« first day (523 days earlier)      last day (4345 days later) » 

10:26 AM
@ScottPack here or SF?
0
Q: Config Server Firewall: What Outgoing ports need to be open for wget and apt-get install?

Henry HoggardI am just configuring CSF and I have to specify my outbound ports here. I am trying to close as many as possible leaving only what i need open, however what do i need to leave open for wget? # Allow outgoing TCP ports TCP_OUT = "20,21,22,25,53,80,110,113,443" # Allow incoming UDP ports UDP_IN =...

it's completely firewall, but then it's pretty close to a "how do i...". Also seems kinda networking basics.
 
 
1 hour later…
11:30 AM
In security.stackexchange.com/q/2532/5501 @RoryAlsop specified that this question is duplicate. But it doesn't seem duplicate to me as this question asks about code static analysis tools, not about all tools that can be used to assess in security audit. Therefore I think that security.stackexchange.com/a/2534/5501 and security.stackexchange.com/a/15252/5501 are not answers to this question. Do you think so?
 
12:09 PM
@AviD I would normally say move it, but I'm not too keen on migration because it's a reasonably low quality question. I'll go ahead and answer it so he'll get it resolved.
 
@AndreyBotalov true, but so? the other questions linked also refer to source code analysis.
I do agree that Henry's answer there isnt on target, but @DW's answer basically says - reviewing the code is problematic, here is a different approach which may help.
@ScottPack cool. could also always just go ahead and close it, and point the OP at the SF question linked in a comment....
 
12:24 PM
@AviD The specific question he asked was rather poorly worded and more SF focused, so I focused more on the sec.se parts. That is the necessary understanding he'll need to know what he's getting himself into.
 
 
3 hours later…
3:40 PM
Joel Spolsky on May 21, 2012

Remember this old picture?

What’s that “Blog” circle supposed to be about, you ask? WHERE’S THE BLOGGING?

Since Stack Overflow launched, we’ve been trying to explain that it’s not just a Q&A platform: it’s also a place where you can publish things that you’ve learned: recipes, FAQs, HOWTOs, walkthroughs, and even bits of product documentation, as long you format it as a question and answer.

As Jeff wrote:

if you have a question that you already know the answer to …

 
4:06 PM
@RoryAlsop @AviD I thought we declared these questions off-topic:
-1
Q: Where can I find malware database?

Andrey BotalovI want to test part of application that allows users to upload files for presense of up-to-date and configured antivirus. To do this I need some malware that is likely to be detected (it doesn't need to be harmful). Where can I download it?

 
 
1 hour later…
5:35 PM
I'd suggest to migrate this, but it seems like it's gotten enough attention already...
6
Q: How to prevent zero day attacks

honeybadgerTraditionally all the anitvirus, IPS works using signature based technique. This doesn't help much in zero day attack. Therefore, what can be done to prevent zero-day attacks? PS: zero attack means virus which is not known (no known signature).

 
 
2 hours later…
7:15 PM
@Iszi it seems that you consider my question blackhat one. But I need it in whitehat activity. What's bad with this question?
 
@Iszi where?
 
7:41 PM
@AndreyBotalov Essentially, you're looking for links to what are likely to be black-hat sites. Not something we want to do, here. There's been other discussions about these sort of questions as well. Most of the posts are really old though, so I'm having a hard time digging them up. (CC: @Gilles)
 
@Iszi I'm not keen on this post, because it's asking for a list of sites
but blackhat isn't a reason to reject the question (Cc @AndreyBotalov)
 
@Gilles Actually it is, here. Check the faq, under the headline "Black Hat vs. White Hat".
 
@Iszi @Gilles answers to this question can be used in blackhat activity as many other at this site. Maybe, "Where can I find malware database?" is too blackhat. Will "Where can I find malware to test antivirus presense?" be better question?
 
@AndreyBotalov The same problem still applies: Such resources are likely only available on blackhat sites, and we don't want an SE site linking to blackhat sites.
 
@Iszi Also I don't ask for actual malware. I ask about something that is likely to be detected as malware
 
7:49 PM
@Iszi ugh, when did this get added? It's far more strongly anti-blackhat than
7
Q: How do we provide value to white and grey hats?

OriSo it's something we're kicking around in chat for a while about a specific question, but I think it goes to the style of the site. We as a community are answering blackhat style questions. Do we want to impose a requirement that all questions regarding vulnerability exploitation also include a...

 
@Gilles Pretty sure it's been here since the start, or close to it.
 
@Iszi I don't think there was anything in the FAQ back when this meta thread happened
 
@AndreyBotalov If you're looking for something that's "likely to be detected as malware" the only "white-hat" resources you might find are false-positives or PUPs (Potentially Unwanted Programs) - neither of which will be of much real use I think.
I fracking swear I commented on a thread about this, but I can't for the life of me find it.
I have a feeling the topics may be hidden behind the 10k barrier.
 
8:04 PM
@Iszi questions like security.stackexchange.com/questions/164/new-xss-cheatsheet, security.stackexchange.com/questions/9440/… seem to be the same degree of blackhattish to me.
 
@AndreyBotalov Note that neither of those has had an answer that required a "this site is harmful" warning.
 
evenin' all
 
Howdy @RoryAlsop
 
@Iszi How has the day been - I've been out of touch today. We had our inaugural eCrime Scotland Summit
 
@Iszi the actual question that I had was "How to test for presense of properly configured antivirus?". It's recommended in many places at site to have antivirus. So question about testing for it was absolutely whitehat in my mind.
I think that the only way to test is to upload malware. So I need malware.
 
8:15 PM
@AndreyBotalov for A/V everyone uses EICAR
 
@RoryAlsop That only answers part of the question though.
The missing piece being "how do I test that it is updated and will detect the latest malware"?
 
To be fair, testing for it is almost pointless these days. If you have an AV solution, whether it be standalone or enterprise level, the only useful checks are - is it turned on, is it set to scan on open, is it set to scan on file receipt, and are the signatures up to date
2
It is a pretty mature industry - leave the vendors to do the testing of their signatures
if it passes those checks I listed, that's about all you can ask for
 
@RoryAlsop I'm pretty sure there was a thread somewhere, where I (or someone) mentioned that we shouldn't have our site linking to black-hat sites, but I think it got pushed behind the 10k barrier. Do you know which one I'm talking about?
@RoryAlsop Add: Is it set to run a full scan on a regular basis.
 
@Iszi I do remember that - I'll have a look. Not sure we have much behind that barrier, though.
@Iszi oh yeah - regular full disk scanning
 
@RoryAlsop I've searched the thing to death, and can't find it.
 
8:20 PM
additionally, if you google for malware repositories, the one listed comes up anyway
think I'll take the link out
 
@RoryAlsop Took the link out already. Now it's just a text domain name.
 
...my job here is done :-)
 
...though, I didn't mean to imply I'm happy about it being there at all. :-P
 
@Iszi I am happy to remove it altogether and suggest the asker goes to google
 
@RoryAlsop Let me know if you do find that thread I was looking for. It's bugging me now.
 
8:22 PM
hunting using various search terms...
 
@RoryAlsop Sounds good. Also, your own answer with the now-starred chat post might be good to throw in there.
 
@RoryAlsop Why does the FAQ have this anti-blackhat passage? It doesn't seem in line with the outcome of the meta discussions I've seen
 
@RoryAlsop Do you have a screen that just shows deleted threads? Might be an easier place to start, if it turns out it actually is in one of those.
 
@Iszi yup, deleted:1, mod-only search operator
 
@Gilles cheers - didn't know that - will go and trawl now
 
8:27 PM
I checked Meta too, and no dice there either. Or, maybe I just wasn't stroking the search box nicely.
 
there's too much talking in here.
 
@AviD No there isn't!
 
@AviD It could be worse.
 
@Gilles there is an element of covering ourselves a bit, we really don't want to be seen as enabling an attack
 
@AviD We
 
8:27 PM
@RoryAlsop funny, I was just thinking of pointing that out.
 
@AviD never
 
@AviD could
@AviD be
@AviD pinging
@AviD you
 
@Iszi Oy!
 
@Iszi it could be all rory again.
 
@Iszi done
 
8:28 PM
@AviD every
@AviD message
 
The room still is roryed, according to the top right
@Rory - I mean @Scott - hasn't changed it back yet
we only have 28 deleted questions!
that's not bad, eh
 
hehe
@RoryAlsop we could do more
 
@AviD I reckon we can leave our first big cleanup for when we are bigger :-)
 
@AviD One of these days, I might see if I can search through stale closed questions and flag them for deletion. Or, is that something only a 10k can do?
 
yeah, but I meant we should go around deleting things. Yknow, for the hell of it.
For the rory of it.
 
8:31 PM
@AviD DELETE ALL THE RORYS!
3
 
("That" being search for closed questions, not vote delete.)
 
@Iszi you could always flag. closed are all visible.
 
@Gilles where's @Scott with his memegenerator when you need him
 
@Iszi anyone can search for closed:1
 
@RoryAlsop Here you go...
 
8:32 PM
btw @Rory - back to the sanity check from yesterday...
 
 
sorry rory check
 
yesterday, by AviD
okay, this bit I'm less sure about - configuration/deployment guidelines for a bunch of linux boxes, about 4-5 different types (web, db, nosql/hadoop, proxy/fw/waf...), and network.
 
@ScottPack superb!
 
8:33 PM
I aim to pleasure.
 
@ScottPack Hey now...
 
And ew
 
@AviD that one is a bit finger in the air, how long is a piece of string, kind of thing
 
user image
2
 
8:35 PM
A week could be right - will depend on quite a few things obviously
 
I just ate a jellybean that tastes like a Christmas scented candle. ಠ_ಠ
 
@ScottPack why?
 
@AviD I don't believe in sanity check
 
@RoryAlsop I didn't know what it tasted like until I put it in my mouth.
3
 
@ScottPack That's what she said!
 
8:36 PM
@RoryAlsop heh. okay, thanks.
@Iszi loool! how did I miss that one??
@Gilles it reminds me of what we used to say as kids. "They did a CAT scan on you, and it came back: Negative".
 
heh - the great outdoors SE has a great question:
7
Q: Can I shoot a bear in self-defense?

wyocalboyCan I shoot a bear in self-defense? Will I face fines and jail time if I do?

 
@RoryAlsop Oy! — bear #1
@RoryAlsop Oy! — bear #2
 
Haven't seen the bears for a wee while - they haven't been shot in self defence have they?
 
@Iszi very nice
for some reason when I first saw it I saw Kzinti:
 
8:42 PM
I was about to call you a nerd, then I saw the picture of Niven.
 
@ScottPack why?
 
@ScottPack Surely everyone knows the Ringworld novels - classics. Not at all nerdy...probably
 
I've heard of them, but haven't read them yet.
/me is reading Journey to the Center of the Earth right now
 
@ScottPack read the first, skip the rest
Ringworld #2 is one of the few novels I didn't finish
 
@Gilles yeah, sadly true.
Same with most of his series, although the Mote in God's Eye, and the Moat Around Murchieson's Eye are both good
 
8:46 PM
Also, after you've read Ringworld, or even instead of, read Pratchett's spoof
:For discussion regarding the term strata as used in geology, see stratum. See also Strata (disambiguation). Strata is a comic science fiction novel by Terry Pratchett. Published in 1981, it is one of Pratchett's first novels and one of only two purely science fiction novels he has written, the other being The Dark Side of the Sun. Although it takes place in a different fictional universe and is more science fiction than fantasy, it could be said to be a kind of precursor to the Discworld novels, as it also features a flat Earth similar to the Discworld. It has been called a "preconsider...
 
@Gilles Yep - that is a good one
 

« first day (523 days earlier)      last day (4345 days later) »