I don't like the way they operate, without consideration for the consequences of their actions. Whilst they have done some good stuff, a lot of the things they released SHOULD stay secret for a reason.
most of the uber-secret stuff never gets released at all, unless it's directly related to privacy concerns or other human rights issues.
the whole TrapWire thing is sick though. government installing facial recognition cameras all over the country to monitor the movements of citizens, and in some cases listening in on conversations.
but facial recognition matching to known activists and "potential trouble makers" (i.e. anyone they like) and tracking of citizens' movements is disgusting and moral-less.
@RoryAlsop I didn't see it as quite the same - hence my asking if you wanted it. The one I asked about seemed to me to be a case of How can I find out how it was done, rather that what should I do to fix it now it's happened
@DigitalFire I'm sorry, I don't see how that is on-topic for this site. It seems you've posted it to Meta because it is a "discussion" topic that wouldn't fit on an SE main site. However, Meta is supposed to be for discussions about the main site - which that is not.
@DigitalFire I agree with @Iszi on this one. Completely off topic. I also removed the first paragraph, as it didn't really have any bearing on the question.
@DigitalFire - @Iszi and @Polynomial are spot on here. Unfortunately I don't think we have a site for that kind of question. Even if the Ethics proposal comes about it will be too much of a discussion. We don't do questions asking for an opinion.
@DigitalFire Additionally, I'd recommend not advertising to the Internet that you've been part of potentially illegal activity regardless of how Anonymous (pun intended) you think you are.
@Polynomial Thank our room owner, @ScottPack
@Polynomial I don't get this one. I can't really recall it having been used much on Sec.SE. Care to add some case examples?
Meme: Mafia
Originator: @Rook (probably)
Cultural Height: Mid-2012
Background: The term "mafia" is frequently used to refer to "organised bad guys". A side-effect of its use is that it makes you look like a crazy person. Most people generally assume that users of this meme wear a tinfoil hat, ...
@Iszi It's mainly the Rook comment that I linked, and some of Andrew Smith's markov-chain-style ramblings which I didn't want to quote (he's a douche, he deserves zero credit!)
@Polynomial To be a meme, it presumably has to be fairly widespread and/or in recognizable common use within a community. I fail to see that with this one, in the Sec.SE community.
On the meme topic, I dunno if I've mentioned but I plan on doing the write-up for S&M... from home. I'm having a hard time tracking down the origin though, 'cause chat search hates simple terms.
how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have about 15 workstations that consists of Sales Dept, Accounting Dept, and Shipping Department.
i ...
@RoryAlsop Perhaps. I recognize Andrew's gravatar, but I don't have any associations with him. The bird, however, always struck me as more douchey than paranoid.
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing connections enabled, and all incoming connections will come from local SSL frontend using self-made CA a...
Would you guys consider "voodoo" as a meme? i.e. security voodoo / crypto voodoo, where something is done without really knowing what it achieves in terms of security, but it feels like "you've done something, so it should be ok... right?"
Great quote I saw in an article today: "Simply put it is possible to have convenience if you want to tolerate insecurity, but if you want security you must be prepared for inconvenience." General Benjamin W. Chidlaw - December 12, 1954
In the site FAQ, it is written:
Black Hat vs White Hat - This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a v...
Once this is done we can go to the Computer Security Hacking! and see if there are any questions there that would be ok for Stack Exchange but not for Sec.SE
Meme: S&M
Originator: Unknown
Cultural Height: Unknown - nearly as old as Sec.SE itself.
Background: Prior to being renamed to "Not Constructive", the close option that described questions that would "likely solicit debate, arguments, polling, or extended discussion" was called "S...
@RoryAlsop When I wrote my latest meta question I expected to be lobbying for allowing more black hat content, and then I realized that 1. the FAQ doesn't actually really prohibit black hat content, only the kind that would be NaRQ anyway, and 2. the constant stance on Meta.Sec.SE is that we don't discriminate against black hat stuff
I have, however, seen many comments on questions like “voting to close for black hat content”
@Gilles Black-hat content which is of sufficient quality to be shared and discussed on a serious site like sec.SE is actually not called "black-hat content", it is called "advanced research in security".
What makes the hat black is not the stuff that is discussed, but the intent of the hat wearer and, to a large extent, they way it is discussed.
@ThomasPornin I agree... Which is why I don't want to see comments/downvotes/votes-to-close for questions that happen to discuss how to write an exploit
@RoryAlsop (and other mods) what do you think about meta.security.stackexchange.com/a/893/5501 and specifically about "official guidelines allowing moderators to delete bad answers regardless of their score."
I went and looked for comments complaining about the black hat nature of a post that do not correspond to the dominant sentiment on meta, which is that good questions about attacks/exploits are fine
This seems to be too much on the black hat side, and as such is out of scope for this site. Feel free to bring the question inline with the faq and we can re-open. We are looking at ways to make questions like this more appropriate - this is not a 'black hat hackers site' - as per the faq it is for security professionals in an enterprise environment (with some leeway around that, I guess) — Rory AlsopJun 11 '11 at 0:04
From the faq: Black Hat vs White Hat -This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a virus, it may be moderated. Show us where the value is to a security professional, ie white hat rather than black hat. Yes, it would be different to provide info on securing a captive portal- much more value. — Rory AlsopJun 11 '11 at 14:51
@RoryAlsop The question FAQ-compliant since revision 1. It's vague but not terrible. And “for the threats you list, what mitigation scenarios are effective” looks pointless and out of place
welcome to IT Security! "How to exploit" smells like a black-hat question, which is not in scope for IT Security. (If you were asking whether it is OK to use this code, that would be in scope, but I think we don't need to know how to exploit it to know the answer to that question.) — D.W.Aug 2 '11 at 20:13
This strikes me as a blackhat kind of question. I expect that these sites can be used to facilitate some kinds of attacks on websites, and to conceal your identity when attacking a website. But what is the positive purpose for this? If this is a blackhat question, it does not belong here. — D.W.Aug 11 '11 at 19:57
“If this is a blackhat question, it does not belong here.” is plain wrong. The question is bad but for other reasons
Hi @filip I'm afraid this isn't the place to come for exploit code. We can give answers on protection strategy and explanation of technique, but we avoid the black hat end of things. A quick google will get you lots of exploits anyway. — Rory AlsopOct 2 '11 at 16:15
“we avoid the black hat end of things” → again, not really. But the question is NaRQ material
What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...?
I have been using Backtrack and tor network with proxychains to do this, but tor has limits and I would like to know what other tools are there to do this. I want to run my to...
@Ali - I'm having trouble seeing what possible use-case or scenario in which one would legitimately have this requirement. As others have mentioned, this seems to the result of unethical (black hat) activities. These are not welcome on our site. — AviDMar 15 at 20:10
@ScottPack @Iszi @AviD There is no basis in any meta discussion to close this question
@Gilles The question has no use for a white-hat. That's really all there is to it. @AviD's comment says just as much. Anonymization in this context is only useful to conceal the identity and/or origin of an attack. One who is performing an authorized penetration test has no such need. As for chessbird answering the question: He's well-known in this community for being more black-hat oriented than the majority.
Meme: Mafia
Originator: @Rook (probably)
Cultural Height: Mid-2012
Background: The term "mafia" is frequently used to refer to "organised bad guys". A side-effect of its use is that it makes you look like a crazy person. Most people generally assume that users of this meme wear a tinfoil hat, ...
how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have about 15 workstations that consists of Sales Dept, Accounting Dept, and Shipping Department.
i ...
In the site FAQ, it is written:
Black Hat vs White Hat - This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a v...
Meme: S&M
Originator: Unknown
Cultural Height: Unknown - nearly as old as Sec.SE itself.
Background: Prior to being renamed to "Not Constructive", the close option that described questions that would "likely solicit debate, arguments, polling, or extended discussion" was called "S...
