« first day (3926 days earlier)      last day (1172 days later) » 

7:45 AM
@FireQuacker Accepted answers should be given a bonus, like 25% or 50% of their score, in the ordering. Because if we do not give an incentive or a reason to accept answers, the site should just stop accepting answers altogether. However, answers that are significantly better than the accepted one should be ordered before to reflect what the community thinks is the best (or more up to date) answer, despite what the OP though at the time (s)he accepted an answer.
@A.Hersean @FireQuacker I suspect its reasonably likely SU might opt out of that.
 
4 hours later…
11:38 AM
@JourneymanGeek Of making answers acceptable?
@MechMK1 of not pinning accepted answers
interesting idea. I'm curious to see how it'll plan out
Most sites will likely go with the default
12:12 PM
What's the rationale bethind SU specifically abandoning pinning accepted answers?
 
1 hour later…
1:13 PM
@MechMK1 outdated answers... someone asks in 2007 about how to store passwords, someone says salt+MD5, it's accepted, and stays on the top forever.
True, true
or less than optimal solutions, where OP is too clueless to evaluate the answer and marks the first answer as accepted
I honestly wish we could mark StackOverflow answers as security risk
Then again...this keeps me in business
haha... Flag as risk
Seriously, 90% of security questions on SO go like this:

Q: I want to do <thing> but <security measure> throws this error. Wat do?
A: This worked for me. <steps to disable security measure>
1:15 PM
I've seem this time and time again
Inevitably, you will see a comment from someone with security knowledge saying that this is insecure, followed by OP saying "Thanks, works perfectly now!"
it's because I am still to see good tutorials on anything that says "for increased security, we will have to do this and that BEFORE doing what you want to do"
most are "security are left as an exercise to the reader" or "this is insecure, don't put into production" but never tells why is insecure or how to secure things
and they expect someone that don't even know how to connect to a database be able to protect it against SQLi, against hard-coded credentials, how to connect over TLS, how to validate the certificate...
Security becomes widespread when it's the default, or when it's made to be a "pit of success"
Meaning that the secure way to do it is also the easiest way to do it.
@MechMK1 that will never ever happen...
so your job is guaranteed for life
Well, it happens slowl
Most frameworks have anti-CSRF tokens built in
You specifically have to disable them
So any app written with that framework will automatically be protected against CSRF
1:22 PM
@MechMK1 I worked on more than one soft house... I've lost count of how many "fix this latter" comments are on the code...
there are security embedded in, but when the release window is closing and one pesky upload form is not working properly, "Accept-Origin: *" is pushed and it's done...
Yes yes, true
But my point is: When a security measure is done without requiring the devs to do anything, it has a much better chance of succeeding
Which is why we see HSTS being deployed more and more widespread, and not CSP
the problem is that security blocks things from running... blocks too much, code does not work... blocks too little, bad things work
like the immune system... and it's faster to disable security than to fix the code
2:05 PM
I have the same in a pentest I am doing
Since monday, I've been trying to get my tools to run
 
1 hour later…
3:21 PM
service whatever up
*permission denied*

chmod -R 777 /var/lib/whatever
service whatever up
Ok
3:43 PM
It's such a simple solution...
4:09 PM
it works and it's fast... no need to strace the binary to see what it's trying to write, no 30+ google queries... one command and done
that's why "secure by default" isn't possible
Everything would be so much more secure if it weren't for people
That would make an interesting motivation for a robot-apocalypse story... Instead of "keep humans from starting a nuclear war and killing themselves", have robots that are passionate about security who start killing off all the programmers
5:12 PM
Shouldn't we ban all robot apocalypse stories? I'm afraid that robots may one day watch the Matrix, decide that the Matrix is a really cool concept, and set out to implement it.
because of those 2 lines on a very popular robotics SDK:

`$a = 1`
`if ($a = 2) startRobotApocalipse()`

...the apocalipse started...
@nobody like we did with Idiocracy?

« first day (3926 days earlier)      last day (1172 days later) »