@AviD @Avid, I think the question is just confusing the way that it is worded. It ultimately intimates that Gmail and hotmail account lockouts don't actually function. If that's the case it should spell it out in the subject, not use a charged statement.
Stack Exchange is providing communities with blog functionality if there is demand and the enthusiasm to create and maintain a valuable blog. Discussion over here on Meta.SO
Key points from @Rebecca:
Here are some guidelines that I would expect to see from a community wanting a blog:
Raise th...
Sounds like a great idea - after a few minutes chat we already have enough volunteers, but will get some more topic input before coming back.
We did have one interesting query - as a few of us maintain our own and corporate blogs there could be an information copying issue. Some of us may want t...
@Ori I agree, that was my sentiment. I wanted to close as S&A, but the answers really do a good job on answering the real question, yknow the one that wasnt asked (but everyone understood).
@Ori maybe try rewriting the question for him?
@ScottPack it looks like there is (almost) a consensus to push this q away, after all? at least 3 comments (with upvotes, but not mine), however no actual close votes (except for one flag). Still think it should stay here?
What is the best solution for mount options/partitioning when having e.g.: an Ubuntu minimal install (11.04) for Desktop use? e.g.: put /tmp on different partition to give it mount options like: nodev,nosuid,noexec - it could increase security. I just want to gather tips, how to do this
noatime ...
@RebeccaChernoff dunno, both ways, I guess? Does it matter? It seems the same to me, other than (possibly) a timing issue.
I dont think this is about copying historical posts, rather near-simultaneous (with some possible gap) cross-posting. Maybe @RoryAlsop has different input?
@AviD I dunno. Only one of those 3 commentators has close-vote votes on any SE site. I still stand by the fact that it was pretty borderline to begin with.
I am a little annoyed by the fact that the high voted answer gives pretty much the same information as mine. An asshole would say migrate it and let the bounty go away :)
I see one of two problems with the close-votes issue.
Either A) people who actually can vote don't care or think it's fine, B) They don't want to vote because migration isn't an option, and they're nervous of marking it for closing.
What would be some hypothetical ways to bypass a captive portal?
For example when you connect to a public WiFi hotspot, you often are on a seperate vlan, only moved to the real vlan when you agree to the terms and conditions.
How could you bypass this? Only via attacking the webserver directly,...
@ScottPack I thought about that one for a bit, and considered talking about how the bounty was a poor choice. I'm in favor of it being migrated, but I'm not able to click that button other than to toss up a close vote.
@JeffFerland Uncontested. The concern being the difference between, "How might this be broken so that I can fix it?" versus "How might this be broken so I can escape it?" being an awfully fine line.
@ScottPack Maybe I should augment my response with ways to prevent that? I'm typically putting on my AnP hat looking at a question like that. It's definitely a BH response though.
@ScottPack I'm thinking of writing a response that perhaps augments the question. Though editting the question to include the question "and how would you prevent it knowing this?" might be an option.
I'm real keen on whichever window I'm hovering over accepting mouse inputs (think scrolling a webpage while keeping keyboard input on the terminal screen). Every now and then it burns me
@ScottPack I'm not against that. What I am against, is having a pop-up notification (such as an alert messages from background services) accept keyboard input (such as spacebar or enter) while I'm in the middle of editing a document or something.
Usually, the pop-up will come up and then instantly disappear because I was still typing and hadn't had a chance to realize that my next press of the space/enter would do something other than put a space or carriage return in whatever document I'm working on.
A few minutes ago, I had one that I didn't recognize and now I've got NFC what it was.
@ThomasPornin Thanks for updating my quick initial effort on the crypto tag (back when my tag edits required demotivating approval....). I added a bit on password hashing (one of the most abused parts of crypto, in my experience).
Some way of marking deprecated but well-known algorithms might help - e.g. I put md5 in italics
Declaring which algorithms are "bad" is a complex matter
e.g. with SSL, SSLv2 is "bad" while TLS 1.2 is "good" -- unless you use an RC4-based cipher suite, which is "not so good", or a certificate with one of the millions of dubious things that can be done with those
@ThomasPornin Indeed. The most clear examples I saw were the ones deprecated by NIST (SHA-1 and MD5). MD4 wasn't in the tagwiki. In other cases it is mostly an issue of recommended key length and algorithms.
@nealmcb I tried to make the list of the most commonly used algorithms; there are many others, and "commonly used" does not equate "rock solid" (unfortunately).
@RebeccaChernoff I recall that there are SEO reasons, to say nothing of user confusion, for not publishing content in multiple places. But it would be fine to refer to one blog post from another.
I guess the first big question is whether the blogged content would be licensed Creative Commons Share&Share Alike, as are questions and answers. If we include Q&A content in the blog post that would seem to be mandatory, at least for that post.
Rory asks about copying info from & t...
@Ori This is a delicate area. But I guess I think the "bypassing portal" question and others like it should be rewritten, so we avoid losing reputation (in some quarters :) by having lots of questions looking black hat. But it will be tough to keep up with folks like that poster who are typically pushing the envelope. Perhaps we just need a clearer policy that questions should always ask for remediation steps of any problems that are brought up
Hey all. Back on line - have had a full few days at AppsecEU in Dublin. Going to chill with some wine and then get to grips with all the new posts and the blog chat
Should I post this here, or SU?: "Windows 7 - How to keep user IDs from being displayed on unauthenticated remote sessions?"
Example: When I log onto the system locally, I have to manually enter my username. But, when I try to log in via RDP, I am prompted with the ever-too-friendly "select a user account" style welcome screen. I want the latter to behave like the former.
@nealmcb In my day to day It's typical for me to include that in a vulnerability analysis, so it feels kinda wierd for the question to not even be asked. There are some questions I don't even look at due to this.
What would be some hypothetical ways to bypass a captive portal?
For example when you connect to a public WiFi hotspot, you often are on a seperate vlan, only moved to the real vlan when you agree to the terms and conditions.
How could you bypass this? Only via attacking the webserver directly,...
I guess the first big question is whether the blogged content would be licensed Creative Commons Share&Share Alike, as are questions and answers. If we include Q&A content in the blog post that would seem to be mandatory, at least for that post.
Rory asks about copying info from & t...
