The DMZ

nobody

12:05 PM

@FireQuacker I do. I think security by obscurity does have the benefit of driving off low skill and low motivation attackers. However, you should never ever tell that to anyone except a fellow security guy. Otherwise people invariably decide that relying on security by obscurity

However, I don't think it will be particularly useful in this case since I guess the software will get posted online by other people anyways

MechMK1

@nobody The thing is, a lot of stuff that is claimed to be "security by obscurity" really isn't.

nobody

@FireQuacker Hmmm... I had my school's network admin password, but I never thought of accessing the security cameras.

MechMK1

For example, saying "You should not disclose your web server's version and OS version in the server header" - that's not security by obscurity

"Security by Obscurity" happens when you refuse to have anyone look at and assess the security of your "thing" (algorithm, etc...), saying that that act alone will make it insecure.

nobody

@MechMK1 That's just obscurity

MechMK1

Yeah, and it's not a bad thing to limit the amount of information you disclose

nobody

12:12 PM

@MechMK1 Well, the problem is, if the vendor themselves won't do anything about security, a layer of obscurity at least reduces the amount of stuff I have to deal with

@nobody *Otherwise people invariably decide that relying on security by obscurity is good

MechMK1

Oh shit, then you have a problem

nobody

@MechMK1 Everybody does. Computers are a problem :)

MechMK1

Computer problems are the best problems to have though

Because they're logical

Even the weirdest, most obscure problems have a logical reason for them occurring

Whereas people problems...I don't understand people

I really don't

A. Hersean

"Security by obscurity" should not be confused with "need to know".

MechMK1

"Relying on the secrecy of the key is security by obscurity. If the key is disclosed, your algorithm is insecure."

A. Hersean

12:25 PM

Anyway, for the problem at hand, the solution is a PKI.

With key embedded in HSM or secure elements (SIM cards) in the cameras' hardware.

The "secure" hardware should handle authentication of the software (or user) and allow the modification of the firmware.

You could do the same without secure hardware, but that means doing everything in firmware and that's easier to hack, but could be enough depending on the threat model.

nobody

1:07 PM

@MechMK1 So far, I have just avoided people. I don't know how long I will be able to do that

MechMK1

@nobody I've attempted to understand them, but failed

A. Hersean

Nobody understands perfectly other people. Most do not even understand themselves. Neuropsychologists (and others) are just beginning to explore their field.

And I meant nobody, not @nobody. No pun there, sorry.

nobody

People are random. Interestingly, they are not cryptographically random, yet we fail to understand them

MechMK1

I don't get it at all

There was a girl I've been talking to for two weeks

A. Hersean

The distribution is not uniform, but still unpredictable.

MechMK1

1:12 PM

Then, out of nowhere, she stopped talking to me

No idea why

A. Hersean

Maybe she's dead?

MechMK1

I probably said something wrong, but I don't know what

Doubt it

nobody

@MechMK1 Send us all your chat transcipts, maybe we can help :)

MechMK1

I'd rather not - not because there would be anything objectionable in there, but because I believe private conversations should remain private

A. Hersean

It might not be you. Her agenda might have changed. Or the boyfriend she did not talk about got very jealous. Or any other random stuff that happens in real life.

nobody

1:14 PM

@MechMK1 You thought I was serious?

MechMK1

@nobody No, but I like to respond to obviously joking queries as if they were serious

@A.Hersean Yeah, who knows?

Though I would find it weird if he got jealous over topic like "What's your favourite fish for sushi?"

nobody

@MechMK1 Just keep trying, there has to be someone who falls for you. And remember not to try to understand people.

MechMK1

@nobody :D

nobody

:sigh: You take my jokes seriously, and now you think I'm joking...

A. Hersean

@MechMK1 You never met one of my ex-GFs.

MechMK1

1:22 PM

@nobody I know myself well enough to know that won't happen

@A.Hersean What happened?

A. Hersean

@MechMK1 She was pathologically jealous (among other related behaviors). For example, she stopped talking to her only brother (except to insult him, even in public or in front of her family) because he waited a few weeks to tell her about his new girlfriend. And she was not dating him, he was her brother. I let you imagine how jealous she was about me. Every woman I talked to (or could talk to) was a threat (and worthy of being insulted if she was kinda pretty).

So "What's your favourite fish for sushi?" would be 7 words too long for her.

MechMK1

@A.Hersean Literally same.

My ex was literally the same

I get a call from a female co-worker. Her question was "Hey, could you do me a favour and join a meeting this afternoon? I might need you for an estimate"

Me: "Sure, just send me the outlook appointment"

My ex almost freaked out, asked me why I was "speaking to a woman"

A. Hersean

1:44 PM

Her jealous behavior stemmed from her extremely deep lack of self-confidence combined with an extreme pride: Her pride did not allow her to show weaknesses, so she lacked self-confidence and self-esteem. Which in turn needed to be compensated with an exaggerated pride. Since she could not trust herself, she could not trust others. So she was jealous because she could not trust someone else, and because she could not afford be in a failed relationship.

MechMK1

Yeah, I know exactly what you mean

nobody

2:55 PM

enderland, Valhalla

7.7k 3 11 14

This user has only one question and nothing else yet he has moar rep than me

MechMK1

A good reason why I believe that questions should give a maximum reputation, like 2000

Since you can gain 200 rep per day at max (or per question/answer?)

I think it makes sense that one answer or question should award 2000 rep max (excluding bounties)

Fire Quacker

SE greatly rewards people who asked a popular question many years ago

MechMK1

Simply put: One interesting question or simple answer to a common problem should not yield magnitudes more reputation than a large amount of well-researched, but more specialized questions/answers.

Fire Quacker

I know this problem has been discussed on MSO or MSE somewhere, but I can't remember where

nobody

@MechMK1 It shouldn't, yet SO optimized the HNQ to do just that

Fire Quacker

3:03 PM

I'm not bothered so much by this particular user because was highly active on other sites, so I don't think the privileges will be misused

I assume the HNQ was put in place to get more traffic to other sites, but it brought many other problems as well over the years

Man, just when we start talking about SE, JourneymanGeek leaves the room...

nobody

Do you think that upvotes from high-rep users on a site should hold more weight than random drive-by users?

Fire Quacker

I'm pretty sure that idea has been floated before. I assume there was some reason it wouldn't work out well

Actually, the biggest problem with weighing votes is probably the mechanics of it. The reputation count calculations are difficult already. Add in weights and it becomes trickier.

Not to mention that votes are supposed to be private.

A. Hersean

That would cause elitism, where a few long time users would have more influence than other experts.

Fire Quacker

"I just got one upvote but suddenly I have 10,000 rep???" "Oh, Jon Skeet must have upvoted you"

A. Hersean

I think a cap as suggested by MechMK1 would be best. What's the practical difference between a 200 votes question and a 800 votes (with the security.SE scale)? Both are great, one just have more views.

Or an increase in reputation gain proportional to the logarithm (or sqrt) of the Q/A.

nobody

3:14 PM

Yeah, per post caps seem nice

A. Hersean

Diminishing returns on reputation, per post.

nobody

But the first thing to do should be to fix the damned HNQ algorithm. There are just so many obvious flaws in it.

A. Hersean

The crypto.SE hates it. It only brings stupid answers by know-it-alls.

Fire Quacker

126

Q: Revisiting the rep cap (yes, again)

TL;DR: The rep cap system isn't as effective or fair as it might be. I'm proposing one alternative for comment, and would welcome other suggestions too. Disclaimers I'm pretty sure the rep cap hits me harder than anyone else (pretty often over 1000 points in a day), so a change could easily be se...

discussion daily-reputation-limit

28

Q: Are reputation points working as intended?

UPDATE: This is an extremely rare situation AFAICT so please ignore I hate that I look at my rep but that said I'm wondering if points are working as intended. I ask because I saw at least a few questions and answers with +5000 upvotes. That means for one question or answer that person is ev...

discussion reputation

6

Q: Advantage to Old Users

Isn't there an advantage for old users who started using SO much earlier? There are many basic questions that have been asked and answered in an early time when SO was launched. These questions are accessed and seen even today thousands of times per day. So such users get a higher reputation tha...

discussion feature-request reputation

djsmiley2kStaysInside

3:36 PM

@FireQuacker I could summon him.,...

@A.Hersean They could opt out?>

nobody

4:44 PM

If I have half written an answer, take a break, and come back to find another answer that includes most of the points I want to make, should I continue writing it?

Fire Quacker

5:18 PM

Up to you. If it doesn't cover everything you were going to say, maybe the other part you were going to say makes it worth it.

I think I've been upvoted for casually mentioning something as an aside when I was trying to talk about something else, but somebody thought the aside was interesting

Fire Quacker

8:07 PM

> I submit to the discussion that cost outweighing benefit might be a good business model in economics but not necessarily a good model, or in this case, the foundation for doing the right thing in cyber security practice.

Umm... what? Cost-benefit analysis shouldn't be done for security?

That's the end of my discussion with the guy who thinks firmware and utilities should not be easy to download

Basically, his argument is, if it can increase security in one area, it should be considered an industry best practice, whether or not it decreases security elsewhere

I think I'm done with the discussion

nobody

9:47 PM

@FireQuacker Ask him to set an example by applying that to his personal security practices

Fire Quacker

10:47 PM

I wonder if "cost benefit analysis is evil because it's capitalism" is a thing...

progressivereform.org/our-work/regulatory-policy/…

Transcript for