« first day (27 days earlier)      last day (5151 days later) » 
01:00 - 13:0013:00 - 14:00

01:16
12 messages moved to The Bridge
Good man
right?? I mean, WTH?
btw, the site went over well at owasp
much interest there
eggselent
 
10 hours later…
11:32
here sir!
good morning
How's things
IT LIVES!
aye, not bad thanks. Despairing over the state of a client project, but that's par for the course
Yup - that's always the way
11:35
how's you?
the same - have a project where we are one of 3 contractors. All 3 of us are ahead of targets, but the client has issues. Very time consuming
but enjoying more sub zero temperatures here in Scotland - ice and snow everywhere
lovely. Wet and miserable down here in Oxford
@AviD's here as well!
/me falls over
boo
Afternoon Avi
wow, all 3 at once! woot...
11:37
I know - crazy, eh
well, I guess thats @GrahamLee 's cue to leave ;)
someone should take a screengrab just to prove it happened
Hahahaha
AVi - I don't think I had any extras to add to your agenda - looks good
11:38
btw, just fyi - its sunny, warm, and I'm considering switching to shorts here.... :D
stop gloating
:-P
lol
actually we need the rain - working on a water shortage....
I hear the Australians have plenty...my cousin in Brisbane now has a waterfont property - he was 600 metres inland before the weekend
I think the fish in my pond have got too much, you can come and borrow a bucketful if you want
ah yes, that is bad.
ouch
but but but! its an ISLAND!
11:41
a very large, mostly desert island :-)
heh
time for me to leave...to get some lunch before we start the feature presentation :)
lol
tolja!
:-)
I got myself a cup-a-soup before coming on. Healthy!
eh, I'll have another redbull later :D
11:42
caffeine - food of the gods
trying to find a marketing contact within the Monster Energy drinks group - trying to see if I can get them to sponsor my band, as we go through an awful lot of energy drinks
lol, luvvit
heck get them to sponsor 7elements ;)
hahahaha - even better, not sure they'd sponsor something as lacking in adrenaline as IT
no no, not IT, HACKERS!
lacking in adrenaline? You've never tried to recover a file from LTO media, obviously
11:48
Hahahaha - very true
so shall we go through @AviD's agenda, then?
sure
go for it
right - Mod Activity
enough? too much?
Either I get there after you two have already deleted all the crap, or there isn't much for us to do at the moment
11:53
heh
no, not too much...
now the site is growing, I'm assuming we should hang back more from activity and let the users guide us with Mod flags (unless there is the odd spamming answer we spot etc)
a bunch of retagging, some cleaning up, and the occasional spam
How many flags have we had so far, 4? 5?
yeah
@RoryAlsop yup, I agree
we might still need to check for questions with 3-4 close votes where not enough people visit the question to actually close it
11:54
well, I think there were a few before pro tem, but not too many since
agree that it seems better to wait a bit before closing to see what happens
agreed.
that was easy - next! :-)
11:55
Same with retagging - even though my OCD makes me want to retag almost every question that comes in - I see it usually gets done one way or another
Scope of site seems to be a biggy
btw, another comment before scope:
but settling down a bit now
re merging questions
yeah - the lesson learned from my gaffe: close first, then wait, then merge
11:57
I'm not even sure merging is usually necessary at all
but realistically - going forwards we should maybe wait for users to request a merge
(btw, I think they fixed that bug)
did you raise that thing as a bug with meta?
right
yeah...
it just makes a bit of a mess.
agreed
11:57
My reading of Jeff's recent blog post is that he'd prefer to have aggressive merging, maybe I'm wrong
even when they ask, only do it if necessary - if "close as duplicate" is not good enough
e.g. very good answers on both sides
ok
It seems like having a few good general questions with good-quality answers is better than having a lot of stagnant closed questions with a link-tree pointing back to the originals
I guess you're right - but if you catch it with no real answers, why bother merging?
11:59
that's true
close it, and point to existing question. That can also train users TO SEARCH before posting....
ok... scope?
are there specific questions about the scope on meta that haven't been addressed yet?
dont think so... and yet they keep coming back up
12:02
starting to get good consensus I thought - looking at it I'm not too worried. Lots of good questions, and very few I'd think were right out
If we lay it out clearly in the FAQ, might help - we can just point back to it
I agree with Nick^WRory
@RoryAlsop I agree. but as the site grows, the line will get blurred.
F.e. we should try to define what kind of "black hat" or "exploits" we dont want.
oh definitely!
Maybe just a paragraph saying "if you're a home user asking about seurity software, go to superuser.com"
12:04
oh thats good too.
my position on black hat/underground stuff is still open to persuasion
you stand with @rox0r on this question:
1
Q: Should we allow questions/answers that appear to include or request exploit code?

IsziI don't speak SQL myself, so I'm not sure if this is a good example, but here is the question that prompted this query: http://security.stackexchange.com/questions/1281/how-would-you-exploit-this-vulnerability-in-order-to-cause-max-damage/1303#1303 Asking for general conceptual how-tos is one t...

?
IMO it's possible to be valuable and contain exploit code, like securityfocus.com
Or that SQLi question...
agreed - dunno whether it is just a judgement call what the poster is after
12:07
@AviD yeah, I'm with @rox0r on that one. Although I'd disagree with his second point
any public information on building malware can be used by anti-malware people, IDS configurations etc
how about this:
We state in the FAQ that we don't allow *malicious* posts, e.g. how to spread a virus.
but ignore the "exploit code" question (or dance around it)
and purposefully leave it vague - to leave room for judgement calls.
works for me
@GrahamLee I agree
but as @RoryAlsop states sometimes you just *know* the intent.
yeah, that makes sense to me too
script kiddies are usually pretty obvious
12:09
aye. The Windows 7 question definitely fit in that category
yes. But I had a different problem with that one - besides being probably blackhat, it was so limited in time, that I closed it for being "too localized".
so I think your proposed wording for the FAQ should be fine Avi
should probably also get a mention in faq - details of 0-days are just too temporal
well, any 0day is localised
but it's not necessarily the case that the information isn't still useful later
exactly - thats why it doesnt make sense to ask about 0day today
12:12
the Morris worm was a 0day
just marketing hadn't invented the term back then ;)
"what 0days are there right now" vs "what do you do about 0days"
okay, what about the legals / copyright question?
it seemed to be about choices as to what code to use
for a security function, so very loose for this site
which question is this?
12:14
however I think for awareness it was good to have it here
3
Q: Are copyrights/copyright laws an IT Security Professional's responsibility?

AlexLet me start by saying, I am by no means trying to start a big fuss here, but I blatantly disagree with the communication I shared with AViD in this question, and I'm curious other's experience: http://security.stackexchange.com/questions/1300/copyright-issues-with-encryption-algorithms Althoug...

is what I thought too... but faq should probably state "we are not lawyers... blabla"
yeah, this is definitely an on-topic question.
Because it's actually about what should be in scope for an IT security professional
we need to know about it
that q was on meta, asking if its in scope. I'm talking about the q it references...
12:16
probably not on-topic
I don't know if any of the SE sites would answer a software licensing question with any authority. You'd definitely be able to get a load of half-baked answers from programmers.se.com ;)
heh
but @RoryAlsop, you also thought it was about which code to use, right?
a security-software selection question?
yesh, which is why it interested me]
I think we were just reading the q differently
that is always possible
12:19
I think the fact that the accepted, upvoted answer doesn't talk about security at all might be the tell here.
agreed
so, to sum up (and try to compromise here): purely legal / copyright questions are out, but finding a solution that wont have legal issues is in
well, what about compliance type questions?
compliance is a different issue.
compliance definitely in
compliance with laws
e.g. privacy laws
12:21
but not in terms of analysis of laws or licencing, more around does this comply with statements
I think that this was a question about application development that is masquerading as an app security question, because the app in question has a security feature
sox, hipaa, etc
@GrahamLee I see development of security features as app security :)
yeah, compliance is pretty much the core of a security professional's job. Throw that out and we've got nothing to talk about.
@AviD: so do I. But this question wasn't even about developing a security feature.
It was about software licensing.
we can't answer a compliance question with "if you have this you will pass PCI-DSS" but we can say "for compliance you will need to have looked at at least these areas..."
or, was it about which package can I use that doesnt have a legal issue?
12:22
but I don't think this was about compliance either
@AviD yes
ah. so, I think we can agree that the specific question was in the fuzzy undefined grey area...
"I'm trying to encrypt this user data, I've used this API, now what do I do with the key?" is an app security question. "Do you think my business manager will let me use this code?" is not.
as @nealmcb said here (meta.security.stackexchange.com/questions/136/…): " it depends on what the question writer wants out of the answers"
"how can I get my business manager to let me use secure key management?"
right, still a question about business management, not security.
I think part of our job is to not just have the right answers, but to sell them to non-security.
12:25
"how can I get my business manager to let me bake a cake?" is not a cooking question.
lol
So have you guys been at this for 8 hours?
good point... but i do see it as the politics of security. shouldnt that be in scope?
right, but "selling them to non-security" is about discussing the costs and benefits of implementing security features
12:26
lol
or countermeasures, or whatever
tradeoffs
it's not about whether a particular library or other is patented
risk to the business
@AviD: if you take that general an approach, then we should be in the business of profit/loss forecasting
12:27
albeit not technical risk, but arising from your technical choices.
is there any bigger risk to the business than that?
another good point :)
ok... what if the question was "which crypto library can I use, without licensing?"
(would be flagged as bad question, as it doesn't specify for what...) ( joke)
or to put it another way "Please recommend a crypto library. my requirements are that it is legally free to use."
I think it would not be in scope worded like that
12:29
yeah, that looks like a specific question that belongs on the site
wait, what?
as it seems subjective
assuming some more technical requirements too
12:30
how is "legally free" subjective?
the recommendation bit
ah, you mean the "please recommend"....?
that makes it an opinion, no?
no, "please recommend a crypto library" is subjective
aye
heh. Okay, lets assume that was qualified.... "secure, trusted" blabla
12:31
I'd say okay then
yes
my point is, I dont want to throw out questions that mention law or copyright, when its not the core point of the q
and that is a good point
fine, but in the case of this question, law was the core point of a question that gave passing mention to crypto
and regardless of the top answer, thats the way I understood that question
but I dont think thats what he meant. it probably should have been edited
okay - that makes sense. It does come back to the "meaning of the question" again
12:33
he assumed "all crypto libraries have copyright issues"
well, he accepted that answer, so we can assume it did what he needed :)
dont forget - if the question as asked was bad, but close to being good - lets clean it up for them!
or better yet, get others to....
Because I think that the answer cleared up his misunderstanding.
Helped him realize the question IS about crypto, and the law part is free and clear.
though on second reading it is a bit lawyer heavy.... :$
ok, cleared that up, yay.... any more on scope?
think we're good on that one (definitely going to have to go back through this chat record to update the faq :-)
(btw sorry for getting all preachy... its coming off from recent training sessions :) )
cool. @RoryAlsop will you do that?
course we'll all add to it later...
no worries
:-_)
12:37
right, then, item 3: updating the FAQ
I think we just solved that one
:)
that'll be me then
well done @RoryAlsop
:D
item 4: headline
claps @RoryAlsop on the back
a suggestion: after @RoryAlsop updates the FAQ, put a headline "Our FAQ has been updated! Please take a minute to review..." Or somethign like that
definitely
12:39
later we'll worry later about other headlines...
sounds good
next: tagging
we have a bit of a mess, on some of them... could stand to be cleaned up
Any time I see an issue with tagging, I wait two minutes and @AviD cleans it up :)
but I didnt want to make too many big changes, unilaterally...
I had a run through of the tag list this morning, and tbh Avi - I think your cleanup actions have it in a pretty good place. There are a few, sure, but I think we could sort quickly
12:40
lol
@GrahamLee LOL
I meant the existing tags
[best-practices]
do we want to assign tags, or should we just go through as and when we have some time and clean up
The [source-code] tag seems redundant to me
I focus my morning hate rituals on that tag alone
12:41
it mainly just means [appsec]
@GrahamLee is it?
and best practices is pretty much redundant
but appsec could also just be pentest - no code involved
as opposed to secure coding guidelines....
there are no questions yet about managing source code securely
12:42
there were a few about "how to do X in code"
e.g. configuring SCM, granting access, cloud hosting
shit, I said cloud. BRB, got to drink a shot.
lol
cloud shots? luvvit, I'm gonna make everybody I know start that game
right, so questions on pen-testing, SDL, and secure-coding should probably be separated
I think so.
agreed
12:44
but still have the overall category of "appsec"
yeah, we should probably document in the appsec wiki page that it covers a multitude of sins
as opposed to [networks] [operating-systems] etc
ah. tag wikis!
so do defensive coding and security feature implementation need different tags?
oo, that should be our headline. "Please help us update our tag wikis"
I think it's probably a bit too picky, given that we have 7 relevant questions
12:45
heh
@GrahamLee I think not, there are other topic tags that could cover that
e.g. [xss] and [authentication]
kind of cross-purpose with [source-code]
agreed
(which btw should really be [secure-coding], but I try to get rid of "secure" in tags...)
should tags for terms be the TML, or the full spelt out term?
e.g. [ids] or [intrusion-detection-system]
For things like XSS and IDS, people will use the TLAs
so - if we all just do a tags check relatively frequently on a fairly common sense basis, it sounds like we will be in an okay place
so they should at least be synonymous
(with the long versions, not each other)
12:49
:)
i guess worst case we can add synonyms...
this is perhaps another use of the tag wiki, so you can explain WTF XSS means
but there are a few tags which are badly misused
probably because of misunderstanding, so they should be changed to something clearer
thought the wiki helps too...
[files] seems to have been sprayed at random onto the website
I guess the real question here is, how disruptive and prescriptive should we mods be with taggage?
yeah, i think that was from early days
tagging is probably the best place where we can lead by example
12:51
[policy] [management] [security-awareness] seem to be more out of place than in place
I think if we see tags that match meaning with another we should just clean it up, and can use the wiki as the definitive description. that is actually another thing I haven't figured out yet - tag wiki. Ideally we should wiki up every tag, but how do we do that.
it's not like we're deleting content or changing the meaning of other users' writing
@GrahamLee I like :). but what about mass changes to existing tags?
security awareness seems pointless - awareness would be better, if used correctly
still would miss out...
how bout training-and-awareness
but then, how is that different from [education]?
12:53
same as education
[audit] [security-audit] are another couple
@RoryAlsop "Ideally we should wiki up every tag, but how do we do that" CAPTCHA farms
security-audit can obviously be merged with audit
@GrahamLee lol
@RoryAlsop and yet they both keep being misused as "I dont know these securitys please educate my awareness"
like it
gawd
interesting about training/awareness, those should be different things
but both are the same as education
12:54
@GrahamLee but is "audit" mean "logging" (tag exists) or "assessment"?
@AviD: indeed, good question
I think audit should be abolished - too confusing
put the qs either in logging or assessment!
the problem is stopping future users from using it
"by example"...
hmmmm - but audit is what an awful lot of IT sec folks do as their day job
12:55
clean it up as it comes in, cuz we cant put an automatic synonym
@GrahamLee training is about the activity, awareness is about content - so maybe we just keep education
@RoryAlsop its also what a lot of programmers put in their code
as a cover all
or on filesystems
yep - so all three are different
12:56
@RoryAlsop @RoryAlsop I think thats best. BUT how prevent misuse "educate me!"
I think audit (as in what an IT audit department does) should be [audit], logging and monitoring should be [logging]
@RoryAlsop are "audit" and "assesment" very different terms?
lol
agree with @RoryAlsop there
on the audit/logging thing
@AviD a security audit and a security assessment can be different eg blog.7elements.co.uk/2010/09/penetration-testing-taxonomy.html
hmm...
12:58
the training/education/awareness thing is still different. If someone says "plz to educate mee" then what they really need is [percussive-education]
</non-violence>
lol
@RoryAlsop no mention of audit there
bugger - did I send the wrong link
oops
is audit considered more of a legal/regulation/policy compliance thing?
often yes
okay, so we have [compliance]
01:00 - 13:0013:00 - 14:00

« first day (27 days earlier)      last day (5151 days later) »