The DMZ

9:11 AM

@MechMK1 just dropping by to tell you a little something I just discovered. They did it again in another game made by the same company. Sunless Sea, look at the quest called "Speak to the Carnelian Exile"

MechMK1

9:25 AM

@Derpy In regards to the Mr. Eaten thing?

Derpy

@MechMK1 yep. Seems that they added a quest with the same concept in another game they made

From what I read, Sunless Sea has a quest called "Speak to the Carnelian Exile" that basically does the same thing - it cripples your character to the point of rendering it unplayable.

MechMK1

@Derpy I really wish I would understand Sunless Sea more

But as soon as I try exploring, I run out of supplies :D

I guess it's a lot like Cultist Simulator (also a game by those designers), where you need to fail a lot in the beginning before you get how to sustain yourself.

Funnily enough, cultist simulator has no such quest or similar path that cripples you

No spoilers, but there is a path that makes you become non-human, but it ultimately leads to a minor victory, so it's fine.

Derpy

9:40 AM

@MechMK1 the funny thing is that the company made policy about not spoiling the end of Mr Eaten is somehow still working with players mostly respecting it even after years.

Which is sad in a way.

MechMK1

@Derpy Fallen London attracts a specific kind of players, which makes it more understandable.

Derpy

@MechMK1 They managed to actually get the players so involved in the game that they did respect the "do not spoil the ending", yet such power is wasted on a thing that means nothing.

MechMK1

@Derpy but is it wasted, though? Or is the shared experience of going through it and not letting anyone else be part of it unless they invested their fair share the actual reward?

Derpy

@MechMK1 the problem is that apparently there is no reward other than a "be part of the club" thing.

MechMK1

And that's fine, isn't it? Enjoyment is the ultimate reward. Being able to say "I did" and not just "I watched" is the reward.

It's one thing to go online and look up what happens, but it's another to invest quite a considerable amount of time into the game and do it yourself.

Derpy

9:46 AM

@MechMK1 yep... and no. Because after that you are also done with the game, basically. Anyway that wasn't exactly what I meant, sorry for being unclear.

What I meant is that given they managed to involve the player so much that they are still keeping a game feature secret... it is a pity they couldn't do more.

MechMK1

@Derpy Well, that character is done with the game. The idea, as far as I understood it, is that Mr. Eaten is supposed to represent the desire for players to do anything, regardless of what it would actually mean for the character.

@Derpy What would you consider sufficient to be "more"?

Derpy

@MechMK1 So is Chara, but that also represent the fact that the game does mean nothing to you - it is just a game made of bits. And look - Undertale endings and effects are well know, no one tried to keep them secret.

@MechMK1 Well, that is tied to a dream I had time ago. A not-so-fresh muffin, if I had to guess a cause. Anyway, I imagined an online game, something with pirates if I recall correctly (probably I had just read about the MS Sea of Thieves game).

The game I imagined had a sort of quest, with no marker, no evidence that it even existed.

just a very convoluted and long set of steps - following it would in the end result in you discover that the map of the game was actually half of the map.

There was a whole second half, never documented anywhere.

the only clue is that you could sometime see players come from this "second half" with equipment that was never to be found in the first half.

and all the few players that managed to come to this second half basically decided to keep it a secret.

something impossible, I guess.

MechMK1

One sec, let me catch up on reading

Derpy

Furthermore, who would go and make a game only to advertise 50% of it? It is like making a platform with 100 levels and then keep advertising that only 50 levels exists.

It would be like shooting yourself in the foot.

MechMK1

That's actually not a bad idea, but the difference between undertale, your idea and Fallen London is that undertale and pirates are more mass-palatable

Derpy

10:00 AM

@MechMK1 I guess that the only way to make it work was if the game had a very specific way to hide the existence of the "others" players, the one who made the jump.

MechMK1

In order to make such a thing, you would need the entire game much more mystery-focussed

Derpy

@MechMK1 Another idea I had is a game that have two fighting factions. Add an almost indecipherable way for the player to give up their faction and join the other one. And have no way for the player to communicate in game with the original faction after they made the switch.

MechMK1

Interesting, but people will find OoB ways of communication

Reddit, for instance

Derpy

obvious, that is why you would need a community that actually was interested in protecting the secret.

MechMK1

Which is difficult in a game themed around pirates

Derpy

10:05 AM

yep, I know.

MechMK1

Players would need to be invested in their character

Derpy

That said, it would be funny.

MechMK1

Very. Though then again I understand why you would make such a secret, that had very little pay-off

"The journey is it's own reward", basically

Derpy

Imagine Diablo, imagine Blizzard suddenly saying "we are adding corrupted soul npc to the game - now you game has a random chance of being invaded by dark fallen heroes npc that will try to kill you and fail your quests". And what the players don't know is that those npc aren't npc, but just players that did something weird in their games.

but yep, that would mean creating a "second half" to a game and getting no credit for it.

If someone spoils the thing, it is over.

MechMK1

It'd be funny, yeah. But look at what Dark Souls does: They add the faction, but it's difficult to get there

Derpy

10:09 AM

and if it stays a secret, it will buy you no new customers.

MechMK1

But can I be honest? I don't think Dark Souls is as good as everyone acts.

Don't get me wrong, I really enjoyed the game.

But so much of the praise in my opinion is just...weird. Like "Oh look, there are so many things that 90% of players won't see". Yeah, that's not a good thing

Derpy

@MechMK1 I don't think Dark soul has that much of content that "90% of the players won't see", unless I am missing what specific content you are talking about.

Mostly, it requires multiple playthru.

I mean, if I had to think of one thing that most gamer won't directly see in the Soul series is the final part of the tutorial in Demon Soul

mostly because it is easy to assume that the Vanguard would be scripted as unkillable and you get only one chance to defeat it.

MechMK1

10:54 AM

@Derpy I never played Demon Souls, I just played Dark Souls 1.

Conor Mancone

12:14 PM

Is it just me or is this question also the definition of too broad?

1

Q: Client-side protection bypass for XSS

Let's assume an application has a function for XSS protection just on the client-side. How can I create proof of concept attack for this?

xss

MechMK1

@ConorMancone It's definitely in the realms of "I have no idea what I'm doing"

OakSecurity

1:42 PM

Please put that question on hold for clarifications

>What XSS protection

>>What's the function

>>>What's the running environment

>>>>What do you mean, "How can I create a proof of concept"? With a pen a pad, wtf.

MechMK1

@OakSecurity First of all, the title is not a question. If the title is not a question, then I don't know what the answer is supposed to look like.

OakSecurity

Fair point, then again, title can be Broad

MechMK1

Secondly: If the question is "How can I create a PoC?", then the answer is an answer for a generic question: "What is a PoC?"

OakSecurity

as long as the question isn't too open-ended (schroeder 21:2, 5th verse)

MechMK1

It's entirely unrelated to the question at hand

OakSecurity

1:45 PM

Which is why I said, please put on hold.

How can I make a PoC

>with a pen and a pad

bye

I got schroeder putting my super-pertinent tails/remmina/rdp2win question off-topic/on-hold telling me "We're not your tech support"

but edits these kind of questions and let them go

balderdash

>angery

MechMK1

I think meta is the best place to discuss this

OakSecurity

My tails question?

It radiates "Security"

MechMK1

Yes

OakSecurity

The goal is security, using the most security-anonimity focused OS publicly available to my knowledge

How is this not a security question

and how his "how do I make a proof of concept" more of a security question

MechMK1

because not every security question is on-topic

"How do I design a secure OS?" is a security question, but too broad here

1

Q: RDP/VNC/Xorg over Tails/Tor - From Tails to Windows

Remoting from a Tails machine to a Windows one. I have been working for a couple of days on making it work with no avail. Using Tails with small persistent modules installed (iceweasel, remmina, proxychains & a couple others). I contacted the small Tails dev team on their XMPP. They asked m...

windows tor remote-desktop vnc

OakSecurity

1:57 PM

Your answer to:
how his "how do I make an XSS proof of concept" more of a security question than "Why can't remmina over tails w/proxychains connect to a winRDP that doesn't run a hidden service"?

MechMK1

This is the question you are talking about?

OakSecurity

is:
because not every security question is on-topic

Yep.

I'm aware it's not a perfect question, but come on

MechMK1

Alright, let me have a look at it

Look, I know you are frustrated, but please understand I am here to help you get your question into shape

OakSecurity

Tell me if I'm being too much, I respect your status here, I don't want to annoy you. I'm generally frustrated.

MechMK1

No, I have no status and you are not annoying me.

Let me give you some feedback that will hopefully help you

OakSecurity

1:59 PM

15k rep is a status, at least to me it is.

I'm all ears.

MechMK1

First of all, I can't identify an actual question to be asked. This is usually an indicator that this is more of a "this is my situation, please help" (which is off-topic on most sites) and less of an actually answerable question.

OakSecurity

I agree

MechMK1

So I would include something that is a concrete, answerable question.

OakSecurity

The question is "Why doesn't it connect"

I can ping it, but RDP doesn't even time out, it just doesn't connect

So perhaps it would be more of a networking question, but networking, tails & security are fingers of the same hand

MechMK1

Yes, that's a good start. The next thing you would have to do is to add some network traffic. Stuff not connecting usually requires some wireshark dump indicating some action

OakSecurity

2:01 PM

There isn't.

The packages are sent out

MechMK1

As you said, it suddenly starts to become a networking problem

OakSecurity

nothing comes back

Yes but Network Security is a major security branch

Also, I doubt a networking stack would be able to answer in a better way than security stack should, imo.

MechMK1

Yes, but you don't ask about network security. You don't want to secure a network, you want to use a specific networking tool. "Why can't I connect to this website?" is not a security question, even if the website in question is about information security.

One rule-of-thumb that I personally follow is "Is this about Information Security?"

OakSecurity

Don't forget the goal

Which is security

anonimity

MechMK1

The goal is irrelevant.

OakSecurity

2:03 PM

Well... I understand your point.

Wouldn't go as far as saying irrelevant

MechMK1

If your goal is to get to your security-related job, then "Why is my car not working?" doesn't become a question about security.

OakSecurity

I understand your point.

but if you use a car to go to mechanic workshop

Or to a race

You're right, I digress.

Trying to evade. You're right.

BUT

You would categorize Tor more of a networking question

than security?

MechMK1

It depends on what you ask.

OakSecurity

Hence, this whole security thing is really about the whole concepts and human natures etc?

MechMK1

"How to set up tor?" is a different question than "Does tor protect privacy or anonymity?"

OakSecurity

2:06 PM

I agree and understand

MechMK1

Sec.SE is about Information Security. Good questions can come in many forms, and sometimes there is overlap.

Especially Sec.SE and Crypto.SE have some overlap.

OakSecurity

I think the whole stigma around this place is similar to the stigma associated with "hackers" in the 90ies

MechMK1

In what way?

OakSecurity

"Oh you're a hacker?" "insert irrelevent question"

MechMK1

We get our fair share of weird questions, such as this one:

-7

Q: I've been using my boyfriend's phone Privacy

I've been using my boyfriend's phone for a few months I never use Bluetooth cos I don't know what it is or what it does. Today he borrowed my phone to go on Facebook later on I noticed the Bluetooth symbol was on the top of my phone I swiped down and pressed on blue tooth and under the symbol the...

bluetooth

OakSecurity

2:09 PM

Or the simple assumption that

you know every technology

MechMK1

I certainly don't

OakSecurity

Because to be able to secure a workflow/technology you need a fair amount of experience and knowledge of the backend/inner workings

Of course you don't

but user220363 does seem you do

MechMK1

What I look out for is if a question feels like it's answerable, even if I can't answer it.

OakSecurity

You mean as a standard

for a good Sec Q?

MechMK1

Yes, when reviewing questions with close vote on it.

OakSecurity

2:11 PM

kk

I understand why my question might seem far fetched

MechMK1

People have different standards, and sometimes I think questions are okay that others think are off-topic, and sometimes I think it's off-topic while others think it's okay.

OakSecurity

but at some point, I doubt anyone else on public stacks can answer better

than security people

I'll ask about Tails on meta and they won't even know

wtf is it

MechMK1

Meta is never the place to ask, except for "Where should I ask questions about...?"

OakSecurity

so forget launching a connection request from a VNC package like remmina from the tor network to a non-tor winsrc

Oh... I didn't know that

MechMK1

But even then it's difficult, because questions "about Tails" can be off-topic here, or off-topic.

OakSecurity

2:16 PM

off-topic here or off-topic?

not sure i understand

Anywho.

Do you have a clue?

MechMK1

Well, some tails questions can be on-topic.

Let me see if I can find an example

OakSecurity

>>off-topic here or off-topic

you mean on-topic?

meant*

Nono, please don't, I believe you

MechMK1

Yes, some are off-topic, some are on-topic.

OakSecurity

I can think of 5 right now.

Yep.

MechMK1

Yes, the point is just because some questions belong here doesn't mean all questions belong here.

OakSecurity

2:18 PM

I understand. At some point, it's not like I challenged or reported something

It's your call and as much as you're right, I'm still bias because I'm looking for an answer to MY problem

MechMK1

I certainly can understand your frustration. Sec.SE can be...weird, at times.

OakSecurity

insert Sheogorath meme

Hey, if you can upvote my answer on security.stackexchange.com/questions/220133/…

would be great

MechMK1

Yes, and that's also why schroeder said that we're not a tech-support forum. We're very strict about such questions, because if we were not, 90% of questions here would be tech support.

OakSecurity

I can understand. but I'm not asking you to crack my "forgotten" windows password to impress my high school friends

MechMK1

@OakSecurity Eh, it doesn't really answer the question and is more a sign of frustration. I get it, you're frustrated because we don't answer your question or help you with your problem.

OakSecurity

2:20 PM

Ok ok... sheesh >_>

MechMK1

Sorry, I'm trying to be as helpful as possible.

OakSecurity

You are.

Let me reassure you.

You taking the time to actually chat is more than I expected

but as I said, "we're not your tech support", is out of line in my opinion.

Like, disrespectful.

MechMK1

I'm trying to help people feel welcome here, understand what Sec.SE is about and how they can get their questions into shape. I had to learn it the rough way back when I learned programming and asked bad questions over on SO.

2

OakSecurity

but that's my opinion

Yeah, amen on that.

-20

-11

account blocked for a year

MechMK1

I understand why you feel that way. To put it in some context, Sec.SE used to have 5 moderators, now we are down to 2. I understand that the mods are pressured.

OakSecurity

2:23 PM

I don't think I'd do it, even with the pros of having that on your resume.

Thankless job.

Are you guys paid?

MechMK1

It certainly is.

Nobody except staff gets paid

So even the elected mods do it just out of their spare time

OakSecurity

Then my question is, are mods and admins considered staff

Yeah... which explains why it's more a tight-knit community than an actual "Yahoo Answers" for stuff.

Then again, I'm thankful for the platform.

Can't complain too much.

MechMK1

@OakSecurity No, they're not.

Cesar M ♦, Brazil

2.9k 5 15 26

discussion bug code-of-conduct comments announcements support data-explorer

You can see this account clearly is labelled "Staff"

They are actually hired by SE, Inc.

People like me just use SE and try to keep it clean (like someone just picking up trash from the street when they go for a walk).

schroeder is an elected moderator, who has more privileges, and is considered to have higher responsibilities.

OakSecurity

As I said. Thankless job.

I'll think of you and my cellmates once I pour liquid on the pavement.

MechMK1

Well yes, it is a thankless job, but we're working to try and make InfoSec more accessible

OakSecurity

2:38 PM

Not by allowing questions about "how can I PoC" and holding "tails RDP over tor"

Actually, I may be wrong.

MechMK1

One sec, I'll brb

OakSecurity

me too

MechMK1

2:50 PM

As I said before, the problem with your question is not that any individual topic is by default off-topic - it is not. The problem is that the core of the question is not about InfoSec, but about networking.

OakSecurity

3:00 PM

through the secure tor network tho and from a secure OS.

If your customized car's titanium alloy frame starts to rust. (dont know if possible, wtv)

You might get an answer from a Metals forum, but maybe an alloy forums might prove useful as well.

MechMK1

Your problem is "I customized my car with this alloy and it doesn't start. What should I do?" is not really a question about metallurgy, and thus off-topic on Metallurgy.SE.

Anders

3:21 PM

Shameless plug of my meta question:

1

Q: The ununiqueness of UUID and GUID

I recently created the tag uuid because I thought it was missing. Then I discovered the guid tag. How to deal with these two? They are sort of the same thing (at least they have the same Wikipedia page), so one tag should be enough. But since GUID is (a) not used as often, and (b) a Microsoft th...

discussion tags tag-synonyms

OakSecurity

Man, I tried like 5 exemples to prevent the good ol switcheroo that you did. Still didn't manage.

I think we understand each other.

but what about "how do I make a PoC"

you know?

like, in comparison

MechMK1

I know, and I think it's a shit question too

Just to be honest

OakSecurity

<3

Yay 500

What's a review queue?

MechMK1

security.stackexchange.com/review

For example, you will have the "First Post" queue. This is where the first question asked or first answer posted will go, and it's your task to check if they are fine, need some editing or should be closed/removed.

security.stackexchange.com/help/privileges/access-review-queues

Anyways, I got to go now. Have a nice day.

OakSecurity

3:36 PM

You too, buddy.

Feeds

6:00 PM

Thomas Ward has frozen this room.

Thomas Ward

okay, so, the two of you are now discussing a specific question heavily back and forth, may I suggest we move you to a dedicated room?

for that question.

→ 32 messages moved to Discussion about security.stackexchange.com/questions/219921

Feeds

Thomas Ward has unfrozen this room.

Thomas Ward

y'all all just bickering back and forth for the most part, so please put your discussion into the other room I just made, please @defalt @OakSecurity

→ 1 message moved to Discussion about security.stackexchange.com/questions/219921

Conor Mancone

9:40 PM

Man, this guy is stubborn (comments on my answer)

1

A: Can canvas hash be used to track me and ruin my anonymity?

Canvas Fingerprinting The technique you are referring to is Canvas Fingerprinting. It is one of many possible methods available for website operators to try to identify and track users without cookies. The reason for this, of course, is because cookies can be cleared, or even "tricked" by thin...

Him: How can I change my canvas hash?
Me: You can't really, without switching browsers, OS, or hardware
Him: Yeah, but what about browser settings?
Me: No, no settings, literally the browser:
Him: Yeah... but... what about browser settings?

Vipul Nair

11:16 PM

0

Q: Remote access avoiding

If I had a private laptop and by accident left it opened on my working desk in my cimpany, someone comes to it and having one hour to mess with it and decided to setup remote access. It can be some ip tracking, some router setup, port opening or something, you name it. Dude knows the job. ... W...

spyware

cuckoo

Conor Mancone

@VipulNair We get a surprisingly large number of questions like that. "Someone did something and now has full control over my computer no matter how many times I reinstall" <-- Practically once a day

Transcript for