The DMZ - 2018-06-19 (page 1 of 5)

« first day (2742 days earlier) ← previous day next day → last day (2137 days later) »

3:04 AM

@Anders For http:// it would make sense to format, but not for HTTP.

56

Q: What does it mean to "Burn a Zero Day"?

I noticed a comment on this answer where another user said ...but it requires risking burning a 0day, which people are not always all that willing to do. I did an Internet Search for the phrase and not much came back. It's obvious that "burn" means "use up" in this case. I understand mos...

Damn I've been trailing behind the top answer by 5-10 votes this whole time.

4 hours later…

Anonymous

7:21 AM

I am still yet to get an answer with other 10 votes I wouldn't feel too bad, lol.

Anonymous

FeelsBadMan.jpg

7:39 AM

As soon as you hit HNQ, you'll get 10+ votes.

That's pretty much the only way for a fresh question to get more than that.

Anonymous

Yeah. One day, I can hope.

Anonymous

This one makes me sad security.stackexchange.com/questions/167576/…

Anonymous

Because I put a lot of effort in and it got one vote and probably not even by the OP.

I just upvoted it. It is a good answer.

Lots of my answers are like that. Some are very detailed with lots of citations and might even contain several hours of research or testing just to answer that specific question, and yet get 1 or 2 upvotes (or none).

Anonymous

:D - You didn't have to do that but thank you.

7:47 AM

I genuinely thought it was a good answer (I know nothing about ASAs, but I assume it's not plainly incorrect).

Anonymous

Yeah I am not saying it took me ages as I already knew most of the answers to his questions anyway, just made me a little sad when I put quite a lot of effort into it.

Anonymous

Haha, well thank you.

It'll happen more. You get used to it. What's even more frustrating is when you get a fairly well-received answer but the OP is unregistered and so does not even accept it...

Anonymous

And it shouldn't be - I re-read it a few times after and did some fact checking with Google.

Anonymous

Oh Forest I totally agree!

Anonymous

7:49 AM

Me, Tom, Benoit and M'vy had this discussion here.

Anonymous

Quite a while ago :D

Seems like it's a common discussion. One of my first Meta questions was about that.

I wanted to know if it was possible for the community to accept an answer if the OP is either unregistered (and so can't), or has been gone for ages (and so won't).

Turns out it's not possible by design.

Anonymous

Yeah. My initial thought was some kind of auto-accept.

At least for a user who has not signed in for a long time, yeah.

Anonymous

So if user X is inactive for N amount of time then the highest voted answer = accepted.

Anonymous

7:51 AM

But apparently or at least according to the meta post I read that's a bad method?

The idea is that it's intended to be a marking of what the OP considered helpful. Unfortunately, the accepted status has an effect on reputation, how often the community users bumps it, whether or not it gets automatically deleted, and how people browsing through see the question.

Anonymous

Yeah, see I get that it's whether the user considered it helpful.

Anonymous

But in return the OP should be helpful.

Anonymous

If they're not it should be left to the opinion of the wider community.

I mean when it's entirely for the OP, why are questions put on a big green background when they are accepted every time you browse through them?

Anonymous

7:53 AM

lol.

It makes it seem like it has more community purposes.

Anonymous

You said community accept isn't possible by design? Why is that?

Anonymous

I genuinely cannot think of a reason why such an implementation isn't possible...

Because the idea is that accepting is nothing more than marking the question that the OP found most useful.

Anonymous

Right, yeah.

7:54 AM

The idea seems sound, but falls apart when you realize that it is treated as a "this question has been answered" mark.

Which it is not, despite giving all the indications that it is.

Anonymous

As I stated previously the problem with rep is, if a user has a question they just want help on and they're not interested in the site they won't care about giving or receiving rep.

Anonymous

So they just don't.

Well the OP not giving an upvote is a little irritating at most, but the majority of rep comes from the community upvoting.

Anonymous

Yeah. Getting the nice green tick is more satisfying though.

The issue with the little green tick is that people who look through the questions see ones that do not have an accepted answer and then think the question has not been answered.

Anonymous

7:56 AM

And it makes me feel like I've achieved something.

True

Anonymous

Upvotes are nice because you get the rep sure but that's just someone elses opinion.

Anonymous

It doesn't tell me the OP has solved his issue (like you said)

Anonymous

So a tick does feel nice. I know I have a few answers where I think I should have got the tick and didnt and you probably have hundreds of them.

It'd be nice if there was both a "solved" mark and a mark for the OP accepting the answer, so people looking through questions can more quickly see if the answer they want is there.

Anonymous

7:57 AM

I saw that suggestion in one of the meta posts I read, I thought it was a good idea too.

Personally what I do is prioritize answering people who have a lot of reputation or have spent a non-trivial amount of time on the site (even if they spend most of their time on another site). For someone who just registered or is unregistered, I tend to either give shorter answers or not answer at all.

It feels a little dirty to do since it's biasing me towards regulars, but it's the best way to get the answer marked as accepted so it doesn't get constantly bumped to the top for being "unanswered" and isn't listed in the "unanswered questions" list (which ironically contains mostly questions that have already been answered).

Anonymous

Yeah that is a good approach I think.

Anonymous

But for a low rep user like myself I must stick to what I know.

Anonymous

And a lot of these Cisco questions are very easy for me to answer and most of the answers that are pre-exisiting are quite awful.

Anonymous

I'll be outranking Rory in the Cisco tag users soon lol

8:02 AM

Alsop or Mcune?

Anonymous

Alsop (Sorry I always forget about Rory 1)

Anonymous

Yeah Rory 0.

:P

Anonymous

Hes on 28.

Anonymous

But I'm at 14 votes 10 answers.

Anonymous

8:03 AM

Hes on 28 - 3 lol

Seems Cisco folk don't often care about security.

Anonymous

No they don't at all.

What does the "security train" (or whatever it's called) in IOS even do?

Does it just contain security-related networking protocols?

Anonymous

You mean the security exam?

Anonymous

CCNA, NP and IE exam

8:04 AM

IOS has different versions of the software called trains.

Anonymous

Oh I see.

At least according to a friend of mine who does a lot of networking stuff.

Might be terminology specific to his region but I had assumed it was a general thing.

Anonymous

Yeah Cisco and versioning is horrible.

Anonymous

We possibly call it something different. I believe hes referring to the S versions of IOS.

Don't even know what "S version" means.

Anonymous

8:06 AM

But its hard to know without speaking to him lol.

We had to switch to a different "train", as he called it, because the 32 MiB of memory was clogging up the router and causing congestion with the more bloated train.

Anonymous

Yeah, we just call them releases.

Anonymous

:D

Anonymous

I see what you mean now (sorry)

Ah

Anonymous

8:07 AM

Its to do with the way Cisco version their IOS for devices.

cisco.com/c/en/us/support/docs/ios-nx-os-software/…

Oh this explains it. Just a major version number.

Anonymous

Yeah a major release.

Anonymous

As I said their versioning is quite horrible.

And this seems to explain that there are multiple kinds of trains cisco.com/c/dam/en_us/training-events/le21/le34/downloads/689/…

(Like "S" as you said)

I think we were on the "E" train or something and it was too bloated.

Anonymous

It happens a lot.

Anonymous

8:10 AM

Especially on older devices.

Well it certainly was an older device.

Anonymous

Yeah. We usually just put more ram in (depending on the type of device)

Anonymous

ASAs are trivial to replace RAM.

Anonymous

Or replace the flash card (if it has one and its too small)

He tried but couldn't find anything compatible (if I recall). Or maybe he was just lazy.

Anonymous

8:12 AM

I dont know enough about cisco versions because I have no desire to learn why they name them in an overly-complex way.

heh

Anonymous

Thats what annoys me on the Cisco exams.

Anonymous

Thye dont teach you some stuff you think they would.

Anonymous

Like how to reset one.

Anonymous

(A device)

Anonymous

8:12 AM

Or how to password recover it.

Anonymous

So the only way to know is to know if that makes sense.

That's why I prefer Debian's versioning.

Or OpenBSD's.

A few different branches for different levels of stability, and nice and simple version numbers. OpenBSD is even nice enough that it doesn't bother with a distinction between major and minor releases so after 6.9 is just 7.0. Not really standard, but nice and simple.

Anonymous

Yeah that is nice and simple.

Anonymous

Unlike this mess 15.2(2)E7

Anonymous

lol.

8:19 AM

If you think that's bad, just look at microprocessor version numbers...

Anonymous

Another upvote appeared on my answer :?

Anonymous

Rory 0? lol.

Like SLB9635TT1.2 gee how descriptive.

Anonymous

Hahha.

Anonymous

How do you actually read that?

Anonymous

8:20 AM

Looks like a serial number - the .2

SLB 9665 (model) TT (standard temperature range) 1.2 (TCG version compliance)

Anonymous

:O

Anonymous

I've got so much to learn >.>

As opposed to, say, SLB9665XT2.0 which is SLB 9665 with eXtended Temperature range support compliant to TCG version 2.0.

Even simple processors like 8051 have stupid version names. Like 8051 has 128 bytes of memory but 8052 has 256 bytes, despite both using the assembly language MCS-51. Hardware gets very confusing (and can be made worse when half the datasheets are in Chinese).

(I have no idea what SLB stands for. Maybe something like SPI/LPC Bus? Who knows)

Anonymous

lol

Anonymous

8:28 AM

As for datasheets, Ciscos may as well be in Chinese, lol.

Anonymous

They're pretty awful too. Have you noticed the re-occurring theme yet? I hate Cisco, lol.

Everyone does :P

Anonymous

To be fair I don't hate them, it's just fun to make fun of them.

Anonymous

Because they do stupid things.

Well I hate them. But I hate a lot of things.

Anonymous

8:29 AM

^ I have noticed your inherent dislike for most things Forest don't worry lol.

Anonymous

Perhaps one for Memes of InfoSec Ex lol.

Not even a joke: I hate "memes of meta" and 99% of "memes" which I consider to be folk ignorant of meme culture taking any joke they find online and declaring it a "meme". I also hate the word meme.

Anonymous

Hahha :D

Anonymous

I don't know whether to laugh or cry.

Anonymous

Its funny but I shouldn't laugh because its not a joke.

Anonymous

8:32 AM

It's just I can imagine you typing that whole sentence with rage in your heart.

It may not be a joke but I completely appreciate the irony.

Anonymous

lol. I guess my life has just been born around memes, gotta' roll with it I guess lol.

Anonymous

Not that I regularly visit or partake in meme groups, people often take things too far there.

The "memes" I like are the classic ones, when they aren't forced.

Anonymous

Such as?

Anonymous

8:33 AM

:O

Some people just throw around jokes out of context in image form and call it a meme.

Anonymous

Oh I completely get that.

Anonymous

That's just the Internet for you, it's full of chimpanzees... - do you hate that one?

Anonymous

lol.

I've never heard that one.

Well, like the phrase "rustled your jimmies" (comes from 4chan I think). It hasn't been "tainted" by the masses because it's not something that you can just throw out for laughs. It's just a phrase that acts a bit as a shibboleth.

Anonymous

8:35 AM

Yeah.

Anonymous

One that annoys me is when people call you tilted.

Tilted?

Anonymous

I hate it so much. Because that is a legitimate phrase in Poker.

Don't know that slang.

Anonymous

But now people just say it as soon as you get annoyed or upset, etc.

Anonymous

8:36 AM

And it annoys me.

Ah, so it sounds like it has the same meaning as the poker term.

Anonymous

Yeah so in Poker it would mean to play off your normal game.

Anonymous

Because of the situations at the table.

Anonymous

But as soon as you get slightly mad people scream it at you like they've missed their daily medication.

Anonymous

it makes me so very angry.

8:38 AM

heh

Anonymous

lol.

Anonymous

If I don't be careful I might go off on a crusade again, lol.

Anonymous

I need to find that post the comment had me in bits.

Anonymous

There it is, just going to favourite so I don't lose it.

Anonymous

WOuldn't want to go " trailing off on a passively aggressive semantic crusade" again anytime soon

8:40 AM

Oh that one lol

Anonymous

Yeah I was dying of laughter.

Yeah I don't understand what got OP so tilted

:^)

Anonymous

I also had to Google the word Semantic.

Anonymous

It didn't make sense in that contenxt.

Anonymous

After Googling it, it still doesn't.

8:42 AM

Probably in reference to "arguing semantics" (i.e. pedantry regarding the terminology used rather than an argument about the core of the situation)

Anonymous

Oh I see. Thank you.

Anonymous

To be fair that's EXACTLY what I was doing then.

Anonymous

lol.

I can get very pedantic myself. I tend to prefix such comments with "Just a nitpick, but [...]" to get people off my back.

Anonymous

To be fair he brought it on himself, when he implied not using something = not trusting it.

Anonymous

8:44 AM

Which is just wrong.

Indeed. Though I think the TrueCrypt folk did genuinely distrust it, but the VeraCrypt folk just didn't understand how it works (given their factually incorrect comments regarding the TCG threat model).

Like they say it can't protect against hardware keyloggers... but would a BIOS overwrite vulnerability in software be able to install a hardware keylogger? No, and a TPM would protect from that. Etc.

Anonymous

Yeah I don't know enough about TPMs to comment it's just common-sense shows his post had a flaw.

Anonymous

Then he went " trailing off on a passively aggressive semantic crusade" because I was " trailing off on a passively aggressive semantic crusade" ;)

Or what about someone who only has the time to plug in a USB device and overwrite firmware using DCI? Would mitigating that be pointless because an attacker could "just" open up your laptop and splice in a hardware keylogger in the low-insertion force strip? I guess that's the kind of thing I get pedantic about.

Anonymous

lol.

Anonymous

8:47 AM

I try to keep my opinions on people objective here but sometimes I speak to people on this site and it makes me depressed.

Anonymous

Because some people are just... I don't even know what I would call them.

The sad thing is that this site is more intelligent than 99.9% of those out there.

Anonymous

Yes that does make me quite sad.

At least we don't have half of our users saying that AES is backdoored and shit.

Anonymous

A lack of knowledge and a lack of common-sense are two different things.

Anonymous

8:48 AM

You mean Tinfoilers as I like to call them?

Though we do have a lot of people who think the Intel ME is worse than it is...

Yep, tinfoil hatters and their ilk.

I mean I'm pretty paranoid but at least I know that the crinkled edges on a tinfoil hat allow for sharp enough contrast to make it possible to spy on ambient audio with a high-resolution camera through a telescope.

(At least most tinfoil hatters don't literally believe tinfoil hats are useful... do they?)

Anonymous

LOL

Anonymous

I've got no patience for tinfoilers.

Anonymous

I hate the Govt just as much as the next guy.

I do, but only because I like arguing with them.

Since I can falsify every bit of information they put down.

Anonymous

8:52 AM

And I like conspiracies but some of the things they mutter.

Anonymous

Is just pure nonsense

Well the problem is that their conspiracies are... well... implausible.

Even from the point of view of an incredibly corrupt police state.

Anonymous

Meanwhile I've just seen this - "or bypass my firewall by any magic exploit or secret technique?"

Yeah I saw that.

Anonymous

"any magic" - yes... Emma Watson is going to get her wand out from the set of Harry Potter and unlock your firewall for "bighakclan1337"

Anonymous

8:53 AM

I want to comment that, but I won't.

Our secret is out. Never again will we be able to hide from the public the fact that we are using divine magic in our penetration tests.

Anonymous

Hahah.

Anonymous

Quick remove the post so people don't know..

Journeyman Geek

I thought we just flooded it with electricity?

I guess employers can be open now and add "experience with alchemy" to the job requirements.

Anonymous

8:54 AM

Hahha Journeyman

Anonymous

@forest I guess if you went to Hogwarts you just get employed instantly then.

Journeyman Geek

hah

Yeah Hogwarts is where I got my CISCP.

Journeyman Geek

there's a blog about hogwart's IT guy

Its hilarioys

lmao need link

Anonymous

8:55 AM

Hmm, I might have to attend Forest.

Anonymous

Perhaps I will see Ron as off the rails as ever.

:P

You'll learn how to use occlumency to mitigate information leaks.

Journeyman Geek

thesetupwizard.tumblr.com

Anonymous

I've always wanted to learn Telepathy actually, will they teach me that?

Anonymous

Perhaps I can just pull information out of peoples minds with it...

Anonymous

8:56 AM

:thinking:

Journeyman Geek

just slip them some veritaserum

People who can do that are called Legilimens.

"You can't hack me I'm behind 7 proxies" -> "You can't hack me I placed Protego Horribilis on my router!"

Anonymous

I had to Google that Forest.

Anonymous

Because I'm not a Harry Potter nerd >.>

Journeyman Geek

@forest unless of course...

you had a rivers of london style relationship with tech

Anonymous

8:58 AM

lol.

Journeyman Geek

any use of magic will burn out technology.

Anonymous

I've heard electricity does it as well Journeyman.

Well the Weasley's car works fine with magic.

Anonymous

Strangely it didn't kill the man who asked why he's not dead though....

ahaha

Journeyman Geek

8:59 AM

@forest oh, a 1940s jag is fine..

Anonymous

Even the title makes me laugh.

Journeyman Geek

modern cellphones kinda... go boom

its a great series ;)

:o

« first day (2742 days earlier) ← previous day next day → last day (2137 days later) »

Transcript for

Jun '1819

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile