "how to moderate" meta posts.

diagprov

@Shog9 yeah but we complain about everything :) bring back flag weight!

Shog9

ugh

diagprov

3:33 PM

sorry ;)

@Shog9 I did. Dunno if it's still there, but yes I did.

Mark Buffalo

@Iszi Yeah, obviously fake, but so twisted it just gave me a pause

Shog9

Ironically, flag weight might actually work now, at least in some limited areas. The problem at the time was that you essentially had a tiny handful of people controlling it, so instead of ever thinking, "I should change how I flag", folks just blamed the mods for their stupidity.

M'vy

@diagprov oooh I kinda forgot that name Ninefingers .

Shog9

...But, a count does the same thing with much less complexity.

Iszi

@Shog9 On that subject, I've been meaning to do a Meta.SE Q but haven't gotten around to searching for duplicates. Wonder if you happen to know whether this has been covered already. feature-request Only allow validation of flags by users currently in-room. (Not saying they need to be in the room when the flag was raised, but they at least need to come to it - upon which they'll theoretically take some time to gather context - before confirming the flag.)

Shog9

3:35 PM

145

Q: Add escalation system to chat flags

The offensive/spam flags in chat are shown to every moderator from a parent site (on chat.stackexchange.com that is every SE 2.0 moderator, more than 200 right now) and 10k chat users as well. This is potentially far more users than a flag on an SE site itself is shown to. I don't think it is n...

feature-request chat flags

See also linked sidebar

diagprov

@Shog9 and also took the internet points part of flag weight too seriously. After all nobody else could see it and unless you got to 0% it didn't really change much.

Mark Buffalo

@kalina I can totally understand how you were offended by that... I didn't mean it that way. I was just trying to help diffuse the situation and help him understand that we get you, and we like you... I should've chosen my words better.

Iszi

@Shog9 Yeah, I remember some discussion about an escalation process. Wasn't sure if it was quite distinct enough or not.

Shog9

@Iszi In particular,

16

A: Flags in chat are defective by design

I've been thinking about this issue for several weeks now, and I recently got my hands on 120 days worth of actual chat flag data. The data covered all cases where at least two people found a message flag-worthy (including the original flagger) and at least one person thought the flag was not val...

tl;dr: folks in the room already have a pretty good jump on flags if they're active. Restricting outsiders would mostly just slow things down and potentially allow cliques to shield behavior that's actually harmful from oversight.

SmokeDispenser

Thank you for your help, I think I have enough to go on now — George Windonski 2 mins ago

Shog9

3:38 PM

Going back to that "let's make an IRC suitable for Q&A" design philosophy, this is one of those behaviors chat was actively designed to frustrate.

SmokeDispenser

sigh

diagprov

@Shog9 The cliques thing could be a problem, I get that. It might help though to have some way not to broadcast to all 10k+ and mods, though. You'll probably know better than me but I believe the original idea was that chat was small, so sending flags to all 10ks make sense as what you needed most was a fast resolution to the issue.

Iszi

@Shog9 The only change I'm suggesting at this point - different from other threads I've been in, if not all other requests - is that a person actually needs to be in the room the flag was raised in before they can respond to it. Notifications would still go out to 10k-ers and mods across the network as they do now, and anyone from those groups could still perform the same actions on the flag regardless of where they happened to be (or not be) at the time of the flag.

They'd just need to get into the room the flag's in first.

diagprov

What tends to happen with the current system is that everyone rubber necks on the drama and weights in, which probably doesn't help.

Still, I don't have a concrete suggestion as to how to fix this, maybe what @Iszi is saying might work.

Iszi

@diagprov Depending on the flagger/flagee involved, the "weighing in" very well may help. And if it wouldn't, it's likely that nothing else would have anyway. The "weighing in" process that many participate in - if done properly - is really just to make sure that all due consideration was taken into account before the flag was raised (and especially before it's acted on - though, usually, after "weighing in" is done, outsiders have already knocked it of, as it should be already but often isn't.

RoraΖ

3:44 PM

So currently mods who are in other rooms can take action on a flag in a completely separate room?

M'vy

@RoraΖ I can currently validate flags from other rooms. And I'm no mod.

RoraΖ

Right mods and 10kers

M'vy

I guess it's not automatic and needs co-validations to truly get appied

RoraΖ

Can you ban people from other rooms?

Iszi

@RoraΖ Not directly through flag responses.

M'vy

3:46 PM

If flag is valid you get a 30 min suspension

RoraΖ

And if it's a mod then it's instant?

Iszi

The flag response is a simple "valid/not valid" vote.

M'vy

and "not sure"

Iszi

And the system has processes and algorithms in place for weighing and handling the response. Flags that reach the confirmation threshold result in post deletion, at least. I'm not sure if it's an immediate 30 minute suspension at the same time or not - that might require a certain rate of confirmed flags against the same user.

Xander

@RoraΖ Yes. Mod validations are binding.

Iszi

3:47 PM

@M'vy Yeah, I couldn't remember the verbiage for that. And, for the purpose of the current discussion, didn't really think it mattered.

Ohnana

what do you think about giving someone a change to self-censor before the validation process?

Xander

@RoraΖ We get a little warning that reminds us of that fact.

Ohnana

aka "hey you got flagged, do you want to remove it?"

Iszi

@Ohnana Arguably, that would just give them a chance to hide it.

diagprov

@Iszi I can't help but feel sometimes it is too many cooks

Iszi

3:49 PM

i.e.: Maybe it was something that really warrants very harsh action, and the room needs someone outside (due to inactivity of local mods or whatever) to come take care of the (ab)user.

diagprov

but I can't see flags any more so :)

Ohnana

@Iszi yes, but it's removed and gone. this solves the problem

you could also have self-deletions notify a local mod or room-owner

Iszi

@diagprov Well, hopefully at least they're reasonable and responsible cooks. That's what the limitation to 10k and mods is supposed to produce.

Ohnana

so if it's a "whoops too far" they can be like "yo, don't do that"

and if it's a "WHOA TOO FAR" they can pull the user aside

Iszi

@Ohnana The purpose of a flag, when properly used, is to alert outside mods/room owners because the locals aren't available and immediate action is needed.

diagprov

3:52 PM

@Iszi Yeah but there's so many mods and 10ks now. If you think 3 pro-tem mods per site, x hundred sites now. I know they're not all online at the same time but still.

RoraΖ

@Xander That makes sense. Someone jokingly flagged one of my messages. And a mod from a completely different room 30m banned me before coming into the DMZ.

Iszi

@RoraΖ You mean they came in after they validated the flag? Dicks.

RoraΖ

@Iszi yep

Xander

@RoraΖ Yeah, I don't ever validate flag (unless it's explicitly clear in the text as to why it was flagged) without visiting the room first to get a handle on the context.

Shog9

a system for escalation is nice for gently reminding folks to think a bit about what they're typing, but tedious in the case of someone who is actively trying to rile folks up / just doesn't care.

Ohnana

3:53 PM

@Iszi however reality does not follow

RoraΖ

@RoryAlsop was nice enough to figure out how to fix it

Shog9

The kick-mute feature was designed with the former in mind, flags are helpful for the latter. Perhaps adding a "kick" option to the flag UI would allow for more nuance here...

Iszi

@Shog9 This is a bit different from escalation though. Like I said, the same people will still be just as capable of acting on the flag as they are now. They would just have one more step, which will hopefully bring along an appropriate amount of due consideration, before they do.

Xander

@Shog9 Yeah, I'd like the ability to (optionally) validate and flag and delete the message without kick-banning.

Mark Buffalo

@Ohnana I do this all the time

and I ask if the room is offended before validating the flag

Ohnana

3:55 PM

or have a strikes policy: first time you get booted for a short time, second you get booted for longer, third is, well, you cannot into chat

Shog9

@Ohnana that's what I mean by "escalation"

that's how kicks work, but not how flags work

Iszi

@Shog9 I wouldn't go with adding. Maybe change the verbiage in the current UI to "kick/don't kick/abstain" or something similar, but without changing the functionality.

Shog9

'cause if you got someone who decides to (for example) spam every room they can find with a link to their project, or thinks posting racist cartoons is the best way to fight the great culture war or whatever... A one-minute timeout just lets them queue up more.

Might be useful to just have more types of flags too, I suppose

Iszi

@Shog9 Works for Q/A. But of course that's a horse of a different color.

Shog9

o Annoying others
o Rude
o Spam or blatantly offensive

Transcript for