@YetAnotherRandomUser As other people have pointed out here, the fact is that many people in this industry consider Gibson to be a snake oil salesman. If you want to learn about infosec, and genuinely want to learn, please forget about GRC.

To be quite honest, I didn't even know people still listened to him. I thought he was forgotten about in the early 2000s. It's a little disturbing to think that he still has a following, however small it may be.

@forest now I feel old ;p

(not as old as Rory but old)

@JourneymanGeek Just remember, we are currently closer to the year 2040 than the year 1990.

ugh 2040 :(

this neighbourhood's probably going to be surrounded by rich people by then

i wonder why stackexchange doesn't have an irc channel

using this in-browser crap is so silly

@YetAnotherRandomUser If you want, I'm happy to look at some specific, recent examples on GRC and point out if they have issues and what they are.

Only on pages without images though. I'm going to use lynx so my eyes don't bleed.

@forest it did once

but there's a bunch of things irc currently dosen't do

like persistance if you log out and replies

There are irc bridges for chat tho - not counting the one that someone started and never finished right after SE chat was created

(Ah, and now thinking about IRC I'm stuck half-way between using almost no punctuation and capitalization, and maintaining proper English).

But persistence is absolutely possible with IRC. That's what ZNC is for.

Do any IRC bridges exist currently? To this chat?

@JourneymanGeek Also, XMPP at least supports a lot of that, and IRC to XMPP bridges are trivial.

@forest you would need to run your own methinks

Own what, IRC to chat bridge? Unfortunately I don't have the time nor motivation to study the API that the chat here uses (if it even has a real API).

Not really no

Oh well

oh you wouldn't need to write it

there's supposedly a pre-existing one

and MANY bot frameworks that might work

I can't remember who was using it tho

Jeremy (ex SE dev) has one but it was last updated 4 years ago

Yeah I think the pre-existing one was dropped.

@JourneymanGeek oi!

@forest I am unsure how i missed irc. I think I was always in companies with messaging systems so never had to. Now when I actually have to use it, I hate it. And systems that allow an irc bridge in make things very confusing

And this is from someone who prefers command line in almost every situation

I just couldn't see what people liked about it

I like it because of its simplicity (the protocol is trivial), and the fact that there are already quite a few major networks with good content.

That is the other bit I couldn't get - irc as a network?

@RoryAlsop you could have linked servers

most of the big networks did that

so you could connect to the nearest one, or have some flavour of redundancy

@forest IRC v3's supposed to have presistance...

though I personally think that matrix is a much more interesting/modern protocol

That said, grand unified chat is a dream that's unlikely to be fullfilled

@RoryAlsop new job uses IRC internally? 0_0

Oh well, could be worse

my last job used Whatsapp for internal communication.

I think I only ever saw chats full of skript kiddies, and never anything useful

oh it was great for small community chats

My favourite so far has to be SE chat, closely followed by lotus sametime

also, bloody just worked once you beat it into working

@RoryAlsop I'm surprised SE never tried to sell an enterprise chat product

but that ship kinda sailed

Aye.

@RoryAlsop There are a lot of IRC servers (especially smaller ones) that are free of script kiddies.

@JourneymanGeek IRC v3 is vaporware :P

@forest matrix isn't

its a lovely ecosystem but unlikely to get much traction ;p

I dunno, I see a lot of people using Matrix bridges on IRC with their damn [m] attached to their name. They tend to be the more ignorant types who have never used IRC or chat networks so I try to ignore Matrix users.

lol

@forest its easy to plug into damned near anything.

and heh

If I'm going to do IRC, I'm going to use a proper IRC client

I think I still have a bouncer running on my old server, and was using hexchat

The only proper client is irssi. BitchX is also acceptable.

lol

I also run windows most of the time ;)

BitchX was one I did use back then. It worked, but yeah, just too many annoyances with irc. Most of my employers have only used it for some internal tech support stuff

@JourneymanGeek omg what?

@TomK. it was a terrible terrible place

sure sounds like it

Was a small, dodgy private school that kept renting any space that came up

so I was handling 3 buildings...

and my predesssor intentionally withheld information

haha, that sure is easy to organize over whatsapp :D

I ended up documenting the entire place.

@TomK. oh that didn't work to badly cause the place was a revolving door of employees ;p

yeah.. I am doing something kinda similar

but I hate whatsapp

I keep it installed on my old phone for mom

building an ISMS for a small site of a company, there's really no documentation

so I had to draw up all the plans and everything, and now all the admins use my plans for the network topology and the IT infrastructure

oh god

the only way to document the network there is to rip it all out and redo it.

My quitting docs literally has a line saying "if the network goes out in the teacher's area, go find the switch under the pile of papers under <teacher's> desk"

and when I told them that it would be really good (=needed) if they just documented their own shit, and my plans were purposefully abstracted on some level and leave out parts of the infrastructure, they just said "yeah .. sure..."

heh

and "if the Director's PA's printer won't print, check the little switch on the director's PC is on. Someone keeps turning it off"

(that guy's why I quit so... ;p )

lol

wow, totally missed pwn2own

I've seen a lot of people on these high ranked CTF teams do this

just posting hex strings

@TomK. That's a pre-commitment hash.

You basically say stuff like "I found a 0day in foo when you bar and blah blah" and then hash it.

That way they can release the plaintext sometime later and prove that they knew the plaintext (i.e. they wrote it) even before releasing it. It's like writing down your prediction for the end of a movie and not showing anyone till the end of the movie if you're right.

oh okay

84ED3F2D4A692B954458555468E9C6DF43AB6D475187C08784E7E614CA752A02

;)

5aelo presented a 0day in Safari, niklasb was another contender at pwn2own. hence the cupertino "joke"

the tension is unbearable @forest

haha

Say, I'm not sure how enthousiastic you people are about crypto, but how well do you know Dan Bernstein (cry.p.to) and Tanja Lange (hyperelliptic.org)? Also, what do you think about them and their work?

I only know bernstein and only from en.wikipedia.org/wiki/Bernstein_v._United_States and this was undoubtedly a huge deal

Don't know much about Lange, but Bernstein is a very good cryptographer (I've read most of his papers for Salsa20/ChaCha/x25519/etc).

@TomK. That paper he wanted to post "snuffle" became the Salsa core :D

I mean to be fair, DJB does have a bit of a monoculture cult following, but his crypto is always a safe pick.

@Discretelizard if you want the folks who are really really enthusiastic about crypto... Cryptography Stack Exchange is the place to go

@forest uh, didn't know

@RoryAlsop Yes, of course. I was just curious how much infosec knew them. Bernstein is decently active on the applied stuff at least.

@TomK. What I like about that is that he apparently managed to convince the judge that algorithms aren't anything magical or something that must be executed on a computer was an intersting way to go with things.

@forest If you want to see Lange, I think the Chaos Computer Club talks of "The year in crypto" and other talks on those conferences by her (usually jointly with Bernstein) are a worthwhile to watch. She's a pretty good lecturer in general (took 2 courses from her)

I don't know Bernstein as well as Lange, but I do know he is more famous and most 'famous' publications of Lange are jointly with Bernstein. Although Lange seems to be more involved in leading a post quantum crypto initiative.

Speaking of which. Want to know more about the next big adversary? (assuming the NSA isn't miles ahead of the competition) Come join the private beta of Quantum Computing:

Although I must say that rather few crypto or infosec would be on-topic on the site, but hey, at least this might make it easier to 'know your enemy'

is it considered serial downvoting if downvote all answers on a question? :s

We need more downvoting

@TomK. No, that's called quality control. ;-) It's also a pity if you won't give an answer yourselves. Or can't, of course.

If you do answer, it is also known as eliminating the competition ;-)

I did

@TomK. Good.

but the question isn't receiving much attention, so thats kinda good

@TomK. It is basically a bad idea magnet?

yeah sometimes we had that problem, as forest pointed out earlier, especially with hot network questions that seem easy to answer

and sometimes you can tell if a question will take off, sometimes you cant

Does telling mods to lock help?

you can't just lock a question, because the answers are bad, if the question itself is legit

^ that

(regardless of the StackExchange site)

comments and flags are the way. we discussed that already and the "regulars" know it.

Oh sorry, I meant protecting. All that confusing SE terminology

the criterion for protect varies from site to site, but HNQs tend to get protected from what I've seen on multiple sites.

and some questions which get a bunch of newbies posting offtopic or irrelevant answers to a question, at least over on Ask Ubuntu where I'm a mod.

normally though, protecting a question doesn't really do much except prevent newly-registered and unregistered users from posting. (It's not really a viable Quality Control method)

@ThomasWard but would you want to protect a question, that has only bad answers or x bad ones with 50+ votes, and one good one with 10+ votes?

ah yeah, thats true

@TomK. the answer to your question is "It Depends on the Situation and Circumstances"

there's a lot of examples of what you've just said on various sites, but for whatever reason (historical purposes, or age, etc.) that we don't just 'delete' things.

locking doesn't help really, and tends to be avoided unless it's absolutely necessary

protect just shields against new/unregistered users from posting junk really

@ThomasWard Yeah, but mods on Computer Science appear a bit overcautious here. But I think that a recent debacle with the HNQ might call for new policy. I mean, there wasn't a massive traffic of posts that would have been prevented by locking, but barely any of those were useful in any form. In fact, there was a simple clear answer and a broad speculative one. That's really enough for something so trivial. Hmm, perhaps I should take this to meta.

but again, I'm not quoting how Info Sec's site operates, this is "in general"

@Discretelizard mods vary site to site ;)

Idea: locking also applies for voting: at least 10 rep onsite required to vote.

I personally think thats good, because it also discourages experienced users to vote and give better answers

@Discretelizard locking locks votes for everyone

or do you mean protect?

@ThomasWard Yes, once agian I mean protect. Thanks

@Arminius btw, did you get any response from CTFTime?

Doesn't seem like a silly idea. Not letting people with basically zero site interaction suddenly take over major quality control

@Discretelizard voting requires 15 rep for upvotes already. downvote requires 125 rep.

@TomK. No

@ThomasWard But not onsite

I also pinged Lucas Kauffman

This is very very important when dealing with HNQ

@Arminius ah, I remember now, you told me already. nvm then

I don't see why when we say some people shouldn't answer, we can't also say they shouldn't vote

They don't seem very responsive

I'm not sure though if you get pinged, if you haven't been to the chat for x days

In fact, the idea is so simple that it's probably suggested before. Time for meta.

permit me to say "Agree to Disagree", @Discretelizard, because I don't think anyone's really going to be gaming the system that way, not without someone like me (a moderator) or The Great and Powerful Shog finding the serial gaming of the system and unleashing hell upon those individuals.

isn't there some rule?

a pinging rule

@TomK. I forget the specifics, but yes, they have to have been in here 'recently' to @ ping them

i think it's 7 days but don't quote me on it

@ThomasWard yeah, I remember something like that

@JourneymanGeek probably knows

@ThomasWard Very well. But please have a look at 'exhibit A':

I can almost be certain that at least 200 of those votes are by users only interacting with CS via HNQ. Is this normal?

For a question where most 'regulars' agree that is 'probably harmless', but awfully trivial?

But, it is of course your right to simply disagree. I'm not necessarily looking for an argument.

Oh and, that another user suddenly gets promoted to #152 rep all-time rank, while having exactly one contribution: the accepted answer to this question. I hope you at least see where I'm coming from: left unchecked, the HNQ can completely undermine any quality control present in the reputation system.

@Discretelizard this is why moderators exist, but if you feel so strongly about it I suggest you post about this to the StackExchange global Meta and get global input on your thoughts.

also

the reputation system wasn't designed with Quality Control in mind

it was never designed that way to begin with.

ever

rep != quality control gauge.

@ThomasWard Yeah, that's what I said. Sorry for bringing off-topic stuff here

Ok. The votes on questions surely are right? And are the privileges awarded to high rep users not tools for quality control?

@Discretelizard "privileges awarded to high rep users" - you're not going to get the powerful privileges for stuff like that with just HNQ posts.

you'll have to be more specific what you mean by privileges awarded

@ThomasWard Close votes, accessing queues and the like

don't forget the rep cap every day (which I hit two days in a row for my answer on a recent HNQ over on Ask Ubuntu... not that rep matters to a diamond moderator)

@Discretelizard Users can get banned from the review queue by moderators. "The like" is broad. again, specifics.

people who abuse editing powers can also get edit-banned by moderators.

@ThomasWard Rep cap? What's that. I come from a site where most good answers get 3 to 4 upvotes.

and peopel who really abuse the system get suspended.

damn, don't we have a good "How does RSA work?" duplicate target?

@Discretelizard there's a reputation cap of how much rep someone can gain in a day

200 rep.

excluding rep gained by bounties being awarded to an individual

@ThomasWard Perhaps I should have mentioned that I was joking about my ignorance of rep caps, because on my site, I doubt they have been reached in the last 3 years. Excluding HNQ, of course

Hmm. Perhaps a few times

@Discretelizard i've been staring at a command line all day. sue me.

point still stands. rep cap is hard to reach, and even if you post to HNQ, rep cap applies even moreso there, even if I get 80 votes in a day I don't get more than 200 for the day from those votes, and the votes don't 'spill over' to the next day's rep cap either, so if I got 80 votes in a day, I've gotten the rep from 20 votes. Again, gaming the system this way just to get rep to be malicious is not easy to do, not without a moderator noticing.

or the community flagging it for moderators to look at ;)

@ThomasWard Also, I'm not sure if I understand. I claimed rep is related to QC in the sense that one needs rep to effectively engage in QC, not that those with rep get great power that cannot be stopped.

@ThomasWard True, but I'm not talking about malice here, but ignorance from offsite HNQ users.

@Discretelizard explain to me then how the edit queues work. We let users propose edits while unprivileged for review by editors/mods.

thereby unprivileged (respectively) users can still contribute to QC

gaining rep is not necessary to contribute to QC, necessarily

so I'm not sure your claim holds up.

I mean, in the end, the event wasn't a problem. (although I'm glad its over) It's like watching someone eat 30 huge sausages and then puking on the street. You think WHY, but it doesn't really hurt anyone.

shrugs

I'm a proponent of restricting things, but I've had enough talks with Shog to know why things are the way they are.

i agree HNQ sometimes brings people who might be ignorant

but that's not anything controllable

that's every social construct ever, and a flaw inherent in it.

@ThomasWard What claim? I really don't understand what you're getting at. Did I claim that unless one has rep, engaging in QC is impossible? Where?

i'll let you reread your exact message

"I claimed rep is related to QC in the sense that one needs rep to effectively engage in QC"

@ThomasWard effectively engage in QC =/= can't do it

consider

Directly doing edits sure a lot easier than waiting for the queue

Is like 3 days quicker on cs

before I had my edit privs, I did a ton of edits. MOst were approved fairly quickly, and to me I considered it an effective contribution to QC

@Discretelizard but then you have to gauge the size of the community and number of reviewers

SO, Ask Ubuntu, Super User, Unix and Linux, etc. have large numbers of people reviewing the queues actively.

@ThomasWard Me too, although there were basically 1 and half reviewers before I got the rep to review

specialty niche sites are a little more... interesting... with the activity levels.

@ThomasWard Yeah, niche sites like CS

so then your claim should be augmented to be this:

> I claimed rep is related to QC in the sense that one needs rep to effectively engage in QC on smaller and/or newer niche sites.

wait, is this the MetaSE chat? "The meta level"

@ThomasWard Yes, I agree with that. Although I do wonder whether you would classify cs as niche or small. I'd call it mostly misunderstood.

But things are better now, as there are 2 and a half reviewers now. (unless I have better things to do) Edit queue is still full on red, though.

@TomK. Yes, everywhere I come becomes meta

Ah well. All in all, while I do think the SE system is rather weird wrt to the effort to be able to do and approve edits (it gets to the point that some queues at times look more like beta site queues) on Computer Science and other stuff, I like the customs and manners of the small but active community of answerers.

I mean, interesting questions to answer is what I come here for. And helping lost or users that are helped better by hints is ok to do at times.

Let me leave you with this: "At least its better than Math.se" --Yuval. cs.meta.stackexchange.com/questions/1151/…

In case you haven't read it yet: codeblog.jonskeet.uk/2018/03/17/stack-overflow-culture

From my experience the culture on SO can be a whole lot different from the culture on other SE sites though

Getting back from SO to SecSE feels like returning from war

^this

well, I never thought SO was so bad

was more of a customer than an asker though

good read by skeet nevertheless

unrelated: snowstorm knocked out power at work and we all got to go home early :/