« first day (213 days earlier)      last day (4965 days later) » 

00:02
@AviD Oh, ok, sure. I can agree with that then.
see? sometimes its my turn to be an ass, too.
I suppose that's still ok. I don't think that I've seen a donkey with cloven feet.
huh?
ahh, hehe
but have you seen one with frikken laser beam on its head??
Not yet!
Hey everyone
Is there something going on with the scores? It seems that I got a -5 somehow, that cannot be explained :>
00:08
i downvoted you!!
@john How do?
hah
Figures, Avi is like that.
hmm, no... i downvoted you 2.5 times!
actually, only thing that makes sense is that someone removed a question-upvote.
either that, or some hinky recalc.
You mean a net -5 rep?
00:09
a couple of hours ago i had 4,837 and no i got 4,832 somehow, and the popup box says a -5 rep for today
but its not logged anywhere
@AviD As opposed to a non-hinky recalc?
@ScottPack of course.
AviD nice guess, that should be it
i was just frustrated, like what the .. where did this come from without any logs :P
Have you looked at security.stackexchange.com/reputation for any clues?
nothing there
hmm now it seems that the -5 on the popup box is gone
it says 0
00:12
hm
And you don't have any questions, so that's out
yeah
somebody's playing with your votes!
ah, erg
@AviD No one this site has ever done that!
i need my missing 5 rep !!!
:)
@ScottPack nooooo of course not....
00:13
coughs
Downvoting an answer is 1, and having an answer downvoted is 2, yes?
hmmm
** total rep 4799 :)
?!
i give up
well, you DID recalc yourself....
There was probably a question where you had an answer that got migrated.
I'll lose 20 when I next recalc myself.
@ScottPack oo good one. or deleted.
@ScottPack heh, sounds diiirty
Giggity
00:16
hmm yes it has to be migrations
i'm not visiting this recalc thing again
There's no good way that I've come across to account for rep loss due to migration/deletion
@john Your rep only gets recalculated if: A) You hit the recalc button, or B) They do a site-wide recalc
oh, didn't knew that
That happened a few months ago when they added the "rep leagues" thing.
Oy, gotta run. Time for bedtime stories.
another funny fact: i got 4k rep and became trusted user, and a week later we got out of beta and lost it again
luck hah
gotta run too
bb
gnite
00:52
@john Yeah, don't much care for that aspect of the graduation thing. We ended up with about half of out active users losing their vote to close privs.
 
4 hours later…
05:11
Can someone say LMGTFY bait? Seems that's what the one answerer has done...
2
Q: Dropbox vulnerability details

jrdiokoDropbox (the online cloud storage provider) was recently in the news for some security and privacy vulnerabilities. What was the problem, and what has been done to resolve it?

 
4 hours later…
08:54
@Iszi looks that way... it could have been asking for a more indepth analysis, but it doesnt... and anyway, that would probably be subject to speculation...
what about this one? looks kinda like a shopping question, but not really a list... more of a subjective/opinion one.
7
Q: Blackberry + RIM Bluetooth-based Smart Card Reader

makerofthingsHas anyone used this Bluetooth based smartcard reader? If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card reader, but no password? All of our devices have a local password already. Is the challenge password something you kn...

 
1 hour later…
10:14
@AviD @Scott - hahahahaha - I'm away for one evening and all this scurrilous rumour kicks off:-)
10:38
@RoryAlsop yes, but where were you away.... ;)
howarya?
@AviD not bad at all sire! Spent an entire day with the kids, watched an awesome lightning storm, cut my hedge, little things like that. Spent almost no time on the computer - very relaxing
@RoryAlsop wow, sounds like a right holiday, dunnit...
I know :-)
im still trying to catch up on the load of traffic here from the weekend...
cant even get on to the blogging...
but wow, traffic sure has picked up of late :)
@AviD - that question doesn't even look on topic. The real answer is likely to be found on a RIM forum :-)
@AviD yeah - the analytics look great now
10:44
@RoryAlsop all pretty like
On the blogging front, I think the fortnightly schedule is very sustainable, with extras as and when we want. We now have a queueueueueue up until mid September
so that's pretty cool
@RoryAlsop i dunno, in principle it seems hes asking about the security/operations of a security product, which could be on topic... but thats not what hes really asking.
@RoryAlsop awesome!
hence the "lazy mods + @Rory " comments of earlier :)...
@RoryAlsop so, I guess we're not doing the "month of passwords" etc theme thing?
@AviD I liked the idea, but not enough folks volunteering in that space, and I think I'd far rather get people blogging on topics they want than try and push people into a particular topic
@RoryAlsop fair enough
this way we have more blogging, probably more focus on each post etc
passwords are likely to remain high up the list though
10:48
I was trying to find a unique perspective to do on passwords, but it just feels done to death.
I was thiniking of jumping from there to SSO, provisioning, management, etc and IdM - but thats a bit bigger
and, it doesnt seem to be of much demand on the site. yet.
hmm, maybe a post on it may change it....
could always prep a series on that - I keep saying to folks I've just kimd of scheduled stuff in as a straw man to get things moving but I'm absolutely not precious about any of it
but right now, more urgent - I have to come up with a brilliant topic for a talk at the owasp conf....
I hear they like passwords:-)
10:49
heh
when is the conf?
any ideas??
september - but CFP is this week. trying to be an example of volunteering a talk, and such...
right now, the most interesting thing I come up with, is Agile SDL - but I already gave it at a chapter meeting, last year...
not same audience, but still... sounds like a repeat.
hmmm - my big push when I give talks at various places is around getting security folks to understand business risk etc., but that's a bit too woolly for Owasp
I see it as the biggest current issue
actually, I talked one of the FAIR guys into proposiing a talk on that - dont know if there will be consensus to accept it or not, but I'm all for it
Oooo - that could be good. I have been looking more at it after you recommending it
10:54
we actually have a lot of really nice topics so far, but i guess I may have atrophied over the past year... nothing really new on my end to report :(
@RoryAlsop yeah, I really like the ideas behind it. I think it could be a bit tweaked, to better support appsec stuff, but overall better than NOT using it.
definitely
hmm... that could actually be good basis for an interesting post...
lemme mull that over for a bit.
Also, expect a conference summary from me, 'round september.
speaking of, you went to appsecEU, dincha?
yeah 'twas grand
ahh - I see what you mean
:)
hahahaha
will see what I can draft up
11:03
should also poll to see who is going to blackhat, draft them into writing a post.
I'm real good at volunteering others, when I cant even shoot off a simple password post, myself... :$
I'll ping a mate of mine who is going to Defcon - see if he is up for writing something for here
@RoryAlsop excellent
0
Q: Anyone going to Blackhat in Vegas - Volunteer a blog post?

AviDWhoever is planning on attending Black Hat USA 2011, in 2 weeks - would you be willing to write up a summary of the conference, for a blog post? Especially any relevant, technical talks you attend, but also the conference in general...

upvoted :-)
heh
I've noticed, I've been posting (q's & a's) a lot less... just trying to keep up, and commenting a lot
mod page bears that out, too :)
added a wee update - is that okay?
11:11
actually, we've been getting a tonne of crypto questions lately, very interesting but out of my league
@RoryAlsop of course!
in fact, I would say nearly all the mass of questions of late, are half crypto (advanced or very beginner), and half "here are my logs, is someone attacking me?"
I think a fair few of the more esoteric crypto questions will move over to crypto.se - and we'll end up with just the practical issues around crypto here.
...probably...
I really dont like those log review questions.
you, @nealmcb, @DW and @Thomas are all on both, aren't you?
@RoryAlsop i hope so, but then I'd miss out on all the stuff I dont know...
@RoryAlsop I know @Thomas is, but I'm not.
I followed on Area51, but apparently I forgot to commit :(
hahahahaha - I read 'em, but sometime I look at the maths words and it's just a blur to me
11:13
which is fine, cuz I know next to nothing about it anyway
@RoryAlsop hehe, me too. I still read em though, hoping a few bits of crypto-entropy will rub off on my brain by digital osmosis.
anyway as it comes up I have very little to add to the mostly excellent answers there.
except for a couple I have open in tabs waiting to find time for a proper writeup...
but those log review questions - dya think they belong here?
they feel like the equivalent of Code Review to SO.
Yeah - I'm not sure they bring anything. It's like catching a fish for someone, not teaching them how to fish
@RoryAlsop absolutely.
oops - I hadn't realised that edit would bump my 'entry skills' question right to the top
heh - was trying to give a good solid answer to
1
Q: Penetration Testing Jobs without Experience

There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the many other forum community members that say it's usually Help Desk --> Network Administrator --> S...

I keep feeling that I want to close them, but I feel wrong about doing it unilaterally.
@RoryAlsop thats good, migrated questions often get lost.
yeah - will maybe put a meta post to suggest people should answer with education rather than explanation, then there is a value add
if we are doing that, then they become useful in future
as opposed to these ones which are often very localised to one instance
11:23
@RoryAlsop well, that does mean the question itself needs to be fixed.
think I have to agree
you wanting to revise it a tad
?
wait, are we talking about the entry level skills q, or the logs review q...?
logs review
thats what i thought, sorry my attention was split with bloody fortify
btw, have I mentioned lately that I hate fortify...? ;)
@RoryAlsop nah, too many of them to bother.
I think we need to start closing as they come in, and fix the older ones to remove the specific info so that they're more generic.
not like one that came in 2 days ago - completely identical to an IIS logs one, but this one is on apache so they're completely different....
@RoryAlsop +1'd it for ya, but why do people keep commenting that security questions should go to Programmers??
hahaha - no idea. The more we can do to publicise Sec.SE the better - it should help now we are out of beta
11:29
@RoryAlsop maybe. but I think for typical programmers, "security" is something different. it sounds like our site is for firewall admins, but they mean something else.
wow, I'm snarky today, arent I...
heh
education awareness repeat as necessary
hehe
yeah....
think I need to take my kids to pick up a subway for a hungover wife:-)
will be back in a bit
bon appertit
cheers
11:38
btw @RebeccaChernoff I updated a bit of details on the OWASP sponsorship q...
 
1 hour later…
12:43
The word "security" is really wonky when it comes to use in the different disciplines.
In the Oracle world, for instance, it almost exclusively means user access management. Incidentally, they refer to groups as "roles". Also makes for some confusion.
@ScottPack @ScottPack!
bit early for a Sunday, innit?
@ScottPack yeah, I think we had that conversation a few days ago... but what was this in context of?
@ScottPack yeah, I'm familiar with that dissonance. They won't fix years-old vulnerabilities, they'll allow public-access sql injections, but their "security" (i.e. roles access management) is rock solid. (except for where it's not).
@AviD It's hard to tell, that was a long time ago.
It's 8:45, I'll have you know. I haven't had breakfast yet, but I am drinking some coffee. Technically, the Open is on, but I'm not really watching.
@ScottPack i meant your comment...
@ScottPack "the Open"? is that tennis...? :$
@AviD I'm allowing for it :)
Golf
@ScottPack "seriously, have some ESPN on in the background...." :$
12:48
@AviD The in-laws are visiting, and he's a golfer :)
@ScottPack ahh
So, this is cute. We're flying down to visit my parents in a little over a month. So this morning I looked up to see what kind of plane we'll be flying in and the ole lady is talking to the kid about it.
aww shweet
showing pics and everything?
reviewing the safety procedures?
practicing swim strokes....?
;)
Just pictures so far.
We're just hoping to get her used to the idea of being on a plane
never been yet?
how old is she again?
12:57
She's 2.5. We flew down there last year just before her 1st birthday, but I'm not entirely sure that counts.
Eatin time. Have a lovely day, eh?
oo fun.
bon appertit....
ey up - on the topic of ESPN have you followed lulzsec's twitter feed today - much nonsense, but vaguely amusing
14:09
I like it
@AviD thanks for the edit on the duress signal question, makes it a lot clearer.
and there are some really great answers, even if there's no solution :-)
15:14
@RoryAlsop Thanks for the new ad image - that's a lot clearer. But I wonder if changing the banner to something more "ours" like IT Security Blog would be clearer and more appealing
though the embedded logo helps. but makes it seem like it is external news about our site
perhaps we can adapt the actual blog header after the redesign lands
15:33
Oh, this is funny as hell.
Hrmmm... I wonder if I should spring for the 2nd-Day shipping this time?
15:45
Oh hey! I've got a popular question! Cool!
3
Q: In inSSIDer, what is the difference between WPA2-CCMP and RSNA-CCMP?

IsziinSSIDer shows my wireless network as RSNA-CCMP. The settings on the wireless router (Linksys E2000) do not at all seem to suggest an "RSNA" security option. The security filtering options in inSSIDer have both a WPA2-CCMP and RSNA-CCMP available. What is the difference between these?

Congrats!
16:30
@nealmcb I can try - I'm not really an arty person, so I'm just trying things
@RoryAlsop Congrats on contributing, while I stand on the sidelines and kibbitz....
LOL
needs both - I think the blog posts I have put up aren't as good quality as some of the others in there, but I'm happy enough being an early straw man for people to have a go at. That then gets those with the creative spirit into it.
 
1 hour later…
17:48
hey @Scott...
whatever happened after the argument I had against closing my question as a dupe?
because @AviD still thinks its duplicate-worthy
 
1 hour later…
19:14
@StefanoPalazzo ayuh, though that leads me to think it should probably be cw.
I especially liked @pulpspy's pre-readied research topic... amazing what turns up here!
@TheEvilPhoenix I hadnt seen that discussion at the time, and when I read it I hadnt yet seen the question itself.
to the point, as @nealmcb says on a comment there, your question doesnt really focus on the points that are different.
if it did, it's likely there is already a duplicate question, probably somewhere in the tag.
as it stands, there is no conceptual difference between yours and the IIS one.
(FTR, I left a comment instead of closing because I wanted to discuss it first...)
and also FTR, I think the IIS logs one is off too.
See my discussion with @RoryAlsop on this earlier today...
basically, my issue is with all questions of the form, "here is my log/code/virus/etc, please tell me what happened/wrong/etc". (as I said there, the Code Review equivalent for SO... )
and once you remove that part of it, it really becomes the same question - or, a generic "how do I harden apache/IIS/etc", which IS different, but also already answered elsewhere...
19:39
@AviD Agreed - the discussion we had earlier was how to provide a valuable question/answer that isn't a one-off. If we get questions like "here is my xxx - what happened" instead of answering with "you got pwned by Zeus through compromised app xx" we should be able to articulate guidance around incident response and analysis, how to assess vulnerabilities, recommendation for hardening plus ongoing audit/improvement/patching/yada yada
I know it's what a lot of us do for the day job, but it is really that key value add for folks who come here in 6 months or a year with a slightly different trojan problem etc
on another topic it looks like QOTW #2 will be on Rainbow Tables (as suggested by @Ninefingers)
3
Q: Top Question of the Week #2

Rory AlsopFor QOTW #2, scheduled for publishing to the Security Stack Exchange Blog on 22 July, please post as Answers, and vote for your favorite question on Security Stackexchange. Please post any question that you feel is of worth and the reason why. Try not to promote your own questions or answers for...

Anyone fancy stepping forwards to do a short post on this question referred to:
17
Q: What are rainbow tables and how are they used?

AviDWhere can I find one? Is there a pot of gold at the end? How do I protect against them? From the Area51 proposal

the QOTW posts aren't expected to be onerous - more of a discussion of the points raised in the question and answers, some external content as a value add etc - but at the end of the day it is another way to get folks coming to visit and hopefully become members
20:23
@AviD can't do that, you've got to make it a CW for me. I think you're right, this could benefit from being a community wiki.
20:45
@RoryAlsop I dont mind doing that - but it would be a lot more "fluffy" than you might think... as you can tell from my comments there. (my question! yay!)
maybe more around the common misunderstanding around it...
@StefanoPalazzo okay, but lets let it sit for a short while... I dunno, @pulpspy's answer is pretty much as close as you can get to the academically proven correct answer....
@RoryAlsop That's what reading did to me as well :)
21:04
Whats a CW?
oh community Wiki
21:33
So sorry to see the US lose in the final shootout. Congrats to Japan on a world cup win - so cool for them. Great game.
is this really different from all the other "can I change x and still get the same hash" questions?
3
Q: How difficult is it to modify an ISO image and still have the old md5 check sum?

LanceBaynesIf I want to download the ubuntu11.04.iso then: UBUNTUMIRRORSRV -> ISP -> ISP -> etc. -> MYPC I just want to ask that how difficult is to spoof the original MD5 sum (e.g.: the md5sum would be reachable through HTTPS!). So we have: - on the ubuntumirrorsrv: XY md5hash, and XZ ubuntu iso - on my...

@nealmcb umm... soccer? :$
No - not another qotw on passwords - give it a rest!
hi everyone
"seriously, just have ESPN on in the background..."
welcome @lovesh!
can i ask a mysql ques?
21:35
@nealmcb which are you referring to? the rainbow tables?
i mean i have asked it on dba.stackexchange
thought we were gonna do a full series on passwords... its not really a series yet :)
@lovesh sure, if its about security
21:36
its about events
just see if u can help
its made me blind
Yup - women's world cup football/soccer
@lovesh umm... doesnt look like it has anything to do with security...?
final
@nealmcb wow, talk about niche sports. Thats not really mainstream, is it now... ;)
no it not but i am desperate for help so asked it here
21:37
We already have 2 on passwords, and I don't want the blog to be all about any one thing - that will be the perception
@nealmcb I was really surprised to hear about the final. It felt like just last summer we had the men's.
a series is good after a few months, but not right off
@nealmcb ah, see... @RoryAlsop had his little heart all set on 6 months worth of passwords ;)
anyway, get your vote in there...
@lovesh It looks like it's probably already on the right site, I wouldn't really vote for moving it over.
personally, I find passwords boooorrrinnng
password management, a bit less so, but still.
21:39
@AviD Well, it's the most popular game in the world, the world final, and there are more women than men, so pretty hard to knock it....
@ScottPack I agree.
@AviD I can agree with both of those statements.
@nealmcb women's soccer final is the most popular game in the world???
@ScottPack i didnt get u
@AviD soccer is
21:40
@lovesh he means dba is the right place for it.
Incidentally, Friday was the most pleasant password change event I've ever gone though. I only locked my account once.
@nealmcb "popular", or "common"....?
oh
i was just asking if any of u guys cud help
but thanks for trying
@lovesh sorry cant help you... but it doesnt seem like anyone here would have the specific expertise, any more so than the common users at dba....
I'm not even familiar with eventing in mysql...
@lovesh Right, what @AviD said. I don't know how those guys are on the weekends, but you may not get anything meaningful until tomorrow.
@AviD Same here, new feature to me.
21:42
@ScottPack yeah, slackers!
@avid Why is this so hard for you? Soccer is a game. The most popular game in the world. This is the final. There are lots of women playing sports, so you can't say it is some niche activity.
@nealmcb lol... its funnier, because of our respective locations... over here, it is a national sport, I just continue to make fun of it. in U.S. its still not as popular....
See you later, folks!
but getting more common, I hear.
@nealmcb Have a lovely evening, @nealmcb!
21:46
@ScottPack ditto!
22:19
urrgg... vox populi badge, now?? I'm still catching up! so many new questions!
I feel like No.5 on this site... "Need info. Morrre infoooo"
shopping recommendation-ish?
7
Q: Resources for data on security incidents

this.joshWhat resources exist to research data on actual security incidents? I would prefer an online resource but offline resources are acceptable. The cost of access should be less than $100 (US) for access to a statistically significant number of incidents. I would prefer databases that include more ...

@thisjosh I think it makes sense to make that one cw - its a "list-of-X" question, though very interesting and important.
sorry, I mean community wiki....
22:42
@RoryAlsop, what's your opinion on lmgtfy bait? I'm seeing a big bunch in the latest crop.
IMO, if there is a trivially findable wikipedia page on it, or a simple google query turns up clear, simple, basic answers in the first handful of results - we shouldnt encourage those questions...
2
23:08
@AviD There are a few, yeah - guessing the peaking we are seeing on the stats is the side effect. We are getting more people, so there are also folks who don't know the focus yet. Experienced SE users will know the score, but brand new folks won't read the FAW, no matter what we try and do.
If LMFGTFY questions turn up I think we shouldn't just say "F off and google it" but we should comment to give them a chance to improve, then close as NARQ or whatever if necessary
3
Think we have mostly managed that over the last 8 months or so
well, there have been some excellent answers to some really bad questions.
correction, not bad, just really low-level. wiki-able.
unless they're being copy-pasted, its a waste of effort... and bad signposts.
You're a waste of effort
@ScottPack hehe, I've been told that before. that, and incorrigible.
and you're an a** ;)
23:24
@AviD I've been called worse today
@ScottPack oh, you've been visiting with your parents, too?
In general, though, I do agree with @Rory. We've got a lot more people that just haven't had time to get the feel of the place. Remember how in the early days of the public beta we were being a tad overly touchy-feely?
I feel as though this stage is going to be another one of those.
And, no, although my in-laws did come in for the weekend. I won't be seeing my folks for another 6 or so weeks.
@ScottPack fair enough, I guess patience and a gentle hand are the rule of the day.
Just like Zhaan always said, 'Time, and patience.'
on a lighter note, anyone watch burn notice?
latest episode was about hackers....
23:27
I haven't, but the half episode of it looked good
oh, and teachers. "The teachers, man, teachers. Teachers. Teachers."
it's... sad.
either they writers are clueless about it, or the victims are really insecure and dont know it.
probably both true....
I'm gonna go with both.
It's usually a bad idea to be close minded.
Did you see any of Breaking In?
always makes ya think, when they talk about the stuff you know - and realize how wrong they are - makes one think about how much of the other stuff is wrong, too.
@ScottPack heh, you're probably right.
No kidding
@ScottPack no, any good?
I'll put it on my list.
23:29
I enjoyed it
Breaking In was an American television series which ran on Fox from April 6, 2011 to May 17, 2011. The series aired at 9:30 pm as a midseason replacement following American Idol. The half-hour workplace comedy stars Christian Slater, Odette Annable, Trevor Moore and Bret Harrison. Fox announced it would not be renewing the show for a second season on May 10, 2011.However on July 5, 2011, Fox and Sony Pictures Television announced they have picked up the options on the cast's contracts, keeping the door open for the show to return for a second season, despite being left off Fox's 2011-2012...
Only lasted 7 episodes :(
awww
lots o good shows, getting cancelled quickly lately.
Slater and Rosenbaum were freaking incredible in those roles.
guess its easier to just do reality tv.
Certainly cheaper.
@ScottPack ahh!! I've been saying for years that would make an excellent show!
23:32
It was a half-hour workplace sitcom on Fox, so you definitely get what you expect. I would have kept watching it, though.
I'm excited that Eureka and Warehouse 13 are back on.
No Stargate. Except for the ~9month gap between Atlantis and Universe, this is the first time in my adult life that a Stargate show hasn't been on the air.
And now it's storytime. Ta.
gnite
23:59
@ScottPack omg, im about 4 minutes in, and I'm already luvvin it! thanks!

« first day (213 days earlier)      last day (4965 days later) »