The DMZ

Scott Pack

17:00

Care to give me a sanity check on my answer? meta.serverfault.com/q/3537/3356

Jeff Ferland

@ScottPack +1

Lucas Kauffman

evening gentlemen

Scott Pack

17:18

Good afternoon fellow male landowners.

Jeff Ferland

@ScottPack Well that should make counting the new moderator's votes easier

Scott Pack

@JeffFerland I'm a traditionalist.

Lucas Kauffman

@ScottPack well u've got my vote

Scott Pack

That was pretty much a brain dump, so I'm glad to hear that it makes sense.

It's been my experience that the SF community, as a whole, thinks our overlap is significantly larger than we think it is.

I think it falls into the classic problem of that pesky 'T' up there in the site name. IT people tend to think of us strictly in terms of IT Security without realizing how much of our field is outside of IT.

Lucas Kauffman

@ScottPack I've never minded the overlap between SF and Sec that much

Scott Pack

17:24

J

Lucas Kauffman

ffs

stupid edit doesn't allow me to edit -_-

tbh the overlap between Sec and SF doesn't disturb as much as the overlap with superuser

Scott Pack

The Sec.SE/SU overlap or the SF/SU one?

Lucas Kauffman

SF/SU

Scott Pack

17:40

Yeah, that's sometimes a pretty arbitrary line right there.

Polynomial

yeah, I just kinda figured that SF is for explicit server software (e.g. Apache) and server gear (e.g. rackmounts, HP-UX, AIX, etc) only.

whereas SU is for anything non-servery.

Rory Alsop

@ScottPack wonder if we can at some point ask for it to be removed :-)

that would make existing t-shirts extra special and rare or something :-)

Scott Pack

@Polynomial SF is, really, for Professional IT (non developer), which makes it way more than server stuff.

Part of the problem is that when it was first set up the coders who created it didn't really understand that there exist professional IT outside of sysadmins, and the only real existing communities were sysadmins.

Desktop Support people have always implicitly, according to the FAW, in scope over there, but it took a lot of nail pulling and backbiting to get them explicitly included.

I don't want to point fingers, but there were vocal people who wanted SF for sysadmins and for sysadmins only.

Polynomial

that does kinda make sense, though.

since SU would work for most other stuff.

forgive my ignorance if I've missed an important factor, though. I don't follow SF/SU much and I don't know much about sysadmins or desktop support specialists.

Scott Pack

17:55

There's a lot of professional IT that's outside of both sysadmins and home use.

Networking is biggest one. Strictly speaking storage, though that's generally held within the sysadmins groups. Desktop Management is pretty big, and I wouldn't expect any home user to really know how to centrally manage 5000 end-user workstations.

Iszi

18:20

@LucasKauffman Y'know, I wonder what we'd have in place of "Overflow" if SOFU was STFU?

@TerryChia Wow. I just noticed I'm currently the top-rep candidate for moderator as well. I'm surprised we don't have any candidates from the five-digit club.

'Course if rep and meta activity were the only measures of mod-worthiness, we wouldn't need elections.

@RoryAlsop @AviD I'm guessing we should plan on being available for a town hall thingy some time next week?

Scott Pack

18:35

That could be interesting. so far we have candidates from the EDT, UTC, and whatever Singapore is.

Iszi

Singapore Standard Time

Singapore Standard Time (abbreviation: SST; ) or Singapore Time (abbreviation: SIN; ) based in Singapore uses a time zone eight hours in advance of UTC (UTC+08:00). History Time in Singapore {|class="wikitable" | Period in use | Time offset from GMT | Name of Time (unofficial) |- | 1 June 1905 - 31 December 1932 | UTC+07:00:00 | Standard Zone Time |- | 1 January 1933 - 31 August 1941 | UTC+07:20:00 | Daylight Standard Time |- | 1 September 1941 - 15 February 1942 | UTC+07:30:00 | Daylight Standard Time |- | 16 February 1942 - 12 September 1945 | UTC+09:00:00 | Tokyo Standard Time |- | ...

Rory Alsop

@Iszi SIN

heh

Scott Pack

Stupid 30 minute timezones

Iszi

@RoryAlsop Indeed.

@ScottPack I think we could really use some coverage in U.S. Eastern.

Scott Pack

I agree. We've got Europe covered pretty well.

Iszi

18:43

(Specifically calling it "U.S. Eastern" to remove any time-of-year restriction.)

Scott Pack

Ideally, and based on our European mods, somebody in Mountain or Pacific might actually be ideal.

Iszi

@ScottPack Don't forget we have one Israeli - though he's only +3.

Scott Pack

I was including him.

Iszi

Come to think, Singapore wouldn't be bad in terms of added coverage. It's the farthest offset from the current team.

Scott Pack

It and Pacific would be equidistant from our current folks.

Iszi

18:48

Y'know, whomever does get elected (from the current pool) will have a lot of work ahead of them - unless they want to stay the only moderator with a 4-digit reputation.

Interesting note: It seems the chat room, and your chat profile, are the only places that display any expression of your aggregate rep across the network.

I don't see it in the Network Profile.

Scott Pack

Me neither

Cute

nealmcb

@RoryAlsop Thanks for making the contest happen! Here's a question on the contest.

15

Q: Official Security Stack Exchange Anniversary Competition

As Security Stack Exchange has just passed its 1st anniversary of graduation, we are going to follow in the tradition of other sites and run a competition. With prizes! Cool ones! Obviously in order to deserve these prizes you'll need to put in some effort, but I know you will rise to the chall...

"One level 2 prize will be awarded each week to an individual whose posting in one of the weekly topic tags (see the answer below for the topic tags) passes the following thresholds: "

Should I assume you mean "total of posting in any of the tags"? Or do you really have to do it all in one tag?

And do questions qualify also, or just posts that are answers?

Rory Alsop

@nealmcb any of the tags for this week

questions and answers are posts

nealmcb

(btw I already edited it to change "post" to "posting"

OK, I'll try to clarify that

(being bold as usual :)

Iszi

19:05

@RoryAlsop @AviD Have you guys taken a look at this one?

1

Q: How to check whether it's sql injection?

I think there is SQL injection in parameter of search form. All exceptions are shown in format: PHP raised unknown error: pg_query() [http://php.net/function.pg-query]: Query failed: ERROR: syntax error in tsquery: "query" (more details about error - in log file) Here are outputs of some value...

web-application attacks databases sql-injection

While there's probably some educational value to the question, its intended purpose is very suspect.

Really testing the line on Black Hat vs. White Hat here, methinks.

nealmcb

@RoryAlsop How does my edit and comment look?

I'll have to take off in a few minutes. Nice to see you all...

@Iszi I say close it as too localized

or as black hat

Rory Alsop

@nealmcb that works, and in answer to your comment - yes, that's how it works

Iszi

@nealmcb I'm not quite sure it's too localized. And it's very borderline on black hat - as in, I can actually think of a situation (see comment) where a white hat would encounter this issue.

nealmcb

Bye bye!

Iszi

@nealmcb Also, have you seen this yet?

10

Q: Clarify our stance on black hat questions

In the site FAQ, it is written: Black Hat vs White Hat - This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a v...

discussion acceptable-question acceptable-answer site-faq

nealmcb

19:14

@Iszi Could you clarify that circumstance? Seems highly unlikely to me. But gotta go.

Iszi

@nealmcb "Black box" pentest?

It just occurred to me, treatment of questions based on hat color may be a talking point in the town hall.

nealmcb

But who would run into this exact circumstance and expect to see an answer here?

Iszi

Are you saying it's too basic of a question for someone who would be in that situation?

Rory Alsop

19:30

The sql identification question is very relevant for teaching pen testers how to identify SQLi. I think it is on topic

except for the final paragraph.

Iszi

@RoryAlsop Refresh. FTFYIT.

Rory Alsop

If we exclude it, the question becomes - are any of these indicators of SQLi

Iszi

(Fixed That For You, I Think)

Polynomial

@Iszi I did wonder whether to question him, but black-box pentest is a legit reason.

Iszi

Funny. I just realized that it's not often I find myself arguing for a (potentially) black-hat question. I guess @Gilles is getting to me, or something.

Polynomial

19:32

maybe I should ask him, and see what he says the situation is. if he says black-box without being prompted, then we're ok.

Rory Alsop

I think asking for more code examples is beyond what we want to do, but giving an indication of what those specific cases could mean should be on-topic

Iszi

@Polynomial Sorry. A little late for that. (Included in a comment.)

Polynomial

D'oh!

Rory Alsop

to me it looks like the app is doing some sanity checking

Iszi

@RoryAlsop That's sanity checking, as opposed to actual sanitization, eh?

Rory Alsop

19:34

@Iszi a bit of the latter, probly :-)

but my version makes one think of great Cthulhu...IA IA IA

Scott Pack

I missed Neal. :(

Polynomial

tbh, I'm not comfortable with the question. he practically admitted it's blackhat.

plus it's dealing with the specifics of one implementation of some voodoo filtering / sanitizing system

so TL + NARQ apply.

well, more TL + offtopic

Scott Pack

I think the question, generally, fits under the acceptably colored hat notion that we've recently started striving towards. It is also, however, a poorly researched I CAN HAZ CODEZ style

Gilles

@RoryAlsop The thread of comments on this question illustrates why we need to fix the FAQ

2

All the meta discussions state this kind of question is fine, and we have sissies arguing that the question doesn't deserve to exist

Polynomial

The problems I have with it are:
1. Localized around a single implementation.
2. Shows very little research.
3. Whilst we accept blackhat topics within reason, explicit blackhat *activities* should never be allowed. They're illegal.

Gilles

19:41

@Polynomial I can't judge 1 and 2, SQL isn't my field

2 is a reason to downvote, not to close

Re 3, I don't see anything illegal in the question

Polynomial

@Gilles see his comments. when asked what he was doing, he said "blackhat is ok".

that to me is an admission that he does not have permission to pentest

Iszi

@Gilles He's referring to the potential that the OP is asking for help on an unauthorized hack.

Polynomial

and I disagree that 2 is a reason to only downvote. we close questions as NARQ all the time for having very little detail / showing no research.

in this case the question is unanswerable. we can't tell him what to do without looking at the specific implementation. so it's NARQ + TL + off topic

Gilles

@Iszi all questions have potential for illegal activities

Iszi

@Polynomial On this site, "general reference" (i.e.: showing no research) is not a close reason. It's a downvote reason.

Polynomial

19:44

@Gilles except in this case, he's admitted it's blackhat.

which means it's no longer a potential. it's a clear case

Gilles

how do you know that my question about using an encryption tool securely isn't going to protect communications between drug dealers?

@Iszi General reference is not at all the same thing as no prior research

Iszi

@Gilles Yes, but there's a difference between a question which might be useful to someone who wants to perform illegal activities with the knowledge, and one explicitly (or quite nearly implicitly) from someone who is currently or plans to do so.

Polynomial

@Gilles I don't, and since you've not given me any reasons to believe that you're intending to use it for illegal activities, I can give you an answer in good faith. If you explicitly say "I'm a drug dealer, and I'd like to encrypt my conversations so that the cops can't bust me", then we'd have closed it.

Scott Pack

As loathe as I am to agree with the French, I'm more in @Gilles' boat here. I think it deserves to be closed because it is a shit question, not because of the author's fashion sense.

Polynomial

then close it as TL.

as I said, take your pick.

Iszi

19:46

@Polynomial Strictly speaking, he hasn't admitted anything about the question being black hat. He's just said black hat is on topic - a general statement that (again, strictly speaking) should not be interpreted as having any bearing on the question's origins or intent.

Scott Pack

Being an asshole isn't on-topic either, but that doesn't mean Avi doesn't deserve to be heard.

Polynomial

@Iszi Sorry, but I'm not willing to accept that nobody can see the obvious intent and implications.

Gilles

@Iszi I don't see how you can deduce that Andrey is doing anything illegal

I see that he's attacking a black box. I have no idea whether he's authorized to do so

Polynomial

@Gilles When prompted for an explanation, he said "blackhat is on topic". That's a direct implication of an unauthorized pentest.

Gilles

@Polynomial no

Polynomial

19:48

Whilst it wasn't explicit, his intentions are pretty damn clear.

Gilles

He was replying to “ That seems more black hat than white hat”.

It is perfectly reasonable to reply to this remark by indicating that it is irrelevant.

Polynomial

Anyway, regardless of the hattedness, it's a poor question. Close as TL for dealing with a specific implementation, or NARQ for being unresearched and practically unanswerable.

Iszi

@Gilles Exactly my point. Though I agree it seems a bit shady.

One would more expect a white hat to give reason why it is untrue, as opposed to irrelevant.

Polynomial

@Gilles Ok, after reading back through it, I can see why you might infer that he was just making a reply.

However, I think it's a case of Occham's Razor. If you hear hooves, think horses, not zebras.

Gilles

@Polynomial The fact that his comment begins with @drjimbob is a pretty good hint that he's replying to drjimbob's only comment in the thread so far

Polynomial

19:51

that's not my point.

Iszi

Of course, if the question is really that simple, why hasn't anyone given it a simple answer?

Gilles

7 mins ago, by Polynomial

@Gilles except in this case, he's admitted it's blackhat.

Polynomial

@Gilles Yes, I admitted since then that I can see how that could be interpreted differently.

Gilles

which I take you mean in a way that should cause the question to be closed

Polynomial

My point is that his reply did not clarify his situation, despite being prompted. That response was either his clarification, or he is being evasive. Either way, it looks shady.

Gilles

19:53

I can see that the question is black hat in that it asks for help exploiting a vulnerability

But I see this as a perfectly normal kind of question on a site about security

Polynomial

But at the end of the day, it doesn't matter. It should be closed as TL because it does not provide any help to further users.

Iszi

@Polynomial I don't speak SQL, but I'm not sure how it doesn't? It appears to me as an example of the typical "I have a problem, this is what I've tried, what am I missing?" sort of question that shows up and is well accepted all over SOFU and other SE sites.

Polynomial

I disagree. Blackhat questions are fine when they're talking about generic cases, or asking about techniques in a theoretical fashion. But this is dealing with a real, practical attack, for which the motiviation is unknown and sketchy at best.

Gilles

@Polynomial So if he'd replied “I'm doing a black-box pentest”, the question would have been ok?

Polynomial

Yes, absolutely.

Gilles

19:55

@Polynomial That's ridiculous

Polynomial

well, it wouldn;t

Iszi

@Gilles Not entirely.

Polynomial

it would have been OK from the ethics PoV

but not from the fact that it's still TL and borderline NARQ

@Iszi It's asking about some voodoo filtering / sanitizing mechanism that someone has implemented on this one particular webapp, which is unlikely to ever benefit another user. It's not a generic question about SQL, it just happens to be related to SQL.

Scott Pack

Cool, so now I know that I can be as shady as I want so long as I preface with, "As part of a black box pentest...."

Polynomial

haha

Gilles

19:56

@ScottPack I'll try to remember this next time I ask a question here

Iszi

@Gilles Again, there's a difference between providing information that could be of use to someone with malicious intent, and actually assisting someone who's expressedly (granted, in this case, it's arguable) indicated that they do have malicious intent.

Scott Pack

The underlying problem is that it's a lot more difficult to figure out if the person is doing something potentially illegal or something wonky that's authorized than it is on other sites.

Gilles

We should add a paragraph to the FAQ: “If your question may look black hat, be sure to start it with ‘As part of a black box pentest’, so that it isn't looked down upon and perhaps closed.”

2

Polynomial

Your sarcasm, whilst amusing, isn't helpful to the discussion.

Gilles

@Polynomial I'm still waiting for you to explain how saying “I'm doing a black box pentest” somehow makes a bad question good

Iszi

19:59

@Gilles Consider this situation. You're a gun salesman in some backwoods place where background checks are optional. Or, lets say your customer even passes the required background checks. If the customer says, or gives strong indication, to you that he's actually going to use a gun he buys to kill someone in the near future, do you sell him the gun?

Polynomial

@Gilles You're being silly, now. I said it was OK from the ethical PoV, because they're telling me that they're not doing something illegal. If the question is bad, the question is bad.

Gilles

@Iszi wait, are we assuming that I'm for or against gun control?

Polynomial

ethics is completely separate to the quality of a question.

Gilles

I don't know what country you're from, so I don't know whether you think people with guns are all dangerous terrorists or people without guns are all dangerous terrorists

Iszi

@Gilles I'm from the Gunshine State, TYVM.

Scott Pack

20:01

@Polynomial Which is exactly the problem with trying to discuss intent with a low quality question. We already have a solution for this one, that doesn't have anything to do with intent.

Polynomial

@ScottPack That's exactly what I've been trying to advocate for the last 10 minutes.

Scott Pack

@Gilles As someone who grew up in an area where high schools permitted guns to be kept in cars, let me tell you that those two are not mutually exclusive.

Polynomial

Perhaps the solution is this: in cases where there's a complete grey area, and the ethics of the question is sketchy, we ask for clarification. From there, we leave it up to people as to whether they want to reply. That way, if I disagree with a question on moral grounds, I just don't answer it, and I can sleep sound.

In cases where explicit malintent is shown, the question should always be closed.

and by explicit malintent, it has to be 100% crystal clear, like "i am a hacker"'s questions.

Scott Pack

but...but....

2

Iszi

@ScottPack Whoo... spinny...

Ah, there's the "user image" link.

Polynomial

20:04

I think for now, a policy like that would serve us well. In the future, we may need to change it to react to events, but there's no point in trying to cover the unknowns.

Gilles

@Iszi Ok then. You've got to understand that I'm not from the US; where I live, guns require licenses and some kind of proof of good intent (I'm not sure exactly what), or at least that you're going to hunt authorized animals.

Scott Pack

@Gilles Here they generally require that you go to a flea market and pay cash.

Gilles

From my understanding of the US, you do sell him the gun, because he's entitled to it by the second amendment. Killing people is only illegal by state law, and the constitution trumps state law.

Scott Pack

@Gilles I wouldn't bring the 2nd Amendment into it were I you. Because of the difference in linguistic styles between modern US English and late 18th century Colonial English it is much too easy to debate meanings.

Iszi

@Gilles No, that's not the case at all. You do not sell him the gun because as a businessperson, you're free to reject service to anyone you please - and you, being one of good morals and ethics, cannot in good conscience knowingly facilitate a murder.

Actually, you can skip all that and go straight to the part where you're now technically an accomplice to the crime and therefore legally vulnerable.

@ScottPack Nice avoidance of XKCD, there.

Scott Pack

20:13

Thanks. In any case, I don't honestly care what dude's intent is of what your ethics do or do not say. A low quality question is low quality. Period. I've not had enough to drink to get into arguing hypotheticals.

Polynomial

I love that clip on Family Guy about that.

"Right, everyone has to right to bear arms." "D'you think that's clear enough?" "Sure. We can have bear arms on our walls."

Iszi

2

Polynomial

:D

Gilles

You may have arms, provided that every countable intersection of dense open sets is dense

You can have real arms or irrational arms but not entire arms

yeah, ok, it's difficult to pun on Baire spaces

Scott Pack

Ah, so those were puns. I was curious.

Iszi

20:21

I'm fine with yielding to the experts on the terms of whether or not this particular question has general value. However, I think the issue of the asker's intentions is really something that needs to be sorted out - not specifically for this question, but in terms of overall site policy.

Gilles

@ScottPack horribly bad and contrived ones

Scott Pack

@Iszi In what way do intentions need to be sorted out for site policy?

Do we need to add, "Don't be a dick." or "Don't ask for help doing illegal things."? The first one is already covered and the second might be as well.

Gilles

@Iszi we can't know posters' intentions. Hence we don't care about them.

@ScottPack the second is covered in the terms of service

Scott Pack

@Gilles I would assume so, though I haven't verified.

Gilles

> Subscriber is responsible for all of its activity in connection with the Services and accessing the Network. Any fraudulent, abusive, or otherwise illegal activity or any use of the Services or Content in violation of this Agreement may be grounds for termination of Subscriber’s right to Services or to access the Network.

> Use of the Network or Services to violate the security of any computer network, crack passwords or security encryption codes, transfer or store illegal material including that are deemed threatening or obscene, or engage in any kind of illegal activity is expressly prohibited

Iszi

20:25

@Gilles For the hypothetical example of where some fool actually comes out and says "I'm trying to hack x without authorization."

Gilles

> Under no circumstances will Subscriber use the Network or the Service to (a) send unsolicited e-mails, bulk mail, spam or other materials to users of the Network or any other individual, (b) harass, threaten, stalk or abuse any person or party, including other users of the Network,

Iszi

Off-topic (for chat, but going into Meta soon):

Gilles

@Iszi close as against the ToS

Iszi

Gilles

@Iszi sorry, I don't get it. Fight Club? This doesn't look like Fight Club

Scott Pack

20:26

@Iszi As Gilles was just kind enough to provide quotes for, that's already forbidden by way of the ToS

Iszi

@ScottPack We need that as an actual close reason then, me thinks.

Andrey Botalov

@Polynomial I have permission to make this check. I don't have permission to do full pentest but I think I have permission to check whether it can be exploited.

But in reality it doesn't really matter because in Internet where you don't really know the other man, you can't be sure in what he says. I think we shouldn't ask questions like "Do you have permission to pentest?" as it's very easy to answer "Yes, I have" even if OP doesn't have it. I think we should judge black-vs-white based on question itself.

Iszi

@Gilles You're probably right. It's what showed up in Meme Generator when I searched for it though.

Scott Pack

@AndreyBotalov Welcome to the last week. :)

Andrey Botalov

@ScottPack what?

Gilles

20:28

@AndreyBotalov Aren't you just stepping out of a time machine?

Iszi

@Gilles This more like it?

Digital Fire

Just catching up on the conversation thread. IMO, it SEEMS as though the question may be with "black-hat"ish intent but that should be irrelevant as the question can be answered without giving exploit code.

Just my 2 cents.

Scott Pack

@AndreyBotalov There's been a lot of bickering about whether judging hat colou?rs should be considered valid.

Gilles

@Iszi I can't confirm whether this is from the movie, but it does look right for the scene

Iszi

@DigitalFire Even then, the community seems to be in favor of allowing exploit code.

A Google Image search seems to validate the first picture though, and I like that one a bit better.

Gilles

20:31

@DigitalFire See meta.security.stackexchange.com/questions/897/… , the meta questions it cites, meta.security.stackexchange.com/questions/911/… , and the past few days of chat

Digital Fire

@Iszi I personally think it SHOULD be allowed. Although not to the particular exploit for the example given. More towards the line of general exploit code. Like telling someone to check a text input with ' or 1=1--

@Gilles I'm trying to catch up but its TL:DR as of right now.

Iszi

@DigitalFire Yup. That's been chat almost all week.

Digital Fire

I think this goes into the need of that "Other" site that is close to going into commitment. We should use that one for all the "darker" questions.

Gilles

@DigitalFire it's 10000 messages covering the spectrum from “don't discuss exploits” to “keep black hat out” to “ok if it isn't shady” to “ok if it isn't obviously illegal”

@DigitalFire we discussed that a few days ago, in fact that's what made the discussion flare up

A side dedicated to “shady” content seems silly

What would the audience be?

Exactly the same as Sec.SE!

Plus script kiddies to keep out.

Digital Fire

Again, I believe that I certain questions wouldn't be a good fit HERE. But would be a GREAT fit THERE.

Polynomial

20:37

That's the problem. In terms of content they'd be a great fit there, but in terms of legality and all of the other problems that come with the topic, they're not good for StackExchange as a brand.

Digital Fire

As for script kiddies, they have plenty of other sites they could goto to get their answers.

Gilles

@DigitalFire I have yet to see a single one

Polynomial

By the way, I'm speaking hypothetically. I've also yet to see a question that'd be a good fit there that wouldn't just be closed as NARQ anyway.

Gilles

@Polynomial I posted a couple of examples in chat, er, I think two days ago

Thank you for the detailed answer, and for sharing the link. I think I will do as you say and use both, but one thing I wonder is, is it unsafe to use your own captcha? recaptcha is of course well tested, but couldn't it be that since my captcha doesn't exist in the exact same form anywhere else, it will leave the spammers on square one? Or am I wrong? — DannyCruzeira 8 mins ago

roll your own captcha

Polynomial

?

heh

Gilles

20:40

(my last two messages are unrelated to the present discussion)

Polynomial

well rolling your own captcha has its benefits, but it doesn't stop spammers

Jeff Ferland

I wonder if captchas would work better as animations

Might run into less situations where a legitimate person can't figure it out either.

Digital Fire

Say I wanted to purpose a FULL (Physical Access included) pen-test example and wanted certain portions answered that aren't relevent to I.T. Is the question a good fit here?

Gilles

@JeffFerland I doubt it. Taking stills or blending images together is easier for computers than for humans.

Iszi

@DigitalFire I don't see the question. Clarify?

Gilles

20:42

@DigitalFire this has been debated a few times

Digital Fire

Its hypothetical.

Gilles

I say yes, the fact that this site is called “IT security” and not “Security” is a historical accident

But the majority of the community is against it

Iszi

@Gilles Not sure about "accident". The site, as I understand it, was originally geared toward application security.

Digital Fire

@Gilles So doesn't that show the need for a different type of site?

Iszi

@DigitalFire What sort of specific question might you ask?

Gilles

20:43

My stance is that anything that Schneier discusses on his blog is on-topic except squids

Scott Pack

The site known as sec.se started out as a combination of a boatload of Area51 proposals.

Gilles

@DigitalFire there's an Area 51 proposal about physical security

Scott Pack

Right about the same time we graduated there was a lot of chatter about removing the 'Technology" from the site name.

Polynomial

@DigitalFire Just because a topic exists and isn't covered by an existing SE site, it does not mean a new SE site should be made. There are limitations.

Scott Pack

It was generally determined that we are a site for Information Security that told the programmers too late.

Iszi

20:44

Regardless, this is still and always will be the Sec.SE-est site on the web!

Gilles

It's not a matter of hat color, it's a matter of whether your security is computer-related

Polynomial

as an extreme example, we wouldn't make Paedophile SE.

Digital Fire

@Gilles Yes!

Gilles

@DigitalFire If you ask a (good) question about physical security, I'll vote to reopen it

Polynomial

@Gilles But we do still have legal liabilities and site reputation to consider.

Gilles

20:46

(phrased this way because I expect it to be closed as off-topic, even though I disagree that it would be off-topic)

Scott Pack

@Gilles Same here. There's a lot of physical security that makes sense for an Information Security professional. /cc @DigitalFire

Digital Fire

@Gilles My qualms aren't about any particular question. Its about the need for the "Hacking!" site that is about to go into commitment.

Iszi

@ScottPack ...and there's probably quite a lot that doesn't. It really depends on the question.

Digital Fire

@ScottPack Exactly.

Gilles

@DigitalFire It's a duplicate of Sec.SE

Scott Pack

20:47

@Iszi That is a true statement.

Rory Alsop

@DigitalFire I say yes

Iszi

@DigitalFire Has that one even decided what it is yet?

Gilles

For a long time that proposal was poorly defined: it was about “hacking”, whichever of the many meanings of the word you prefer

Digital Fire

@Iszi I believe it was modified a few days ago.

Rory Alsop

@Gilles I don't know about that - we have quite few proponenets now

@DigitalFire I say yes

Polynomial

20:48

@ScottPack Physical security is completely on-topic here, as long as it pertains to security of computers. That includes alarm systems and surveillance, but only at a theoretical level. Troubleshooting and similar questions about vendor-specific software and hardware should remain off topic.

Gilles

A couple of days ago the proposal was clarified to mean “hacking” in the sense of cracking

Scott Pack

@Polynomial I would replace 'computers' with 'information assets' and otherwise be happy with your statement.

Polynomial

sure.

Rory Alsop

@Gilles and because pretty much all information is on computers - a lot becomes on topic for your average security team

Polynomial

as long as they're Information Technology assets (IT Sec) that's fine.

Rory Alsop

20:49

@ScottPack agreed

Scott Pack

I would remove the 'Technology' from your statement and be fine :)

Digital Fire

^ lol

Iszi

@Polynomial There's few physical security measures I can think of that couldn't be used to protect IT assets.

Scott Pack

Student Financial Aid applications, whether scanned into a computer or stored in a file cabinet, both require securing and are information assets.

Polynomial

exactly.

it's all on topic.

Rory Alsop

20:49

@Polynomial and @Scott - because pretty much all information is on computers - a lot becomes on topic for your average security team. So I'd say Information Assets

Digital Fire

@Iszi Yep. Locks, Gates, Animals, etc..

Rory Alsop

just in general - think we are saying the same thing really

Polynomial

UNLESS you're asking about vendor-specific solutions, then it's off-topic.

so "how do I get the UltraMaxCam 1230 HyperSurveillance Pro to record only during business hours?" is off-topic.

Iszi

It's like the FAW says, discussions about "protecting assets from threats and vulnerabilities" is on-topic.

Rory Alsop

@Polynomial I think we have had 1 or 2 exception s to that rule

Iszi

20:51

@RoryAlsop Any chance we could get SEI to have [faw] made to work like [faq]?

Scott Pack

@RoryAlsop Except, in the situation I outlined, they're not all on computers. It's the information I'm protecting, whether it's stored as a PDf or printed out in a desk draw.

Gilles

@Iszi in chat, perhaps. On the sites, no a whit.

Scott Pack

ln -s /usr/share/security/faq /usr/share/security/faw

Rory Alsop

@ScottPack lol

beer time - maybe back later.

Gilles

@ScottPack yuck. ln -s faq /usr/share/security/faw

Iszi

20:53

@RoryAlsop @Gilles I never noticed this before... are your usernames in the chat stream blue 'cause you're mods?

Scott Pack

@RoryAlsop Enjoy!

Gilles

@Iszi yes

Iszi

Dunno why I feel like I'm just now seeing this.

Gilles

There's a single chat site for all SE except SO and MSO

Digital Fire

They got that special Mojo ;]

Polynomial

20:53

@RoryAlsop The thing with per-site SE rules is that they're mainly guidelines anyway. If the question provides no moderation burden, fits in with StackExchange rules, and is interesting, is asked properly, and provides a quality resource for people, but it's a little bit off-topic, then it should still be accepted.

Gilles

we're mods on our respective sites' chat, but that's the broader chat.SE

Scott Pack

@Gilles Does your cwd not cause problems with finding faq?

Gilles

@ScottPack ???

Iszi

@ScottPack Don't you mean pwd?

Gilles

the first argument to ln -s is the text of the symlink

Scott Pack

20:54

Wouldn't your syntax only work if you were currently within the same directory as faq ?

Polynomial

Anyway, lords and (in the case of @Iszi) ladies, I shall bid you a fond goodnight.

Iszi

@Polynomial Starting to regret helping with the Meme topic already.

Gilles

@ScottPack No. It creates a symlink whose target is faq. The target is relative to the directory where the symlink is.

Scott Pack

/em sighs

I just realized what I did anyway.

Polynomial

I'll not be around tomorrow, I'm off to London with the gf for our 5 year anniversary :)

Iszi

20:55

Starting to feel like this guy...

Gilles

@Iszi probably not. pwd = print working directory. cwd = wd = (current) working directory

Iszi

Scott Pack

@Polynomial Good luck with the thing at the place with the thing!

Polynomial

Thank you ;)

Iszi

@Gilles Eh? I always thought the p was for "present".

Polynomial

20:56

I'll probably be active on Friday. Good morrow!

Gilles

@Iszi that came later

Scott Pack

@Iszi WRONG1!!ONE!

Polynomial

@Iszi Bazinga!

toodlepip .o/~

Gilles

man.cat-v.org/unix-6th/1/pwd

> Pwd prints the pathname of the working (current) directory.

Iszi

2

Scott Pack

20:59

Well played.

Gilles

Or, as Nobby Nobbs would say: I am a human being, I have the papers to prove it

Scott Pack

Time to go pick up ye olde kid.

Gentlemen. @Iszi.

Digital Fire

@ScottPack Don't those things come trained to come home on there own already? =D

Gilles

@DigitalFire maybe he means kid as in goat

Iszi

@RoryAlsop @AviD Shouldn't the election thread be flagged featured? Or would that be redundant since it already somehow is posted to the "Community Bulletin" section?

Gilles