The DMZ

AviD

00:13

"you look smart, can I have some urine?"

heh, @RebeccaChernoff will probably come yell at me for that....

Scott Pack

It took me 3 episodes to realize that was Rosenbaum.

AviD

hehe.... not really lex luthor, huh....

Scott Pack

A bit different, yeah

this.josh

03:14

@AviD I hadn't though of it that way but I do admit there is some validity to your claim. I think the question is important since it helps answerers use real data to talk about potential outcomes. What is the difference between a community wiki and a regualr question? maybe I better ask on meta...

2

Q: How and when should we use the Community Wiki feature?

Im wondering when, if ever, we should use the community wiki feature which we often see on SO. Is it even implemented in our site? Also have a look at discussion-questions . Discussion questions and other questions which arent easy to make a common conclusion on are often tagged as Community W...

discussion

already there, but not clear to me...

M'vy

07:59

Hi there!

AviD

09:09

either I just became a victim of an upgraded malware-USB-in-the-parking-lot attack (just had one delivered to my home from "amazon"), or I have a secret admirer.

but really, this thing is awsome!

oh, nevermind. Just found the note... it was a gift, from someone I actually know.

But, it sure made me suspicious as hell when the delivery guy handed me a package from amazon I didnt order...

does that make me paranoid?

AviD

09:35

@thisjosh in my view, cw is useful for those types of questions which have a lot of value, but are not really objective questions, in that there can be one complete correct answer.

such as list-of-x questions, if the list has value (so it cant be closed).

its not a condemnation of the question, quite the opposite - even though normally it should have been closed (because its not "proper" SE format), it's deemed important enough to keep. CW gives us a mechanism for that.

M'vy

09:47

@AviD So you're better than those DoD employees :D

(IIRC the good institution :P)

AviD

@Mvy :)

I think it was several different incidents, not just the DoD.

Mind you, I will be plugging this bad boy in soon enough ;)

some kind of hiking-style usb - durable, waterproof, etc...

not that I ever go outside, but its coooool

M'vy

10:07

:P

I heard of a mouse hacking too :p

With a chipset included in the mouse :P

Rory Alsop

@Mvy It was very nicely done - although the image of the inside of the mouse was a horrible physical kludge

M'vy

Well... who dismantle its mouse before plug it in?

Rory Alsop

exactly

AviD

eww... brings a whole different meaning to dissecting mouse in biology class....

M'vy

10:25

^^

Today kids, we're going to study : the mouse :O

- Grab a screwdriver
- Wait, what?

AviD

10:36

hehe

M'vy

hm... we're -> where ?? What I have been drinking? Oh I know, nothing. That could be the problem in fact.

AviD

10:54

nevermind, it was understood by all. Probably had equal amounts to drink, so its symmetric...

Rory Alsop

@AviD symmetric anti-drinking ... there's something wrong here

AviD

oops, missed the part about the "nothing"...

anyway, shouldnt that be "symmetric null-drinking"?

Rory Alsop

did you see @nealmcb's suggestion for QOTW #2 - on hardening, leaving the rainbow tables till a later week. Makes sense to shuffle topics around a bit I think. meta.security.stackexchange.com/questions/388/…

AviD

hmm, as long as we're applying crypto terms to drinking - i think we should switch over to "bcrypt drinking": many many rounds.

Rory Alsop

@AviD public/private drinking

:-)

AviD

10:57

hehe

Rory Alsop

(nobody knows how much you drink in private, but everyone sees your public drinking)

AviD

lol

@RoryAlsop makes sense, IF you dont want to do a *-theme. But he makes sense about waiting with the themes till later.

on the other hand, I also think we need to keep the q-surveys to a low nmber, too. they're great, but if it just grabs other q's it doesnt add much content.

probably does put things in perspective, though...

i guess QotW is good for that then :)

but, thats not a Q otW, its a Topic otW.

still I hate fortify and all, but I think having some of the qotw like that could be fantastic.

especially if its anything like @nealmcb's first one, on all the password questions - that was great. And I hate fortify.

Rory Alsop

well this is the thing - I reckon the normal posts will be the in depth ones people want to do off their own back, whereas QOTW, while not filler, are regular popular topics, with info from the q and a's, some extra bit, but not in depth. -- easy to do one a week

normal ones take a bit longer, are deeper etc

a fortify one would be fun

AviD

@RoryAlsop I agree.

Rory Alsop

do you hate fortify much more than the other tools - Veracode?

or just hate them all?

AviD

11:02

hehe

i just have to use fortify more, client requirement...

I havent used veracode much, but while I dont like the other products too much, I have a special level of despising for Fortify.

Rory Alsop

I like some of the ways fortify hooks in to the full dev environment. Definite value add if you can let the developers run it on every build - so they can impove their code before it ever gets to an IT Sec fortify scan

that is a complete win if you get devs wanting to use it

AviD

maybe because of the difference between their marketing image and reality...

Rory Alsop

despite its drawbacks

AviD

@RoryAlsop thats a very big IF.

and, most other tools have some level of hooks too.

e.g. IBM Rational Appscan Source Edition (?) nee Ounce has much better hooking into the dev environment.

Rory Alsop

project I worked on this spring worked that way - the devs really liked it. Needed a lot of behind the scenes tweaking so that for devs it 'just worked' but the level of acceptance was awesome at that point

and as it needed to hook into TeamFoundation, Ant and Maven - that was interesting, but fortify worked in that environment

AviD

11:05

really? thats fantastic.

that you got the devs to buy in.

Rory Alsop

yup - wish we could use it as a case study:-)

almost got them looking at it in terms of scores

how few findings they could have in the weekly build

AviD

I've had much more luck with checkmarx, even with ounce there was more interest. And I had a very big client where the devs loved klockworx...

@RoryAlsop should!

Rory Alsop

had more interaction with devs than sec team, tbh

really positive environment

AviD

the exception that proves the rule....? ;)

Rory Alsop

@AviD can't. NDA

AviD

11:07

thats very cool. Opposite experiences suck

Rory Alsop

:-(

AviD

aww shucks.

tbh, as long as one doesnt have high expectations for the output or efficiency, its not bad for what it does.

Rory Alsop

it wasn't fortify themselves I was working with, but Justin and teh Gotham Digital folks - they really know their fortify integration!

that makes the difference too

AviD

I would definitely use it, as a starting point, if I didnt have anything else.

ah, those are smart fellows.

my problem is less with the integration (though I have cursed their UI often), its with the engine. And there's not much you can tweak there, except to shut stuff off.

Rory Alsop

@AviD yeah - the rules/exceptions bit is half the battle. That's why they hire folks like us:-)

AviD

11:13

@RoryAlsop how much have you actually mucked around with those?

I've tried it out, but except for rare cases havent found it worth the effort.

it doesnt even compare to checkmarx... them, I'm a fan of.

even if they do still have startup-issues.

Rory Alsop

It was a hugely critical bit. For xMLOC applications we needed to tweak the false positives side of things. Pretty high effort, I agree.

Haven't played with Checkmarx yet

AviD

@RoryAlsop high effort, yes - but did you get enough back out of it? without hitting the false negatives rate?

Rory Alsop

definitely!

AviD

hmm. might be I should look into that again.

wont stop me from hating on it, but I might complain less :)

Rory Alsop

11:35

:-)

Scott Pack

So how much longer is this engagement, @Avi?

AviD

@ScottPack the fortify one?

why, tired of my whinging? ;)

It's ongoing... part of a larger, longterm engagement.
and, it's not just the one... Fortify is scary popular. and my feelings for it go way back, long before this one...

Iszi

13:06

Mornin'

The Evil Phoenix

morning is evil

especially on Mondays

Rory Alsop

Mornin' @Iszi

Mornin' @Thee

is it bad that I really like mornings - I'm that annoying person who gets up early and makes toast, thus forcing everyone to be awake:-)

The Evil Phoenix

yes, its bad @RoryAlsop

:P

@RoryAlsop may I direct you to something that was brought up in the AU meta regarding "LMGTFY" answers to questions? I think it sufficiently answers the validity of "LMGTFY" or "Google it" answers.

(just a thought, but its relevant because i expect them to show up here ;) )

Scott Pack

13:23

Morning Gents

The Evil Phoenix

hey @ScottPack, a question. What would you do in the circumstance of someone posting an answer that had a link to "lmgtfy" or some similar site, or just even saying "google it"?

Scott Pack

@TheEvilPhoenix General rule of thumb? I go back to my, rather undiplomatically phrased, "Being A Good Human Step 0: Don't be a dick."

Rory Alsop

@TheEvilPhoenix - did you have a link?

Scott Pack

Sometimes flippancy works and is fine, in the general case I don't much care for it.

Particularly in professional environments.

The Evil Phoenix

@RoryAlsop yeah, do you want it? Its on the AskUbuntu meta, but it pertains to answers which are only "Google It" or "LMGTFY" links

Rory Alsop

13:30

The good thing here is that people generally try and help - the downside of that is that sometimes we don't push back hard enough on really crap questions which should really be found as google result number 1

The Evil Phoenix

i'd hate to have all of you base stuff off of other SE sites but the question of LMGTFY in answers was brought up a few months ago :P

Scott Pack

As an aside, I would also be willing to state that if that type of answer is actually warranted, then you're looking at a rather poor question that is likely not very well suited to the site.

The Evil Phoenix

mhm

this is the meta post on AskUbuntu's site about LMGTFY answers:

11

Q: When is it acceptable to link to LMGTFY?

I just ran across a link to LMGTFY on Ask Ubuntu. In the past, I've found it offensive when users have posted LMGTFY links for me. When, if ever, is it acceptable to link to LMGTFY on Ask Ubuntu?

discussion newbies searching

Scott Pack

I feel like some basic level of research should be evident from the questions. Not necessarily mastery of the material, but some indication that the individual is actually willing to learn on their own and contribute.

The Evil Phoenix

but i think its relevant to everywhere

@ScottPack i agree

but i also think immediately directing a user to google or lmgtfy as an answer is not useful

and thus that "answer" is worthy of being burned with fire.

Rory Alsop

13:31

@Jeff's answer was - "Never, as far as I am concerned. If it is a problem we can blacklist it."

fairly definite

:-)

The Evil Phoenix

mhm

Scott Pack

I also like Mario's answer, comparing it to the equally despised RTFM.

I will totally quote straight out of man pages and documentation when appropriate, however I try to at least give some explanation of the quotes that comes from hard earned experience :)

The Evil Phoenix

indeed.

but quoting out of manpages is actually USEFUL

because sometimes, the best source of info IS the manpage :P

i shall return... coffee run

Iszi

Sorry... been out of the loop... this about the Dropbox question?

Scott Pack

Same here.

@Iszi Not strictly that one, but there is the feeling that lately there have been a lot of easily googlable questions.

Rory Alsop

13:37

I think the general consensus is that if the question is really weak we hope folks vote to close, but if it is marginal, providing content along with links is a positive action we can take. I still feel that if we can also educate the users in not being lazy but learning how to find information, then that is a net gain as well.

The Evil Phoenix

having said that

Rory Alsop

votes do count

The Evil Phoenix

if a user doesnt have the rep to vote to close

they should flag it for mod attention

Rory Alsop

@TheEvilPhoenix good point

The Evil Phoenix

@RoryAlsop that's at least the consensus over at AU... if a user does not have sufficient privileges to vote to close, they should flag it for moderator attention for the same reason they'd vote to close it, and a mod will analyze the validity of that

Rory Alsop

13:43

yep

Iszi

@RoryAlsop Can't rely on votes to close these days. Not enough people with the privilege.

The Evil Phoenix

@Iszi hence why I mentioned the "Flag for Mod AttentioN" thing

Rory Alsop

@Iszi you'll have that back soon enough

It's 3k now isn't it?

and you're on 2,580 - pretty close

Scott Pack

15:14

I think I'll manage to edit my way up to 2k if I keep at it. :)

Rory Alsop

@ScottPack only 121 to go - easy

Scott Pack

Edits are worth 2 each, so 61.

Shit, I could do that just by getting rid of all those 'Thanks!'

Scratch that, 111.

Rory Alsop

heh

101 maybe :-)

Scott Pack

I like the SO Live! plugin. Nice pretty pop-up when rep comes in.

M'vy

?

Scott Pack

15:18

12

Q: SO Live! Chat Edition. — live updates to your reputation score, while chatting.

Screenshot About This userscript, based on SOApi.js, injects itself in all SE sites' chat pages and polls the API for reputation changes every 60 seconds. When your reputation changes, this is announced at the top of the page. SO Live! Chat Edition uses the same notification system cha...

script javascript notifier

Ormis

wow, i haven't been on security stack exchange since the remodeling... very interesting

Scott Pack

@Ormis I like it. Very pretty.

Ormis

i like it, a bit of a governmental feel, but still good

M'vy

@ScottPack that's funny. But I fuess I won't use it.

Rory Alsop

@ScottPack SO live?

Scott Pack

15:26

This is probably my favorite, in concept, but that I haven't used yet.

46

Q: Pro-forma comments

No more re-typing the same comments over and over! This script adds a little 'auto' link next to all comments boxes. When you click the link, you see a popup with 6 configurable auto-comments, which you can easily click to insert. Features 1. Read your comment before you post it! Note th...

script review

@RoryAlsop See the stackapps one-box two lines down :)

Rory Alsop

I hardly have a handle on useful APIs - any hints on other useful ones?

@ScottPack got it now

Scott Pack

30

Q: Threaded comments

Screenshot Before: After: About Instead of showing comments in chronological order, this user script displays them in a threaded view, making it easier to follow conversations in long comment threads. It uses heuristics similar to the @-reply recognition (but it is a little bit more ...

script comments

Rory Alsop

of course there must be somewhere which explains how to use these?

Scott Pack

55

Q: StackPrinter: The Stack Exchange Printer Suite

UPDATE: Version 0.9.9.3 Screenshot App Homepage Printable view About http://www.stackprinter.com StackPrinter is a website that pulls the main details of a given question, all its answers, comments and votes formatting them in a simple essential printable view. I've created ...

app website python google-app-engine

Rory Alsop

guessing that will be on meta - will have a look later

Scott Pack

15:28

They're all user scripts. If you use Chrome then they install directly as extension. If you use FF, then they install into GreaseMonkey

How they get used depends on the specific script.

Rory Alsop

although I have greasemonkey, I haven't any idea how to install something into it - I think I have one of Gina Trapani's scripts, but that was from a 'click this to install some google goodness'

Scott Pack

For instance, stackprinter plops a print icon underneath the Facebook/Twitter icons on a question.

Rory Alsop

I should really research that side of things

but first - must run through the monsoon rains to my train...which will probably be cancelled due to rain, 'cos we never get rain in Scotland so can't plan for this sort of weather

catch you later

Scott Pack

I you have Greasemonkey, and click on a properly formed userscript, it will attempt to auto-install.

Good luck!

Thomas Pornin

15:48

@RoryAlsop Rain cancels trains ?

That must be quite epic rain

Or quite unepic trains

Scott Pack

16:01

According to weather.com they receive an average of 2.2 inches of rain for the month of July.

Having trouble telling how much they've received so far this month, but that's not very much.

I think I remember hearing that Sandwich (~200 miles away I think?) received 1" on Saturday.

The Evil Phoenix

17:25

afternoon, everyone

hows things

this.josh

@AviD I'd like to hear your opinions on Fortify

Scott Pack

This is one of those conversations that's fun to watch, but not be involved in. Like watching the ultra-conservative and the ultra-liberal "discuss" Regeanomics.

The Evil Phoenix

lol

@ScottPack has anyone asked a question regarding the advantages between Key-Based authentication and Password-based authentication for SSH? If so, can I have a link to it>?

Iszi

@TheEvilPhoenix I think there was something along those lines recently.

The Evil Phoenix

@Iszi link and highlight me

i have to head back to work :/

Iszi

17:35

24

Q: Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE I am interested as well in knowing what attacks are they prone to, e.g. as so far mentioned brute...

authentication passwords certificates

There's an older one.

Oh wait... that was actually a discussion here, wasn't it? Never made it into a question, right?

Thomas Pornin

I just got a call from someone with a heavy accent from India (I assume he was talking some kind of English dialect, but although I speak English, I did not understand about a third of his words)

this.josh

@AviD I'm not taking offence. Setting aside the selection critera of which question qualify for the Community Wiki marker; I am thinking about the difference between a Community Wiki question and a normal question in terms of its behavior on the site. I don't think they rank differently in searches. They don't prevent any kind of answers or comments. Is it just whether users can earn reputation from answers?

Thomas Pornin

He was talking about how the servers of his company were receiving data from my "Windows computer" and he wanted me to run things for him.

Just "for checking about viruses"

looks like a kind of mail-based worm, only using an Indian coprocessor instead of mails.

this.josh

Did you ask him for his direct line?

Or did you mess with him a bit first?

Thomas Pornin

I just told him that I was not using Windows, and he was quite speechless for a few seconds

(and that's true ! I am running Linux, here)

this.josh

17:42

My windows says Ubuntu is that the virus?

Thomas Pornin

Listening to his garbled English was already painful as it is

this.josh

I like to 'put them on hold' and see how long untill the hang up

Thomas Pornin

I work from my home, so I get many calls like that (in French from West Africa, in English from India)

this.josh

Hey Thomas have you see this question?

0

Q: Are there any "real world" implementations of secret-sharing encryption schemes?

Imagine something like TrueCrypt where user A can decrypt his files, or any 3 of the 10 directors in his organization can decrypt user A's files. As I understand it this is similar to the way the DNSSEC Root Keys are secured. Obligatory wiki entries. Does anyone know of any commercial or open sou...

file-encryption

Thomas Pornin

@thisjosh Yes. But I do not know of any such product.

I have seen secret sharing in some products, but not for file encryption

this.josh

17:45

What about theory?

Thomas Pornin

@thisjosh The basic sharing uses Shamir's scheme, which was published more than 30 years ago, and is fine; the question already contains an appropriate link.

More advanced protocols aim at providing a shared decryption such that running it does not imply "showing your shares"

this.josh

Yes I saw, are there other methods then points on intersecting curves?

And are there theoritical limits on minimum number of divisions, ratio of min parts needed to total partitions?

Thomas Pornin

Secret sharing

Secret sharing refers to method for distributing a secret amongst a group of participants, each of whom is allocated a share of the secret. The secret can be reconstructed only when a sufficient number of shares are combined together; individual shares are of no use on their own. More formally, in a secret sharing scheme there is one dealer and n players. The dealer gives a secret to the players, but only when specific conditions are fulfilled. The dealer accomplishes this by giving each player a share in such a way that any group of t (for threshold) or more players can together reco...

Shamir's scheme already allows sharing between an arbitrary number of parts with an arbitrary quorum (well, the quorum must not exceed the number of parts).

this.josh

Is quorum vlaue function of the total number of parts?

Thomas Pornin

@thisjosh no

Shamir's scheme is about choosing a random polynomial in a finite field

if you want quorum q then you chose a polynomial of degree q-1

such that P(0) is the secret to share

then the parts are P(1), P(2), P(3),... and so on

there is no relation between the quorum and the number of parts, except that if you make less parts than the required quorum then you will not get far.

this.josh

17:55

Oh ok, is there a maximum to the number of parts you can issue?

Thomas Pornin

If your finite field has size r, then you can issue up to r-1 parts

silmor.de/5

This is an opensource tool which matches the question

the author has selected a prime value slightly bigger than 128 bits

so he can issue more than 2^128 parts

which should be ample enough

The choice of the field is arbitrary, provided that it is a field

this.josh

Thanks! I'll take a look.

Thomas Pornin

i.e., if you compute modulo an integer, this must be a prime

this.josh

makes sense

The Evil Phoenix

18:12

@Iszi yeah, that was a discussion here, but as I finished that, i had a client of mine ask about setting up SSH on a linux box, and they want either all password-authentication or all key-authentication, no hybrid mix. (regarding the post that you highlighted me on)

Iszi

19:20

Has anyone else run across the "automatically move this discussion to chat" feature?

The Evil Phoenix

its a feature?

i always assumed it was someone just saying "Move it to chat!"

Scott Pack

@Iszi Where does one find this feature?

Iszi

@ScottPack Happens when you're part of a long comment-chat.

Scott Pack

Undocumented feature?

Iszi

@ScottPack Perhaps. It pops up as a little notice under your comment, saying something like "would you like to automatically move this to chat?".

Scott Pack

19:31

Ah, ok. I avoid comment discussions like the plague. Haven't run into that one.

Iszi

When you select it, it copies the whole comment thread to a chat room and leaves a note at the bottom of the thread inviting participants to join you there.

Scott Pack

cute

Iszi

2

Q: "Network path was not found" when trying to access a file share.

This is for a Windows XP SP3 machine, trying to access file shares on a Windows Server 2008 R2 system. The client had access to the server previously, and other clients on the same network are not having problems. Other network functions for the troubled client do not seem to be affected. When...

windows-xp networking file-sharing

Discussion between Iszi and Kyle

Imported from a comment discussion on superuser.com/questions/...

Scott Pack

Interesting.

Iszi

That last comment screenshot "let us continue this discussion..." was auto-generated.

Scott Pack

19:34

So it automagically creates a new chat room and, presumably, invites all parties?

Iszi

@ScottPack Exactly

AND it copies the existing comments from the thread into the chat room.

Scott Pack

Presumably order is preserved?

The Evil Phoenix

you hope :P

Scott Pack

And the comments are left on the original site, good.

Iszi

BTW, if any of you guys have input for that issue please do chime in. I'll be on-site with it in about a half hour.

Did some troubleshooting remotely earlier, which is how I've gotten the intel posted thus far. But I don't want to do any more on what could be a problem lower in the stack, without physically being there.

(My bet's still that the root cause is at Layer 8, but that's beside the point now.)

nealmcb

19:50

@Iszi Huh?

The Evil Phoenix

@nealmcb i think its this:

2

Q: "Network path was not found" when trying to access a file share.

This is for a Windows XP SP3 machine, trying to access file shares on a Windows Server 2008 R2 system. The client had access to the server previously, and other clients on the same network are not having problems. Other network functions for the troubled client do not seem to be affected. When...

windows-xp networking file-sharing

nealmcb

@TheEvilPhoenix Oh - I thought that onebox was just an illustration of the comment discussion issue. And the reference to being "on site" made me think @iszi had posted a chat message here that he intended to post to some coworkers

The Evil Phoenix

not sure :P

i'm making assumuptions

but i think that's all there is... because of the nature of saying "Input for that issue"

it makes me think it was relating to the aforementioned post

Iszi

@TheEvilPhoenix has the right of it.

I'm going to be at the location where that issue is being experienced soon.

The Evil Phoenix

oops wrong window

Discussion between Iszi and Kyle

Transcript for