The DMZ

The Evil Phoenix

00:14

@thisjosh i have several off-site servers that I use, and the system that i'm installing SSH on holds the master keys to that server (i.e. access to an admin account). That's what I mean by access to the servers.

@Iszi the value of the data is somewhere between "Important" and "Highly Secret"

this.josh

@TheEvilPhoenix The general wisdom is to use key authentication. This particular machine is highly sensative as you say.

My opinion is that you should create a separate account to ssh into the machine that the one you normally use locally.

You have some good risk mitigation going on, but there is some really valueable stuff there. In part the security of all your server machines are dependent on this machine.

Scott Pack

At the risk of beating a dead horse, here are some of the examples I use for the 'at-rest' v. 'in-motion' discussion.

At-Rest includes: Whole Disk, file systems, encrypted Word docs, encrypted cells in a data base

In-Motion: https, scp, encrypted ODBC

The Evil Phoenix

00:34

@thisjosh that was my thought, but i did want to hear others' opinions ;)

this.josh

@TheEvilPhoenix Does anyone else use the machine or just you?

The Evil Phoenix

@thisjosh just myself, hence why i was asking if it was worth disabling password auth

this.josh

Keys are the common wisdom because they are less prone to information leakage...

I was initially thinking that it would be harder to automate an ssh attack using key rather than passwords, but I'm not so sure. I think it takes away dictionary attacks, becuase the keys are random.

nealmcb

04:21

@Iszi I agree with you that as more and more reasonable answers are rejected, it is more and more NARQ. I guess I was just more in a mode of trying to improve it rather than putting the ball back in his court by closing it. Not easy to choose some times....

nealmcb

04:34

@thisjosh Note that while the key is random, the passphrase it typically anything but....

@TheEvilPhoenix: SSH public key authn is indeed often recommended. But I was alarmed to read the other day (and put in one of my answers) that there is no iteration in the password used to derive a key to encrypt the SSH private key. So that forces you to use a REALLY long hard password. I looked at the openssh code a bit but not enough to tease it all out, and there is at least one place where they do 1000 reps of hashing, so I'm still looking for more info there....

I meant there is no iteration in the derivation from the password of the key used to encrypt the SSH private key. I.e. it is not something like PBKDF2...

this.josh

05:38

@nealmcb Excelent point. You must make sure to protect the password used to protect the key.

M'vy

06:56

@thisjosh Yes, minimum impact on observed image. It must be useable for clients. And semi-destructive a we don't want the JPEG compression to remove it. But indeed all modification should destroy the mark (because if you modify a proof, it's not a proof anymore)

this.josh

07:29

@Mvy Actually I have seen some research into the opposite, trying to get invisible watermarks to survive resizing and cropping

Usually for proof of ownership to enforce copyright

M'vy

07:53

@thisjosh Indeed, most people see watermarking that way

this.josh

@Mvy What modification will destroy your watermark?

M'vy

Pretty much anything apart the compression process.

Some compression paramaters shall destroy it too

Rory Alsop

08:32

0

Q: How can I protect my phone from being hacked?

With the News of The World Phone Hacking scandal spreading globally amidst allegations that as well as celebrities, victims of September 11 and other major events in the news have had their phones hacked into. With this in mind, many people are wondering: How can I stop my phone being hacked? T...

phone

Thought this might be topical.

M'vy

topical?

Rory Alsop

08:48

big news in uk and us!

[allegedly] the newspaper hacked into murder victims phones and even deleted voicemail messages so they could see if new messages were coming in

leading the families to believe they were still alive

plus loads of celebrities, politicians etc

sounds like it was endemic

backlash in this country has already destroyed the News of the World paper and it is still front page news

M'vy

whhhatt?

Rory Alsop

@Mvy google.co.uk/…

bbc.co.uk/news/uk-11195407

News International phone hacking scandal

The News International phone hacking scandal is a controversy involving the News of the World, a now-defunct (but at the time the scandal broke, best-selling) British tabloid newspaper published by News Group Newspapers of News International (a subsidiary of Rupert Murdoch's News Corporation), and the allegations that individuals working for the newspaper engaged in phone hacking. It was especially notable as the story broke in the midst of an attempted takeover of British Sky Broadcasting by News Corporation. Public reaction to the scandal in Britain was swift. On 6 July, 2011 Briti...

that wikipedia link has a good summary

M'vy

09:06

hmm

Rory Alsop

09:34

oop - and now their CEO has resigned - it's all going wrong for News International

Scott Pack

11:34

I read some about that yesterday. Bad news.

Stack Exchange

12:08

Stack Exchange Security Blog: Question of the Week #1 – How does changing your password every 90 days increase security?

posted on July 15, 2011 by roryalsop

How does changing your password every 90 days increase security? This has been one of our more popular posts, with discussion on the reasons for password expiration: To mitigate the problems that would occur if an attacker acquired the password hashes of your system It prevents people who use the same password for everything from [...]

Scott Pack

12:39

2

Q: Where/How is an ODBC password stored when 'saved' in Access?

I have been working on a program that uses MS Access and ODBC to connect to an SQL server, one of the requirements was that the user need not know the password for the connection to the SQL server so I checked the 'Save Password' check box when linking my SQL tables. Does anyone know where the p...

passwords databases

This feels pretty borderline to me. I don't have any notion of where it might fit better, though.

Rory Alsop

hey @Scott

Scott Pack

Morning Sunshine

Rory Alsop

sunshine just gone, but I have just had a lovely picnic in the gardens with my wife, kids and my brother (who is a bit twitchy as his wife was due to give birth yesterday)

it's a grand day

Scott Pack

Oh, so she's ready to pop any minute now!

Rory Alsop

aye - round, frustrated and scoffing ice-cream. Ready to blow!

Scott Pack

12:43

I'll bet :) I remember how the ole lady felt during her last week

Is this their first?

Rory Alsop

yup:-)

all very excited

Scott Pack

Good times :)

And I'm presuming that all means that the family is near by. That's really good. My mother-in-law came down to stay with us for the first week or so. Quite helpful.

Rory Alsop

think my Mum will travel down for a few weeks, then her folks for a couple of weeks

both families are from the far north

Scott Pack

Oh, that's right, you're an Orky!

Rory Alsop

but me and our eldest brother's family live near

Scott Pack

12:46

Excellent

Rory Alsop

@ScottPack you mean I labour under the control of Sauron?

Scott Pack

Well, there's that.

I also, apparently, used the wrong descriptor. I'm only halfway into this cup of coffee. Shush.

Rory Alsop

mmm - coffee. A girl in Prince's Street Garden gave me a bottle of Lipton Peach Ice Tea, and no matter how much I look at it I can't make myself believe it will taste nice. So I'm off for coffee.

Scott Pack

When I was in high school I would drink Lipton Ice Tea in a bottle. It was...ok. You're right, though, I can't imagine the peach would taste good.

Rory Alsop

yeah - I can drink the normal stuff in Dubai or Vegas or places where the key is to keep hydrated, but in a normal situation (ie Scotland - where it rains a wee bit) I prefer my water to be a transport medium for ethanol

oh, and as QOTW 1 blog post is out, there is a question on meta for QOTW 2

1

Q: Top Question of the Week #2

For QOTW #2, scheduled for publishing to the Security Stack Exchange Blog on 22 July, please post as Answers, and vote for your favorite question on Security Stackexchange. Please post any question that you feel is of worth and the reason why. Try not to promote your own questions or answers for...

discussion qotw

Iszi

12:59

@RebeccaChernoff Is there some way to configure the Twitter bot so that it gives blog posts a certain hashtag, or something else that will make it more easily distinguishable from the regular random question postings?

Rory Alsop

Hey @Iszi.

How do they show up on twitter? is this under #stacksecurity?

Iszi

@RoryAlsop - It's posted by @stacksecurity, but the only real distinction between them and the regular posts is, incidentally, the absence of a hashtag.

Question of the Week #1 – How does changing your password every 90 days increase security? http://bit.ly/q7yVcR

Tweeted by StackSecurity on July 15, 2011 at 12:04 PM

vs...

How difficult is to modify an ISO image and still have the old md5sum? http://bit.ly/oAmwe0 #hash

Tweeted by StackSecurity on July 15, 2011 at 11:40 AM

The Evil Phoenix

morning everyone

hows things

Rory Alsop

morning @thee

(or afternoon over here)

The Evil Phoenix

:P

Scott Pack

13:11

@RoryAlsop I can completely relate to that. I find that, typically, I get most of my hydration from coffee and other libations.

The Evil Phoenix

coffee??/

did someone say... COFFEE?????

Rory Alsop

0xC0FFEE time

this client has a kitchen area only 21 steps from my desk

mmmmmm

The Evil Phoenix

hehe

i've got a pot of coffee here

literally 6 steps from my desk/cubicle :P

(and I've already had 2 cups of coffee since i got to work 20 minutes ago :/)

Rory Alsop

@TheEvilPhoenix Wheeeeeeeeeeeeeeeeeeee!

Scott Pack

Mine is a bit further than that, but it's still contained within the security office's suite.

The Evil Phoenix

13:23

@RoryAlsop wait until i hit my first break of the day... during that time, i run to the nearest coffee shop and usually ingest a triple-espresso drink very quickly o.o

and then sometimes a second (THEN the day gets fun :P)

question for you guys: how efficient is SpamCop at finding and blocking spam?

their DNS blacklists and what not

and i'm aware of spamhaus ;)

Rory Alsop

hahahahaha - I had to give up the serious caffeine habit I developed while working for Siemens-Nixdorf in Munich. There, even the coffee grinder was within arm's reach without moving my chair. Fatal!

The Evil Phoenix

lol

Rory Alsop

@TheEvilPhoenix It seems not too bad, although in recent times I have switched over entirely to the google platform and I get almost no spam. Maybe one or two a week now

but I don't know whether google just use their own internal system or whether they also use SpamCop et al

The Evil Phoenix

@RoryAlsop yeah i use Google as well, but i cant integrate my University mail with Google (some weird POP-not-allowed thing)

Rory Alsop

@TheEvilPhoenix not even an imap solution allowed?

The Evil Phoenix

13:28

and considering i just got 6 more of those "Give us your account info and we'll send you money" spams in the past hour

@RoryAlsop nope

which sucks

be riight back... espresso run >:)

lucky for me there's a coffee shop right at the corner of the street here ;)

Thomas Pornin

13:44

@RoryAlsop Lipton Peach Ice Tea does not taste like tea at all. On the bright side, it does not taste like bad tea. Only a kind-of-peachy water, like an American beer with sugar.

The Evil Phoenix

@ThomasPornin and that's why I dont drink American beers, even though i'm in the USA :P I also dont drink Lipton Iced Tea because it is terrible.

Rory Alsop

@ThomasPornin ewwwwww

Scott Pack

@ThomasPornin I take offense at that. There are some mighty fine American beers. You just won't ever recognize any of the brewery names.

The Evil Phoenix

@ScottPack orly? Point me to those breweries so that I may obatin some of these "Mighty Fine" beers you speak of

Scott Pack

Sarnac is a good standby. Great Lakes is pretty good, though they tend to be a bit hoppier than I like.

Weasle Boy makes some fanTASTIC stuff, though I don't know how widely they distribute.

Wait, you're in Pitt, right?

Here you go. This is going on right now

ohiobrewweek.com

Rory Alsop

13:49

that San Francisco one - Anchor Steam - that was good

Scott Pack

I will be uptown this weekend drinking as much beer as I can find.

@RoryAlsop Yes, also good stuff. Hard to find, though.

I enjoy a Sam Adams, though I don't get excited about it.

Rory Alsop

@ScottPack that looks like a good find

Scott Pack

@RoryAlsop For all the negatives of living here, there are certainly a lot of positives.

Rory Alsop

what exactly does theat attractive Brew Week Ambassador do...

The Evil Phoenix

@ScottPack atm, i'm in Harrisburg, PA... so i'm not close :/

Scott Pack

13:51

A week long celebration of beer is a real good positive :)

The Evil Phoenix

true that

Rory Alsop

(and what is a three peat Athens resident?)

beer = positive

5

Scott Pack

@RoryAlsop I have no earthly idea. You mean as a day job or as Brew Week Ambassador?

Rory Alsop

hahahahahaa

I was just trying to guess what the entry criteria might be

I know appearances may be deceptive, but she doesn't look like a hardened beer drinker

Scott Pack

@RoryAlsop I would say moved here on three separate occasions.

Iszi

13:52

Hrm... I don't see my own Gravatar in the room. What's up with that?

Rory Alsop

i do

Iszi

Oh, there it is. That was... odd.

Scott Pack

For adult residents a very common motif is "Moved to Athens for college, moved away, realized how bad it is Outside, and moved back"

Thomas Pornin

@ScottPack At CHES'2001 ("Cryptographic Hardware and Embedded Systems", a scientific conference), located in Worcester (Massachussets), the coffee breaks featured free glasses of Sam Adams (lots of them)

Rory Alsop

usually mine takes up to a minute to pop in

Scott Pack

13:53

@ThomasPornin Now that is a conference worth going to!

@Iszi It takes a good long time for gravatars to trickle through

The Evil Phoenix

mhm

Rory Alsop

@ThomasPornin do the afternoon speakers get a rousing welcome on stage:-)

The Evil Phoenix

@ScottPack i think it can be forced to update/sync to the chat but i dont know how that is achieved...

Scott Pack

@TheEvilPhoenix There's also CDN and user caching to take into account.

The Evil Phoenix

true

Scott Pack

13:55

I'm still now seeing his new gravatar even on the main site yet

Rory Alsop

there is a new gravatar?

I still see the green and white one

Iszi

@ScottPack New gravatar? I don't have one... that I know of.

Scott Pack

Ah, I misread your statement, sorry.

4 mins ago, by Iszi

Hrm... I don't see my own Gravatar in the room. What's up with that?

I interpreted that as a a new one that hadn't popped up yet.

The Evil Phoenix

heh

Rory Alsop

(I'd have got all confused - I usually do when folks change avatars - it screws with my image recognition wetware)

The Evil Phoenix

13:58

@Iszi did you use your email that you used for gravatar on your security.se account?

just wanting to make sure

Scott Pack

@RoryAlsop That happened on SF when I changed my name from 'packs'

Iszi

@TheEvilPhoenix I don't use gravatar, specifically.

I wonder what it is they use to auto-generate avatars anyway...

The Evil Phoenix

@Iszi doesnt matter. But your gravatar email address must match your SE email address

then the selected gravatar that is your default one shows up

(I learned that when i tried changing my email address on AskUbuntu)

Stefano Palazzo

14:23

@Iszi they use your email address' md5 hash

>>> "http://www.gravatar.com/avatar/%s?s=64&d=identicon&r=PG" % md5("[email protected]").hexdigest()
'http://www.gravatar.com/avatar/c5b62b399bc488863dc513546020dfa3?s=64&d=identicon&r=PG'

like this :-)

Rory Alsop

14:55

@nealmcb - have separated out my original phone voicemail question from:

0

Q: How can I protect my mobile phone from attacks

As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic. So, that simple - how can I protect my mobile phone from attack. There is a wide range of attacks including the THC femtocell attack so all...

phone

nealmcb

15:11

@RoryAlsop Perhaps I should have been more clear. This is still way too broad, broader than "how can I protect my desktop computer from attacks", since the phone ecosystem is more diverse than desktops.

We want separate questions for different platforms, and I suspect that several have already been covered.

Rory Alsop

@nealmcb do you think the original one still works? the voicemail one? More than happy to split out the mobile phone one into Android, Apple, Symbian?, Windows Mobile (meh)

nealmcb

@RoryAlsop I think the voicemail questions is a good start, in particular because I don't recall it being covered before, and such systems are likely to have more shared vulnerabilities

If we learn of specific vulnerabilities of particular sorts of platforms in the voicemail ecosystem we can get more specific in further questions

Rory Alsop

and @Karrax has an Android best practices question

maybe I should stick to modding - being a bit crap at asking questions today :-)

nealmcb

@RoryAlsop Nah - I salute you for getting the ball rolling - I'm more prone to not asking at all until I think I know what to ask, which often means not at all and then we make no progress :)

Rory Alsop

I do like the discussion process in here though - what starts off as a good core but written badly can very quickly get turned around

nealmcb

15:26

Indeed!

Such a breadth and depth of experience we have here. And the newbies are very valuable since they make sure that the answers don't assume too much.

this.josh

16:53

@Rory I think it might be nice to attribute the points in the QotW to the people who made them, either link to their answer or profile.

The Evil Phoenix

good afternoon

how is everyone

Thomas Pornin

The title on QotW#1 (in the blog) appears garbled for me

Chromium 12.0.742.112 (90304) Ubuntu 11.04

The Evil Phoenix

@ThomasPornino doesnt show up like that for me

but if you give me a few seconds i'll double check

;)

redownloads chromium-browser

Thomas Pornin

Same with Firefox 5 (with even more overlap)

The Evil Phoenix

betcha its the HTML on that sesction

section*

this.josh

17:00

Hey @Thomas nice writeup on ISO MD5s

Too bad Crypto isn't open yet, because it got me thinking about hashing attacks.

The Evil Phoenix

you know what, i think its an error but i cant tell what's generating it

but i have a thought:

why does the QOTW need to have the question in its blog title?

because immediately under the title is the question and a link to it :/

Thomas Pornin

@thisjosh crypto.SE should enter public beta next Tuesday (I think it is one week of private beta, we are in the fourth day right now)

this.josh

Oh good. Is there any leakage of state information from MD5?

Thomas Pornin

You mean, from MD5(m), can we get some information on m ?

this.josh

No not exactly.

Iszi

17:07

@ThomasPornin Posted in Meta already.

this.josh

I was think about differential hash value analysis.

Iszi

2

Q: Long blog titles wrap-around on same line.

In Firefox 5. See screenshot below. Tested in Safe Mode as well, with same result. Looking at the Blog Overflow homepage, it seems we're the only blog with a recent post title that long.

bug design blog firefox

this.josh

If you have the message m and h(m), then you modify m to be n and calculate h(n), not all the bits between h(m) and h(n) will be different

Thomas Pornin

@thisjosh Actually even for a perfect hash function h you expect h(m) and h(n) to match on about half their bits

For MD5, the collision attacks work by using differentials

on two blocks

this.josh

Now what you are searching for is the smallest string of bits p that when added to n will produce h(n+p) = m

err I meant concatenate h(n||p)=h(m)

Thomas Pornin

17:12

in the first block, one searches for messages m such that h(m) and h(m xor d1) differ by only a few bits in specific positions

i.e. h(m) xor h(m xor d1) = d2

and then for another block m' such that hashing m' beginning with state h(m), and m' xor d3 from state h(m xor d1), end up with the same value

so it is a kind of leakage

only with a quite low probability (its a 1 in a million chance)

For a properly secure hash function you cannot have the kind of leak you talk about, because if there is such a leak, then this looks like a good way to speed up collision attacks, and therefore the hash function is not secure.

Iszi

@ThomasPornin FTR, what OS were you running Chrome on, when you took the screenshot of the blog?

Thomas Pornin

@Iszi Ubuntu 11.04, 64-bit

this.josh

In your example the message under attack is m?

Thomas Pornin

@thisjosh In my example, we look for a collision, so we create both messages

this.josh

is that h(m) = h(m xor d1 xor m')?

Thomas Pornin

17:22

in my notations m is the first block and m' the second

so the two colliding messages are m||m' and (m xor d1)||(m' xor d3)

Iszi

@TheEvilPhoenix - Which Firefox versions have you tested, and on what OS? And, which screenshot do they most look like?

this.josh

How is d1 chosen?

The Evil Phoenix

@Iszi FFox 4 (Windows) FFox 5 (Ubuntu) Chromium (Ubuntu) Google Chrome (Ubuntu), FFox ones look like the all-on-one-line overlap one, Chromium and Chrome look like the one with half-overlap

Iszi

@TheEvilPhoenix FTR: What Windows/Ubuntu versions/editions?

And, is there really a difference between Chromium/Chrome? Never knew there was such thing as "Chromium"?

Thomas Pornin

@thisjosh That's the magic

apparently a good way is to have some Chinese researchers painfully walk their way through the algorithm structure with a pen and some paper

Iszi

17:28

@ThomasPornin Don't forget to provide the abacuses as well.

The Evil Phoenix

@Iszi latest on each, 64bit only

Thomas Pornin

There is some research about finding more or less automatically "good differentials" but it appears to be quite hard too.

The Evil Phoenix

@Iszi win7 sp1 64bit, ubuntu 11.04 64bit

i'm off

Thomas Pornin

There was an effort from University of Graz (Austria) to run a distributed search for good differentials on SHA-1

it used BOINC and was driven by Rechberger

this.josh

I though you were going to make a joke about the chineese remainder theorum

Thomas Pornin

17:30

but he gave up, for lack of contributors

Iszi

Ok. Updated the browser/OS list in the bug report.

Thomas Pornin

@thisjosh Me, making a joke ? Tss.

this.josh

Theorum: no matter what you do at least a billion Chineese couldn't care less.

the remainder might care.

Rebecca Chernoff

@Iszi tis possible sure...but what hashtag?

Iszi

17:49

I wonder if there by chance is one already used by IT Security blogs? Maybe #ITSecBlog ?

Scott Pack

#chknltl ?

The Evil Phoenix

18:03

lol?

Rebecca Chernoff

Sure, I'll go setup #chknltl right now (:

this.josh

Except the answers are telling you how to protect youself in the even that the sky does fall.

Scott Pack

Oh right, that's just how we're made to feel by clients and employees, not the image we're trying to project! Damn!

this.josh

You are supposed to project the image of someone who could hold the sky up, so that your client doesn't need to worry about it falling.

but just in case I'm not around...

Rebecca Chernoff

anyways, yes, I can add a prefix or suffix to the tweets, convince me there's something worthy of being added (:

this.josh

18:16

thats wierd the other browser put reputation numbers under peole's name/gravitar

Iszi

@thisjosh If you're talking about in chat, it only happens when that person posts enough consecutive lines to have room for a larger gravatar and their username and their rep.

this.josh

oh thanks Iszi!

Iszi

For example:
I think the requirement is four lines.
So, this post should show you my gravatar, name, and reputation.
With this one more line.

Correction: Requirement is three lines.

@ThomasPornin @thisjosh Look here.

(Maximized at 1280x1024)

Scott Pack

/me is waiting

Iszi

@ScottPack is waiting for what?

@thisjosh Also, the rep displayed in chat is not for any single SE site. I think it's an aggregate of all your SE rep.

Scott Pack

18:26

For what they're supposed to be looking at.

Iszi

@ScottPack "Here" was referring to the message reply pointer.

And why are you worried about it? The message wasn't addressed to you. :-P

Scott Pack

Because I'm a naturally curious person :)

And yes, it's an aggregate across all SE sites. Including those where you only have 101 rep.

I just did the math

To verify

this.josh

arithmetic, math takes more work

Iszi

@RebeccaChernoff I think I'll start a Meta thread and let the community decide.

0

Q: How should we distinguish blog posts in the Twitter feed?

Should we add a hashtag, or other particular prefix/suffix to the blog tweets, to distinguish them from the regular question tweets? If so, what?

discussion blog twitter

Scott Pack

18:53

I always enjoyed working in a math department. The guys were a bit fun to hang out with once they got out of the undergrad program. Signing up for things like MATH 705 - Counting

Rebecca Chernoff

Hmm, I might suggest taking out "Question of the Week #x:" from the blog title. Think it adds value?

Iszi

@RebeccaChernoff Maybe at least trim it to "QotW #*x*" or "QotW x" or even just "QotW".

Rebecca Chernoff

mehhhhhh

think of it from the perspective of a random user coming across the blog post from a google search

this.josh

Its fun to watch grownups trying to figure out the answer to 1 + 1

Rebecca Chernoff

3. Duh.

this.josh

18:59

for large values of 1?

Scott Pack

Give or take...

Ninefingers

@thisjosh @thisjosh or ask them whether or not 0.9 recurring == 1...

this.josh

hummm maybe arithmetic is cheating...

Iszi

@Ninefingers OMG

Scott Pack

@Ninefingers Or even better, the closer they get to PhD, ask them more and more basic questions.

Watching a Maths PhD candidate try to figure out his to-hit total in DnD is marvelous :)

Iszi

19:13

Time to make like the geese and get the flock outta here. Cy'allz l8r!

Scott Pack

19:23

Have a lovely weekend, kiddo.

Hendrik Brummermann

19:36

Is there a click-way from security.se to the blog?

Thomas Pornin

@HendrikBrummermann I asked that too, a few days ago

answer is: there is none yet, but there shall be one at some unspecified future date

Scott Pack

There seemed to be an indication that if someone asked for it, it might happen. So there's a meta post asking.

I suppose, as a temporary solution, we could have @RoryAlsop modify the banner to linkify his reference to the blog.

Thomas Pornin

@ScottPack I upvoted that question (from Rory). Is it expected that we express support in a more vocal way ?

Scott Pack

The best click-through I've found is to go to the bottom of the page, click on blog, then click on 'blogoverflow' then click on our entry.

@ThomasPornin I'm not entirely sure.

Rebecca Chernoff

4

Q: Community Promotion Ads - 2H 2011

What in the Wide, Wide World of Sports is Going On Here? TL;DR -- put images and links in the answers. If they get voted up enough, they will appear on the main site as community promotion ads. But whyyyyyyy? This is a method for the community to control what gets promoted to visitors on the s...

discussion featured promotion community-ads

Scott Pack

19:43

Yeah, just found it.

oh, this is the one I was talking about

6

Q: Can we have a 'Blog' button on the front page to take visitors directly to the security blog

I think anything we can do to make it simpler for both newbies and experienced hands would be a useful addition.

feature-request

Rebecca Chernoff

we give the blog time to grow, and then at some point we'll change the blog link on the site

until then, a community promotion ad would be very appropriate

hint, hint q:

Scott Pack

@thisjosh What kinds of information are you wanting to get on the incidents?

The Evil Phoenix

Greetings

Scott Pack

Afternoon.

this.josh

@scott I was hoping to answer questions like: Do attackers attempt ssh authentication with keys or just with passwords, if so how frequently...

Scott Pack

19:53

@thisjosh Ah, ok. So not statistical information about what kind of breach, how many records exposed, etc.

this.josh

@TheEvilPhoenix No, I wanted the data to analyze so I could find the answer

@ScottPack Thats useful too because I could say X type of attack is potentialy very compromising but uncommon

Or according to X database there are no reported incidents like that

I want to add a little concreteness to the theory

Scott Pack

Ok, cool. I'll type something up. May not be as detailed as you like, but we've found the data pretty useful in the past.

this.josh

Maybe it will useful to others as well, thats the point of the Q & A right?

Scott Pack

phaw!

this.josh

If I want to know it is likely that n other people want to know.

When someone asks 'Should I stick my finger in a electrical outlet?' I want to be able to say 'No! And here is what happened to people who did.'

Scott Pack

20:02

110 or 220?

The Evil Phoenix

@ScottPack relevancy? :P

Scott Pack

@TheEvilPhoenix One tingles and one hurts.

The Evil Phoenix

and both can kill :P

given the right circumstances

this.josh

tingles/hurts someone could misconstrue that

Rory Alsop

20:14

@thisjosh Agreed. My bad. Fixed now

this.josh

Agreed? I don't remember what that's in reference to... poor memory

err I mean temporal data degredation for security purposes

Scott Pack

@thisjosh Attributing points to the asker of the QotW.

If you click on the arrow on the left side of the message, it will bounce you up to the message it refers to.

this.josh

Ah I just discovered the left arrow that takes you back to the refering post

Rory Alsop

I have also just fixed the length of the title - shouldn't wrap around any more

@RebeccaChernoff - community promotion ad for the Blog sounds like a good idea. What I might do is wait until @Jin has sorted the theme, and then I'll create a banner ad for it

this.josh

I was just thinking that the Blog is ment to draw people to the site, so you want as many links to draw people in as possible, and its also polite to site your sources

Rory Alsop

20:22

Definitely

Totally my fault for just not remembering

The only challenge with the top line system message feature is it doesn't give much space, and is only valid up to 48 hours so you kind of need to keep changing it for whatever is new etc

it also seems to only cope with one hyperlink

Scott Pack

Ah, there's the rub right there.

Rebecca Chernoff

@RoryAlsop ah, very nice. A /blame @Jin. I approve. q:

Rory Alsop

@RebeccaChernoff hahahaha - no, I could grab the ad already there and modify it with some new TOAP

in fact, I might as well - lemme go and get another glass of wine first

@Scott - what font did @Jin end up using?

Scott Pack

@RoryAlsop The default is Verdana, but he setup Arial as a fallback

Rory Alsop

cool - will create an ad just now

Rory Alsop

20:46

0

A: Community Promotion Ads - 2H 2011

@Rebecca - can you let me know what you think. Wasn't sure about the image uploading rules, so hopefully this worked.

@ScottPack What do others think?

(if you don't like it, let me know - easy to change)

if you do like it - vote it up, and if it gets >6 votes it can go into rotation

right - everyone must be away for the moment. I'm off for some gin - be back later

Scott Pack

Couple of glasses of wine, glass of gin.... Come on, @Rory, it's not Tuesday.

That's hot

this.josh

If its Tuesday this must be Belgium

Iszi

21:02

►

this.josh

Why is the equals sign odd?

Iszi

@thisjosh 'Cause it's a YouTube link.

Click to play on YouTube.

Scott Pack

Speaking of going to the bar for some excellent microbews....

Rebecca Chernoff

@RoryAlsop, it is fine as is, but I might suggest actually doing something a bit different visually. You want people to notice it, not think it is the same as the other ad.

Rory Alsop

21:23

@Rebecca - ah, so we don't need to stick to the brand then. Cool. Will have a think

Rebecca Chernoff

the twitter one we just pull from an existing one and plop in the apple-touch-icon for the site and voila! (;

Ninefingers

22:05

ok blog reviewers, any more comments on my post. I have incorporated @ThomasPornin's comments from yesterday.

Thomas Pornin

@Ninefingers I am the official resident cryptographer now ? Is there a badge for that ?

Ninefingers

@ThomasPornin yep, there is: security.stackexchange.com/tags/cryptography/topusers

Thomas Pornin

@Ninefingers Ah yes. Indeed.

It can even become a gold badge at some point

Ninefingers

22:20

I'm sure it won't be long until it is

Thomas Pornin

@Ninefingers I have 2/3rd of the required upvotes, but I also need to get upvotes on a 100 more "cryptography" answers. I do not think there are enough crypto questions yet in security.SE, and the new crypto.SE might drain newer crypto questions

we'll see

and right now is time for me to stop goofing around and start some serious non-working for the week-end

goddbye everybody

this.josh

I don't think I can read Techdirt anymore, anytime I read a TSA article I get angry.

techdirt.com/articles/20110714/09102815090/…

Bye Thomas

Transcript for