« first day (2771 days earlier)      last day (33 days later) » 

10:52 AM
interesting new technique for Spectre mitigation with supposedly as little as 2% performance overhead arxiv.org/pdf/1807.05843.pdf (this is for all Spectre variants)
 
@TomK. That's interesting/clever
 
definitely
and supposedly this is tweakable to work against Meltdown as well
and they might be able to bring down the overhead even further
best sentence in the paper: "A naive approach to fix Spectre vulnerability is to put fences (e.g. lfence in x86) after every branch instruction"
that was basically Microsoft's approach with their C-compiler update :>
 
12:01 PM
I am texting to a person. He claims to be from coca cola. He is saying that he can get me a job in USA, since there is a hiring going on in coca cola. Now he is asking me to share my CV and Passport image. He is resisting to share his detail to me. Shall i share my passport image? Is something wrong could be done by him?
 
@SiddharthChoudhary Do not do this
Large corporates have HR web portals
Coca cola will have one
Trying to work through a recruiter across national boundaries - by text... !
it's a scam
 
If anyone is trying to hire you through text or whatsapp, its fishy
"he is resisting to share his detail with me" is also fishy
Even if its an outsourcing firm, at the very least you should have email, not text.
 
12:30 PM
exactly, i thought. that's why i had stopped there.
 
how did this person get your number in the first place?
 
1:04 PM
well, maybe there are some cultural differences too. I knew a gue in Malaysia who do tech support by whatsapp rather than mail
but still, asking for personal documents without giving more info screams like scam
 
1:36 PM
Soo... SE stopped replying about the security bug I reported in November 2017 (!) altogether
 
good tactic
well, does it still work?
 
2:03 PM
The tactic or the bug?
 
2:22 PM
Yeah - I don't see you on the list yet: stackexchange.com/about/security
 
Yeah the bug still works
Frankly it has gotten to a point where I think it's irresponsible
 
2:38 PM
@Arminius what is the escalation route?
A suggestion, ping an email to team with the current email trail in it
that should hopefully expedite
 
@RoryAlsop did SE get their new security head yet?
 
You know they still have their advert up for a security director, so my guess is a lack of resource, or prioritisation
 
(I kinda lost track)
 
@JourneymanGeek the advert still looks like it's up
 
2:39 PM
@Arminius Just drop it here.
 
I used the contact form, email, got either no replies or generic "we are still looking into it", I also posted on meta
 
@Arminius have you got the meta link?
 
@forest Heh, we're having that conversation each time
 
I can try and help push it
 
@Arminius that seems vaguely common for contacts :(
I almost want to half jokingly suggest tweeting Joel
 
2:42 PM
@RoryAlsop It was that one. I'm writing up another one because making that public seems to be the only way this may move forward
It's not that this is a terrible bug
But they are not even replying anymore
 
If it's XSS, it is a terrible bug.
 
Cheers
Thanks
 
2:59 PM
0
Q: Your handling of security reports is disappointing

ArminiusI'm trying to get a security vulnerability on a StackExchange domain fixed for about 8 months, but the lack of progress and communication is frustrating. Unfortunately, asking for status updates repeatedly and offering further details if needed didn't get me anywhere. Timeline 2017-11-20 Repor...

3
 
3:53 PM
@RoryAlsop #DaysOfOurDMZ ?
 
 
4 hours later…
7:28 PM
Ha! They patched it! 🎉
Suddenly everything went really fast :-)
 

« first day (2771 days earlier)      last day (33 days later) »