The DMZ - 2018-04-27

« first day (2689 days earlier) ← previous day next day → last day (2192 days later) »

2:42 AM

> especially newer coders, women, people of color, and others in marginalized groups.

lmao what

I mean new coders I can understand...

But when's the last time you said "Sure I can help you, your problem is.... Wait a second, you're black aren't you?? Downvoted!"

I can honestly say not once have I ever been hostile to a black person or woman here because of that fact. That's just a silly claim.

Hell, even if I was plain old racist, 99% of the time, I have no clue what anyone's gender or skin color is here unless their name is "blackcodergirl99" or some shit.

> especially the idea that women and people of color felt particularly unwelcome

Maybe they just have a victim complex and are actually just not very good at asking quality questions, and decide to externalize the blame to everyone else. I mean seriously, keep the fscking politics out of a Q&A site.

Journeyman Geek

@forest there was a tweet storm

and top people were involved

and much drama

Ahaha

Journeyman Geek

and frankly, I don't care about your gender outside proper pronoun use.

(She right?)

Sounds fun. I hope there was a good amount of resistance among staff from turning a professional site into an emotion-laden political sphere.

Journeyman Geek

Oh

we can do better.

2:50 AM

Hell I don't even care about that. I just say "they" or something similar.

Journeyman Geek

But its not a race/gender thing

I actually think a more civil SE goes back to the "low noise" ethos of SE

Yeah, I mean I understand new people not understanding and getting overly scolded, but why turn that into a race/gender issue?

Journeyman Geek

Cause no one gets excited about people who don't know how to ask good questions.

Heh, true

Way to co-opt a valid issue with gender politics.

Journeyman Geek

Now what tees me off is how folks complain about how we remove thanks and such

I was new once.

2:52 AM

yeah :/

Journeyman Geek

I spent a while getting to know the place.

(and now? > 10 k on 2 sites ;p)

Yep, and was I. And if you really want to say thanks, put it in a comment that has more than just that! "Thanks, I didn't realize that so-and-so because I was under the impression that blah blah'

But "thanks in advance", it's not like we downvote people for that, we just edit it out.

Journeyman Geek

you upvote it. Say nice things. Don't get your $gender_specific_appropriate_underoos in a bunch when that comment gets deleted.

heh

I mean really it's beating a dead horse at this point, but honestly, when was the last time someone said "I don't answer questions from $racial_slur" or "Go back to the kitchen, stop trying to learn about $language"?

Journeyman Geek

none

2:56 AM

Last time I saw anything like that was on 4chan.

Journeyman Geek

actually the only accusations of bias I've heard was...

"people upvote JMG cause his ava is adorable"

heh

Journeyman Geek

and see

I wonder if they'll take the blog post down with all the criticism.

Journeyman Geek

that's why I've love specific examples

naw, never happens

2:58 AM

Welp

Journeyman Geek

and tbh, there's some evidence of this

I don't particularly like how the twitter folk handled it

but Jon's talked about that

and I kinda trust our CMs

Of what?

Journeyman Geek

oh how users have implict gender bias.

One moment!

jericson.github.io/tag/race_to_1k.html

Last study I saw talking about that "bias" was that women are marginalized because... wait for it... people use the wrong words! People use words that are too "technical" and which don't have enough emotion, like "I feel" statements! And I'm serious too, not joking.

> It took me some time to recognize that they bugged me because they were so condescending.

That... has nothing to do with their gender.

Journeyman Geek

percieved gender.

3:03 AM

Or that.

Journeyman Geek

I was half joking the solution is to get rid of usernames and avatars

I mean people really don't take the time to look at someone's profile and try to guess their gender. They just look at the question and see if it's good or bad.

heh

Journeyman Geek

well, apparently people don't?

I'm sure a few people respond favourably to posts on SU and MSE cause its me

(it bothers me a little.)

Oh sure but that's just seeing a recognizable name, not trying to figure out your gender.

Journeyman Geek

Would an obviously female, indian name get a different response?

I donno. I might try it the next time I ask a question.

3:06 AM

Nope, though sometimes Indian names often come with really bad English and grammar, so people may be more perceptive of such things (which is an issue for anyone with poor English, not just Indians).

Unless your name is "1337gamerguuurlcoder" or some crap, no one will treat you differently (though they'll treat you like any new user).

Journeyman Geek

My english and spelling is terrible

I hadn't noticed.

Journeyman Geek

in fact, I need to be mindful not to use a few common errors I have a sad tendency to make

I mix up my its and it's

lots of use of spellcheck, and going over what I write twice.

Well by terrible I mean like, really basic mistakes, not just mixing up its and it's (which even native speakers, at least in America, do because American education). Or how many people really know the difference between affect and effect?

Journeyman Geek

affect - to do something to. effect what happens when something is done to. ;)

3:09 AM

Better than most Americans :P

Journeyman Geek

Well, if my core question is sound, I'm sure I can intentionally do the needful.

Personally, I don't mind a slightly elitist community. It gets people who don't care about good questions and doing their research to screw off, and it gets people who genuinely care about it to actually take the time to help the community.

I mean, we were all new once, but clearly something differentiates us from people who come in and ask "Hey can I get hacked if I use the internet?" or "Tell me how to do floating point operations in C, and no I won't Google it first".

Wikipedia is the same way, if even more elitist.

And look what it's become... one of the greatest and most popular collections of knowledge in the world! Exactly what SE/SO strive to be, in QA format!

Journeyman Geek

3:23 AM

So, that's a thing

and funny I have said it twice....

I think my ideal stack is agressively meritocratic

but "heart" there isn't lowering the bar. Its pulling others up.

mmhm

I think meritocracy is the main reason why software development works so well (as opposed to, say, politics). Meritocracy is not incompatible with teaching and allowing others to have their own merit (that's what SE is for, after all).

Journeyman Geek

"We need to change things to better fit folks new to SE" vs "How do we help new users with their posts?"

But that involves more of an investment than "I need a quick answer now"

Hopefully this is just a PR stunt to make Stack Exchange Inc's shareholders happy.

Journeyman Geek

hmm

naw

Its a thing that happens every few years

ah

And I assume it just dies down and people forget about it?

Journeyman Geek

3:28 AM

Kicking off the Summer of Love

Joel Spolsky on July 20, 2012

It’s summer here at StackHQ. Have a flower!

You’re welcome. Now on to some serious work. Can we talk about cultural anthropology for a minute? I’d like to talk about what happens when a community (online or off) gets to be about… oh, three or four years old.

Every community starts out needing to recruit members, so they tend to be very friendly to newcomers.

After a few years, an insider group of old-timers forms. They get to know each other. They know the rules. They know the history and the legends of the community. And it’s only natural to get little bit irritated when newbies show up who don’t know the rules. …

heh

Journeyman Geek

does this sound familiar?

I guess the problem with that is its very "Us vs Them"

I prefer "this is a thing. We need to be better "

mmhm

At least SE sites are community-controlled (primarily), so it's not like the mods here are going to forcibly re-open crap like security.stackexchange.com/questions/184540/…

Journeyman Geek

Oh, that's kind of one of the things SE did right.

and typically we have very little CM intervention unless things go horribly wrong.

For sure, it allows meritocracy to flourish.

Since it, by very definition, is at odds with discrimination.

Journeyman Geek

3:43 AM

Yup

but too many people assume equal opportunity involves lowering the bar.

I'd rather people reach out. We'll pull them up ;)

and quite honestly - there's a ton of very smart people who happen to be female I have tons of respect for.

Same

Journeyman Geek

SF's a tough community, and I've learnt a lot from hanging out around JennyD for example.

One of the best researchers in hardware security (of rootkit fame) is female :P

Journeyman Geek

... Joanna something right?

I can't spell her last name

(though not an extremely good example since she has a very... extreme personality, similar to Theo de Raddt or Brad Spengler)

Journeyman Geek

3:46 AM

Lots of smart people do ;p

Rutkowska.

Journeyman Geek

Yup!

*Rootkitska

Journeyman Geek

rofl

:P

Journeyman Geek

3:46 AM

If only

(though I disagree with her wrt Qubes, since it relies so much on Xen)

Journeyman Geek

ah

security or maintainability?

security

Xen is pretty crappy, but she treats it as invincible, to the point of running everything as root equivalent because "lol nothing can break Xen"

Journeyman Geek

ah ok ;p

ah lol

No one's perfect?

I had a field day last several times a Xen bug was only exploitable on Qubes because she decided to run it all as NOPASSWD sudo.

Journeyman Geek

3:49 AM

....

(it still runs as NOPASSWD sudo)

Journeyman Geek

I'm not exactly the sharpest blade in the drawer but... I know what's a terrible idea

mmhm

The idea is that, even if it's root, it can't break out of the guest...

But that's assuming Xen is flawless.

Journeyman Geek

unless it can

Truth is, there are plenty of bugs that can only be exploited by a privileged guest.

The core idea behind Qubes is really clever. Great graphical separation, the window border color idea is brilliant, the anti-evil maid thing (SRTM measured boot) is awesome. It's just the idea of relying entirely on Xen that I don't like.

3 hours later…

7:17 AM

@forest I'm sorry, but this is just BS

Well, it's not safe against FWE tricks

women have been complaining about being treated very differently online for years and men have always responded like this

I mean.. read the top100 bash.org quotes and this is exactly how women have been treated in every online community for the last 30 years

gamergate wasn't a coincidence and not an isolated case..

Nah.

The problem is video games.

Maybe to opinion based so i won't ask it on the main security.SE, but why did so many people/question present SQL injection as the main threat while they are so easy to avoid?

@Kepotx Did you come across security.stackexchange.com/questions/128412/…

7:37 AM

well, I understand that some companies, or even more some particular/charitative organization don't mind security, but take the third most upvoted question, security.stackexchange.com/questions/211/…

wouldn't someone making effort to know the best way to hash and salt passwords also make their own application protected against SQL injection?

No.

It's most likely that :
1. someone doesn't even know the notion of hashing
2. learnt to do a MD5 and haven't updated his/her knowledge since

Also, legacy systems sometimes doesn't work well with proper hashing

I once had to migrate one db from MySQL to PostgreSQL

Passwords were encrypted (not even a proper encryption), and I was going to hash them until I learnt that some legacy applications designed their authentication protocols such as hashing passwords would break them

Im a junior developper (still doing studies in part-time training) so i don't have many experience, but are systems with protected password but vulnerable to SQL injection and/or system with vulnerable password but with protection against sql injection common?

I'm sure they are

I will speak about PHP, since it's the language I know the most, and it's one of the most used on the Internet

I mean, the whole "A chain is only as strong as its weakest link" also apply to computer security, so I found odd to improve security only on some parts of the application

The default lib to connect mysql had an horrible design, which led people to building their queries by concatening strings themselves

It got replaced with PDO, so people learnt to do it "the right way", but even with PDO, some people are still doing it wrong

Proper password hashing function were not in PHP before 5.5

Which came in 2013

A lot of sites are older than that, and weren't updated since

A lot of developers learnt PHP and never updated their knowledge

7:50 AM

@BenoitEsnard haven't use PHP since long time but isn't it as simple as PDO->prepare("select * from table")?

isn't it all a combination of laziness, hubris and "crypto is hard"?

It is.

@Kepotx it's hard to improve security everywhere at once, so you must fix problems one at a time

maybe it's because Im too young to see big improvoment in some languages and too junior to see that some developpers don't/can't adapt to knew practices

Are you a student?

student but also working on a company

7:55 AM

I guess your co-workers are either young, or particularly skilled then

Or maybe I just had bad experiences :)

I would say both, but as we are a small company doing our own software and not a big company doing stuff for random customer, we try to have a good quality

2 hours later…

9:36 AM

someone here that has a metasploit instance running right now?

@forest The horse you are beating is so dead, it was even killed in the blog post you criticise: "We are one of the only large sites where it’s practically impossible to find a single slur – our community takes them down in minutes."

tagging a javascript question as java in StackOverflow beeing the ultimate slur

but it's not about the slurs.. it's about other users thinking women and people of color are incompetent. If you ask something on SO and you have username/profile pic that identifies you as e.g. a female, people will explain things to you very differently

and if you give answers as a female people will take them less seriously

or look at the questions at the workplace / academia towards sexual harassment

these are horrible

and people lost their shit

someone asked on mathematics SE if anyone had an idea what kind of pairs were a good real life example other than heterosexual couples for some seminar

or this question:
https://academia.stackexchange.com/questions/98176/how-to-avoid-being-falsely-accused-of-harassment-by-a-student

sorry.. I'll stop now with the ranting.. SE is definitely far from perfect or free from bias against women or people of color

@TomK. I agree that it's not about slurs, it's about something else.

Did not mean to suggest there is no problem. The point is that the absence of slurs is not proof of absence of problems.

9:51 AM

agreed

emphasis in the blog post should be on "find a single..". yeah, well.. people still post them

but even if there weren't ever any slurs posted, that still doesn't mean there was no problem

2 hours later…

12:03 PM

to get back to information security: is a question "Is system/software X (still) vulnerable to Y" on topic? I only found this on meta and this doesn't really touch on the topic, although it includes this sentence: "They are not off topic as such"

I am researching now for quite a bit if NTLMv2 is vulnerable to certain attacks and am still unsure

@TomK. I don't think they are off topic. Might be duplicates if there is an answer saying "X was never vulnerable to Y" or "X is no longer vulnerable Y".

that's the thing, I know there have been patches in the past, but I still see posts about successful attacks

alright, I'll research for a little longer and then ask a question citing you @Anders :P

12:42 PM

I'm at work right now

Electricity has been cut for security reasons, since some people are working on it right now

(the whole street has been cut)

Help me flood the whole street with electricity so I can go back to work

user image

the ultimate form of flooding with electricity

@Arminius Just saw this, have you gotten a hold of anybody yet? I know they are in the process of hiring a security director, so hopefully that will improve pretty soon. In the meantime let me know if you want me to help push this inward...

2 hours later…

2:55 PM

Shouldn't this have some sort of reference to "product recommendations are off-topic"?

Journeyman Geek

technically security.stackexchange.com/help/dont-ask

also ugh $deity, I hate the multipage FAQ

As far as I know, there used to be a badge when someone read all FAQ pages

wow, I clicked on both links 3 times now until I noticed there was a difference

It was removed though

Journeyman Geek

@BenoitEsnard there still is

3:05 PM

Wut, is it sill active?

3:18 PM

you can't earn it anymore, but still here for historical reason

security.stackexchange.com/help/badges/80/analytical

Oh, that's what I meant.

the last one was earned more than 4 years ago

funny thing, badges are the same between different SE, so somes like worldbuilding where created after the badge retirement

worldbuilding.stackexchange.com/help/badges/77/analytical

so the badge is here, but nobody have it and nobody will never earn it

Haha, quite fun

3:36 PM

@TomK. If you folks are going to keep the "flood with electricity" meme up, it needs to be documented here 😊.

We agreed to wait before inserting the meme in the wiki, since it's too new yet

oh, I missed that.

(I miss a lot, including what the meme actually means)

There's only one person who knows what it all means, and they're probably high right now

@AviD Thanks, but I think after so many inquiries and a meta posts they seem aware of it. It's just that I don't have been given a timeframe when it will be resolved or a comment on why it may take longer

4:17 PM

Critical 0-day on Firefox latest version : vuln.shhnjk.com/…

be safe

5:05 PM

Didn't work for me

« first day (2689 days earlier) ← previous day next day → last day (2192 days later) »

Transcript for

Apr '1827

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile