The DMZ - 2011-08-19

« first day (246 days earlier) ← previous day next day → last day (4932 days later) »

Jeff Ferland

02:11

@nealmcb I only need to apply it to one system for it to be useful for me... but nobody's going to generate the table if I've got the only system. I think that was the point that I had trouble expressing.

nealmcb

02:41

@JeffFerland Well, it depends on how valuable your system is.... When you say "function" you're describiing the technology, not risk analysis.

1 hour later…

Ori

03:53

security.stackexchange.com/questions/6403/… This seems like it may violate some agreements, or be downright illegal to discuss.

Feeds 205

04:06

Five-Minute Comics: Part 4

nealmcb

@Ori I guess it could be a problem for them to talk about it. But I doubt it is illegal to discuss. I guess some countries (not the US?) outlaw even discussing some things like that related to their own secrets. E.g. the NY Times had no trouble sharing and discussing wikileaks stuff.

Manning on the other hand....

Ori

@nealmcb I'm just guessing in order to have the CAC you had to sign something that said you wouldn't discuss it in this manner, which might have criminal penalties.

nealmcb

@Ori Right - but by "discuss" I thought you were meaning it might be illegal for us to discuss it....

Ori

04:23

@nealmcb Heck no, keep on keepin on ;) if it was illegal to speak about CAC in general half of defcon would be in prison.

Iszi

04:39

@Feeds205 404?

Rory Alsop

05:01

@Thomas - will be on and off today as I'm heading to meetings in London. Happy to chat asynchronously by email, or should be back to normal tomorrow.

@iszi - interesting. @Scott - what us feed 205?

2 hours later…

this.josh

07:28

@Ori The US DoD has many agencies that have different perspectives on security. Operational security is difficult to bound in a manner that allows some operational discussion while restricting critical elements. I thinking it is a good idea to provide warning and comments if you think discussion of the subject matter may be illegal, unethical, or breach of contract. However I think it is difficult in many cases to know if the subject matter is any of those things.

Graham Lee

07:39

@Ori (and everyone else talking about it) I think the question stands. Whether the asker is violating some private agreement in discussing the content is their own problem; the question is attracting answers that seem reasonable so "the community" is benefitting from the post.

Besides, even when you had to sign an NDA to learn about a particular matter, you can't infer that somebody else is confined to the same terms.

Oh, and hello everyone.

AviD

gmorning

@RoryAlsop @Iszi @ScottPack - that looks like the xkcd feed. weird about the 404.

also the name is weird....

hmm, I think I fixed it. should show up as the same StackExchange user now...

@ThomasPornin its definitely getting to be more work now, than at the beginning.

on the upside, there are slowly starting to be more users that can do most of the work, too.

Graham Lee

I hope we don't have the XKCD feed in here. I already read the cartoons once when they're published, then again when somebody asks a question about each at the main site, then another six times as everyone "cleverly" quotes it in their answer.

AviD

@GrahamLee excellent. and yes, @ScottPack added the xkcd feed in here, as per @Iszi's request.

I guess it makes sense, to be prepared for the questions...

Graham Lee

Oddly enough I have an RSS READER for reading RSS.

AviD

@GrahamLee shocking, right?

but someone usually winds up sharing it here anyway, when theres a good one (which is often...)

@ThomasPornin I will also say that a large chunk of the time I spend modding, is not really modding - editing, retagging, and cleaning up most posts.

also, apparently, I comment on almost all the posts here :$

at the beginning, that wasnt so much - I spent more time just trying to get the community more involved. meta, chat, external activities.... trying to build up the site.

Graham Lee

07:49

@AviD @ThomasPornin yeah, same here; most of my time is spent reading through and looking for things to mod. I end up voting on a few posts then moving on.

AviD

now, the influx of questions and answers are such that I often dont even have time to answer, let alone read all the posts.

Graham Lee

I also tend to "sweep": if both @AviD and @RoryAlsop have looked at a flagged post and not done anything, and I don't want to touch it either then I clear the flag.

AviD

@GrahamLee oo thats good to know.

this.josh

Agree Graham. Like I said even in US DoD not every agency views OpSec in the same way.

AviD

but in general, there's really not that many flags.

Graham Lee

07:50

No, it's not like SO where there are currently 93 flags and 54 pending edits.

AviD

if it was just dealing with the flags, it would be very minimal work involved, especially since there are 3 mods

whoaaa, wait a sec - who's the fella with the cap and beard??? he stole @ScottPack's name!

trying to zoom in to see if that guy really has @ScottPack's eye....

@ThomasPornin I will also say that for @RoryAlsop its probably a bit different, especially since he's also taken on the blog... though that could just as well be seperately modded. And, he also spends a bit more time here than myself and @GrahamLee put together... ;)

Graham Lee

Certainly for the last few weeks he's been unemployed...that might change now ;)

AviD

08:17

well, I'm off to take the kids to the pool. no, that is not a euphamism.

Graham Lee

heh

Rory Alsop

09:00

@GrahamLee Not me - I've just been consulting in my own company since September last year, now I'm back to being employed by someone else:-)

Rory Alsop

09:10

Is interesting being back in London City after months away, and sitting in an office 40 feet from my old London office:-) That Shard building is coming on well!

Graham Lee

Last time I saw it it was a spindly stick of concrete, but it was already taller than Canary Wharf

Rory Alsop

will tweet a picture later from the boat - am taking the river taxi across to the other main office at Embankment later (I'm such a tourist)

2 hours later…

Scott Pack

11:37

@AviD Fun Fact! The sepia tone is my right eye!

@RoryAlsop How long are you going to be down south?

Thomas Pornin

12:10

Hello

@AviD Well, I am not asking for security.SE -- I mean, I do not volunteer for the upcoming mod elections on security.SE (whenever they happen); but I am being volunteered as temporary mod for crypto.SE and I want to know if I should run away from it.

Also, completely unrelated: if there is a wrong answer (which has been upvoted a lot), adding a comment is good, but editing the answer to add a paragraph (saying that everything above is wrong) is wrong ?

Stack Exchange

Stack Exchange Security Blog: QotW #6: When the sysadmin leaves…

posted on August 19, 2011 by ninefingers

When we talk about security of systems, a lot of focus and attention goes on the external attacker. In fact, we often think of “attacker” as some form of abstract concept, usually “some guy just out causing mischief”. However, the real goal of security is to keep a system running and internal, trusted users, can [...]

Thomas Pornin

(I get that as a suggested edit on crypto.SE and I whink I should reject it)

Scott Pack

@ThomasPornin I would consider that bad form

Graham Lee

@ThomasPornin if you're editing to say "the answer is wrong", why not just edit out the wrong bits and replace them with right bits?

Thomas Pornin

@GrahamLee Apparently the editor thinks that the answer (actually, two answers) are entirely wrong and should be removed altogether.

Graham Lee

12:26

I'd only be inclined to that if I could demonstrate with appropriate references that my "right" answer was rightier than the "wrong" answer.

It seems to be a particular problem in appsec where developers get cargo cult notions of how encryption protocols should work, so if someone gives the cargo cult answer they'll get upvoted into the stratosphere with little chance of correction.

M'vy

hi there

Ninefingers

@ThomasPornin Editing someone else's answer and saying "this is wrong" is really bad form. Either the editor should have corrected it (small error) or downvoted it (large error) and left an appropriate comment politely pointing out the mistake.

Graham Lee

hey @Mvy

Bill the Lizard

13:00

Hey all.

I've seen a few other "learning recommendation" questions here that didn't get closed, and I was wondering if this one is specific enough. I didn't find any exact duplicates.

0

Q: What resources would you recommend for learning about OS security?

I'm interested to discuss security and want to work in this field. I need a difference of useful resources! I first want to study the security of operating systems, both Windows and a version of Linux. Which Linux version is better for security work, and what is the best resource for learning? ...

windows linux security operating-system

If you think it should be migrated, let me know. If I get no response I'll take that as a "no thank you." :)

Graham Lee

Hey @BilltheLizard, I'll take a look, but it seems very similar to Qs we already have

Yeah, I'm pretty sure that's a duplicate of the site's existing content, even if not a dupe of a specific question.

M'vy

If anyone has time and is interested in the GamesCom, I advise you to read @Fallen blog post on gaming blog

Mana ಠдಠ

Super special awesome link, GO!

blog.gaming.stackexchange.com/2011/08/19/…

Bill the Lizard

Thanks @GrahamLee. I ran it through the "Ask Question" page and didn't find anything exactly the same either. I'll just give them a few of the similar links to IT Security questions.

M'vy

@Manaಠдಠ XD

Graham Lee

13:10

@BilltheLizard great, thanks :)

M'vy

@Mana That's funny : autocompletion does not porpose you unicode characters, but reply does it

Mana ಠдಠ

@Mvy Interesting. I was always wondering how other people got the characters to show up in their replies.

2 hours later…

Iszi

15:00

@AviD What's really weird is that the comic that ended up in that slot isn't the comic that posted to the feed.

Did you guys ever actually see a comic in the feed? There was one, initially. Now I see the XKCD error message.

@AviD Yeah, that's more the reason I asked for the feed.

Scott Pack

15:23

I put in the rss feed for the comic, so I wonder what got busted

Scott Pack

15:37

The settings look good, and it's designed to be posted by the StackExchange user

Graham Lee

grumble

Scott Pack

Sorry, it's nearly lunch time

1 hour later…

Iszi

16:51

Emergency alert @ KSC "unauth. individual w/ beard wandering around HQ building wearing long coat & back pack" turns out it's @IsraelZulu

Tweeted by neodagringo on August 19, 2011 at 4:25 PM

Yeah, it's been an interesting morning...

M'vy

Waaat?

@Iszi you're physicaly pentesting?

Iszi

@Mvy No. I have a beard, and the jacket is a part of my daily attire. The backpack was necessary to carry a laptop that I was going to use at an appointment I had for vulnerability scanning.

M'vy

^^

Iszi

The jacket isn't really that long either.

Scott Pack

17:41

Only knee length

I'm thinking of a Cake song....

/me blinks

Ok, so, @Iszi. A DM you sent me a few weeks ago just got a completely different context.

2 hours later…

Iszi

19:29

@ScottPack Which?

Scott Pack

You are!

Iszi

@ScottPack Am?

@ScottPack You've lost me just a bit.

@ScottPack Not even close.

user image

Scott Pack

That is incredibly not-fun of you.

Iszi

@ScottPack What? I wear it every day, and have for the few years I've worked there.

Scott Pack

Isn't it a bit...warm in the summer months?

Iszi

19:43

@ScottPack A little bit. But I'm used to it, and I'll switch to carrying it if I'm staying outside for too long.

Just so happened that today I walked past the wrong little old lady. Instead of asking me for my badge, she went straight to calling security without a word to me.

Scott Pack

Excellent

Well trained that one.

Iszi

What's somewhat bothersome is that, in reflection, I've gone wardriving with that jacket on without a problem... Walking the halls with a bulky hand-held unit that has a big ol' antenna...

@ScottPack By the way, it's also a bit rainy in the summer. And, I like the pockets.

Scott Pack

Ok, sure, every day from 2:45pm to 3:07pm sharp you get torrential downpours. I'll go with that, but it's predictable.

Iszi

@ScottPack Predictable? Obviously, you've never lived here.

...and definitely not in the past few weeks. We've had all kinds of rain during all times of day this season.

Iszi

20:05

Oh, @ScottPack and @Mvy - Just to be clear, I'm not actually an "unauth. individual". I was authorized to be where I was when the person called security on me. The "unauth. individual" is just a rough quote from the e-mail alert that went out.

Scott Pack

mmhm

Graham Lee

20:34

evening

Stack Exchange

21:18

Stack Overflow Blog: The Future of Community Wiki

Posted by Grace Note on August 19th, 2011

When you mark a post community wiki on a Stack Exchange site, that means …

this post can be edited by anyone with 100 reputation

this post does not generate any reputation for anyone when upvoted or downvoted

The main advantage of community wiki — more editing — was nerfed when we introduced suggested edits. With suggested edits, anyone, even an anonymous user, can edit anything — so long as another experienced user reviews and approves their edit.

This leaves many wondering — what’s the point of Community Wiki? …

Thomas Pornin

21:57

Third time this month that I am getting attacked by an Indian virus

i.e. a computer virus which duplicate by having someone with a heavy Indian accent phoning me about "detected problems with my computer" and requesting that I run some commands for him.

I really wish that they would write in their database: "does not work on that guy"

1 hour later…

this.josh

23:09

@ThomasPornin Don't you understand what a great opportunity it is. They called you, you can say anything you want. I usually ask if they want to talk to Frank cause he's the tech guy. Then there's the fun of giving responses that can't happen. Finally, I usually play a faint doorbell sound and ask them to hold on. By making noise in the background I've got one guy to hold on for ten minutes.

this.josh

23:23

Oh and they probably don't share databases. Thats part of the argument for in the open security. If the good guys pool resources, and the bad guys don't, then all other things being equal the good guys win.

I think we should consider migration from IT Sec to SU of security.stackexchange.com/questions/6403/…

« first day (246 days earlier) ← previous day next day → last day (4932 days later) »

Transcript for

Aug '1119

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2025 Stack Exchange Inc; legal

mobile