The DMZ

packs

00:05

@Iszi Yeah, funding is always exciting when you're talking about a public institution.

Rory Alsop

just about to head to bed but read the updated 10 digit primes question. Still don't understand what hhh was trying to get out of it. @Graham - think you were right to close and not delete. Probably what we should do every time.

certainly wasn't a security question in any way, and had nothing to do with passwords

:-)

packs

00:24

Ah, it got migrated over to the maths site.

Man does that place freak me out :)

Feeds

09:19

Stack Overflow Blog: Are Some Questions Too Simple?

Posted by Jeff Atwood on February 22nd, 2011

On Podcast #58, Joel and I had a disagreement. Not the first, and certainly won’t be the last:

Joel says that the only bad simple question is a duplicate simple question. I say simple questions are OK as long as they’re actually interesting (in some way) for other users to consider and answer. To prove his point, Joel actually asks the question on Stack Overflow: How do I move the turtle in LOGO? Do you think this question adds value?

We still have this disagreement. Our community is now struggling with this issue across multiple network sites: …

Graham Lee

11:19

@packs I didn't bother looking at the site, I just gave them our detritus ;)

packs

12:21

@GrahamLee I browsed through the maths site once on a whim. It reminded me too much of my university days.

Being the sole radio engineer in a group full of math majors and professors meant bar times could be real....weird.

Graham Lee

I notice they accept LaTeX formatting in questions. That's well cool.

packs

I did appreciate that.

And it means the questions/answers are beautifully set

Graham Lee

yes, that.

looks like there's some javascript that detects LaTeX in the page source, translates it to MathML and lays that over the top of the LaTeX

packs

Sounds messy, but clearly it works.

Graham Lee

right, I'm off to London to see the Queen^WDefCon talk, see you anon

packs

12:32

Similarly, I am off to see to the child so I can get to work.

Enjoy your day of hipsters or whatever these kids are nowdays.

Iszi

13:26

@Feeds Some interesting points there. We've had some similar issues/discussion over at RPG. I'm not sure we've had a lot of truly "trivial" stuff here, though.

epeleg

13:37

iszi? your here >?

Iszi

@epeleg For the moment.

epeleg

hi, thanks for your note over at my Q.

Iszi

No problem.

epeleg

maybe I am a bit thick today,

but I seem to be missing something

without password the communications is cleartext - right ?

Iszi

Yes.

epeleg

13:39

and with a password ?

does it encript the same for all the users ?

Iszi

@epeleg Generally, yes.

epeleg

so it should be more secure to use a password even if everyone know it - is it not so ?

maybe a bit background

someone else where I live decided to provide such a free network around his house

and I was under the impression that it would be better for him and the people using his free network if it had a password

even if the password was written on such a sign

but wanted to ask here so I won't be missleading him

Iszi

@epeleg In that specific case, I would somewhat disagree.

epeleg

o.k, can you explain why ?

Iszi

For all current Pre-Shared Key encryption methods used for WiFi, there are attacks available that allow a hacker with knowledge of the PSK to sniff all the traffic on the WiFi network.

epeleg

13:44

and when you say to sniff the traffic you mean to actually see it unencripted ?

Iszi

@epeleg Yes

So, the level of protection for that network is directly proportional to the level of effort put into keeping the password unknown to unintended users.

epeleg

hmmm.... and if everyone is welcome to the network? there is no way to secure the users from one another ?

Iszi

@epeleg For a hacker with the appropriate tools, there isn't much you can do if he has the PSK.

epeleg

o.k. I accept that BUT...

what if its a less skilled hacker? will there then be a difference in the chance of him sniffing a network that has a password (that he knows) then one that has no such password

Iszi

@epeleg Probably. But, if you're posting the password on a big sign out front, then you really have to consider the worst-case scenario because you'll never know who has the password or what level of expertise they have.

In the case of a home WiFi network, the signal probably (for most receivers) is only clearly audible for about a block or so. Therefore anyone who can see your network also will have easy access to find your PSK if you put a sign up front. My suggestion to better protect the network, is that you instead post a phone number or e-mail address by which the password can be requested. And, be selective in who you give it to.

epeleg

13:51

but the worst-case is then not different when you have no password or have a known-to-everyone password. and in the less worst case a less skilled hacker will find the known-to-everyone password protected network a bit harder to hack.

I see your point. a personal approach might push away a potential hacker. but again, since I can not validate who will be the caller and anyone asking for the password will get it. we end up still with the same worst case.

Iszi

@epeleg The PSK does indeed still offer a layer of security. But, in the case of a freely-accessible, publicly-available PSK the protection is no more than that offered by WEP, MAC Address Filtering, or SSID Hiding these days.

@epeleg Like I said, the network's signal will only stretch out for about a block before it becomes unusable to most systems. So, in the end, the only people that should be using the network will be your neighbors and their visitors - people you should know or people who can be validated by those you know.

epeleg

this is not the case here, its not a city, it a village that has guests visiting and we want them to have free internet access...

to summ it up. you are better of not letting a hacker into your network. but if you do, then it takes a better hacker to hack a known to everyone password protected network then the one needed to hack a password less network.

why does it say 969 below my name at the left and 5292 below yours ?

is it total reputation accress all stackexchange sites ?

Iszi

@epeleg In this case, the PSK that requires a personal contact is sort of like posting a "home security" sign in front of your house - it probably prevents more attacks than the alarm alone.

@epeleg Yes. Most of my rep is on RPG.SE, and IT Security is probably my second-highest.

epeleg

yes, maybe the sign should also say "all traffic is monitored :)"

RPG.SE ?

Iszi

@epeleg On a small wireless network like you're proposing, that's not a big threat to an attacker.

@epeleg rpg.stackexchange.com

epeleg

14:00

cool. didn't know they had RPG as well.

where are you from? (if I may ask)

Iszi

Florida

epeleg

I am from Israel. thanks for your help, If you want to post a summary to my Q I will accept it as the answer.

Iszi

@epeleg Probably 1k or so of my overall rep comes from just linking my accounts for the free 100 rep. I'm on 14 StackExchange sites, but probably only active in half of those.

packs

@Iszi Same here, I'm really only active in security and SF.

Iszi

@epeleg No problem. I'll try to get to it later. Right now, I've got to get out in the field for some wireless network scanning.

packs

14:03

I keep rpg up, but I haven't really gotten involved yet.

@Iszi Enjoy your time off :) Looks like I have another day of perl and sql ahead of me

epeleg

is there an overall SE account profile somewhere ?
and is there a way to invite someone to a chat ?

Iszi

@epeleg I haven't figured out the whole "invite to chat" bit. But, if you look at a user's profile on any SE site, there's an "accounts" tab that will show you their rep and badges across all sites they're members of.

packs

@epeleg On any of the SE sites, if you go to your user page, and click on the 'Accounts' tab, that will show all of your linked accounts.

Is that what you're asking?

Iszi

@packs Not sure I'd call it time off. A geek's feet weren't made to go for this many miles.

packs

Bah! It's good for you.

Since we moved down to the first floor, the only exercise I really get is the .7 mile hike up hill to the other IT building for meetings.

Iszi

14:08

@packs Isn't that what teleconferencing is for?

packs

I'm not a big fan of teleconferencing when a face-to-face is actually possible.

Hell, I don't much care for telephones!

epeleg

I cant seem to find the "accounts" tab you are talkign about.

packs

Example

security.stackexchange.com/users/618/packs?tab=accounts

Iszi

@packs On the flip-side, I'm not a big fan of going to other buildings for meetings. One of my former employers had a great system set up, where all the conference rooms had phone numbers posted in Outook and most every meeting had someone serving up the slides on NetMeeting.

packs

@Iszi We do that too with Adobe Connect.

I find that if I'm going to be a passive participant, I'll watch a meeting from my desk. If I actually want to be involved, I would rather go to wherever it is.

Iszi

14:12

@packs I suppose I'm more often the passive participant than not, for meetings that aren't in my building - hence my stance regarding them.

epeleg

@packs - thanks for the link. its just that on the chat profile you don't get those.

Iszi

@epeleg Yeah, you need to use the "user profile on *.stackexchange.com" link.

epeleg

well, of to install a linux or something....

Iszi

Yeah, I really need to get out too. l8rz.

packs

@epeleg Oh, chat profile is a little different than main site profiles.

Enjoy

epeleg

14:14

@packs just to see how it looks when I replay to a message instead of typing a new one....

thanks again both of you.

Rory Alsop

14:30

@packs - morning UTC-5 :-)

packs

@RoryAlsop Good Afternoon!

Hey @RoryAlsop!

Do you think a question about performance profiling a security tool (in this case snort) would be appropriate?

Iszi

Well, I was going to get out, but then I got reminded of breakfast. Hi @RoryAlsop

Rory Alsop

hi @Iszi

@packs - I think it can be appropriate if it is around how you would profile it, as opposed to which tool we think is best (which would be very subjective)

packs

@Iszi You're like my wife ;) She waits until she gets to work to eat breakfast as well.

Rory Alsop

LOL

packs

14:41

@RoryAlsop I'm thinking that you're making a distinction that I'm not quite catching at the moment?

Iszi

@packs How about you pose the question title here?

And perhaps a few clarifying details.

Rory Alsop

@packs - I missed off my second line, sorry; edited now

packs

@RoryAlsop Yeah, that makes more sense to me, and fits pretty well.

Iszi

@RoryAlsop Must be nice to be a diamond mod so you can edit your own chat messages regardless of age.

packs

Since I'm already using a tool, and am monitoring it, but just don't have clear information about what output fields are actually useful and sometimes what they actually mean :)

@Iszi Tell me about it...

Rory Alsop

14:55

@Iszi - how long do you usually get (didn't know I was getting special treatment :-)

@packs - pop the q up and let's have a butchers.

Iszi

@RoryAlsop 5 minutes, maybe?

packs

It's just a couple of minutes, maybe 5

Sometimes it doesn't even feel that long.

Iszi

Probably the same for comments, which is 5.

Rory Alsop

@packs - ok. I'll have to see how far back I can do it :-) Intrigued now

Iszi

@packs Agreed.

@RoryAlsop For you, probably infinity.

packs

14:56

I'm sure it's well defined in some random blog post from 234 days ago on blog.so :)

Rory Alsop

yup - looks like it

packs

17:17

wtf Nature, seriously.

We got almost 1.5 inches of rain yesterday. And now it's snowing.

packs

19:58

Hey, @RoryAlsop. If you're around could you look at: security.stackexchange.com/questions/2248/it-asset-management

Iszi

20:42

@packs He's also got a question about AUPs. The AUP question is definitely closer to being IT Security-Specific than a hardware inventory, and I agree that the latter should be moved.

packs

Yup. The AUP could, in theory, go either way. I don't really see it needing to be moved, though.

But yeah, the asset management system deserves to be on that side of the fence.

Too bad vote-to-close appears to be busted

Incidentally, I also mod-flagged the question before pinging Rory over here. I was just hoping to get some attention a big quicker :)

Iszi

@packs Worked for me.

packs

the vote-to-close?

Did you get any migration options?

Iszi

@packs Aye

packs

Hm. I only got meta

Iszi

20:54

@packs Oh, that. Yeah, you can't request migration to any of the other sites like you can on the trilogy.

Just vote as off-topic and let the mod flags/comments handle the migration suggestions.

packs

boo

So, @Iszi, are you done warwalking yet?

Iszi

22:37

@packs End of this week is the cutoff. I won't get quite as much done as I'd like, but there's only so much I can do under certain constraints.

Rory Alsop

22:52

hi @Iszi and @packs

sorry - was off drinking and playing on guitar.se

I see @AviD got to your asset management issue before I got back

packs

@RoryAlsop!

At least somebody did

Rory Alsop

:-)

and followed a link to www.eeemo.net

amused me

packs

Oh dear...does emo mean the same thing over there that it does here?

Rory Alsop

it does, but this page isn't emo

it's zalgo :-)

knowyourmeme.com/memes/zalgo

packs

For an old man you sure know your memes

Also, figuring out IRS forms is unfun

Rory Alsop

23:00

See me, I'm right memed up (used to hang out on B3ta.com a lot)

And I totally agree - luckily our accountant is sorting most of that...hopefully

it suddenly gets confusing when you start your own company - my old firm did it all for me for the last 10 years

packs

We ended up screwing up our 2009 returns (off by 1 error). We refiled and paid the due amount, but we apparently also have to pay interest on it as well.

Rory Alsop

aye - US IRS are as evil as our own HMRC then

packs

Both the wife and I received a bill, everything is the same (right down to the code and SSN) except one is in my name, and one in hers.

Rory Alsop

although our lot try to levy fines as well, for not understanding their complicated forms

packs

So I'm trying to figure out if we each have to pay, or if one is just an extraneous bill.

There is a toll free number, though I can't imagine that would be a quick call.

Rory Alsop

23:04

[cynic] whichever you choose will be wrong [/cynic]

Iszi

@packs Yeah, I'm sure they don't recognize the authority of shibboleet

packs

@Iszi They do, but instead of 'shibboleet' you have to say the ASCII representation of a specially designed pivot table.

@RoryAlsop Tell me about it.

Woo dinner.

Rory Alsop

@packs real LOL

Iszi

How do I bookmark/link a chunk of chat?

@RoryAlsop It's kind of sad when "real" has to be specified. Should we just make a new term, RLOL?

Rory Alsop

23:23

@Iszi or maybe BLOL - belly laugh out loud, as opposed to a normal officeLOL which is usally more of a snort

to link a chunk of chat, go to the drop down arrow to the left of it, and click on permalink

packs

23:44

I rather like the sound of BLOL. It sounds an awfully lot like the ^warrior^ sound that Malcolm Reynolds makes when Inara surprises him mid gun-cleaning.

Do we want this over here?

0

Q: UNIX-Security Advise

Hello, I want to build a quite secure UNIX-Server. Mechanisms I already implemented: SNORT + fwsnort for banning psad to block network-scanning attempts Portknocking to start+open SSH (key-based login - no password) hourly update of IP-Tables-Rules from a Security-Subscription Fail2Ban ClamAV &...

Transcript for