The DMZ

Stack Exchange

20:00

Blog - Stack Exchange: Podcast #62 – Delete This Whole Episode

Abby T. Miller on February 04, 2015

Welcome to Stack Exchange Podcast #62, recorded live on January 20th–with a live studio audience (kinda)!. Today’s podcast was brought to you by the American Venture Capital Association. With you today are our hosts Jay Hanlon, David Fullerton, and Joel Spolsky.

Let’s jump right in: we made a big announcement! Andreessen Horowitz has invested a pile of money in our little company so we can improve our ‘programmer forums’. Precisely none of the pile of money is going into Jay’s raise, but one of those dollars is going to SomeKittens. …

Xander

-1

A: How to encrypt in PHP, properly?

The encryption method depends on your application. Symmetric encryption is conceptually simple, but depends on a shared secret. The shared secret cannot be negotiated in the clear without a third channel or some form of asymmetric encryption. For different applications, negotiation of the sh...

schroeder

he wasted a lot of time typing that answer

Xander

Yay. Not only does he not answer the question at all, he attempts to instead explain crypto to a world-renowned cryptographer.

raz

"It explains why there can be no code sample."

:facepalm:

I guess it's impossible to do encryption in PHP.

Simon

@raz Yeah, the language is way too complex to successfully implement an encryption method in it.

Ohnana

20:07

@raz uh, it's a miracle it made it into the LAMP stack, let's not challenge the poor thing

raz

Also who's DW?

schroeder

lol

Simon

Other than a dude with 50k rep, no idea.

Xander

@raz @Simon en.wikipedia.org/wiki/David_A._Wagner

David Freitag

O_O

Simon

20:10

Oh, well, that was unexpected.

raz

he did some stuff

Simon

@ThomasPornin You don't even have your own wiki page, you suck.

Ohnana

@Xander mofo's been doing crypto as long as I've been alive

Gilles

27

Q: The review system suggested something was probably spam, what should I do when I see this?

While reviewing suggested edits and first posts by new users today, the review system did something new - an alert appeared that suggested that what I was reviewing was probably spam, and prompted me to take a careful look at it. Should I be doing anything differently than I otherwise do while r...

raz

ThomasPornin is David Wagner

mind blown

Xander

20:12

@Ohnana And was co-author of an AES finalist.

Ohnana

@Xander finalist, as in accepted?

raz

@Xander But he didn't win now did he.

Gilles

could be that the author used an IP address that has also spammed

Rоry McCune

@Simon I think you should write it for him

David Freitag

@RоryMcCune Hahahah

raz

20:13

@RоryMcCune With our powers combined!

Ohnana

@RоryMcCune it'll win a new record for page deletion

Rоry McCune

that's terrible you 3, so cynical, I'm sure @Simon could do a great job of that, and probably only mention the D word like 5-10 times in the article

Simon

Yeah, his name would be "Thomas D. Pornin".

Xander

@Ohnana Finalist as in one of the 5 algortihms considered in the final round, and thus considered to be a strong algorithms. Rijndael was eventually the algorithm chosen, but not necessarily because of weakness in the other four.

Ohnana

@Xander damn that is an awesome achievement

if he's so good, why is he asking the question and not just going over there and laying smackdown

raz

20:16

@Ohnana Mathematicians don't code.

5

Simon

Yeah, they boogie.

Ohnana

@raz that's a good point.

raz

Also, PHP is terrible.

I wouldn't answer either, even though I probably could.

David Freitag

@raz With a capital "oh god why"

TildalWave

@Gilles I understand there's some level of heuristic involved and what they're doing likely resembles (or is) a Bayesian filter. What I meant was that I'd expect it to do a better job by now, because many obvious spam posts slip through it unnoticed and I see posts like the one linked that should, but don't. There is no way for me to know what triggered it tho, so I could suggest improvements, is there?

Xander

20:23

@Ohnana He doesn't want to write a PHP code sample, I presume. And I can't blame him for that.

schroeder

There's a difference between being able to write your own PHP library to perform encryption and being able to use existing libraries to encode a string

Ohnana

@schroeder I see that now

TildalWave

@schroeder noooo!

encode != encrypt? :O

Lucas Kauffman

►

TildalWave

@LucasKauffman has been shared before :P

Lucas Kauffman

20:38

@TildalWave I know by me

but Im enjoying it

schroeder

@TildalWave that was actually a typo, but I'll stand by the result

Lucas Kauffman

again

TildalWave

@schroeder Well it only makes it more obviously true. Question is, are you too obvious? :D

Arperum

@LucasKauffman It's steel Panther, what did you expect?

Ohnana

@LucasKauffman wat?

Gilles

20:51

@TildalWave You seem to be assuming that it's a Bayesian filter based on the content — but it isn't, the IP address's history on SE has a large weight in it

Xander

1

Q: CryptoWall 3 - how to prevent and how to decrypt?

My father's computer is now infected with CryptoWall 3, according to the link below. http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#CryptoWall Is there a way to decrypt the files? I will try to recover them but according to the link, the virus safe deletes the c...

encryption cryptography virus decryption

Andddd....This is why @tylerl gives all of his relatives ChromeBooks.

Ohnana

@Xander 1. Nuke the computer from orbit

2. GOTO 1

schroeder

21:15

I'd love a standard Reason to Close as "we are not a malware remediation forum"

TildalWave

@Gilles And it's a false assumption thinking that you can block spam by IPs, and that's actually what I feared is behind it. What I wanted to say is that the link you posted in reply is kinda useless (not your reply, the reply there) for not including any link itself to filter tests with more detailed debug output. But if it's mostly IP based, then that explains both its lack of quality as well as lack of control.

Gilles

@TildalWave It's lack of quality? Come on. Compare the before and after. The spam filter blocks a LOT of spam. Like all spam filters, it isn't perfect, but blocking like 99.99% is damn good.

Remember that you don't know how much it blocks because you never see these attempts.

The ones you see as “possible spam” are the ones that were just above the threshold.

TildalWave

@Gilles I'm not sure where you get that number from but I would hardly put it that high. Sure, it's better than nothing, especially if it helps you filter out large majority of spam via simple techniques, but I wouldn't call it "damn good"

Gilles

@TildalWave Tim Post posted stats on meta. It really does block a lot.

TildalWave

@Gilles And how much of that is false positives?

Gilles

21:22

@TildalWave it's hard to tell, but judging by the extremely low number of folks who complained that they were wrongly blocked, it's got to be pretty small.

TildalWave

(I had such cases before with users complaining they couldn't even post questions without going through CAPTCHA tests and such, and one of those was a member with over 50 questions then)

Gilles

Accounts with a positive history (I don't know if it's rep or some other measure) are exempt.

TildalWave

Anyway, we won't be able to establish its quality. But what I'm saying is that I'm not sure anyone can. And it need not be that way.

Gilles

@TildalWave If you think it can be improved, SE will be happy to listen. In the meantime, don't go telling people that your way is the One True Way and everyone else is an idiot.

TildalWave

BTW "not many complaining" is a really bad metric on a system that requires you to login to complain

Gilles

21:27

@TildalWave no, complains go through email, not through the site

TildalWave

@Gilles What? I didn't say that

Gilles

@TildalWave Yes, you did, and you're still doing it.

TildalWave

Now you're just putting words in my mouth.

Gilles

You don't understand how it works. That's not a problem. But you make incorrect assumptions about how it works and then push your conclusions. That is a problem.

TildalWave

In your opinion, if someone is concerned about something and expresses opinion (and as it happens, on something I'm not a complete noob at), that's ... what you said?

@Gilles How is that a problem exactly?

Gilles

21:30

@TildalWave expressing concerns is fine. Saying that something doesn't work, when the person who has both the competence and the data says it does, whereas you might have the competence but definitely don't have the data, will not endear you to people.

TildalWave

@Gilles That's not how heuristic spam filters work. You would have ways to test it with arbitrary inputs over time.

Lack of such controls is indicative of "improper implementation"

Gilles

@TildalWave What's not how heuristic spam filters work? How do you know that there are no such controls?

kalina

so much blueness

TildalWave

@Gilles Because you'd want as many people checking it as you can trust. There aren't any such controls in place, because I (as, assuming, a trusted SE member), don't have any such links.

Gilles

@TildalWave Why would you have access to those controls? It's the job of SE. But if you want more access to the spam filter logs, ask on Meta Stack Exchange

TildalWave

21:34

2 hours ago, by TildalWave

OK it's a crap question, but what about it triggered the spam alarm while many others that actually included shortened URLs over product names in a single paragraph answers didn't?

And I'm not touching [MSO]

But my initial question was about what happened.

Gilles

@TildalWave and I linked to a thread on MSE that explains what's going on.

TildalWave

And I said it doesn't

Gilles

The particular heuristics used by the spam filter are obviously not going to be made public.

kalina

they obviously can't state <it does exactly x> because that would be a little counter productive

no anti spam system is perfect, anyway

TildalWave

how so?

Gilles

21:36

and even less the IP access logs

kalina

@TildalWave it allows the people doing the spamming to fully understand what the system is doing?

TildalWave

I mean what about saying how it works and/or even linking to its debug outputs would actually go against what it is supposed to do?

Gilles

@TildalWave If you publish the heuristics, it allows the spammers to work around them fairly easily.

TildalWave

in that I don't agree

Gilles

If you don't publish the heuristics then the spammers have to make a lot of attempts and see what goes through. The logs of these attempts go and train the spam filter to be better.

kalina

21:38

@TildalWave why would you ever make such information public?

Xander

@TildalWave Having had the experience of having to fight spam on extremely large community sites (millions of users, millions of posts, billions of page views) I absolutely agree with @Gilles. If you want to have any chance of keeping ahead of the spammers, you keep the secret sauce secret. Those suckers are devious and dedicated.

Gilles

22:29

READ THIS FIRST. Yes, you do need to reinstall. No, if you don't reinstall, you haven't eliminated the malware. — Gilles 1 min ago

Terry Chia

22:48

twitter.com/binitamshah/status/562964557925462016

TildalWave

23:17

@kalina Because in a heuristic system any output is just a snapshot. It's not a true representative of how the next input will be interpreted, even if it's exactly the same. The point being, that you want it to get better at it. And to know that, you have to have track record of its previous states.

Case in point, two exactly the same inputs might already be indicative of something fishy going on. So you really have to think of such a system as an adaptable outcome pattern recognition software. And as such, the more you feed it, the better. And if there's a chance that abusers will feed it stuff to test if they can pass it, then actually even better. It will learn before it even need to do anything about it.

At the same time, SE system is crowd sourced, with relatively well established trust system. So you can take advantage of that too, teach it even faster by having people you know how much you can trust guide its output to how it should look like.

Besides, hiding anything of it is just security through obscurity. If you have reasons to hide that, then you most likely didn't design it really well.

You would usually still "hide" its current state (not really hide, just limit access because it's proc intensive and you don't want to limit its capability by making it run in shallower mode), but that's no reason to also hide some of its snapshots. Those can even be shared on independent systems that only feed your active one with already processed data.

Anyway, whatever. Apparently this is a touchy subject and my intentions and endearment are being questioned for it. It's just a system, right?

schroeder

23:39

your'e an endearment

2

I figured that since Simon wasn't here, I'd pick up his slack

TildalWave

Canadians ...

:D

schroeder

lol

heh, donuts eh?

TildalWave

actually I wouldn't mind having one maple cream doughnut now at all

Transcript for