@TomK. I didn't read the paper, just skimmed the first bit.

I'm sure it's a good paper and there's probably some reason that "rowhammer over RDMA" is not as easy as it sounds.

@JoshJones And this is the kind of reason I refused to let my websites be hosted behind any ASA products. The net admin really wanted to put it behind ASA but I vetoed that. I am so glad I did.

Anyone here ever fuzzed pdf.js?

@forest I just really don't like this "well, THIS was obvious" or "I could've done that myself" attitude towards new findings. :P

someone had to, it obviously wasn't known until now and why again did you not write that paper? :P

and @JoshJones well, yeah, I think there are some other pitfalls with that idea. I think it would hinder engagement from new users

a site that has it all figured out and where all questions are answered is pretty intimidating for a new user

also, if a site has a very high answer rate users would probably be inclined to mark answers as accepted that are not 100% correct

yup

you are definitely right

to be honest, this is mostly a problem related to new users. Maybe a solution could be to award some rep (not somuch, maybe 10) if they read the tour/FAQ, so they know better how SE work

you don't care about rep if you plan on asking one question and then leaving the site

probably. I don't know how, but I'm sure that it could really solve lot of problem, like dupe/poor quality questions

@Kepotx When I first came across Security Stack Exchange 7 and a bit years ago, I didn't even know I had been to Stack Overflow before. Hadn't even thought about it. I had asked a question and gone away after I had an answer - and never realised there was an accept, or guidelines or anything

I did what all noobies do - which is why we needd to do that up-front help. A better welcome page, with easy to understand guidelines on it.

SE keep trying, and there has been improvement over the years

Still a way to go yet, I think

@RoryAlsop Well, we have all been noobs one day. and I have nothing against them: the majority don't follow the rules, not because they don't want to follow the rules, but because they don't know the rules. I used SO before creating an account, and I read the tour when creating an account, so I knew the basic rules, but not all of them...

Some are not explicit rules but just good advices, like don't accept the first answer but wait some time so everyone can answer

Sure, the one who will use SO once in a lifetime won't do any effort, but I think there are lot of noobs (usually students/junior) who used SO before creating an account, and will continue to use it. I think we can do effort for this kind of new people

I'm a noob!

I have problems asking questions, I never know if it can be offtopic, etc. In fact, one of my question was moved to law.stackexchange despite the fact it was about the infosec implications of GDPR. On the other hand, a user asked a question about GDPR totally unrelated to infosec, and it got lots of upvotes and wasn't considered offtopic.

Another question of mine is still on hold I guess, and while I agree it was basically too much about "recommend a product or resource", then I edited it to change it to describe the actual problem I have, but I have no idea how long it'll stay on hold

@JoshJones, yeah, I later realized it was a stupid question anyway, but I couldn't realize it when I asked it

yes, he's not asking about the security of anything, even if he was concerned about the security of his configuration he does not state it anywhere in the question

@TomK. Unfortunately, a lot of research exists only because someone needs to pump out new papers. Just look at all the million papers on CFI and consider exactly how relevant they are to anything.

@TomK. Because I'm busy doing more practical and interesting things :P

Oh my god that RPG.SE link.

Reminds me of the classic

> Imagine punching somebody so hard that they turn into a door. Then you found out that's where ALL doors come from, and you got initiated into a murder club that makes doors. The stronger you punch, the better the door. So there are like super strong murderers who punch people into Venetian doors and shit.

@forest yyyeeeeaaaahhhh, Sure :p

We are both right on some level, but I think I am more right :P

@forest What's the source of that... thing?

@RoryAlsop heh.

I started off answering.

Which probably helped a bit

@BenoitEsnard Very, very old copypasta. The true origins have been lost to the voids of the internet. I first saw it on 4chan in like, 2010 but it's much older.

Found a reference on a bodybuilding forum in 2007 I guess, but it may be older

It's strange to say that 2010 is old

It still sounds so close

indeed does sound strange to say that 2010 is old. cause it's "vey old"

Nah :P

Yeah I thought that too. I felt a small wave of embarrassment for saying I only found out in 2010 as if I'm totally new to the internet before realizing that was 8 and a half years ago... The way time passes on the internet is so strange.

We are currently closer to the year 2040 than we are to the year 1990.

How horrifying is that?

obligatory xkcd reference

Can I ask if my question (that was put on hold some days ago and was then edited) now makes sense and there's any hope it will be accepted? And if not, what's wrong? Link: security.stackexchange.com/questions/186151/…

I think it describes a real problem, which could be generalized to any system where updates are not considered stable I guess, but then it might be considered too broad

@JoshJones don't you consider that old?

@reed I'll take a look at it in a moment

to get reputation you need to ask or answer basic questions that everybody is interested in and everybody can understand. Virtually all of such questions have been asked and answered already

@JoshJones, I'm taking to myself, LOL. General comment, referring to what you said about getting reputation

never realise before (probably because i'm not a native english speaker), but we say phishing instead of fishing. is there a reason?

yes, but why do we spell it in a diferent way? I always assume it was the samme as we bait users/fish

yo, @reed, read your question now

I think this is pretty much what you are looking for: whatis.techtarget.com/definition/…

but those words have diferent meanings, and probably quite diferent pronunciation, while phishing is clearly "inspired" by fishing

that definition doesn't really fit your WP example, but it's the process you need

oh, so we should also use saltt and paypper for hashing passwords

oh, seems good

thanks

@reed here's another answer that explains what patch & vulnerability management is ;)

@TomK. thanks, it looks like "patch management" is what I need to look into

from what I'm reading, the approach I suggested in my answer would then make sense and is the only way to go: 1) stay up to date with all the release announcements, security advisories, etc. 2) identify critical patches and serious vulnerabilities that need to be patched at once; 3) do something about it as quickly as possible (for example disabling the vulnerable part, etc.)

@reed pretty much. but it all depends on your application and what other processes are involved

I'm quite appalled by Google's password acceptance

No unicode characters, only checks that a password is at least 8 characters long and they have a approx. 100 character limit (possibly in the range 100-120).

@forest and we're closer to the 3rd millennium than we are to the 1st.

GitHub's max character limit is 72

Fan.

pthree.org/2018/05/23/…

@HamZa is this being discussed on crypto.se?

@TomK. no idea, i got it from a colleague