The DMZ

@forest It is

But only on parr

Whoops, nevermind, I misread

8:06 AM

@forest alright, now I'm fully awake. I mean sure, you can always say that some attacks are kinda obvious once you read the paper. But somebody had to write paper first. This Rowhammer attacks is pretty sophisticated and afaik is the first one that is done over a network.

I didn't read the paper, but as the bits must be on the border, doesn't that limit a lot the attack?

also, don't know how easy to di it is, but isn't filling border bits with useless data, so sensitive data is in the center, be enough to prevent this?

Anonymous

I wish we got more Cisco questions here :(

Anonymous

8:21 AM

Security-related ones ^

8:50 AM

are there non-security-related Cisco questions? :x

Anonymous

Well yes, asking how to configure routing isn't related is it? :P

Anonymous

Are we both misinterpreting what one another is saying? lol

@Kepotx as far as I understand the matter, none of the methods that are currently employed are enough to mitigate Throwhammer

@JoshJones no, I'm just joking because of all the horrible Cisco related vulnerabilities that keep on being published :s

Anonymous

Okay so it was me misinterpreting lol

Anonymous

Umm yeah. A lot of remote code execution recently.

Anonymous

8:59 AM

On almost all devices...

Anonymous

Im not entirely sure what the hell is happening.

Cisco devs not learning after mistakes are revealed, that's what's happening

"Hm, where should I store this key? better just hardcode it into the software so it doesnt get lost!"

times... three?

Anonymous

It all kicked off ever since the NCC investigation into ASAs.

Anonymous

Then Cisco PSIRT just started "noticing" the same kinds of issues in all products.

Anonymous

Admittedly the ASA thing was unique but ever-since then fury has sparked.

9:03 AM

nah, it started before that

Anonymous

Oh. I honestly never saw that lol.

Anonymous

To be fair I've only been working a year so I wouldn't have seen 2014 or 2016 lol.

Anonymous

Not even a year actually lol, only 9 months.

it's alright to be new, just don't say stuff like "it all kicked off ..." ;)

Anonymous

Hah, well I was referencing how many advisories they've released in the past three months more than anything.

9:06 AM

also, that's just googling for one issue.. there are others

Anonymous

Yes I know there are others, lots of them lol.

Anonymous

As I said, lots and lots of remote code execution.

Anonymous

This one is quite funny to me - tools.cisco.com/security/center/content/CiscoSecurityAdvisory/…

Anonymous

I prefer Juniper kit lol.

Anonymous

Speaking of Cisco I fucking hate ASAs.

Q: Punching someone so hard that they become a duck

11:42 AM

27

I was reading 4chan's description of the exalted. In it while describing Sidereal exalted, it mentions punching someone so hard that they turn into a duck (before saying it makes more sense in context). I know White Wolf publishing has stories or story-like descriptions in almost all of their bo...

2

I posted this just for the title

Anonymous

Hhahaha

Anonymous

Imagine if it worked in real life

12:28 PM

could someone explain this to comment me: security.stackexchange.com/questions/139493/… ?

12:38 PM

E2E = end to end

End to end protocols are based on public / private keys

You need the public key before contacting someone

And WA/Signal don't force you to check your contact's public key

So an attacker could impersonate them, I guess

Anonymous

security.stackexchange.com/questions/186365/… is this massive "PLEASE NOTE" at the top of his Q something we'd endorse here?

Well, I would remove it

Anonymous

Yes that's what I am thinking

Anonymous

Seems passive-aggressive and unnecessary, plus pretty sure thats not how SE works..

Anonymous

Done.

Anonymous

12:47 PM

I've never seen anyone do that before...

1:18 PM

@BenoitEsnard that's exactly the point I was wondering about. can an attacker do that?

I can't.

WhatsApp / Facebook could.

I guess US agencies could do it too.

So it depends on your threat model

Anonymous

My favourite two words :)

US agencies?

threat model?

I can't?

It depends?

on your?

Anonymous

Haha, threat model.

1:21 PM

Benoit Esnard?

Tom K.?

Anonymous

Benoit Esnard are my second favourite two words on the basis of his humour.

hm... well am I able to check someone's public key when using Signal?

😎

I guess you can.

Anonymous

And Tom K. is my third favourite two words on the basis that he also likes the humour of Benoit Esnard. Or likes it enough to join in :)

1:22 PM

I don't have Signal atm, so I can't tell you how. I guess Google is your friend.

Anonymous

support.signal.org/hc/en-us/articles/…

Anonymous

I guess that might help?

Anonymous

"Safety number" is what they appear to call it here.

support.signal.org/hc/en-us/articles/…

oh

Anonymous

Unless I am misinterpreting again. Interactions with humans aren't my speciality :)

1:24 PM

yeah, it's the right article

Anonymous

:)

I have signal installed

Anonymous

Never used it. Honestly never even heard of it until I saw that Q ten minutes ago.

it's a bit hard to find though

Anonymous

Make a Q on UXExchange ;)

Anonymous

1:26 PM

lol

Someone said something about security & usability

Anonymous

Am I the only one who finds it really annoying when people don't use the accept button? (Not only on my own answers but in general, I don't suppose I am the only one..)

Anonymous

Even more frustrating when the user responds to the poster perhaps even upvotes it and still doesn't press accept three weeks later when nobody else has helped them. Perhaps I get angry too easily? lol

I guess some people don't even know there's an accept button

Anonymous

I guess so.. But it is a pretty big icon.

Anonymous

1:35 PM

lol.

2:13 PM

maybe you should ping him in a comment with a link to the tour page, and explain briefly the benefits of accepting answer

blog.talosintelligence.com/2018/05/VPNFilter.html

Anonymous

Kepotx as I said not just on my own answers

Anonymous

In general.

Anonymous

And I am not going to comment on every post where the user has clearly read the answer, responded waited two months and still not accepted the answer lol.

Anonymous

I think after a certain time period a moderator should be able to force an acceptance

Anonymous

2:21 PM

I think thats a good approach or even a queue for it, not that it will happn but :)

or like bounties, an automatic accept after a specific amount of time, granting less rep than manual awarding

with maybe more strict rules, like at least x upvotes, with y more upvote than the second most upvoted answer

Anonymous

I might actually make a meta post on why moderators don't have the ability to force acceptance after a certain time.

Anonymous

It seems insane to me this is an action they cannot carry out.

Anonymous

Because some people ask a question, get a very GOOD answer, the OP reads the question doesn't upvote or accept (because they don't care to do so) and then leaves the site and never comes back.

Q: Force Accepted Answers on Questions by Inactive Users

111

As a disclaimer, I must admit this may benefit me (I haven't checked), but probably not as significantly as most others. This issue is also something that has prevented me from answering questions by users with 1 rep in the past, especially if they are poorly fashioned. The Problem New users wi...

feature-request status-declined stackoverflow accepted-answer abandonment

2:28 PM

well, unlike upvote, I see accept as a subjective vote, related to the OP

Anonymous

I knew it'd exist already :)

you are not the first ones to think about this ;)

there are more posts about this on meta.se

i think this is probably the best approach

Anonymous

And I've not read it but I suppose the general consensus is - it's a good idea. But hard to implement?

Anonymous

@Kepotx I deem that to be the case with SOME questions, not with all.

@JoshJones they did auto-award for bounties. Is that that different?

Anonymous

2:32 PM

And yes Tom I like that idea. I think that is the best way of allowing such a thing to happen but it was written in '10 so I doubt it's ever going to become a thing.

well, who knows

dunno what the official stance is

Anonymous

The official stance is most likely - "It's a good idea in theory, but possibly to hard to implement and/or not worth the headache it could cause in the cases of subjective questions"

@JoshJones is there any policy about old meta question? I mean, is the debate closed forever, or can we say that after almost a decade, things have change and we could debate again?

Anonymous

I've not been on the site nearly long enough to say whether there is a policy on old meta questions.

Anonymous

What I do know is that IF I repost such a thing it will only get marked as a duplicate despite the 9-year time gap.

Anonymous

2:37 PM

At least I am fairly sure that is what will happen.

Anonymous

And yes auto-award bounties is different.

Anonymous

In-fact it is very different.

Anonymous

This conversation is starting to get a little off topic from infosec but take this question for example security.stackexchange.com/questions/150733/… (Im using my own answer because its easier to reference however there are some cases where this applies much worse and I think its important that a responder actually gets the rep they worked for...)

Anonymous

If you read that question it's a typical question on Cisco passwords (we get stuff like this all the time)

Anonymous

Now Adam has 500 rep so he clearly knows how to use the site the problem is hes not visited since Apr 1st, now before I responded the Q was basically inactive for a year and all the answers he did get where sloppy, quick and basically they should've been comments.

Anonymous

2:44 PM

I took my time to write a very detailed answer which I clearly put time into and it got one upvote but the vote wasn't even from Adam (We know this because hes not visited the site) - in this case this is not a subjective question, I've given him detail on every possible password type he could use, Adam will probably revisit the site in a few months who knows and maybe he will accept but the point is for now I get one upvote on an answer that took me a while.

Anonymous

You can see the frustration? As I said there are more serious cases (Obviously) it was just easier to reference my own post :)

Anonymous

//rant over.

would you rant that much if you had more upvotes ?

Anonymous

Yes.

I mean, is the problem lack of visibility, or lack of OP answer?

Anonymous

2:46 PM

Because there is a difference between upvotes and acceptance, isn't there?

Anonymous

Not just a rep difference. There is a difference in visibility in general.

sure, and it's frustrating to know that you "loose" time for nothing as the OP don't even read your answer

well, rep from accepted answer is not that great. for question with few upvote, sure, but if you got let say 10 upvote, is wining 100 or 115 rep that different?

Anonymous

A lot of upvotes doesn't always mean a GOOD answer or at least it doesn't mean a GOOD answer to the OP. But if the OP accepts the answer and when I say "accept" I don't mean just presses the button, if they actually read what's been said and then accepts it that gives out the opinion to anyone viewing the question that the answer is a good answer.

Anonymous

The point is; in general accepting an answer is showing to everyone what has been written has helped me, I've understood it and for the most part you should read it to if you're looking at a problem.

Anonymous

But upvotes don't always give across the same message.

Anonymous

2:50 PM

Of course this is working on the basis that the OP isn't a total moron and doesn't just press the button because they can (That's not what we want at all)

Anonymous

But what we do want is good answers to be accredited, acknowledged, understood and visible.

Anonymous

Sure upvotes give it visibility but it doesn't always mean it's a good answer as I've stated.

Anonymous

Because let's be real in general new users will just upvote anything after reading the first line (Even if they don't understand the topic to a full extent)

sometimes it just need to compile, even if it's false

and sometimes, new users will accept the answer they understand the best, even if it's the worst (lambda expression? I don't know what it is and I don't want to know, I accept this old for-loop answer)

Anonymous

That is also true.

Anonymous

2:59 PM

I get where you're coming from - but the point is if you take time to write a good answer you should be accredited for it, otherwise what's the point? I'm inclined to say that most people wouldn't be as active on here as they are if there was no reputation, no badges - you might argue - "I would" but then if we actually did it as in we actually removed all of those features for a month / removed any feature which gave you a sense of accomplishment you'd be bored after a few days.

Anonymous

Humans like a sense of achievement - you remove the sense of achievement the act becomes hollow.

Anonymous

Sure people would still post questions because they want to learn, but would people still post as many answers? I don't think they would.

Anonymous

At the very least reputation, badges, etc they motivate users to carry on using the site. Obviously, some people aren't interested in them at all but I would say most people who have large amounts of rep and badges are very proud of their profile and like to flaunt their rep.

Anonymous

I've not been on the site long and it's already happened to me a few times. I cannot imagine the amount of times it's happened to people on here and on places like StackOverflow. Perhaps it's too late, perhaps not.

Reputation is even more than just a score or shiny litle things as badges, as rep give you some privilege, so you can contribute even more to the network, and beeing accepted as a trusted user

Anonymous

3:07 PM

Yes exactly.

also, rep/badges are not only goals, but a recap of all you've done

Anonymous

So you can see my argument for why you should be accredited to the best possible standard on all answers.

sure, and beiing "accepted answer" is a strong incentive to help people

Anonymous

Not only that but it's quite disheartening when you spend such a large amount of time on a question and the OP doesn't even read the answer, or they read it and don't respond to it.

not only you know you've been usefull, but others also know it

Anonymous

3:09 PM

As I said acceptance of an answer in general (Assuming the OP took the time to digest it properly) shows it's a good answer or a helpful one at the least.

Anonymous

Exactly.

@JoshJones also, something crual is visibility of some questions. on another SE, puzzling.SE, i've spent quite some times answering a Einstein-like riddle, giving me something like 5 upvote

Anonymous

And I think that's a lot of what this site is about, it's about providing the best possible answers & questions we can and with that we would hope we are accredited to the highest potential possible for our hard-work.

the next day, I answer a small riddle in no more than two minuts, it reach the HNQ,, giving me much more upvote

Anonymous

Yes precisely.

Anonymous

3:11 PM

That can happen. Most people aren't interested to read a 600 word answer (Even if you put a TLDR) because simply they don't care.

Anonymous

A lot of people come on here to just ask questions, they don't care about rep, badges, accrediting people, reading a massive paragraph they don't really care for the wider community.

not going to say i was sad to get lot of upvote, but the other answer deserve them more

Anonymous

All they care about is a short, concise answer to their solution.

Anonymous

I think that is partly why people feel these sites can be elitist at times.

it also depend a lot of what SE are we talking about

Anonymous

3:13 PM

Because in essence we do have some very "strict" rulings on things but it's to improve the quality for the users that are involved with the wider community.

AndrolGenhald

That may be part of it, but I think it's also that questions that reach HNQ tend to be those that are easily understood, personally I'm hesitant to upvote an answer if I don't know enough about it to verify that it's true

I mean, Worldbuilding for example have much less noob as on SO, asking question because they can't use google. Also, the answer is much more subjective, so no automatic accepted answer possible

Anonymous

Yes but I don't think it should be auto

I mean even hand-validated

Anonymous

In the post Tom linked with the best suggestion was to allow high rep users to "vote acceptance" on an answer.

Anonymous

3:14 PM

I think that is THE best way of doing such a thing.

Anonymous

Perhaps let's say 3000 rep and you get the ability to vote acceptance on an answer perhaps after 30 days of inactivity?

Anonymous

Obviously there can be issues with subjectivity that's inevitable however if something is generally accepted as the answer and that doesn't help the user, there should be a function in which they can revert it, explain why they've reverted it and then ask for further help and add more specifics.

they could also send some notifications (maybe mail is too much spamish for that) to make them remember they could/should accept an answer

Anonymous

I'm not saying it should be set in stone by any means (especially if the user is active on a monthly basis)

Anonymous

I feel like I should create a meta Q on this the problem is, we've had one before.

Anonymous

3:17 PM

And I am fairly certain it will just get resolved as duplicate.

maybe make a meta post before about old meta question

Anonymous

Theoretically, there shouldn't be anything wrong with a Q asking about what happened to the Q.

venturebeat.com/2018/05/24/…

Anonymous

Why did I open that on the work network... >.<

Anonymous

What a stupid idea.

Anonymous

3:21 PM

Time to go unidle all my tabs to hide the evidence lol

:D sorry i guess

Anonymous

Not your fault lol it's not NSFW.

Anonymous

We've even got the Meraki Systems Manager that runs in my laptop.

Anonymous

And if I disable it, it alerts them.

Anonymous

on my laptop*

Anonymous

3:25 PM

One day I am going to rebel and install linux on this laptop

Anonymous

So done with Windows...

Anonymous

Sigh

is it your work that impose you windows?

Anonymous

Yes it is.

Anonymous

(I don't work in security, I'm a network engineer)

Anonymous

3:29 PM

I am not sure any security company would enforce Windows only.

Anonymous

Network solutions company though? Sure

it would be interesting to see from what sector do the users of security.SE come from

Anonymous

Most of them security, lol.

Anonymous

I don't use the network engineering exchange because I actually don't find networking interesting at all.