« first day (3869 days earlier)      last day (307 days later) » 

12:05 PM
@FireQuacker I do. I think security by obscurity does have the benefit of driving off low skill and low motivation attackers. However, you should never ever tell that to anyone except a fellow security guy. Otherwise people invariably decide that relying on security by obscurity
However, I don't think it will be particularly useful in this case since I guess the software will get posted online by other people anyways
 
@nobody The thing is, a lot of stuff that is claimed to be "security by obscurity" really isn't.
 
@FireQuacker Hmmm... I had my school's network admin password, but I never thought of accessing the security cameras.
 
For example, saying "You should not disclose your web server's version and OS version in the server header" - that's not security by obscurity
"Security by Obscurity" happens when you refuse to have anyone look at and assess the security of your "thing" (algorithm, etc...), saying that that act alone will make it insecure.
 
@MechMK1 That's just obscurity
 
Yeah, and it's not a bad thing to limit the amount of information you disclose
 
12:12 PM
@MechMK1 Well, the problem is, if the vendor themselves won't do anything about security, a layer of obscurity at least reduces the amount of stuff I have to deal with
@nobody *Otherwise people invariably decide that relying on security by obscurity is good
 
Oh shit, then you have a problem
 
@MechMK1 Everybody does. Computers are a problem :)
 
Computer problems are the best problems to have though
Because they're logical
Even the weirdest, most obscure problems have a logical reason for them occurring
Whereas people problems...I don't understand people
I really don't
 
"Security by obscurity" should not be confused with "need to know".
 
"Relying on the secrecy of the key is security by obscurity. If the key is disclosed, your algorithm is insecure."
 
12:25 PM
Anyway, for the problem at hand, the solution is a PKI.
With key embedded in HSM or secure elements (SIM cards) in the cameras' hardware.
The "secure" hardware should handle authentication of the software (or user) and allow the modification of the firmware.
You could do the same without secure hardware, but that means doing everything in firmware and that's easier to hack, but could be enough depending on the threat model.
 
1:07 PM
@MechMK1 So far, I have just avoided people. I don't know how long I will be able to do that
 
@nobody I've attempted to understand them, but failed
 
Nobody understands perfectly other people. Most do not even understand themselves. Neuropsychologists (and others) are just beginning to explore their field.
And I meant nobody, not @nobody. No pun there, sorry.
 
People are random. Interestingly, they are not cryptographically random, yet we fail to understand them
 
I don't get it at all
There was a girl I've been talking to for two weeks
 
The distribution is not uniform, but still unpredictable.
 
1:12 PM
Then, out of nowhere, she stopped talking to me
No idea why
 
Maybe she's dead?
 
I probably said something wrong, but I don't know what
Doubt it
 
@MechMK1 Send us all your chat transcipts, maybe we can help :)
 
I'd rather not - not because there would be anything objectionable in there, but because I believe private conversations should remain private
 
It might not be you. Her agenda might have changed. Or the boyfriend she did not talk about got very jealous. Or any other random stuff that happens in real life.
 
1:14 PM
@MechMK1 You thought I was serious?
 
@nobody No, but I like to respond to obviously joking queries as if they were serious
@A.Hersean Yeah, who knows?
Though I would find it weird if he got jealous over topic like "What's your favourite fish for sushi?"
 
@MechMK1 Just keep trying, there has to be someone who falls for you. And remember not to try to understand people.
 
@nobody :D
 
:sigh: You take my jokes seriously, and now you think I'm joking...
 
@MechMK1 You never met one of my ex-GFs.
 
1:22 PM
@nobody I know myself well enough to know that won't happen
@A.Hersean What happened?
 
@MechMK1 She was pathologically jealous (among other related behaviors). For example, she stopped talking to her only brother (except to insult him, even in public or in front of her family) because he waited a few weeks to tell her about his new girlfriend. And she was not dating him, he was her brother. I let you imagine how jealous she was about me. Every woman I talked to (or could talk to) was a threat (and worthy of being insulted if she was kinda pretty).
So "What's your favourite fish for sushi?" would be 7 words too long for her.
 
@A.Hersean Literally same.
My ex was literally the same
I get a call from a female co-worker. Her question was "Hey, could you do me a favour and join a meeting this afternoon? I might need you for an estimate"
Me: "Sure, just send me the outlook appointment"
My ex almost freaked out, asked me why I was "speaking to a woman"
 
1:44 PM
Her jealous behavior stemmed from her extremely deep lack of self-confidence combined with an extreme pride: Her pride did not allow her to show weaknesses, so she lacked self-confidence and self-esteem. Which in turn needed to be compensated with an exaggerated pride. Since she could not trust herself, she could not trust others. So she was jealous because she could not trust someone else, and because she could not afford be in a failed relationship.
 
Yeah, I know exactly what you mean
 
 
1 hour later…
2:55 PM
enderland, Valhalla
7.7k 3 11 14
This user has only one question and nothing else yet he has moar rep than me
 
A good reason why I believe that questions should give a maximum reputation, like 2000
Since you can gain 200 rep per day at max (or per question/answer?)
I think it makes sense that one answer or question should award 2000 rep max (excluding bounties)
 
SE greatly rewards people who asked a popular question many years ago
 
Simply put: One interesting question or simple answer to a common problem should not yield magnitudes more reputation than a large amount of well-researched, but more specialized questions/answers.
 
I know this problem has been discussed on MSO or MSE somewhere, but I can't remember where
 
@MechMK1 It shouldn't, yet SO optimized the HNQ to do just that
 
3:03 PM
I'm not bothered so much by this particular user because was highly active on other sites, so I don't think the privileges will be misused
I assume the HNQ was put in place to get more traffic to other sites, but it brought many other problems as well over the years
Man, just when we start talking about SE, JourneymanGeek leaves the room...
 
Do you think that upvotes from high-rep users on a site should hold more weight than random drive-by users?
 
I'm pretty sure that idea has been floated before. I assume there was some reason it wouldn't work out well
Actually, the biggest problem with weighing votes is probably the mechanics of it. The reputation count calculations are difficult already. Add in weights and it becomes trickier.
Not to mention that votes are supposed to be private.
 
That would cause elitism, where a few long time users would have more influence than other experts.
 
"I just got one upvote but suddenly I have 10,000 rep???" "Oh, Jon Skeet must have upvoted you"
 
I think a cap as suggested by MechMK1 would be best. What's the practical difference between a 200 votes question and a 800 votes (with the security.SE scale)? Both are great, one just have more views.
Or an increase in reputation gain proportional to the logarithm (or sqrt) of the Q/A.
 
3:14 PM
Yeah, per post caps seem nice
 
Diminishing returns on reputation, per post.
 
But the first thing to do should be to fix the damned HNQ algorithm. There are just so many obvious flaws in it.
 
The crypto.SE hates it. It only brings stupid answers by know-it-alls.
 
126
Q: Revisiting the rep cap (yes, again)

Jon SkeetTL;DR: The rep cap system isn't as effective or fair as it might be. I'm proposing one alternative for comment, and would welcome other suggestions too. Disclaimers I'm pretty sure the rep cap hits me harder than anyone else (pretty often over 1000 points in a day), so a change could easily be se...

28
Q: Are reputation points working as intended?

gmanUPDATE: This is an extremely rare situation AFAICT so please ignore I hate that I look at my rep but that said I'm wondering if points are working as intended. I ask because I saw at least a few questions and answers with +5000 upvotes. That means for one question or answer that person is ev...

6
Q: Advantage to Old Users

coder hackerIsn't there an advantage for old users who started using SO much earlier? There are many basic questions that have been asked and answered in an early time when SO was launched. These questions are accessed and seen even today thousands of times per day. So such users get a higher reputation tha...

 
3:36 PM
@FireQuacker I could summon him.,...
@A.Hersean They could opt out?>
 
 
1 hour later…
4:44 PM
If I have half written an answer, take a break, and come back to find another answer that includes most of the points I want to make, should I continue writing it?
 
5:18 PM
Up to you. If it doesn't cover everything you were going to say, maybe the other part you were going to say makes it worth it.
I think I've been upvoted for casually mentioning something as an aside when I was trying to talk about something else, but somebody thought the aside was interesting
 
 
3 hours later…
8:07 PM
> I submit to the discussion that cost outweighing benefit might be a good business model in economics but not necessarily a good model, or in this case, the foundation for doing the right thing in cyber security practice.
Umm... what? Cost-benefit analysis shouldn't be done for security?
That's the end of my discussion with the guy who thinks firmware and utilities should not be easy to download
Basically, his argument is, if it can increase security in one area, it should be considered an industry best practice, whether or not it decreases security elsewhere
I think I'm done with the discussion
 
 
2 hours later…
9:47 PM
@FireQuacker Ask him to set an example by applying that to his personal security practices
 
10:47 PM
I wonder if "cost benefit analysis is evil because it's capitalism" is a thing...
 

« first day (3869 days earlier)      last day (307 days later) »