« first day (3354 days earlier)      last day (35 days later) » 

8:36 AM
@A.Hersean I guess __-in-the-Middle is the most inclusive then
@FireQuacker Oh you know it!
@UwU Yeah, I'm actively making fun of the "everything is ___ist" thing that is going around
I still remember the debate about whether the "master/slave" paradigm was racist
And the github issues "Fire this guy from the project because he made a rape joke in 2007 on Twitter"
9:08 AM
A comment I made on The Workplace got deleted :D
Probably too offensive to tell someone they did a bad thing
9:20 AM
If you could include any three characters into Smash, which one would you include?
Is Political Correctness a character somewhere? Cause if yes, it will be the doom of everyone
@M'vy I'd honestly pick Remilia Scarlet as a sword archetype, Marisa Kirisame as a zoner and Yukari Yakumo as a tech-based character
Final Smash of Remilia would be a huge magical attack with her spear Gungnir, similar to Ridley's Skewer, but more visually entertaining
Final Smash of Marisa would be MASTER SPAAAARK, which is basically a huge beam like Samus Aran
Final Smash of Yukari would be the Border of Life and Death, basically a clone of Zelda's final smash
9:41 AM
The fact that Touhou is actually quite big in Japan puts this "Touhou in Smash Ultimate" thing in this uncanny valley of "Maybe it might be possible"
2 hours later…
@ConorMancone Well, they are a prominent target
More difficult to remain secure if people actively attack you every day
An agency inside of the DOD, which is in charge of secure communications and IT support, had their systems breached
@MechMK1 Indeed, but I still find it funny! This is actually one of (I think) the best arguments against the recent push for putting backdoors in encryption
@ConorMancone The people who argue for backdooring encryption still think there is a difference between "consumer" and "military"/"government" encryption
Yes, even people from the government think there is.
Especially if a government agency somewhere has easy and direct access to a large number of external and "secure" systems , it will simply become too big of a target
And you have to say: Do you want that the algorithms used to secure your nation's most confidential data have a single point of failure?
11:41 AM
What was the malware campaign that caused a large amount of damage and turned out to be propogated by a 0-day that some branch of the US government was holding onto but accidentally leaked?
@MechMK1 why yes, yes I do
This is going to bug me until I remember which one it is... It's on the tip of my tongue....
YES!!! I had "deep blue" stuck in my head and knew that wasn't it
Yes, eternalblue was such a shitshow
But when I try to convince people that backdoors are not a good idea, I use lock analogies
I say "Imagine there was only one producer of locks, and everybody had to use those. Do you want those locks to be secure? or not?"
And if they say they want those locks to be secure, then the result is that the bad people will also have access to secure locks.
And if they say they want insecure locks, then ask them why they want a lock in the first place.
"But can't we give the bad guys bad locks?" - No, we can't. There is only one company, and we can either make all locks good, or all locks bad.
2 hours later…
1:20 PM
Locks are definitely the go-to analogy for anything security related. I still really hate the modern discussion about "responsible encryption". I vomit a little everytime I hear that phrase...
@ConorMancone It's such a loaded topic
You can make anything sound arguably in your favour by adding loaded terms like "responsible" to it
"responsible", "common-sense", etc...
Because it not-so-subtly implies that those who argue against you are irresponsible and lack common sense.
E.g. "We don't want to ban anonymity, we just want to make responsible identity laws to prevent anonymous hate crimes"
Unfortunately various governments are smart enough to choose their words in such a way to make their points sound as appealing as possible. More unfortunately, they aren't smart enough to be trusted with backdoors everywhere (although to be fair, no one is, which is pretty much the point)
I remember a time where you could call people "retarded" without getting banned or called a Nazi or without people trying to call your employer and getting you fired
I swear to God if I ever have a company and someone calls me and explains that one of my employees used the word "Retarded" online, then I'd say it's their damn right to do so
@ConorMancone Putting backdoors into every encryption algorithm on the planet is not a good idea. But on Government, it is. Government, not even once.
Protip: Micro-Aggressions can be countered by Micro-Not-Giving-A-Fuck
2:05 PM
I've been digging around the most downvoted questions on ISSE and it's
just a joyous experience
@UwU What did you dig up?
My favorite is this one
Q: Viable way to ruin a milk corporation?

user37603Hack into their system and change the "Sell by" date so that it is immediately bad. How long do you think until they notice, if you pull it off?

The deleted answer:
> That seems like a lot of work. Have you considered cowpox?
To be honest, I only wanted to get to 10k rep so I could see deleted posts
We have some really good deleted answer
Let me quickly look one up
2:13 PM
This one is bizarre
Q: Need more options

tedsince I learned coding I was writing on a 7 year old laptop, sadly it's gone now, so I need a new one. I've been thinking all night about wjat I can do, I could only think of some small posssibilities, I asked here because maybe some of you could give me more options. I have a Drive-by download ...

This one was too long to paste here
@UwU I like the fact that everyone takes this guy serious
Snowden is that you?
It's just so..... so edgy
why is it so edgy
Every time a kid got mad at me on the internet and threatened to hack me, I would openly invite them to do so
@UwU Edge is the currency of angsty teenagers
Q: I want to learn hacking but unable to connect to internet

Slim ShadyI'm not sure if this is offtopic or not but i'll ask it anyway. Im 15 and i am into web design and development, working on PHP and MySQL. And i want to learn hacking but unfortunately my windows computer doesn't have access to the internet. There are some open public wifi connections but my pc's ...

ah yes
wanting to hack at 15
The problem is that those who want to learn "how to hack" want to do it to impress their peers and seem cool and mysterious
It has nothing to do with a desire to become knowledgable
2:17 PM
he doesn't realize it's boring as shit
Well, not always. But you can only really understand the cool parts if you are part of the real hackers
having that leaked Zynga database doesn't make you cool
maybe xxs makes you look cool
it made me feel cool when I learned it
The cool parts are something like "Look, I can write to this part of memory after spending 200 hours researching how to do that" and not "I press one button and facebook is down"
All of those hacker fantasies, because that's what it is if we're honest, are just fueled by movies
You could just as well say I want to be a ninja
Q: White Hat Communities

Charles HoskinsonI've been searching Google for a bit and I'm having difficulty finding credible White Hat forums. For example, when one wants to discuss bitcoin they go to bitcointalk, is there a white hat equivalent? Edit: My goal is to assemble an appendix of communities that an individual learning about c...

But... I'm a ninja hacker already...
2:20 PM
Loving the comments on this one
@FireQuacker Yeah, but you were that before it was mainstream
The funny thing is that Sec.SE is a white hat community
The DMZ is this dark mysterious place where the arcane knowledge of cyber security is gifted to only the most promising aspirants, and also where MechMK1 comes to shitpost monday to friday.
@MechMK1 I dunno. There are a few users who have interesting... stories
Q: How i can stop already sent email?

Md. Helal UddinI have a Gmail account. Unfortunately I have sent an email from my Gmail account. How I can stop or back this email ?

first stage of grief
@FireQuacker Rory is kind of an important guy, Conor has a PhD, schroeder worked for a bank, etc...
2:23 PM
How about forest?
I know enough about forest to know that the less I know of forest the better it is for me.
But man, I miss him
@UwU Reminds me of the guy who made a bomb threat to his university, then tried to play it off as a prank
oh yikes
"it was just a prank guys please don't send the police"
Yeah that was a big oof moment for him
I had three threats called on my highschool
one was so bad they told us not to come
How is one called in threat worse than another?
2:25 PM
the kids doing it always get caught
apparently he had some proof there was a bomb in my school (?)
we weren't really allowed to know
**Situation:** An important exam is coming up and you did not learn enough. How do you react?
a.) Take the exam anyways, hope to get at least a passing grade and if not, take it again
b.) Call in at least three days before the exam and say you want to take the exam on another date.
c.) Go to your doctor and claim to be sick, so you get an excuse as to why you didn't attend.
d.) Send a fake bomb threat from an anonymous e-mail address to have the exam cancelled.
you can't hide behind spoofed emails and phone numbers for long
@MechMK1 That question is disturbingly relevant to me
@UwU At least, stupid teenagers who are too dumb to learn for an exam can't
@FireQuacker Pick A or B, trust me
It's gonna be A. I paid for the test already.
2:28 PM
Good on you
you'll pass
I believe in you
I winged so many of my tests, I don't even remember
I was a terrible student
Like, the worst kind
I have 3 exams next weej
I'm not even dumb, just lazy as fuck
I know that feeling
I just don't want to learn shit that won't ever apply to me
"You know, you could achieve great things if you just put in some effort" - "Yeah, but I can achieve mediocre things by putting in no effort, and I can put in all the remaining effort into things I actually enjoy doing"
2:30 PM
I might not be the best cyber security expert out there, but I think I don't need Calc 3
oh lord
Q: Someone claims to have hacked my WiFi. What do I do now?

Julie BothellMy son plays Minecraft on the internet. Someone said they hacked into his WiFi. Our WiFi is locked and must have a passcode to access. Is it possible this happened and, if so what should we do?

Well, this isn't a bad question
I think it's actually fairly reasonable
"My son plays Minecraft on the internet"
just that line
Yeah, but there are enough parents who have no idea about computers and they'd believe that
fair enough
It's not a bad question, just a question from someone who has no clue
Bad questions have no context, no clear goal, often not even a question
2:33 PM
Kind of wonder if it will be worth creating a canonical question to point all the "somebody hacked my wifi" people to
They're just loosely coupled ramblings held together by brief moments of lucid thought
like this one?
Particularly the clearly paranoid ones
Q: where can I find list of zero day vulnerability?

user56978I want to have list of zero day vulnerability, Could any one intuduce some site which annonce them?

The answer is soooo good though
2:34 PM
the answer is amazing
Q: How did (in particular) Americans just go along with the concept of having to own and show "photo id" everywhere?

Seann BarcelosI remember hearing or seeing a documentary or something a "long" time ago, likely in the early 2000s, about how a lot of Americans (USAians) refused to show an "id" even when voting, where it might possibly be justified to demand some form of identification in order to prevent duplicate votes (if...

This for example is a bad question
It's off-topic and basically just a rant
A: Someone claims to have hacked my WiFi. What do I do now?

andDevWIt's psychological warfare, their true goal is to get you scared/angry enough to cut your son's funding, taking him out of the game. That being said, if you're running an off-the-shelf router you're quite vulnerable. Check this list of free and open-source router firmware and then either flash y...

Ah yes I see you are a man of culture as well
Seems quite a bad advice to ask non technical person to go mess with non main-stream open source stuff
What? ahh I didn't see what M'vy posted
2:37 PM
@UwU ;)
Q: Adobe Photoshop has killed my creativity by introducing so much anti-privacy, anti-security, and dumbed-down bloat

Edgar CilluffoI could pick so many angles to this, but I will focus on a very famous piece of software which has been utterly ruined in recent years: Adobe Photoshop. This is not a rant, but related both to software design and psychology. These days, it is not possible to install it on a PC without going thro...

Why don't these people just write an essay
Yeah, I saw that one
The platform I usually go to when I need to rant is...
I mean well, you're on it right now
Q: Password of Information Security

bandanaWhich one of the following statements about a password is TRUE ? a) It must be changed only if it is compromised b) It cannot contain special character symbols c) It must be registered with the system administrator d) It should be changed regularly

Quiz questions may be my favorite
People mis-using SE in general
It's part hilarious, part sad
@MechMK1 That's humanity
2:39 PM
Do you want to see one of my finest troll-posts ever?
Q: How to deal with apathetic co-worker?

Robert S.I work in gastronomy in a rather small restaurant. The co-worker I spend most of my work-day around has become more and more apathetic over the past few months. It was a very gradual change, so I am uncertain if it has to do with a specific event. I generally enjoy my job and try to be in a good...

I'm really proud of that one
@MechMK1 Rhetorical question. You will post it even if we write "no" just to troll us.
Q: hashing, salting - but also sugar and pepper? Uncrackable?

PiddienWhat do you think is the best way to store a password in the database? I suggest: hashing using something way better than MD5. But what? salting with a very cryptic non-readable salt such as DonKEYFace or something "sugar" - some energy. Timestamp! and check it with the db later "pepper": has ...

@A.Hersean of course I would
"And please, do not just point to theory. Everyone knows that already. Do some calculations! Show me how quickly you could decipher this!"
@UwU "You can't crack this message, therefore it's safe" is the biggest fallacy in cryptography
2:41 PM
don't ask me to do more work than I want to for your question that you have put 0 effort into
Especially for amateur cryptographers, and I'm using that term loosely
I usually go by the idea that if people want to crack something, they will crack it
Well, in cryptography, you need to be sure of the claims that you are making, and how to prove them
For example, an attacker may not need to know the content of a message, only that two identical messages were sent to two different people
Once you get in mind that security is a trade-off, you really don't care about these so much.
@M'vy In which way?
2:43 PM
a.k.a. "Given sufficient resources, one can achieve to go around any security".
@M'vy Yeah, so all I need to do is to make this task more resource intensive than the asset is worth to the attacker
Then security really is: how much resources you want to spend, to make it difficult enough to discourage someone who can't/won't invest that much resources
If you could spend USD to get access to my 239.41 USD bank account, then you successfully wasted a lot of money for nothing.
I mean, you could have trillion dollars invested in security to protect the gov stuff. If you are willing to invest a million you probably can find someone willing to extract info X for you without having to defeat the main security system they put in place.
@M'vy Yeah, but I've been preaching for a long time now that completely ignoring people is a terrible idea
So many companies are like "It's just reachable internal, so we're 100% safe"
2:47 PM
"Path of least resistance"
Your employees aren't nearly as trustworthy as you may think
Like the bar of chocolate for your password study
They are trustworthy up to the amount you're willing to pay them to be trustworthy.
@M'vy Like this xkcd? xkcd.com/538
I tell you what, I'll go downstairs and give people chocolate in exchange for their Windows password and I'll get tons of them
2:48 PM
And by pay, I don't mean necessarily money.
I don't understand why people don't just say some random shit and take the chocolate
I mean, that's what I would do
It could be trust, loyalty, autonomy, well being, feeling protected etc
@UwU Maybe some did, how would you know?
God I hope some did
that gives me a little more faith in humanity
@FireQuacker yep
2:50 PM
Q: How could an attacker have gained remote access to my laptop?

COURTNEYI have a 15 yr old daughter who's become not only a certified Microsoft Expert, but by pure accident, it came to my attention she'd long ago created a SPLIT network connection on our internet, HIDDEN from my view. I've had numerous problems such as errors when trying to open certain web pages...e...

how did we miss this prodigy child?
I honestly don't know what these people are trying to do
A low-effort troll maybe?
I recall a question on SO a few years back where a guy used the phrase "c+plus"
that sounds like something I would type
I doubt any of the above-stated is anything but fiction
Oh my god, it reminds me of that 15 year old kid!
It was soooo funny
There was a 15 year old kid who made a facebook account, pretending to be 25, ultra rich, having a sex-obsessed 18-year-old girlfriend, etc...
oh yikes
The funniest thing came when his mother discovered the account and ratted him out
2:54 PM
oh no
"My son has a very vivid imagination, and I'm sorry for everybody whom he may have offended"
@MechMK1 I mean, if you aren't technical in any way and you don't trust your kid, and then your helpful technician is one of those guys who mumbles a bunch of jargon and you don't understand what he's saying...
@FireQuacker the question isn't written in that way. It has too much jargon in it
People who know nothing usually state how they don't know anything about some topic
you gotta master the art of acting clueless
A good troll is one that convinces everyone he is no troll
2:56 PM
too stupid you're faking, too smart you're lying
Like Robert fucking S.
@RobertS. OK, so... I'm probably crazy but after reading your question I am seriously considering whether your coworker is called Squidward Tentacles and you work in the Krusty Krab — and the fact that your own name is essentially Bob is not helping at all. — walen Jun 5 '19 at 8:15
It took me so long to come up with that script
But you know what the best part about it is? It is, after taking all the comedy away, still a good question
> While this may not be what you were asking, it might help. Your kid is clearly talented, and more to the point is obviously bored. Point her at the Certified Ethical Hacker qualification, it will take her mind off mischief and will set her on a decent, challenging and respectable career path doing something she loves. – Chet S May 6 '14 at 8:00
And that's what makes it such a good troll
Q: how can one find the honeypot

shahrozhow can one find the honeypot while want to observe the other hackers.

@M'vy If it's true, a good advice
2:58 PM
@UwU Usually winnie the pooh has one nearby, you gotta ask him
high quality response right there
How do you find honeypot. Just smell the air for honey scent?
The "the" makes this question so good
2:59 PM
The big honeypot in the sky where all good hackers go!
"How can you determine if a server or service is a honeypot?" would be too on-topic. "How u find the honeypot?" is so much better
The mother of all Honeypots
"while want to observe the other hackers"
are you a hacker sir?
Clearly, they are a hacker and want to learn from others...
You don't know? All the cool hackers meet in the honeypot
3:00 PM
You thought they were going to use a honeypot for good things?
It makes me sad that the DMZ is not called "The Honeypot"
Honeypot would be more fitting
"bro you wanna hang out in the honeypot tonight?"
"sorry bro i'm hacking the NSA tonight"
@RoryAlsop Who do I need to pester to make a petition to rename the DMZ to "The Honeypot"?
@UwU I wish hacking was more like in Shadowrun
honestly though
"I rolled a 18."
"You get into the bank."
Q: MPR I suppose somehow I found a way to make a super hacker angry with me

donnyI suppose somehow I found a way to make a super hacker angry with me. I've lost three cellphones. It might have all started with the iPhone 4 getting locked then both androids to simlock. And I'm at three laptops to this ignorant Windows mpr rewriting boot that starts as soon as I turn on the scr...

what qualifies as a super hacker?
3:04 PM
You clearly didn't ever play Shadowrun or you'd know it's played with a D6
yikes you caught me
Off to impostor jail you go
i swear my friend used a d20 when he played
Your friend played the illegal D20 edition
@MechMK1 you can post on meta.sec.se
3:06 PM
sorry guess i'm not a nerd
How do people feel about this idea? Would you like to see the DMZ being renamed to "The Honeypot"?
I think that's a great idea
@UwU Everyone can be a nerd if they want
Don't know, I'm used to it now ;)
Q: Are the only people who can work in security those who were learning from 10 years old?

S7_0I'm a second years Master student in computer science. As time passes, the more my desire to work in computer security increases. I have many friends who are more experienced than I, who told me that I'll not be able to work in this area, because most of the people who are working in this area ...

3:08 PM
Q: Can we rename the DMZ to "The Honeypot"?

MechMK1I know it's a silly request, but I just feel like name would fit the theme of Information Security better. It was also inspired by this rather funny question, where somebody wanted to create a honeypot to watch other hackers. Would people like to see this change?

10 year old hacker gang rise up
"This post was made by 10 year old hacker gang"
We put the kid in skiddie
"I know your ip address don't mess with me"
Yeah, as I said above I had plenty of kids say that to me
I even helped them
I told them what OS I was running, etc...
One tried to explain to me how they can hack my gmail account if I told them my e-mail address
It was funny
oh now that's just the best
They think that online accounts are just like real locks. You only need a paperclip and string to get into them.
3:14 PM
@UwU I actually once picked a lock with two paperclips
It was the coolest moment of my life. Everything else paled in comparison.
That's the key skill to picking up chicks
ba dum tss
Actually my girlfriend was completely unimpressed by that
You might wanna use something a bit more flat and a paper clip actually
@M'vy It was a bit of an older lock already, so it was very easy to get the clip in
3:31 PM
Man, it's one of those "It's friday and MechMK1's report isn't done yet because he kept wasting time on the DMZ" posts
You got caught in The Honeypot
> mfw
5 hours later…
8:25 PM
is there such a thing as roll your own non-crypto? ie doing something unique-ish to the password before it gets hashed so that you can say hey they had to illegally reverse the code in order to be using our internal APIs
So not a security feature but a sort of watermark to prove somebody was reverse engineering your stuff?
@MechMK1 So sad! In movies though picking locks is extremely easy, so I suppose you could always blame that on movies setting the bar really low
@Gregory Interesting. I don't think I've heard of anything like that
Not sure how necessary it would be. Is it that hard to show that somebody's reverse engineering your stuff? (IANAL)
This guy:
Q: How to embedded exe file into png file such that when png file open then exe file also open with png?

Mobeen GhaffarNo code yet.I have used binary and base64 to embedded exe and png file into png.But none of these method works for me.Because when I run png file exe is not run.I didn't why?I need help in this project saveFileDialog1.InitialDirectory = @"C:\"; saveFileDialog1.Filter = "PNG (.png)|.png|J...

Reminds me of my very first attempt at programming (maybe I shared this story before?). I had an old DOS game that I loved to play, but it was a bit buggy and would always crash at the worst possible time. I had a vague understanding of "if" statements and what-not, so decided I could fix it myself. I opened the .exe file up in a text editor, fully convinced that I could find and fix the bugs
Naturally, opening a txt file in a text editor was a completely unsuccessful venture, and I was forced to conclude that I had absolutely no idea what I was doing and was a complete fool to even think that I knew what I was doing
Pretty much the text book example of the dunning-kruger effect.
8:48 PM
@FireQuacker I just see the boilerplate "Do not look at this code" legalese in the js files, and was wondering if it would be easier to prove that this was done if there was custom uh.. "obfuscation code?"
9:27 PM
@MechMK1 the correct route is to open a question on meta, however this was done previously and The DMZ was voted in
@RoryAlsop Ah, but "Honeypot" wasn't suggested at the time. Maybe the users these days are more clever :D
MechMK1 already opened a meta question: security.meta.stackexchange.com/questions/3353/…
Remember, honeypot is where you expect to trap enemies. DMZ may have good and bad mixing together in an environment that isn't safe but has done controls
As far as good and bad, the chat isn't too far different from the main site. And chat sure doesn't sit between Google (the "outside") and anything.
Meanwhile, chat could conceivably be a place where all the cranky sarcastic people (insider threats) get slowed down by participating...

« first day (3354 days earlier)      last day (35 days later) »