The DMZ

AviD

00:15

yeah, its like meta-meta :-)

Rory Alsop

@AviD what does it say about my brain that I immediately thought "meme tata"

too much whisky?

AviD

or not enough

Journeyman Geek

I read that as me me tata ...

sounds like the sorta dirty joke you'd see slipped into animaniacs

Arminius

Sounds like food to me

Journeyman Geek

that's a me me tato.

Tom K.

07:25

accepted answer tomorrow: "acutally we decided against hiring and will obtain all our expertise from your meta-site now"

Journeyman Geek

lol

Tom K.

"hey guyyssss, this is a bit unorthodox, but also extra meta. we just had a major data leakage. what should we do now?"

Journeyman Geek

07:51

@TomK. Well, SE has had a tradition of hiring from 'within' the community

and I'd guess there's no point having a room full of experts if you can't leverage them

Tom K.

true

Journeyman Geek

and unlike say, systems or other places , they don't really have a inside track here

Tom K.

I think the OP himself is somebody like that

Journeyman Geek

rofl

Tom K.

not 100% sure about that

Journeyman Geek

07:53

I think he goes way back?

Tom K.

yeah, I think so. but then got hired when it got bigger

Journeyman Geek

so insider - but not in the same sense as a lot of the SRE, CM and dev team

Tom K.

don't know too much about them

Journeyman Geek

timing's a bit.. odd tbh

Tom K.

why's that?

Journeyman Geek

07:54

They just had a round of restructuring

Tom K.

well, then it isn't odd at all, is it? :D

Journeyman Geek

Well, in context not so much

Tom K.

they probably thought: "hmm, whatever our technology farm grew back here in the last years, it doesn't look too good now"

Journeyman Geek

eh, not really

Tom K.

we should probably hire someone to take a look at this, before shit hits the fan

Journeyman Geek

07:57

Well, feels more that "we're basically selling our service to folks who may run it outside our server farm"

++

Tom K.

yeah, that as well

Journeyman Geek

channels probably has a few interesting needs since they want it both integrated with SO, yet private enough that there's no data leakage

Very different running a tightly controlled service with a private/controlled back end and a very public front end

Tom K.

just yesterday I realized, that all of the public posts are mirrored 5 to 10 times

Journeyman Geek

hah

Tom K.

(on other sites)

Journeyman Geek

08:00

there's a lot of scrapers

and, assuming they follow the SE licencing requirements, that can even be legal

Tom K.

but most of it is just advertising scam

you google for a question, see an "interesting" post in the search results, click on it, get redirected to an ad farm

Journeyman Geek

ya. its sadly a thing

(which kinda is amusing considering how much some folk were panicing over that latest MSE announcements that some sites were getting affliate ads)

Tom K.

panicking? really?

everything was quiet around here :>

Journeyman Geek

dude ;p

You clearly are not plugged into the gossip ;p

Most main sites are low drama, low "non topical stuff"

Tom K.

nope

I gladly take an invite

Journeyman Geek

08:09

I usually follow MSE, and "work here" to try to get a pulse on what's going on

Tom K.

I'm kinda procrastinating right this second

Journeyman Geek

87

Q: Affiliate Ads Are Coming To The Network

Some time ago, we announced that certain SE sites will have advertising enabled. This has gone well and we're extremely thankful to everyone for their support and feedback. Because it has been successful so far, we're going to be extending the program to the majority of our graduated sites. Well,...

so - this to me is not bad. SE's very cool about adblockers and expanding ads means that smaller sites turn into revenue sources. But there's folks who're kinda like "All ads are evil"

(featured tags are kind of "this is what's happening here")

Tom K.

sheesh

Journeyman Geek

stackoverflow.com/company/work-here

is useful for gauging what SE's doing in future

Tom K.

(ugh, Munich)

Journeyman Geek

08:12

More sales jobs in talent in europe - so one can guess that gets bigger weight in future. Azure is interesting since SE's always been about bare metal, until you consider SO enterprise, and some clients potentially wanting cloud hosted services...

so stuff like that ;p

Tom K.

well... okay :)

interesting!

that affiliate ads post is just hilarious

"oh no, a site i am visiting frequently will have ads!"

Journeyman Geek

yup

and people assuming it is/should be a non profit

Tom K.

arf..

worse!

people assuming it is their site

like they can decide what's happening around here

wtf?

Journeyman Geek

well, to a certain extent, we can

Tom K.

well... there is some nudging

Journeyman Geek

08:17

but SE/SO's actually been pretty good about these things

Tom K.

and yes, you probably won't get any porn ads on your site

Journeyman Geek

-290

Q: A New Code License: The MIT, this time with Attribution Required

Update: January 15, 2016 Thank you for your patience and feedback. The changes proposed here have been delayed indefinitely - we'll be back later to open some more discussions. Important context for those arriving from reddit and slashdot links: The status quo is not "public doma...

discussion licensing feedback creative-commons

here's an example when SE tried to bring about a change and... people hated it.

Tom K.

but the general decision "SE will get ads" - it's pretty obvious that this will happen

yeah.. I mean I've been around when documentation on SO was introduced

that was a fun time

Journeyman Geek

ah, but here's the thing. SO and the rest of the trilogy already do

erf.

documentation's kind of the 'thing that ails SE'

they're really really good at one thing

(but they've gotten so good, they're trying to find the next thing, and that''s less easy)

Tom K.

tbh, I LOVED documentation

Journeyman Geek

08:20

Careers and such is sucessful but It can't really grow any further

@TomK. I never used it ;p

(to me SO is also kinda dev focused. It makes sense considering the team but, its attracted a much wider community, both techie and otherwise IMO )

Tom K.

well... I loved the idea.. it wasn't done well

Journeyman Geek

well, they threw it at a wall, and it didn't stick

Tom K.

yeah, look at the growing languages like R and scala

that's not the typical SO user

but they are all there

Journeyman Geek

I'm not a SO user ;p

Tom K.

okay, nevermind ;)

Journeyman Geek

08:23

my main sites, other than chat are SU, MSE and... I guess Pets

Tom K.

why are you so interested in MSE?

Journeyman Geek

hmm

Officially? Its about the only place I can use my mod experience to answer things ;p

Tom K.

is this a "Imma work there when I'm older" thing?

Journeyman Geek

cough

Tom K.

haha

Journeyman Geek

08:25

UNOFFICIALLY, maybe

Tom K.

alright, tell me if the offices are nice

Journeyman Geek

well more if a role comes up that I'm not underqualified for

ah! Se's offices are on google maps

and a good deal of people work from home

Tom K.

I'm leaving germany for new york in about 2 years or so

so... yeah

Journeyman Geek

4

Q: What do the Stack Exchange offices look like?

I was curious to know about Stack Overflow and searched on Google to see what Stack Overflow offices look like and what the environment is like. I want to know about employees, but unfortunately I couldn't get any single video on YouTube. Google is a huge corporation and even they provide a vie...

discussion stackexchange

Tom K.

somebody apply for that CISO job already

Journeyman Geek

08:26

lol

I think its already down the grapevine

Tom K.

is there some kind of secret mod chat?

Journeyman Geek

hmm

Tom K.

(well, the lounge looks nice)

Journeyman Geek

kinda?

and there's a wee bit of networking going on here and there

Tom K.

i have to read the first letter in every word in every sentence?

Journeyman Geek

08:31

Naw

20

A: "Private" Moderator Q&A site

The Teacher's Lounge exists for two reasons: Provide a place where moderators can relax a bit, commiserate and bond without every word being thrown back in their faces the next time someone disagrees with their actions in public. The name is sort of a giveaway here... Allow discussion of sensit...

this is like, the official, secret mod chat...

Tom K.

ah, cool

Journeyman Geek

(and yes, private, mod only rooms are a thing)

that said, its mostly boring, and as a mod (elsewhere), very little of what I do is really secret.

Tom K.

"Top Questions
It was not possible to perform this tag search at this time due to an unexpected error."

on Sec.SE

Journeyman Geek

ugh

did they break the tag engine again?

Tom K.

no, others work

Journeyman Geek

08:34

which link?

Tom K.

(damn it! always hitting the wrong button)

works again

Journeyman Geek

ehh. you can edit anything you say within errrr

I think 3-5 minutes? I don't remember.

Tom K.

that was the home button-"link"

not if you accidentally delete something

Journeyman Geek

actually ya

I can't undelete.

its a strange thing about chat

Tom K.

hmm... while I have you at my disposal

can a mod edit a comment to "make" it an answer?

Journeyman Geek

08:44

no

We can go the other way around tho

Tom K.

Yeah, I know that..

I'm just going through unanswered questions. Some of these are answered in the comments. Question is: Should I answer these myself with basically the same content that is already in the comments? Or is there a good way to flag the comments for moderator intervention.

(heh moderator invention)

@AviD @RoryAlsop Suggestions?

AviD

09:09

@TomK. nothing for a moderator to do about comments (except delete them).

I would suggest if the post/comment is rather old, go ahead and answer it yourself - just makes the site better.
If it is fairly recent, I think it would be better to give the commenter the courtesy of suggesting they make it an answer.

Journeyman Geek

Oh, yonking comments, improving them and answering is pretty much fair game.

AviD

WHOA @JourneymanGeek @TomK. did they kill the documentation??

Journeyman Geek

@AviD DUDE

DUUUUUDE

quite a while back

AviD

hey I dont use it often, but when I did I found it rather useful

Journeyman Geek

1161

Q: Sunsetting Documentation

We will stop accepting contributions to Documentation on August 8 On behalf of everyone who worked on Documentation, I want to thank all 15,451 users who contributed. We particularly want to acknowledge the 294 people who tested the private beta and the 2,361 who pounded on the public beta in ...

discussion documentation

Tom K.

09:14

to extend on that:

DUUUUUUUUUUUUUUUDE!!

AviD

heh.

Journeyman Geek

(TBH, I do keep an eye on... as much as I can, and I know all the good stalkers ;p )

Tom K.

09:30

and now, stop arguing! @AviD

AviD

who is arguing?

Tom K.

#metapost

#cisobeingonsite

AviD

ah

you just dont have the remote mindset ;-)

Tom K.

yeah.. probably

another point to the matter: at a registered association I worked for, one of our servers was used us a Tor exit node

Journeyman Geek

@TomK. why?

Tom K.

09:44

one day, the federal police showed up

nobody was on site(!) that was qualified enough to speak with them

@JourneymanGeek the association was associated with hackers and the likes :P

Journeyman Geek

Taking into account the scope of the job, and the nature of SE's workforce - many of the people actually doing the work are offsite, including key development personel

naw, for the CISO being on site

Tom K.

ah

AviD

yeah the only ones that REALLY need to be onsite are the ones handling the hardware. and not even all of those.

Tom K.

e.g. to interact with law enforcement

Journeyman Geek

yup

AviD

09:46

well unless they move to the cloud...

Journeyman Geek

SRE team is heavily US based

AviD

but also not 100%

Tom K.

how many people work in their offices?

Journeyman Geek

@AviD even then - you'd want to have some people on site but you'd want to have some diversity

Tom K.

I think the "signaling" point is the most important here

or is most important to me

Journeyman Geek

09:47

@TomK. technically that's legal.

AviD

well if its in the cloud there is no "on site"

Tom K.

but that's probably my non-remote-mindset

Journeyman Geek

No one's ever actually seen legal.

AviD

@JourneymanGeek this.

Journeyman Geek

Legal's kinda like the Nazgul. Only they might, possibly, be on your side.

AviD

09:47

even if LEOs show up, its the legal team that handles them, and they can call the CISO if necessary.

Journeyman Geek

yup

and I think your ass is more or less covered if you take the time to call your boss.

(who calls legal?)

Depends - but that's the sorta policy a CISO probably will need to think about ;p

Tom K.

SOMEONE WHO'S ON SITE!

point - set - match

Journeyman Geek

er

Tom K.

boom

Journeyman Geek

absolutely not

AviD

09:49

sure, and by "think about" you mean "consult with legal"

Journeyman Geek

Cause shockingly, you cannot trust cops 100%

Tom K.

say what now????

what kind of nonsense is this, young pup!

Journeyman Geek

@AviD by which I mean "ok, call this person if there's LEO. This is what you should say"

Tom K.

well... I'm not a 100% convinced, but please, have your way

Journeyman Geek

which is mostly "I'm not quite sure here, let me call legal" I suppose?

@TomK. Ever heard of possession is 9/10th of the law?

Tom K.

09:52

whenever cops show up in your building, whoever sits at the reception should call legal

@JourneymanGeek nope

Journeyman Geek

bits.blogs.nytimes.com/2011/06/21/…

Stuff like this happens.

@TomK. assuming there's reception - your servers might not be in your main office

AviD

@JourneymanGeek I meant, when defining the policy it is in tandem with legal. CISO wouldnt set that unilaterally.

Tom K.

that is true, if they go directly to your data center, there sould be someone sitting at the door though

Journeyman Geek

SE has them in... er Denver (where there's no office) and NJ

@TomK. and the datacenter calls your sysadmin or SRE. Who... follows policy and presumably calls legal.

@AviD yup ;p

AviD

plus, in the cloud, its NOT EVEN YOUR SITE.

Tom K.

09:54

yeyeye

Journeyman Geek

@AviD assuming SO corp dosen't do a 180 and go full cloud

I hope not! their architecture writeups are a good read for a hardware geek like me

AviD

oh yeah, love them.

And their reasoning, which wouldnt apply for like 95% of internet companies, is really well thought out.

Tom K.

@JourneymanGeek just to be clear, the feds seized our servers that day and what followed was not nice. So my personal love for law enforcement isn't too .. er .. great

Journeyman Geek

@TomK. sounds about right

and that's why... you talk to legal

TheJulyPlot

10:48

If I was to audit a webapp plugin vendor in advance of using their service what things should I be asking about? I’ve got permission, encryption, patching process, on-going support, client side scripts, code execution, webapp server code execution. Also if they scrape any of my webapps data, who their security contact is, how they notify of a breach, etc. Have I missed anything obvious?

Also I don’t think this really fits the format for a full question as it is opinion based and very broad on SE.infosec? If any of the mods/longtimers disagree I’ll ask it as a proper question.

Also pen testing and sec creds.

Tom K.

@TheJulyPlot How exactly will you audit them? Just by interviewing? If so, who will you interview?

TheJulyPlot

@TomK. It would be a checklist/Q&A that they complete in advance of a contract being signed. It is really to provide a level of due diligence and to infom decision making.

Tom K.

ah I see

Tom K.

11:46

Hmm.. it's hard to tell. Depends where the plugin(s) will be used, how many users etc.

but I think your list looks good as a starting point

do you have a contracting department that deals with stuff like this?

TheJulyPlot

no this is really to inform a change board

to ensure that security considerations have been taken into account

Tom K.

okay, and your role is?

TheJulyPlot

Security architect

Tom K.

Maybe include steps when the contract ends/they end the relationship with you

and handling of any data they might collect

also with regards to any laws you/they might fall under

but other than that, I think your list looks good

Transcript for