« first day (2696 days earlier)      last day (2482 days later) » 

07:44
why is there no stackexchange site for microsoft products..?
this question doesn't seem to fit on SU or on SF
and it also seems off-topic here
Because in theory, it should fit in the trilogy
Problem there is its a product rec more or less
the trilogy being ...?
SO, SU, SF?
Yup! In 4 parts.
"although we have no reason to believe password information ever left Twitter’s systems or was misused by anyone" for twitter and "GitHub said it discovered its error during a routine audit and made it clear its servers weren't hacked.". How can they be sure that there havn't been hacked? does enetering a server always leave traces?
... does that make MSO/E the christmas special?
@Kepotx probably mroe that they came across an error during their own audits rather than finding the passwords scattered all over the internet like dog toys.
07:48
@Kepotx unless you were attacked by someone extremely skilled and/or of nation state character, yes
and also what JMG said
@JourneymanGeek do you know if there was ever an Area51 proposal for a Microsoft Product specific site?
Nope? I think people got the idea that it won't work. But someone might have tried
its less of a natural fit than say, the gadget/consumer electronics SE that never gets off the ground
I'd imagine a site that's more about the more complex but also widely in use systems like sharepoint, exchange etc.
@BenoitEsnard I have a feeling they may be checking in the run up to May 25
@TomK. Is there not one for something MS-y? I got a t-shirt from that site, but can't remember what it was now
I think GitHub's disclosure helped Twitter to discover its own internal bug
@RoryAlsop on SE? not that I know of. Only Windows Phone
07:54
@BenoitEsnard I was chatting to a penetration tester last night and was going to point him your way re ctf's. Could you use another pair of hands?
@TomK. hmmm - I'll trawl back through
@Kepotx I would love to see this question on the main site
Proving you've been hacked is easy, proving you've not looks way harder to me
go get some rep @Kepotx
@RoryAlsop We need more re-skilled people so fel free to invite him :)
@BenoitEsnard will do
@TomK. Go on Area51
07:56
@BenoitEsnard (I think he didn't mean reverse engineering with "re" ;)
Oh. What did he mean then?
regarding
re is short for regarding
@BenoitEsnard nothing there :/
Oh, didn't know that. Thanks for pointing it. :D
Does your friend have a SE account?
sorry, yes that's an English-ism
he does - I'm trying to figure out what his user name is
07:59
Sorry, something is: sharepoint.stackexchange.com
oop - figured it out. It actually is his name :-)
wow, already from '09. so not that new..
0
Q: How can Twitter and GitHub be sure that they haven't been hacked?

KepotxYesterday, Twitter anounced that they recently identified a bug that stored passwords unmasked in an internal log. Recently, Github also had a similar bug In both cases, they pretend that nobody had acces to the file Twitter: We have fixed the bug, and our investigation shows no indication...

@JourneymanGeek sure, but that's assuming the leak would be spread. what if someone had acces to the file but keep it secret?
good design would audit access
08:16
a possibility though: if the passwords were saved indeed accidentally in that internal log (in Twitter's case) they might not have full file access logs for that
08:43
seems like a common problem: news.ycombinator.com/…
09:22
I have a question about password managers, specifically in corporate settings.
Now, a regular password manager can sync by sending around the encrypted passwords, where only I have the master key.
How does this work on a corporate scale, where there are multiple master keys, one per user.
My only guess is it would be some kind of PGP system.
09:39
@WilliamMariager I can't really follow.
Do you need some kind of key or password exchange between users?
if not, why wouldn't every user just have their own instance with their own set of passwords and their own master key
10:22
@TomK., Sorry for the late reply.
Right now I used Dashlane
The corporate version allows syncing passwords among employees as far as I can tell.
So if I create an account at a system, I can select which employees have access and which doesn't.
So it'll have to send the password around in some way I'm guessing, in a way the other user can decrypt.
10:39
Ah okay
well, that probably depends on the product and if a user is able to change the given password
I'm pretty sure there are password managers that can be linked to an AD for instance
 
2 hours later…
12:56
@Kepotx well, that did turn out well ;)
Finding good questions is easy actually.
yeah, deffo
I was wondering about this one: security.stackexchange.com/questions/185145/…
because if asked well, it could be a really good one
so I could either edit it so much that it is.. no longer that question
or ask a completely new one
no idea what the "right" course of action is though
Ask the mods!
What a great idea!!
13:01
@RoryAlsop what do you think?
@TomK. yes, good thing it reach the HNQ, it really help to have better answer
 
1 hour later…
14:24
@RoryAlsop nevermind, I posted a new one. I think it's different enough.
 
1 hour later…
NH.
NH.
15:24
I may be behind the times, but I just found out that word-based captcha is going away. Hooray! Good riddance!
Except no more inglip, but that's probably a good riddance too.
As if it wasn't hard enough already to convince sites I'm not a robot
NH.
NH.
you thought the squiggly words were better?
15:50
my mother regularly fails these
NH.
NH.
@TomK. Even when my eyesight is good (with correction), it is often hard to pass the word-based kind.
Captchas suck.
NH.
NH.
The newer picture-based ones are only needed if I do the initial account sign-up on my phone (where they can't detect my humanlike hovering pattern), but I can usually get through them after one or two screens.
Spammers suck because they made captchas necessary.
@NH. no, she fails the "mark all the pictures that contain cars"-captchas
I never know what Google thinks is part of a street sign. Do I still check a square if it contains just an edge? Do I include the pole? Is a velomobile a car?
5
16:06
yeeeah
Anonymous
@Arminius I know EXACTLY how you feel.
I think we all know that feel.
Anonymous
Those get me all of the time I fail them regularly.
I would read the shit out of any paper that covers the topic "stuff people do, that they THINK fools an algorithm"
Anonymous
Be right back going to go write that paper @TomK. lol
NH.
NH.
16:12
@Arminius because it is AI-based, it isn't about what Google thinks is part of a street sign, it is what we think is part of a street sign.
(maybe the majority of the people?)
@TomK. what do you mean by fail? I didn't know it was possible to outright fail (I thought it just kept presenting screens to you until it had determined you were human).
the worst one I had recently was hills. One picture had nothing but grass in it. How am I supposed to know if that grass is part of a hill or not?
@NH. Reminds me of that "penis attack" musicmachinery.com/2009/04/27/moot-wins-time-inc-loses
Everything is fine until the "majority" are malicious
Although I think they said they had measures in place to prevent that
Wow, 8 different people at the same time here
What's happening?
NH.
NH.
I don't want to read that link since I'm on work network
@BenoitEsnard I mentioned captchas and spam, when combined they are the greatest source of annoyance in the world.
That's what is happening
@NH. Well, when I already know which object I want to frame, I'm not sure why Google would be interested in keeping the instructions for indicating that object ambiguous.
NH.
NH.
@Arminius I think it is clear that you click on it.
("Select all squares with...")
16:25
So, do I include the pole?
NH.
NH.
no
yay for self-moderation!
wait, is the pole part of the penis attack? :x
.... what?
@NH. no, if you fail too often you can't access the site
@NH. Basically captcha had 2 words, 1 known and 1 unknown, so if they manually had a large number of people type the known word correctly, but put "penis" for the unknown word, a significant percentage of "known" words will incorrectly be "penis", at which point they can automate it.
16:29
erm,ok
interesting idea but apparently it didn't work
@JourneymanGeek basically the first picture (of a word) was already known by the algorithm, but the 2nd wasn't. so when the captcha was implemented at first you only had to "guess" the first word correctly
so the learning part was outsourced to users
well, some of it
The first one here would really frustrate me.
omg free bitcoins??
NH.
NH.
17:33
where?
 
2 hours later…
19:12
That's what it says in the picture
 
3 hours later…
NH.
NH.
21:54
hey, it happened in the wild (I knew it would).
and now, I don't know how you can ever claim your npm-dependency-hungry app is secure.
22:19
You cannot @NH.
NH.
NH.
☹️
but good thing I'm a C# developer
NH.
NH.
22:31
(and I pretty much avoid NuGet packages)

« first day (2696 days earlier)      last day (2482 days later) »