The DMZ

Scott Pack

02:22

Congrats, @JeffFerland!

Oh, and it looks like @HendrikBrummermann as well!

Jeff Ferland

03:16

@ScottPack Oh, wow... somebody put some effort into giving us the bump.

Stack Exchange

06:24

Iszi

06:34

Oh, wow! Science Fiction and Fantasy is out of beta, and looking sweet!

Ninefingers

10:39

@RoryAlsop That is interesting... I read an answer on here linking to somewhere about cutting ethernet cables so that could happen. Really interesting.

Also a former colleague of mine ran a Tor node at home as a honeypot exercise... that was interesting...

Scott Pack

12:26

@JeffFerland It doesn't seem like that much of an effort.

Rory Alsop

14:57

Yay - congrats on our new 10k's - @JeffFerland and @HendrikBrummermann

Jeff Ferland

Wooo... retirement.... :P

Iszi

STNG fans, enjoy:

►

Ninefingers

15:37

I'm nearly at 5k... :(

Congrats @JeffFerland and @HendrikBrummermann. Do you like the power tools @Jeff ?

Jeff Ferland

@Ninefingers We're such a small site that there isn't a lot to do. Dashboards for high / low voted answers are cool, and seeing deleted posts. Also, I approved an edit this morning (woohoo)

Scott Pack

Having the 10k tools makes it a lot easier to keep track of pending actions

Like, if you go to /review there is a close tab that lists all the questions with close votes.

Jeff Ferland

grumbling about the lack of "vote to migrate" options

Scott Pack

Flag baby flag!

You come across something in particular you want moved?

Jeff Ferland

@ScottPack A few days ago. Just miffed that we've had the migration list on meta for 5 months and haven't implemented it.

Scott Pack

15:52

@JeffFerland I understand the reasoning. Let's wait until there is sufficient data to determine where we actually migrate stuff

However, what is the definition of "sufficient"

You should have access to migration stats now, yes?

Jeff Ferland

7

Q: Building our own migration list

Now we've graduated from beta, wouldn't it be time for us to set our migration list? I would propose: meta.security of-course superuser serverfault webapps math / theoretical.cs / stackoverflow Does the moderators have some feedback on this in term of statistical of previous migrations? Th...

It has been researched twice with the same results.

Scott Pack

Morning, @schroeder.

schroeder

morning

Scott Pack

@JeffFerland I hadn't actually seen those updates. Whoops.

That's a pretty fast drop off

Oh, you still looking for work, @JeffFerland?

Jeff Ferland

@ScottPack Still considering my options. :)

Scott Pack

15:58

Looks like Yale-New Haven Hospital has a few security jobs open.

Of course, the downside is that it's in New Haven.

Jeff Ferland

@ScottPack Yup. Big downside.

"Looking for work" will probably be a running joke until I graduate or a miracle offer lands in my lap.

Scott Pack

Graduate, eh? What program and how far along?

Jeff Ferland

@ScottPack Info & comms tech, 1 semester away.

I've been part-timing it for a long time.

Scott Pack

I can understand that.

Jeff Ferland

(graduating with a 4 year degree and an 8 year resume)

Scott Pack

16:03

I've been exactly one thesis away from finishing my MS for a few years.

Jeff Ferland

@ScottPack perfectionist procrastinator?

Scott Pack

Nah, had I been a perfectionist I would have finished a long time ago. Because I would have had enough done that my boss, wife, and advisor would have just submitted the damn thing for me.

More like getting distracted with work/life and not making the time to do it.

schroeder

I am also in college for InfoSec while working full-time in the field. I have not been impressed with InfoSec education at my institution or in other programs that I have looked at.

Scott Pack

I've not dealt with any IS/IA programs, so I don't really have any first hand experience. Mine is straight CS.

Jeff Ferland

Bachelor degrees need to stop popping up in every friggin' emerging field that's out there.

Scott Pack

16:09

@JeffFerland No doubt.

Jeff Ferland

No place should be offering an undergraduate degree in security. The field isn't mature enough.

Scott Pack

Here we have, principally, two computer related programs. CS out of the Engineering school, and ITS out of Communications. So, in effect, you have the theory and design of computation in one and the practical and professional IT in the other.

I see no reason for there not to be a security focus in one of those, but a separate degree is a bit much.

schroeder

I agree that the field is far too new. The program head is an old SANS instructor who is trying to replicate the SANS experience in a college setting. The focus is on security administration, which is something, but it leaves a lot to be desired.

Scott Pack

You guys think this is worth migrating?

0

Q: Security implications of having files owned by the apache user?

Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario: Multiple developers need access to create and modify files under /var/www/html The developers need to be able to access each other's code in case they are out on vacation, ...

apache2 security permissions

By and large the SF community seems to be fairly reticent to migrate things to us, but this seems to walk the line for me.

Jeff Ferland

@ScottPack Good to accept, don't know if they'd call it good to migrate, though.

schroeder

16:17

I would migrate due to the implications of any helpful answer

Jeff Ferland

@schroeder What?

schroeder

@JeffFerland any helpful answer is not a server-based answer, it's a security implication. Such implications need a security oversight.

Jeff Ferland

Well hello question!

schroeder

lol

Scott Pack

I totally flagged it. I flagged it hard!

Jeff Ferland

16:26

Ha

schroeder

I am brand new here, but I can see the value and I like the community that has built up. Is there anything that I can help out with anything?

Jeff Ferland

@schroeder Our tag wikis could use better articles if you're feeling ambitious. Otherwise, answer questions, hang out in chat, and acclimate to being one of us :)

Ninefingers

Tag wiki edits that are approved will net you some rep too... can never remember how much it is.

schroeder

I'll take a look

Ninefingers

Almost any activity that nets you one of these: security.stackexchange.com/badges will be helpful, like editing etc

Scott Pack

16:31

@Ninefingers 2 rep per edit. The excerpt and the full description count separately.

Getting some quick rep right now may be hard. We have a pretty dang high answered percentage.

Ninefingers

@ScottPack Ah ok, thanks. I'm not an active participant anywhere where I've had the chance to actually gain rep from that :(

schroeder

I though about editing, but I'm actually not sure what criteria to use for changes

Scott Pack

@Ninefingers I got the last 100 rep to 2k from edits :)

Ninefingers

@schroeder Generally, don't change the intent of the OP and avoid minor edits. So don't go too big or too small. But adding in links, correcting multiple spelling errors, better titles and tags all help.

Scott Pack

@schroeder Officially, the SEI want substantive changes that increase readability and or clarity without modifying intent.

schroeder

16:33

kk - that helps

Scott Pack

Personally, I almost don't care about the size of the edit so long as it increases readability/clarity and/or brings it in line with community standards.

Ninefingers

The reasons for rejecting an edit are:

copied content This edit plagiarizes content from an external source without proper attribution.
invalid edit This edit is incorrect or an attempt to reply to or comment on the existing post.
radical change This edit changes too much in the original post; the original meaning or intent of the post would be lost.
too minor This edit is too minor; suggested edits should be substantive improvements addressing multiple issues in the post.
vandalism This edit introduces spam, defaces the post in some way, or is otherwise inappropriate.

Scott Pack

Just keep in mind that every time you edit a question it bumps it to the top of the main page, so if you're doing mass cleanups be careful to do them slowly.

schroeder

oh - good point

Scott Pack

That includes retagging, by the way.

Jeff Ferland

16:35

Yay. I've approved, improved, and rejected edits today. I feel like a champ.

Scott Pack

Goddamnit @Jeff!

Ninefingers

I agree with @ScottPack - on crypto I generally ignore the "too minor" reason entirely if it helps improve the post, although I do sometimes hit the improve button.

But @schroeder if you're ever not sure pop in here, someone'll be able to explain what to do.

schroeder

will do

Scott Pack

@Ninefingers I've been known to do something as simple as searching for the word "thanks" and just stripping it out.

Jeff Ferland

One this morning was changing a 10<super>24</super> to a 10<super>308</super> -- textually minor but really important. :)

Scott Pack

16:38

I think, in most cases, that would qualify as 'too minor', but I consider it a community standards thing.

Jeff Ferland

I give up

Ninefingers

@ScottPack That's a big one on SO that I do all the time. I also search for and flag "email me"

Scott Pack

@Ninefingers Yeah, I dislike those.

Jeff Ferland

@ScottPack There, I upvoted your competing answer. :)

Scott Pack

I haven't gone on a real flagging spree lately.

On SF we've lately had a problem with flags being rejected for seemingly invalid, or no reason given.

As such I've been nervous to actually go a flaggin.

@JeffFerland I would love to, but I have to wait a few more hours :)

schroeder

16:41

speaking of, how would you handle a vendor response: security.stackexchange.com/a/9747/6253

Ninefingers

@ScottPack I think it must be hard with the volume to get it right all the time. On crypto I or Paulo or Thomas can look at pretty much every case there is; on SO/SF it's more "if the community can sort it..."

Scott Pack

@Ninefingers But only mods can mark flags as good or bad. There's been a feeling lately that we don't have enough mods that are actually active in the community, so who knows.

@schroeder I think he handled it correctly.

He wasn't shilling his product, clearly outed his involvement.

Jeff Ferland

@schroeder Ooh, +1 to him.

Ninefingers

@ScottPack Yeah I saw. I was actually in SF chat briefly and I've seen the meta.sf post.

Scott Pack

I don't think it's a very good answer, but for a vendor response I think he did great.

Ninefingers

16:45

I'm not sure the requirement to be always active is necessarily fair. I don't answer all that much on crypto, but I do respond to flags, edit, vote, retag etc. That said, I'm always around on meta and in chat, so...

Scott Pack

@Ninefingers It's pretty unfortunate, really. I think the flagging issue is what really triggered it. At least one person doesn't seem to be taking the, "unless demonstrated otherwise assume the flag was given in good faith and mark as helpful, even if you don't act on it". advice to heart.

@Ninefingers I think that's more the concern. I'm not as concerned with the mods answering and having high rep, I just want them to be involved.

If we, as a community, come to a consensus on how to handle certain situations in chat and/or meta, then the mods should be aware of that. If all they do is handle flags and such, then how will they know?

Ninefingers

@ScottPack This is true. They do need to know. If anyone raises a Q on meta.crypto (or meta.sec here) the mods get notified in the top left, so they should really know and review what's going on.

I'd be tempted to comment just to show I'd seen it.

Whilst we're at it, here or with crypto?

0

Q: How do GPG verify succesfull decryption?

How do GPG verify that it has succeeded with decryption (in i.e. the symmetric encryption)? Is something appended to the clear text so there exist some expected data? $ gpg -c test.txt $ gpg -d test.txt.gpg returns gpg: decryption failed: bad key when wrong key is entered. How does it kn...

pgp

It's probably ontopic on crypto, but where these ones are concerned I like to ask.

@schroeder By the way as a quick introduction to chat - if you post links to a question or answer on their own they turn into a onebox as you see above. This also happens to youtube videos, amazon links, tweets and a few other things I can't remember.

Scott Pack

Pretty much any image file

Ninefingers

You can also reply to specific posts by hovering over them - on the right there's a reply icon (far right) which allows you to address a specific post by a specific user.

You can mention someone with an @, like this: @ScottPack

Scott Pack

Snowman!

Ninefingers

16:53

What else - we can star stuff too and it goes over here ------------------------------------------------->

schroeder

lol

Ninefingers

erm.... stuff can be pinned too. We can schedule events, bookmark chats and a few other useful things although I don't think we use that much in this room.

Scott Pack

Now that you point that out, @Ninefingers, I'm noticing exactly how snarky and/or nearly NSFW some of my comments are.

Ninefingers

[tag:something] produced a linux icon which takes you to the questions of that tag.

@ScottPack Hehe. Yep, you can also flag stuff as offensive, although every moderator on the network and any 10ks for this site will see it if you do... usually it's only used for when someone comes along and really dumps something horrible somewhere.

Oh and everything you say here is kept on a public record going back forever and ever...

So now we can track @ScottPack's snarkiness over time :)

schroeder

lol

Is there an example of a good tag wiki article that you know of?

Jeff Ferland

17:01

@schroeder stackoverflow.com/tags/c%23/info

Ninefingers

Or stackoverflow.com/tags/php/info or stackoverflow.com/tags/c%2b%2b/info.

schroeder

@JeffFerland thanks

Ninefingers

One of these days I'm going to write operating-systems because I have 100 upvotes in that tag. But no badge, because I haven't answered enough questions.

Jeff Ferland

There's a reject migrations button? ^.^

-1

Q: What risks is one exposed to by browsing the Internet?

I which forms can visiting certain sites compromise one's system security, taking into account that browsers keep a sandbox for each opened page? Nowadays, can a malicious -or attacked- site really, for instance, steal all stored passwords from a client or infect him with a virus?

client-side

One more close vote needed to kill this thing

Stack Exchange

Stack Overflow Blog: Come Here Often?

Posted by Alison Sperling on December 14th, 2011

The holiday season is upon us, and as another year comes to an end, it is Stack Overflow Annual User Survey time again! So, take a break from wrapping gifts and come tell us about yourself. We promise it will only take a few minutes of your time.

Of course, as the “annual” implies, we’ve been running a survey for a few years now, including last year’s survey which marked the first time the anonymous data was formally used in support of selling advertising on Stack Overflow and Server Fault. This data is an important part of keeping the lights on around here, and, as a user of either of those two sites, or any Stack Exchange site for that matter, we ask you to participate. …

schroeder

17:26

tempted to sift through all posts on a hunt for the elusive 'Alot' :)

Jeff Ferland

@schroeder Let me know if you find the elusive 'Alittle' :D

I used to a little but the little wasn't enough so the little got more and more...

schroeder

17:52

How do I suggest tag synonyms? I don't see a 'new' button, nor do I see the ability to create synonyms as a rep reward.

Rory Alsop

18:05

@JeffFerland Royal Holloway University has an awesome security curriculum!

oh, and evening all

@JeffFerland Done

Oh damn - does that mean I lose the rep from my answer on it :-)

Ninefingers

18:20

@schroeder Actually doing that is a mod only thing. But you can request it - normally I think people ask on meta.security.stackexchange.com

schroeder

@Ninefingers ah ok

Ninefingers

@RoryAlsop Not on close... if you hit delete you will.

But it doesn't always appear until you go to security.stackexchange.com/reputation

and do a recalc

actually with your mod powers you should be able to force a recalc on anyone...

including yourself :)

Scott Pack

In theory, high enough rep people can do tag synonyms. However the system is pretty well unusable on any site except SO, so just rely on mods.

Even SF doesn't have enough volume to make the tag synonym system work.

Ninefingers

Oh yeah. @schroeder I'm telling porkies - security.stackexchange.com/privileges/suggest-tag-synonyms

We could work it - four people with 2500 rep. Just have to know about it.

schroeder

18:37

@Ninefingers Oh, there it is. I can never find that privileges page ...

Scott Pack

@Ninefingers It's not that easy. You also have to have a certain rep in the tag being voted on

Hendrik Brummermann

Thank you

@JeffFerland congratulations to 10k and your fifth rank.

Scott Pack

Hey @Hendrik

Jeff Ferland

19:41

@HendrikBrummermann Thanks. Looks like #5 is determined between us by who is on vacation. :) Neck & neck for the long-haul.

Transcript for