The DMZ

tylerl

04:10

@JeffFerland Come to the Googley side. We have cookies.

And nobody will make you write PHP code.

Rоry McCune

09:08

Morning All

Some quality weasel words here kb.vmware.com/selfservice/microsites/…

"err yes we support weak SSL ciphers but, that's not our problem honest"

Tinned_Tuna

09:36

@tylerl "And nobody will make you write PHP code." Definitely a huge plus to the googlers :-p

Also, I find it amusing how the top two starred comments at the mo. are light-heartedly abusing @RoryAlsop

Rоry McCune

@Tinned_Tuna this may be because I'm one of the 3 people (that I know of) who can pin stuff and lightheartedly abusing Mr Alsop is a hobby :op

Lighty

Morning

Tinned_Tuna

morning

TildalWave

Morning

Each time I see TOTP I still read it at first as "Top Of The Pops" :)

Rory Alsop

10:11

@TildalWave that's what it is, obviously :-)

@RоryMcCune Heh

TildalWave

@RoryAlsop Or, considering some of the questions here asking about it, it could also mean "Time Off The Pill"

@RоryMcCune Any blue people and @ScottPack and you can pin messages onto the star wall. So your ability to pin is not so scary as, say, that @AJHenderson can pin them too :)

Tinned_Tuna

@TildalWave so, if I hold my breath for long enough, I'll be allowed to pin? Cool!

2

TildalWave

@Tinned_Tuna you nailed it :)

Xander

Happy birthday security.SE!!! 4 years ago today, this site was launched into private beta.

11

TildalWave

10:31

2

Q: What is the difference between antivirus and firewalls

I need a brief explanation about the differences between antiviruses and firewalls

this one needs protection please

(and two accounts /posts nuked)

-2

Q: Why is Connrat's YouTube channel so bad?

Why is Connrat's YouTube channel so bad? [Channel] why, just why? I don't even..

internet

@RoryAlsop You here? What's two nukes among friends? :)

Saladin

1

Q: How do I predict future root cause analysis in the presence of double unknowns (unk-unks)?

Using following concept is it possible to define or layout future risk or in security terms future root-causes that are critical for organization operations and businesses. Those concepts are:- 4 entities known bad known good unknown good unknown bad zachman framework system conce...

risk-management risk-analysis

Tinned_Tuna

So, I'm new to reviewing, and I'm looking at a question in the First Post queue. If a question is not on-topic (i.e. requesting support for a specific product), do I simply flag it? Or is some other action appropriate?

TildalWave

@Tinned_Tuna Close as off-topic / belongs on a different site / Super User

if that applies of course

if it doesn't then just off-topic / not within scope

Tinned_Tuna

@TildalWave I don't see that under "flag", am I looking in the wrong place?

TildalWave

@Saladin That's just a RFC question ... not what we do here. OP should specify a specific question that can be addressed in answers of reasonable length. We don't "discuss" things here.

@Tinned_Tuna use the close button

it's a big red button top right

Tinned_Tuna

10:42

@TildalWave I might not have earned the right to close questions yet, I've only got ~500 rep. I think the closest "right action" in this case would be a down-vote and maybe a comment.

or flag for moderator attention

TildalWave

@Tinned_Tuna vote, and a flag then to close ... not the mod attention flag but a flag that suggests to the system that the question should be placed in an appropriate review queue

Saladin

@TildalWave what about constructive feedback to new theme or ideas? this site is not fit to provide such....

TildalWave

@Saladin it's too broad

or "unclear what you're asking"

same thing here ... doesn't identify a specific question

Saladin

@TildalWave did you saw the prezi preso?

TildalWave

@Saladin No, I don't have to, because I read the question and I can't see what the question is. We don't do thesis analysis or alike here, we're a Q&A, simple as.

Tinned_Tuna

10:46

@TildalWave The question in at hand is security.stackexchange.com/q/72714/7954 I was going to flag it "closed for another reason, off topic". Does that sound right to you?

TildalWave

@Tinned_Tuna I guess, I forgot what you have available without access to vote to close ... I voted as "off topic / product recommendation"

anyway, it has 3 votes to close already, it'll be closed pretty soon anyway

Tinned_Tuna

@TildalWave thanks :-)

ManishEarth

Uh, so I've self-assigned the task of integrating simple cert validation in Servo. Yay me

I'll probably start of with a very simple thing that checks against a cert whitelist (yay security) and then switch to pkix/certverifier or NSS. (Any other recommendations?)

Tinned_Tuna

@ManishEarth how high's your pain threshold?

ManishEarth

@Tinned_Tuna I dunno :p

why?

I'm integrating an existing library

Rory Alsop

11:09

@TildalWave thanks for those - I nuked 'em :-)

TildalWave

@RoryAlsop Yey! Thanks! Since you're spending nukes, could you also obliterate this one security.stackexchange.com/a/72696/20074 ? It seems it could be a related account.

Both threads started with "What is the difference between ..." and the answers are/were just some gibberish ... could be some script kiddie that just discovered how to script POST requests

Rory Alsop

@TildalWave yes - how annoying

thanks for calling them out

my modhammer is warming up nicely today

TildalWave

no problem ;) where IPs related?

Rory Alsop

@TildalWave not sure - once you destroy spammers, it takes out a lot of info. CM's can see it, but mods can't

Anyone reckon this now has enough info to be reopened?

1

Q: HTTP attack taking down PHP-FPM

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons of different agents xx.xxx.xx.xx - - [10/Nov/2014:5:14:35 -0500] "POST / HTTP/1.1" 502 574 "...

php denial-of-service wordpress nginx

TildalWave

@RoryAlsop Do you know of any good example thread on Video Production (or elsewhere) that uses embeded YouTube videos? I wanna answer one of the meta questions in space to enable embeded videos and I think it would be useful, but am looking now for one or two good examples of how that works on SE

Rory Alsop

11:24

@TildalWave Definitely a few over on Music.SE. Hang on

TildalWave

@RoryAlsop Not really. I voted to leave closed. He doesn't add any debug info that we could use or changes in request rate. He just adds that "something happened" and that "he hasn't a clue how to extract relevant info"

It could as well be SQLi on one of his pages that others are trying to open and causing the clients to process some JS that POSTs invalid requests and his server trying too hard to make sense of them.

It's still not clear that it's a DDoS and while it obviously is a DoS, the cause of it can't be established by info he posted.

Also - OVH. That's like what you need to be protected from, not where you host your server and aren't protected from attacks from within the OVH network.

That network hosts like 3/4 of all illegal requests I get on my sites. It's usually the first to get its own blacklist policy.

CodesInChaos

12:17

4

Q: Trusting new IT personnel

I work in a small software house. We are all developers and we do servers/network management required for our software (many servers per customer). We are expanding with more customers; and the overhead of server management is increasing and now we plan to hire server(s) administrator. Normall...

hiring-process new-hires

CodesInChaos

12:29

@RоryMcCune As long as you don't prioritize them over stronger suites, I wouldn't care too much.

Rоry McCune

@CodesInChaos indeed unlikely to be a real-world problem, but to me they're trying to get out of the obvious fix of "disable support for weak ciphers on the server"

Journeyman Geek

@CodesInChaos eh. I answered that

TildalWave

12:57

> make sure they have the access they need and no more

well that rules out the beer fridge then :)

Note to self: Make sure that the company policy includes refilling the beer fridge and locking it for security purposes. Conveniently forget to include a key issuing and revocation policy as old employees leave and new ones join the corporation.

Simon

13:15

All I see in here is a bunch of donuts.

Rоry McCune

@Simon any particular reason, or just general Doughnutry?

Simon

@RоryMcCune Yeah, it just struck me.

Rоry McCune

@Simon but are doughnuts good or bad?

Simon

@RоryMcCune Well you see, that's the thing, they're vicious. Tasty as nobs but if you eat too much, you'll become as fat as everyone's mom on the Internet.

Rоry McCune

@Simon hmm so you're saying the DMZ is good in small doses but don't be on here too much or you'll end up a lardass

raz

13:20

@Simon Your mom's as fast as the internet

Journeyman Geek

@TildalWave Clearly. One needs careful use of alcohol to ensure that we have a ballmer peak ;p

Simon

@RоryMcCune What do you think happened to @AviD? He just became too fat to even press the power button on his PC.

Journeyman Geek

And I was very carefully trying not to say principle of least privilege;p

Simon

@raz Hey, thanks!

Journeyman Geek

3

Rory Alsop

13:23

@RоryMcCune @Simon - Doughnuts are bad mmkay: metro.co.uk/2014/11/10/…

Simon

"... after a doughnut giveaway turned sour."

Genius.

However, I think I'm gonna write an email to this person to let him know that he misspelled "donut".

Rоry McCune

@RoryAlsop heh that's those livi northers, uncivilised

Rory Alsop

@RоryMcCune that's exactly what I said to the team here

(one of them came in with a box of them yesterday - he took that train :-)

Simon

What a train tooker.

raz

@Simon No problem! I love a good morning insult.

Rory Alsop

13:29

@CodesInChaos @JourneymanGeek - I had to answer as well

Tinned_Tuna

14:08

@JourneymanGeek We don't have the Ballmer Peak in the UK. It's called the Turing Peak and it's fueled by correctly-brewed tea.

Journeyman Geek

@Tinned_Tuna: Its not just for programming though

There's a reason your tanks have a boiler for tea built in

Tinned_Tuna

@JourneymanGeek one can't have uncivilised tank-warfare, of course. Also, if you break the gunner's best china... well, let's just say you'd best run.

AJ Henderson

14:27

@TildalWave hey now, are you afraid of quality humor or something ;)

TildalWave

One can't simply replace nuclear fusion with foliage infusion!

@AJHenderson More that you'll mention more so bad it's good movies :)

AJ Henderson

@TildalWave wellllllll... now that you mention it

@TildalWave insert link

on a line by itself

the oneboxing is automatic

TildalWave

@AJHenderson it doesn't show it to me while editing some question, must be parsed after

AJ Henderson

like this

►

but in a question

@TildalWave yeah

it's parsed after

a bit annoying, but that's how it works

TildalWave

@AJHenderson OK I can find some examples, perhaps not the best ones but they'll do ... one question tho, can they be linked so they start playing at a specific time / position? I.e. does #t= work for embedded YT videos as they're parsed by SE?

AJ Henderson

14:35

@TildalWave I think so, but I'm not positive

pretty sure I've seen embedded clips starting at a particular point

TildalWave

@AJHenderson could you please trivially edit some post for me to check that?

surely there's some that embed a video and say "look at this time"

@AJHenderson video.stackexchange.com/questions/4066/… can you try on this one?

(might need a few more corrections than the link alone tho LOL)

@AJHenderson or perhaps a better one: video.stackexchange.com/questions/7131/…

@AJHenderson Doesn't take it does it? Can you try with &t= instead with next edit?

AJ Henderson

it took on that one

apparently it needs the m and s in the time part

TildalWave

@AJHenderson Ah cool so it's possible to make it work, thanks!

AJ Henderson

@TildalWave btw, no comment on my beautiful combination of a running joke with your legitimate question, or were you just trying to ignore that hoping it would go away ;)

TildalWave

It probably simply cuts at the hook part when parsing so I guess it should still work with &t= in any format, including just specifying number and it then interprets it as seconds from the start

Simon

14:44

You're a parser.

TildalWave

@AJHenderson must have missed it, you know I comment on everything even when no comment needed LOL ... link please

AJ Henderson

I embedded a clip to zoolander as my demo of embedding in chat

Rory Alsop

@TildalWave isn't foliage infusion just a nice cup of tea

TildalWave

@RoryAlsop indeed

only worked in Hitchhikers ....

Thomas W.

before I go asking questions has anyone posted a question regarding whether server/service separation increases the overall security for a site/cluster on the site, and if they have do you have a link to the question?

(I searched and found nothing)

AJ Henderson

14:48

@ThomasW. hmm, can I take a wild stab in the dark guess as to what your question will be if we don't have one and you need to ask it? ;)

it depends a bit on the situation though and what threats you are trying to protect against

Thomas W.

@AJHenderson If you want, you could. I'm basically echoing someone on Super User who asked if there's any benefit to separating their web server and databases to separate servers, whether the benefits are security or recovery in nature

as I understand the nature of cyber threats, service separation across multiple servers doesn't add any inherent security benefits in terms of protection from threats, DDoS, etc.

Simon

@ThomasW. I always thought that was more an efficiency improvement than security.

AJ Henderson

but short answer, yes, generally there is a benefit, but not one that should be relied on. It's more of a defense in depth thing

Thomas W.

@Simon Agreed there, that was my argument, I'm seeking something more detailed :)

AJ Henderson

but it depends on how well configured your environment is

Thomas W.

14:51

@AJHenderson Right, but defense-in-depth applies to a point - once you have anything web facing you run into a case where you open yourself to attack

and then it comes down to the site/scripting to provide some protection

AJ Henderson

ideally, the user for the application shouldn't be able to do anything invalid for the app to do, in which case you have two systems with different attack surfaces, one that holds the data is more walled off and limited than your publicly exposed web server

Thomas W.

(in this case, I don't consider any PHP implementations inherently secure)

right

AJ Henderson

but more often than not, that isn't how it is implemented

which results in drastically reduced security advantages

thing is, your DB server shouldn't be web facing

it should be web server facing

Rory Alsop

'Well configured' is key here

AJ Henderson

ideally, internet connects to web server, web server connects (on a seperate interface and possibly across a firewall) to the DB server

and the DB server only answers calls from the web server

Rory Alsop

14:53

segregate Web server from internet and internal network, only allow pipe to db server (or app server if 3 tier)

yep

Simon

@AJHenderson Just like the "Private Networking" feature Digital Ocean offers.

Thomas W.

@AJHenderson @RoryAlsop True statements on both counts. In an ideal world, every set of servers would have IDS/IPS, firewalls that are decent to segregate services, etc. I'm judging by the person who posted the initial question I am asking about (because it stirred my interest) that they don't have an enterprise-grade setup

AJ Henderson

yeah, if the DB server is publicly exposed and not properly secured and the web server is running with a full admin user on the DB server, then seperation does basically nothing

Thomas W.

may be wrong, but that's my take on their issue - in my case, I've got a pfSense appliance on the edge of my network with Snort on there to add IDS/IPS to some grade, and I even firewall my web apps further to specific IP sources

right.,

AJ Henderson

if not make things worse

actually, probably makes things worse

Thomas W.

14:55

the other consideration is if they're all VPSes - i.e. not on the same section of the network with an Enterprise-grade firewall to segregate access

AJ Henderson

because if they were on the same server, atleast they would probably be bothering to limit to localhost connections

Thomas W.

then you run into basically everything web-facing to interface with each other server and you have problems

@AJHenderson True.

AJ Henderson

but as you can see, it's a far more complicated issue than it seems at first ;)

since it can range anywhere from fort knox to walking around with your pants down

Thomas W.

@AJHenderson preaching to the converted.

my tiny residential class network has a pfSense firewall with Snort on it for IDS/IPS... I'm that paranoid :P

and my residential netowrk here is even VLAN'd out the wazoo, each VLAN is separated from each other, with only one computer able to communicate across vlans

even got that with my wifi, I have a guest network for visitors from my classes so they can access the internet - mind you they're restricted to 2Mb up/down shared on that guest net, but still

paranoia sometimes comes in handy :P

AJ Henderson

15:11

yeah, I have a similar setup for my guest wifi network when I have it operating, though I don't leave it on all the time. My personal paranoia is that I operate my own webserver for my file storage and sharing needs so I don't have to trust it to dropbox and the like

Thomas W.

right, I even go further - the guest wifi has a restricted outbound port set

AJ Henderson

not that I seriously expect them to be going through it, but I have the ability to avoid using them, so why not

Thomas W.

heheh I agree

i only allow port 53, 80, and 443 outbound destination on my guest network - paranoia in my favor i guess, but that's still a very restrictive ruleset

TildalWave

@AJHenderson didn't we discuss this not too long ago and was initiated by one question on the site?

(I'm afraid I don't remember much else about it, so either due to old age or as a defense mechanism if I was wrong LOL)

AJ Henderson

@TildalWave I don't recall

but I might not have been on for that discussion too

TildalWave

15:20

it was definitely you, you shared names of bad movies as good examples :P

Simon

You're a good example.

TildalWave

You mean as a specimen?

Simon

No, as a donut.

TildalWave

I'm immune to your nomnomenclature :P

4

AJ Henderson

@TildalWave oh... hmm

Simon

15:23

10/10 would read again

raz

9/9 I'd stop on a dime

Tinned_Tuna

My Local: roseandcrownyork.com/uploaded/0002/1922/whisky.jpg

Simon

8/8 donuts money you should donate

Tinned_Tuna

The top two shelves are entirely whiksy :-D

AJ Henderson

but then only half of it is top shelf

Tinned_Tuna

15:33

haha

They're out of order compared to when I last went in -- I think they've got more since the photo was taken.

AJ Henderson

@TildalWave you could say they donot apply

2

raz

@AJHenderson I think that should be donoted

TildalWave

@AJHenderson you mean they donut apply?

Simon

Please stop with the puns, I donut enjoy them.

AJ Henderson

15:49

@Simon doesn't that normally encourage us?

@TildalWave or maybe a doknot, it could be half way cross between a donut and a pretzel

TildalWave

@AJHenderson that's a Möbius strip then :P

besides, anything toroidal in shape like @Simon or doughnuts are always fun to make fun of

Can't swim? Here, have a donut ...

Stack Exchange

Blog - Stack Exchange: Announcing Bosun, our new open source monitoring & alerting system

David Fullerton on November 11, 2014

If trees could scream, would we be so cavalier about cutting them down? We might, if they screamed all the time, for no good reason. - Deep Thoughts, by Jack Handey

A big part of scaling up an engineering team is getting serious about monitoring and alerts. A good monitoring system collects data from all of your various systems — for example, how fast pages are loading, or server CPU usage, or emails being sent — and alerts you when something isn’t working correctly. When everything works perfectly you can sleep easy at night knowing that you’ll get an alert if something isn’t working correctly. …

Simon

QOTW!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Said no one ever.

AJ Henderson

@TildalWave or if it has too much glaze, it might become a mobius drip

TildalWave

@RoryAlsop I added a comment, I've seen those before. Frankly, I didn't think too much of them, I just always assumed its some decomposed mushrooms soaked in water ... and some do release a whole lot of mucus during decomposition too if you add water, it's just cellulose IMHO

There's also some mushrooms that are nearly translucent, tho that's not it. The image shows multiple stems / hyphae if you open it in full size, so it must be from multiple individual mushrooms

Rory Alsop

16:00

@Simon I think the two we had been hoping for have been a bit busy (cough @Avid and @ThomasP ) and I'm a bit busy myself. Happy to come up with one for Friday. Anyone else fancy doing one? If 5 people all did, we could schedule them in until Christmas :-)

Simon

@RoryAlsop I like this one: security.stackexchange.com/questions/72652/…

Rory Alsop

@Simon Do you fancy writing a QOTW post? These are actually the easy ones as you just take content from a question and its answers and post it. The self-authored ones are much more time consuming.

Simon

@RoryAlsop I have no idea what people usually write in there but I might check it out when I get home. I won't promise anything though.

Rory Alsop

@Simon If you have a read of security.blogoverflow.com and look at those questions tagged QOTW, you'll see what is needed

security.blogoverflow.com/tag/qotw

Simon

@RoryAlsop Cheers.

Jeff Ferland

16:29

@tylerl ... aaaaand nevermind. shrug

raz

19:21

Any well knowledged people on SE Linux in here right now?

Rоry McCune

@raz well I'm not totally clueless but nor am I @Gilles

raz

I came upon this question and answer

15

Q: Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access to the program being sandboxed. However, is it possible to perform finer grained control, such a...

network linux access-control selinux apparmor

And I'm curious, if this is the only way SE Linux effects the linux networking stack.

Rоry McCune

@raz ahh that's closer to the gilles level than I get I'm afraid. Never really done anything much with SELinux or AppArmor

raz

@RоryMcCune That's cool, I'm only really interested in SE Linux. I figured I'd ask here. Wondering if I should actually post a question or not.

Rоry McCune

@raz seems like a good question to me, but then I'm well known as a poor arbiter of what's a good question :)

raz

19:26

@RоryMcCune haha, more minus questions than plus?

Rоry McCune

@raz nah the ones I ask tend to go ok, but I'm far more liberal in what I think is on topic than the mods...

raz

@RоryMcCune Get your donuts together Rory!

Rоry McCune

@raz you appear to have fallen into incorrect ways of the doughnut... I'd recommend less listening to @Simon

raz

@RоryMcCune but... but... @Simon says...

3

AJ Henderson

19:51

@raz you were just waiting to use that one weren't you

raz

@AJHenderson How could I not? And the setup was perfect!

@RоryMcCune with the assist!

AJ Henderson

20:17

@raz oh don't get me wrong, I'm the one who stared it

I'm just glad I'm not the only one with such a bad sense of humor

raz

@AJHenderson Ummm, our sense of humor is awesome.

AJ Henderson

you know, it's funny, because people always groan and complain about how bad my jokes are, but I notice I have a whole hell of a lot of stars

ManishEarth

@AJHenderson that's only to shut you up

:p

AJ Henderson

@ManishEarth by encouraging me?

raz

@AJHenderson Ahahaha

ManishEarth

20:20

Er....

reverse psychology?

AJ Henderson

I'm not sure reverse psychology works the way you think it works

ManishEarth

:p

AJ Henderson

otherwise we should be staring simon a lot more

Simon

@RоryMcCune No, no, no, you got it all wrong. You need to correct your spelling, sir.

AJ Henderson

@simon how is it spelled?

Simon

20:24

@AJHenderson sweet bagel

2

AJ Henderson

ok, someone start the 5 minute timer

Simon

wadafuk

AJ Henderson

lol, sweet bagel

Simon

I CAN'T EDIT IT NOW FFFFFFFFFFFFFFFFUUUUUUUUUUUUUUUUUUUU

ManishEarth

ftfy

Simon

20:27

fml

AJ Henderson

well, editing to improve spelling and grammar is a correct reason to edit right?

ManishEarth

Mess with the blue, sucks to be you

AJ Henderson

@ManishEarth that makes me think of portapotties

ManishEarth

LOL

AJ Henderson

which, I suppose we both deal with shit all day

and try to make it smell less bad

Simon

20:28

Kids suck.

And they don't suck donuts, they just suck.

AJ Henderson

if your kids are sucking, you are definitely doing it wrong

sicko

Simon

What? How do you feed them milk, through their nose?

Lighty

20:59

@AJHenderson Febreeze

David Freitag

21:22

So a friend of mine is having some issues with a mouse in his basement, so he set a trap the other day. He went to reset the trap this morning and found that the mouse had chewed its own arm off to get out of the trap

Gilles

21:48

@raz I don't know much about SELinux. We have a few people who do on Unix & Linux

Rоry McCune

21:59

@Simon on the day when the UK is a colony of Canada, perhaps :op

sweepstake on time to exploit on MS14-066 anyone?

AJ Henderson

@DavidFreitag yeah, they have a tendency to do that

it's generally best to either use a quick kill trap or a completely enclosed trap

otherwise they really freak out and do crazy stuff to try to escape

David Freitag

Eh, I'd just flood my basement with chlorine. That'll get 'em.

AJ Henderson

@RоryMcCune depends how long it takes for the Bear to get on

Rоry McCune

@AJHenderson 'cause I'm thinking if that's all versions of IIS back to Windows server 2003 land, and an exploit comes out.... it'll get really ugly really quickly

AJ Henderson

@RоryMcCune I may or may not be remoting in to patch my server as we speak

Rоry McCune

22:08

@AJHenderson good plan(tm)

AJ Henderson

aw dang it, I had a previous set of updates pending a reboot already, so now I have to reboot twice :(

AJ Henderson

22:23

I hate applying windows updates remotely with no ability to monitor progress easily

Simon

23:02

@RоryMcCune Give me a few years, I'll make that happen.

David Freitag

23:16

@Simon That could never happen. "Stop shooting at me!", "I'm sorey, eh."

Transcript for