The DMZ

StackExchange

04:08

Gonna start bugging the Unicode consortium to add snake segment characters that can be combined into an arbitrary-length non-breaking snake.

Some Guy

05:52

openwall.com/lists/oss-security/2016/05/03/18

Yuriko

06:34

Good morning everyone

I'd like to know, how do you handle questions like that one? The author seems to ask it with some malicious intents (or at least in the scenario given), while the real question behind this (how does LFI works?) seems fine to me.

bilbo_pingouin

07:08

I'm not a reference here, but from what I've seen so far, the official policy is not to be judgemental. So no question about the intents. That does not mean that all agree to that.

AviD

07:40

@bilbo_pingouin to be more specific: the official policy is not judgemental - but you are allowed to be as judgemental as you wish (and choose not to answer it).

@Yuriko however, the problem with the question is not that it is malicious (btw to me it doesnt read as malicious, but as homework), it is that it is otherwise a bad question anyway.

@bilbo_pingouin that said, we do have a limit to this policy of non-judgementalness: we have a custom offtopic close reason for certain type of cases.

> Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

tho this is more to prevent the far-too-common type of "giv meh teh hax" questions.

bilbo_pingouin

yeah there is a limit... but it is essentially, as you say, to prevent script kiddies to hack their high-school data base

the "unless" part shows that if you're serious in it, you'll get help here :)

AviD

07:57

exactly. its the 101-level, toddler-with-a-shotgun that we are trying to avoid

Yuriko

Thanks! and yeah, I was referring to that rule when judging it as malicious (perhaps not the most suitable word)

CodesInChaos

08:18

NIST readies 'post-quantum' crypto competition

"Are you Shor you want to try this?" oh god, the horrible pun

3

Rory Alsop

11:13

@CodesInChaos Oh, by the Great Bear, that's terrible

Jan Dvorak

11:51

I've just got a new Win10 PC with McAffee pre-installed. What should I install instead of it, or should I keep McAffee?

AviD

@JanDvorak that depends on what you're looking for. There are plenty of available malwares and other RATs, many are better than Mcafee. What is it you want it to do?

Jan Dvorak

It's a workstation + youtube player, I will be visiting no porn sites (unless someone tricks me in a SO chat). I want to avoid gaping holes in basic security.

Some Guy

Trend Micro. One of the best

(Not serious)

Jan Dvorak

...oh

The previous workstation had Avast, but it seem a bit adware-y (Enable our web shield! but before that, buy the full version, duh)

rlemon

@JanDvorak reddit.com/r/buildapc/comments/3e16h7/… is worth a read

AviD

12:05

@JanDvorak I'm confused. You say you want to avoid gaping security holes? So why do you have Mcaffee on the machine?

Jan Dvorak

@AviD It was preinstalled by the laptop distributor

AviD

Ah. rookie mistake.

Madara Uchiha

@JanDvorak take note: When the service is free, you are the product.

Jan Dvorak

How about MSE?

AviD

always wipe the machine, to clear out all the crapware, bloatware, spyware, and other malware (like Mcafee) that they install by default.

Madara Uchiha

12:07

Anti viruses make little to no sense in 2016, in an age where malware is distributed online

Stay safe, don't install browser plugins, don't install browser extensions which are not open source, don't click on questionable ads, you'll be fine without a bloaty AV.

Jan Dvorak

I don't have the OS installer :-( does Windows 10 have a magic "remove all bloatware (and everything else)" button?

Rory Alsop

Use MSE.

Madara Uchiha

@JanDvorak Yeah, it's at the bottom of your laptop

(Not really)

Rory Alsop

Unlike what Madara says, you need an AV plus all the things he mentions

Jan Dvorak

I've already installed uBlock origin and greasemonkey

Madara Uchiha

12:08

@JanDvorak :Both of which are open source.

Rory Alsop

You can't avoid questionable ads and think you are safe. Many reputable sites have been compromised in such a way a sensible user will still be compromised without AV

Madara Uchiha

@RoryAlsop That's why I block all ads.

From the hosts file.

But that's me.

uBlock Origin also does a very good job at that.

The real dangers are from Flash and Java

Jan Dvorak

Concerning Android, I guess the best antivirus is no antivirus?

Madara Uchiha

@RoryAlsop I have yet to see a statistic that determines that people who have an antivirus installed on their computer are less prone to ransomware (for example, which is a relatively new type of attack) than those who do not.

Jan Dvorak

Your best bet is to treat ransomware as a disk failure.

MSE it is then. Thanks.

AviD

12:17

@JanDvorak For Android, the best antivirus is "not Android".

Jan Dvorak

iOS is too expensive and Windows mobile is too weird :-/

Yuriko

12:30

@AviD Words to live by…

AviD

12:40

@JanDvorak youre too weird !

StackExchange

13:09

Welcoming Stack Overflow’s New CMO – Adrianna Burrows

Alexa Scordato on May 4, 2016

The Stack Overflow team is beyond excited to welcome Adrianna Burrows as Stack Overflow’s new Chief Marketing Officer. She’s an industry veteran of everything from global product launches to partner development and she is as laser focused as we are about empowering developers.

Xander

13:19

@JanDvorak The best anti-virus for Android is not downloading crap from unofficial app stores. Or crap from the Play store, for that matter. Or browsing the web. Or using a non-Nexus device that doesn't get regular updates. But really, you're reasonably safe if you just don't download crap from unofficial app stores.

Jan Dvorak

@Xander Thanks. Some things are only available through unofficial play stores though.

Xander

@JanDvorak Then, you take your chances.

AV probably isn't going to help you.

Jan Dvorak

Thanks.

WorseDoughnut

14:21

Anyone have any idea if Kali nethunter is compatible with the ChamelonMini?

M'vy

14:44

Isn't it only available on nexus devices atm?

WorseDoughnut

Yeah I meant, is the ChameleonMini compatible with nethunter installed on a nexus device.

M'vy

Oh. Then I don't know what a ChameleonMini is

I was supposing it's a phone

WorseDoughnut

Nah, it's an NFC/RFID emulator, for sniffing, replaying, cloning, etc. Like a proxmark3 but allegedly better since it doesn't need a peripheral antenna

Matthew

16:26

Anyone want to look at security.stackexchange.com/questions/122306/…

Might need closing...

Iszi

16:43

@Matthew Not sure if that should be shut down or if it's good enough to move to SU.

Xander

16:57

@Iszi Moving Burp questions to SU would not be the right option. We've had this discussion before on Meta. There's no reason good security tool question are not on-topic here, and it doesn't make sense to move questions about tools that only security folks use to a general site like SU. (I haven't looked at this question to see if it's any good or not.)

Iszi

@Xander Yeah, I'm still not clear on if it's a good question or not, but it appears to be a basic installation question that likely has little to do with any actual security-related aspect. Those sorts of things don't need to be here.

Xander

And...It was migrated to SU. After being answered and accepted here. Yay for us not understanding how SE works.

AviD

19:05

@Xander I am starting to wonder, once in a while, how it does.

or really, whether it does at all.

Xander

@AviD Perhaps we overthink it. Perhaps we need to take a tip from the dude, and just abide.

AviD

@Xander Always.

but I was talking about SE in general.

Xander

@AviD We had a discussion earlier today on that specific subject in the other room.

AviD

I am not surprised.

that's kinda the point, isnt it

Xander

It wasn't in a negative way, but in a "I'm not sure these numbers add up" way

AviD

19:20

yeah... sometimes it feels like swimming through marshmallows. I mean, its fun and all, and sometimes you'll grab something rather tasty, but it just feels like too much effort without moving forward.

Xander

@AviD Could be worse. It could not exist, and we'd all be relying on ExpertsExchange and reddit.

schroeder

@Xander Shouldn't off-topic questions be migrated regardless of acceptance by the OP?

Don't answers migrate as well?

AviD

@Xander oh absolutely.

Xander

@schroeder I would suggest that based on prior discussions (there's at least one, maybe more on meta.sec.SE) that the question was not, in fact, off topic.

schroeder

I was not aware of discussion (or meta activity)

Xander

19:33

@schroeder Ehh, I may be wrong.

@schroeder This is one of the ones I was thinking of.

0

Q: Why security tools related questions are closed one after one?

On What topics can I ask about here? I read that asking about security tools (not to be confused with software recommendations) is on-topic. However, I see these type of questions are closed one after one in the name of: Ask the producer support. I see this as a contradiction: either we remove t...

discussion

schroeder

it was a pure "how to configure X tool" with an answer in the product manual - we've migrated tons of Burp certificate questions in the past

Xander

To which you and I provided the only answers, so not much to debate there. :-)

schroeder

lol

Xander

@schroeder IMO, we should not migrate Burp questions. Burp is a tool that is used only by security peeps, so either it's on-topic here, or it just needs to be closed, full stop.

schroeder

Burp is used a ton by QA folks

and devs

it's like wireshark for web devs

Xander

19:37

@schroeder And to your other question, the official FAQ on migration says to "avoid migrating answered questions."

79

A: What is migration and how does it work?

What is migration? Migration allows an off-topic question to be gracefully moved to another site in the Stack Exchange network. It preserves the current revision of the question, all its answers, any comments on any post, as well as most of the votes. Side effects of migration Down votes are ...

schroeder

heck, my wife plays with burp to understand request/response

@Xander ah ok - I will adjust

Xander

@schroeder That isn't my experience. Perhaps we're in different dev circles.

@schroeder IME, people who need HTTP traffic proxies or captures use Fiddler.

@schroeder But did she learn about it from you? :-)

schroeder

@Xander sure, that too

@Xander frankly, yes, but does Fiddler run on Macs?

devs who use Macs tend to run Charles or Burp

IME

Xander

@schroeder Yeah, Charles is the Mac proxy I'm familiar with.

AviD

@Xander wasnt the question actually about configuring firefox (to work with burp)?

Xander

19:43

@schroeder If there are a reasonable number of devs using Burp though, fair enough.

@AviD I don't know. I didn't read it. When I went to read it to see if it was a good Q, all I really saw was that it had already been migrated, and didn't bother.

schroeder

@AviD yep

"I installed Burp and Internet broke"

Xander

In any case, I still contend that it shouldn't have been migrated as it already had an accepted answer.

AviD

@schroeder "I configured firefox and internet broke"

schroeder

@Xander and I now concede to your contention

Xander

@schroeder Yay! :-D

LOL

AviD

19:45

@Xander IMO that consideration helps if its borderline, not if it is clearly offtopic.

not that I'm saying this one is

Xander

@AviD Yeah, I agree, but IMO clearly off-topic should be more like egregiously off-topic. Like a cooking question. Or a carburetor repair question.

Bob Ebert

20:01

Hi I would like to know if it is dangerous to accept any connection (on lets say port 80) by making an ACCEPT rule in IP TABLES on that port? The purpose would be, lets say I make a request to a website but I wish that the reply goes to another computer, that computer would need to allow traffic in

IDK if I expressed myself clearly enough :p

SEJPM

@BobEbert accepting any connection is generally somewhat dangerous because it may allow an attacker to infiltrate your network / PC more easily

(but I'm not an expert in network security as much as some other people here)

@BobEbert does this mean you want to do: PC1 -> Webserver -> PC1 -> PC2?

Bob Ebert

I would like to learn each way but in this case, it would be PC1 -> Webserver -> PC2

But how would it be easier for an attacker to infiltrate my network easier?

SEJPM

:29447832 which would be instantenously dropped by your firewall

Bob Ebert

because if there's a vulnerability, he may simply exploit it and ask for a tcp connection to my computer to the port 80 *?

SEJPM

each open port is a potencial way to get on your computer, because it means an attacker can make arbitrary connections to you and doesn't require activity from you

@BobEbert is the webserver on the internet or within your trusted network?

e.g. is it your webserver or somebody else's?

Xander

20:14

@BobEbert The request goes to port 80, the reply does not.

@BobEbert That doesn't make any sense. You're going to initiate and open a TCP connection from one computer, then send an HTTP request from that computer, and somehow magically route the HTTP response to another computer? And it's happily going to accept it? Even though it knows nothing of the aforementioned TCP connection?

Bob Ebert

20:41

@Xander I would modify the ip of the source in the header to the ip of PC2. The PC2 would have ALLOW on port 80 so the connection would go in and record the reply. Does that make sense?

@SEJPM The webserver is on a remote network (internet)

Xander

@BobEbert No, that doesn't work for TCP over the Internet. TCP is stateful. The computers have to get to know each other, and all happens before the HTTP request is sent.

And you'd have the tell the webserver that your user agent is using port 80, which browsers don't do.

Bob Ebert

Ah true...

@Xander I could to do instead, PC1 -> PC2 ->Webserver -> PC2 -> PC1?

SEJPM

@BobEbert then PC2 acts as a proxy which should be possible

Xander

@BobEbert Yes, that would work. In that scenario, PC2 is just acting as a proxy, which of course works fine.

SEJPM

@Xander faster :P

Xander

20:51

@SEJPM Ninja'd.

@SEJPM Ninja'd with that, too! Bah. :-)

Bob Ebert

In that mean, that would be a situation named: ip forwarding?

Xander

@BobEbert It depends on the mechanism. If PC 2 is operating at the IP layer (i.e., it's a router, and configured as your default gateway) it could reasonably be called IP forwarding. Generally, however, that's just called routing. If it's operating at the application layer, e.g., an HTTP proxy that you configure in your browser in PC 1, then no, not really.

Bob Ebert

21:27

@Xander I'll go read about that! thanks for the help!

Transcript for