The DMZ

Scott Pack

02:35

@LucasKauffman Iain stepped down because he was getting too cranky about it all. Vortaq has the angry crusty face, but in reality I find him to be pretty reasonable. Sysadmin1225344t52329798766!!!8877one0987835 is without question the most reasonable. He's just never on chat and his meta posts tend to be a novella.

Simon

02:54

@ScottPack ILY2

Simon

03:25

He fled.

Scott Pack

eh?

Simon

o

Scott Pack

hip hop horray

AviD

06:44

@Iszi its actually not that complicated (considering that Excel is not a database ;-) ).

It's in two and a half steps: first find the latest date for each UID, which is simple to do manually but not formulaicly; then find which row is the one with the found date; then pull out the status from that row.

you can combine them, but logically its still the same.

Terry Chia

08:02

I'll just leave this here, github.com/dgorissen/coursera-dl

Looks handy for the people who use Coursera.

Lucas Kauffman

08:57

@ScottPack hes not a mod anymore?

Lucas Kauffman

09:23

getting the keys to my own first place tonight, kind of excited ^^

AviD

We'll all be over with a keg and some pizza soon enough.

Lucas Kauffman

09:52

@AviD awesome

Lucas Kauffman

10:13

@AviD Ill make sure the glasses are cold

AviD

@LucasKauffman and the chicitas are hot

Terry Chia

Introducing the best social networking site ever, PRSM. getprsm.com

4

AviD

11:26

@TerryChia I don't get it, how is that different from Facebook?

Terry Chia

@AviD It's automatic, and you don't have to sign up.

Gilles

@AviD you can choose not to have a facebook account

@AviD Your argument that there are other people who call themselves security professionals is a good one

AviD

@Gilles so what makes PRSM better?

Gilles

unlike the “more flood of non-pro questions” which is a bogeyman

AviD

@Gilles s/people/professions/

@Gilles right, I agree on that point - I wasnt clear about it the first time around.

Gilles

11:29

but I don't like “information security”, I don't think it's an improvement on “IT security”

it's far too long

and it doesn't describe the scope any better

AviD

@Gilles I think its definitely an improvement, even if its not quite there yet - though I dont see anything better.

@Gilles I think it does describe it better, since "IT" is pretty limited.

Gilles

Is it really a problem, tough, that there are other security professions?

Unix & Linux doesn't do unix programming. We get the occasional programming question, but not such a flood that we don't survive

Terry Chia

@Gilles It is better IMO, as "IT Security" wouldn't cover questions related to physical security or social engineering.

AviD

some could legitimately see it as excluding things like small companies - "we dont even have an IT department!", big companies - "this isnt just the IT department", academia, etc

Gilles

Theoretical Computer Science doesn't do all theoretical CS questions, only research-level. They get the occasional non-research-level question but they survive

AviD

11:32

@TerryChia or anything outside of the IT department.

Gilles

@TerryChia but “information security” doesn't do any better

AviD

I think in this case its not like TCS or Unix - we're not talking about slightly overlapping scopes, my point is that the term itself is unambiguous - depending on your field.

the term is not fuzzy, but it has several distinct meanings.

I always find it irksome when someone just assumes that his narrow definition of a shared term, is the only meaning there is.

@Gilles well, that does cover soceng, and a certain subset of physsec.

Terry Chia

@Gilles Well, "information security" covers it a good deal better I will say as most physical security and social engineering techniques are aimed at getting some sort of information from the target.

AviD

I think instead of looking to Schneier, I think we should look at the CISSP CBK as the defining scope.

@TerryChia physcial security - not so much.

Rory McCune

@AviD what ya mean you don't like the idea of a social network that has all your stuff in one place and you don't even need to login?

AviD

11:36

safe cracking?

pickpockets?

attack dogs?

killer robots?

@RoryMcCune again, whats the difference from facebook? ;-)

Terry Chia

@Gilles It's not really a "Are we able to survive it" thing. It's more a "what sort of image do we want to present to the general public" sort of thing.

AviD

@TerryChia I agree with this ^

Rory McCune

@AviD well one of the two is a parody (try clicking the sign-up button) :)

Terry Chia

@AviD I'd argue that safe cracking killer robots and pickpocket attack dogs would definitely be awesome questions to have around here.

3

AviD

@RoryMcCune again, how is this not the same as facebook?? ;-)

Rory McCune

11:37

@AviD :op

AviD

@TerryChia be that as it may, "info sec" simply does not cover those.

Terry Chia

@AviD New A51 proposal methinks.

AviD

and I think that is @Gilles point, that they should be ontopic and encouraged. And "Information" doesnt.

@TerryChia probably too narrow. How many safe cracking killer robots and pickpocket attack dogs are there?

and what if I want to go a little less mainstream, and go for safe cracking attack dogs and pickpocket killer robots??

Rory McCune

@AviD ahh well that depends on whether you regard IT security as a straight subset of infosec?

Terry Chia

@AviD I dunno, is there some sort of census out there that tracks these sort of things?

AviD

11:40

@RoryMcCune I dont think safe cracking killer robots and pickpocket attack dogs are included in either one.

Rory McCune

you could argue anything involved with the processing of information is ontopic in an Information Security forum

AviD

and I would say it is almost a complete subset.

Rory McCune

safe cracking is a means of defeating a security control related to the storage of information

AviD

@RoryMcCune "information"???

Rory McCune

killer robots are a mitigating control against physical attacks on stores of information as are attack dogs

3

AviD

11:41

diamonds! gold! microchips!

Rory McCune

sure bits of paper in a safe :)

we didn't specify that only currency can be held in the safe

Terry Chia

@RoryMcCune That deserves to go on some pentest report.

AviD

heh. So I could show up at my bank, and read off a list of bills ID#, and get the equivalent in cash money?

Terry Chia

You doing any assessments for power crazed CEOs?

Rory McCune

@TerryChia sure with the correct threat model it would make sens e:)

@AviD well information has value under many circumstances

Gilles

11:42

@RoryMcCune but what if you have diamonds in the safe? I don't like itsec/infosec because it invites scope micromanagement: “no, if you're storing diamonds, your question is off-topic”

Rory McCune

information about when things will happen, what things will happen, can be directly translated to cash

Terry Chia

@RoryMcCune If you were a supervillian and your adversary was James Bond?

Gilles

I've seen this on other sites and it isn't pretty

AviD

@RoryMcCune heh, that reminds me of that time @nealmcb practically called @beth crazy for suggesting armed guards.... in a warzone.

Rory McCune

@Gilles sure just because not all uses of a control are in-scope doesn't mean that the control is not in scope at all

that would be like saying that not all uses of locks are in scope so no discussions of locks can take place :)

just don't specify the contents :)

TBH a lot of the questions that get put on hold/closed here can I think be answered usefully by only answering the relevant bits

Terry Chia

11:44

Also, have we given any more consideration to replacing the lion's head with a Bear instead?

2

Rory McCune

@TerryChia that's easy as soon as you catch him you shoot him, no questions, no explanations nothing

Terry Chia

@RoryMcCune What? You mean I wouldn't have my opportunity to gloat? Unacceptable!

Rory McCune

@Gilles another point (which I sense I'm in a minority in) is that I think it's quite easy to be too strict on scope on these sites. We develop a range of ideas of what's in and out of scope then apply them to new people, but all they see is what they thought was an ok question getting closed for reasons they don't understand

my feeling would be that we answer more of the borderline questions, but this would be why I wouldn't run to be a mod :)

Gilles

@RoryMcCune I agree with interpreting the scope on the broad site, with one caveat: it must still be something where we can expect to have expertise

for all you might like to answer a gardening question on sec.se, there's no local expertise, no peer review

so we should reject gardening questions, even if someone happens to know the answer

Rory McCune

@Gilles yes if it's clearly not within the area like gardening would be here, but my personal feeling is that any definition of this kind of site will have quite a lot of fuzz in it..

AviD

11:53

@Gilles no, we should reject gardening questions because they have nothing to do with the raison d'etre of the site.

Terry Chia

@RoryMcCune That last point really isn't an issue about the scope of the site. It's an issue about perhaps encouraging people to edit the questions to bring it more in line with the scope instead of closing it outright. I know I'm guilty of really disliking the job of editing crappy questions.

AviD

but yes, I agree that the scope cannot be 100% strictly predefined, and we will always be surprised by questions that should be ontopic, but we did not realize as such.

Rory McCune

@TerryChia possibly but I think sometimes we have a too nuanced view of what's in-scope

as an example "shopping" questions get closed, but if you asked someone who didn't know the details of the site they would reasonably think that they're in-scope

AviD

however, the huge majority of newbie/offtopic questions really are offtopic, and should be closed as such. We just need to keep the open mind for the rare topic that comes up, and should be ontopic even though we didnt realize it.

Rory McCune

a question about the best product in a given circumstance sounds like it makes sense

AviD

11:55

@RoryMcCune yeah, I dont like closing those as offtopic. I see them as not constructive, even if they are ontopic.

I think that was the one change I really didnt like with the new close system.

Rory McCune

@AviD dunno. For me one of the hardest things in IT in general is sorting good products from bad and experience with the products is hard to come by

this kind of site could be great for that

finding new tools to do specific types of test etc

but that whole avenue gets shut-down

Terry Chia

@RoryMcCune Yeah, but that always has the problem of the most popular tool getting the most upvotes instead of the best tool for the situation.

AviD

well, as for allowing shopping questions at all, we've gone through that. Feel free top open that as a meta q, though.... but I would suggest doing some resaerch on that first.

@TerryChia @RoryMcCune ^. this is one of the big parts of the problem.

Rory McCune

@TerryChia possible but I know I wouldn't upvote something for being popular only 'cause I thought it was a good tool for the job..

AviD

Thats also why I really like the "shopping-guidance" type questions - i.e. what should be the criteria for selecting a product.

Terry Chia

11:58

@RoryMcCune See, that's just you. And possibly a few of the regulars.

Man, I'm really dominating the star wall recently.

2

Rory McCune

@TerryChia sure but I've not seen much evidence of popularity outweighing goodness elsewhere in the site (e.g. website recommendations)

so not sure I see why that would change for products specifically...

AviD

like your "Criteria for Evaluating Static Analysis Tools" question...

Rory McCune

@AviD sure but I like the "what's in your kit bag" style questions too

Terry Chia

@RoryMcCune Heh, that could be a good QOTW.

Rory McCune

they would need to be torn down and revisited regularly to keep currency but I felt that were useful...

AviD

12:00

@RoryMcCune dunno, those always feel like "getting to know you". they say more about the answerer, than the contents.

Terry Chia

Well, not so much QOTW as a regular blog post series.

AviD

yeah, it would need to be updated every week... ;-)

and thats another one of the problems with shopping q's.

and context etc...

Terry Chia

Didn't @ScottPack had an answer about that?

Dunno if he bothered to keep it updated though. Probably not that lazy ass.

AviD

I think a better q would be something like "a process to define your jump bag".... though thats a little fartsy.

Rory McCune

anyway the overall point I was making was that a newcomer to a site where questions and answers on IT security were made would think that that kind of thing is on-topic, so it's an area where the scope has been tightened in a way that people might find unintuitive, which in turn may put people off the site :)

AviD

12:02

@TerryChia no value in that for him.

@RoryMcCune that part, I find, has been improved with the new system, there are better explanations in place.

Rory McCune

@AviD do you think that products in ITSec change more frequently than other areas that are on-topic?

Gilles

@AviD how do I keep rabbits off my salads?

AviD

but "offtopic" vs "not constructive"... meh.

@Gilles lolwat?

I guess thats a "salad security" question....

Rory McCune

@AviD it's part of his insidious drive to include gardening in IT Sec

Terry Chia

@Gilles How about "How do I keep Bear's away from my salmon"?

AviD

12:04

@RoryMcCune most other sites its offtopic too....

Gilles

98

Q: Shouldn't "off-topic" be only about... off-topic?

A related question/discussion point to this one posted just now, but with a completely different rationale. Whenever a question is closed because it doesn't contain SSCCE, or specific code, it also gets marked as "off-topic". I would argue that this is confusing, especially to new users, since t...

Rory McCune

@AviD ah no I more meant that we provide answers about a wide range of things in IT security (including things like on-line references) which change frequently, if we're ok with changes in them, wouldn't the same argument hold for products...

AviD

@RoryMcCune ah, well, 1st of all is the inherent potential (potential? its practically begging for it!) for spam. 2nd is that truthfully I'm not a fan of asking for websites either.

Gilles

@AviD is it a security question? is it a sec.se question? Why or why not?

AviD

with the poooossible exception of industry-standard websites, like owasp, sans, pci, etc.... and even that I'm not sure about.

@Gilles well if you keep eating nothing but salad, you will be sec.se in no time.

Rory McCune

12:08

@AviD sure, especially with ones with a lot of dead content (cough cough OWASP cough), but without writing war and peace per answer not referring to outside sites is pretty difficult...

AviD

lol

Rory McCune

I just think that volatility is something that's inherent in internet based answers, hopefully people searching get used to that aspect of things

AviD

referring to an outside site, as a source and reference, is great in my book. Asking for e.g. "what site could I learn from" is a sucky q all around.

Rory McCune

I know that's why I use evernote webclipper now instead of bookmarks, too many times a reference disappears..

@AviD sure "what site can I learn from" is sucky, but realistically I bet we have sites quoted as references that either don't exist any more or aren't the best any more, it's inevitable...

AviD

@RoryMcCune okay, thats a different topic altogether.

Rory McCune

12:12

@AviD well not really, one of the arguments against product questions is that they go out of date, my point would be that that's no different to any other question, :)

AviD

the faq specifically does discuss not posting ONLY links, and content should be quoted such that an answer can stand alone.

@RoryMcCune which product supports feature X? --> probably out of date within a month, if its an important feature.

and, its not just a product reccomendation, its a list question.

so the list will never be complete.

and, as mentioned, it usually falls down to "what are the popular choices?" Which is a sucky question.

Rory McCune

@AviD really? I'd say that popularity usually has some level of reason even if it's not necessarily a good one :) so for example if someone said "what tools would be a good fit for use by a development team creating a new application in ASP.NET for completing source code reviews during development" that Q. would be a close as not useful?

'cause I would have thought that a good answer to that could be quite useful to a number of people :)

AviD

sorry - gotta run - be glad to continue this tonite. Or start a meta q....

Rory McCune

have fun out in the sun :)

Gilles

7

Q: Does the moderator agreement prohibit usage of certain browser extensions?

Our moderator agreement states: […] I acknowledge that I may have access to potentially personally-identifying information about Stack Overflow users and that in connection with such access […] b) I will not disclose this information to anyone, c) I will not store or copy this informa...

discussion moderator-tools privacy moderator-agreement

AviD

12:20

@RoryMcCune to be really useful - the q would need to specify its particular context, and each answer would need to elaborate how it fits that context...

Rory McCune

@AviD sure so it would need to be a good quesiton not a crap one :) but then that's true of any question. My point is that the product recommendation aspect shouldn't be a close on its own :)

Terry Chia

@RoryMcCune I have noticed that product recommendation type questions tend to get much better treatment when they are asked by a more established user.

Gilles

spam

Rory McCune

@TerryChia sure not a complete surprise, probably a combination of the established users being better at asking questions and more leeway being given ...

Scott Pack

16:17

@LucasKauffman No, he stepped down just prior to the last election.

@Gilles The biggest problem with the IT Security name is that it explicitly scopes us to be computer stuff. Dropping the T broadens that scope out to what we actually do for our job. Part of my normal spiel when talking to customers is explaining that while I am in the IT department my group, unlike the rest of IT, doesn't really care where or how the data is stored, only the data itself.

@Gilles For an IT Security person a student's personal record would only matter if it's stored electronically somewhere. By dropping the T we help describe the fact that the record itself is what matters, whether it's stored in a database or in a file cabinet.

@Gilles The real question is whether it's worth dropping from the name of the site. I've never thought it was worth the bother. If other people want to champion it then I'm all for it. The DNS name is fine, the shortname is fine, it's the art elements that would have to change and I never thought that was worth it.

AviD

19:05

@ScottPack right, I think it is definitely betterer, but not betterer enough.

AviD

19:18

@Iszi re that excel question... something else was bothering me, take a look at my latest comment there. I simplified it much further, its much cleaner now.

didnt test it thoroughly, though - so Im leaving it as just a comment.

Lamia

23:01

Hi everyone, missed The DMZ :P

can anyone please recommend a place where I can take security-related master degree at? :X in the US :D

recommend me*

AviD

23:17

anyone think this is a good question here?

3

Q: How to attract hackers?

I'm contributing to an open source project and we setup a testbed for security testing. We want to start a challenge to find security flaws and my question is: how do we attract hackers to participate? How shall the challenge be designed (except for a webpage that explains the why and how)? Th...

penetration-test professional-education

Simon

@AviD I +1'd on the first day it was posted, quite an unusual one so I think it's decent, yes.

Gilles

@AviD meh, at least it's firmly in the “teach me how to fish” category

AviD

@Simon yeah? not quite clear on how this is really a security question, or even really a question at all.

@Gilles it seemed more in the "where do I find the good fishermen" category.

whatevs, I'm on my way to sleep.

Simon

@AviD I have no idea what it would be about if it's not about security. He didn't specify a question, though.

Iszi

23:42

@AviD Thanks for the update. Sorry, I've been crazy busy lately and haven't had a chance to do any of my own testing.

Transcript for