The DMZ

forest

00:04

@nobody Perhaps they're looking for different kinds of 0days in different places.

P0 doesn't claim to have perfect coverage.

> We suggest that a number of factors contribute to growth in the quantity of zero-days exploited. For example, the continued move toward cloud hosting, mobile, and Internet-of-Things (IoT) technologies increases the volume and complexity of systems and devices connected to the internet—put simply, more software leads to more software flaws.

P0 doesn't appear to be looking towards things like IoT, which would explain a lot of it.

> In line with our previous analysis, Mandiant identified the highest volume of zero-days exploited by suspected Chinese cyber espionage groups in 2021, and espionage actors from at least Russia and North Korea actively exploited zero-days in 2021 (Figure 3)

It's funny that they don't mention the US. Actually, it's not funny, because the US is known to frame other countries for their own attacks. It's their primary MO...

nobody

00:38

Somehow the infosec industry doesn't seem to detect western attackers as often as they detect Chinese and Russian attacks

forest

yup

Although I'd change that to "doesn't correctly attribute attacks to western governments".

You remember when P0 shut down a C2 run by the US government?

That caused a firestorm.

nobody

No?

When did that happen? Do you have a link?

forest

There was a C2 that P0 shut down that the US government was (ostensibly) using against terrorists.

Yeah, gimme a sec.

nobody

I do remember once they detected multiple 0days used by a "western threat actor". There was some speculation that they gave advance notice to the intel agencies before disclosing the zero days...

forest

Repulsive...

Might be verdict.co.uk/…, and another link (the original news story?) is technologyreview.com/2021/03/26/1021318/…

This is their blog post: googleprojectzero.blogspot.com/2021/03/…

> The decision to block an “expert” level cyberattack has caused controversy inside Google after it emerged that the hackers in question were working for a US ally.

nobody

00:43

Yeah, that was the one I was thinking about.

forest

> It is not clear whether Google gave advance notice to government officials that they would be publicizing and shutting down the method of attack.

But it's great that they did that. I only fear that they might have been pressured not to do it again, and caved.

> It’s not a new issue, as many in the field would acknowledge, and a balance always has to be struck. The US has a formal process of assessment for zero-days discovered by its own secret agencies, deciding whether they should be publicised for patching or “stockpiled” for hacking.

My hatred of the IC and the western IC in particular knows no bounds.

To say it makes my blood boil would be an understatement.

nobody

I wonder if anybody left the P0 team directly after the disclosure (or just before it).

That would definitely be a bad sign.

forest

I don't think so. It was Maddie Stone who wanted to do this. If memory serves, she's pretty outspoken about not holding back, and I think she still works for P0.

nobody

Yeah, she does

So I guess its good.

This probably was the reason the US created so much bad publicity against Kaspersky. I think they busted the most Western operations

forest

That, combined with the fact that they aren't as easy to bully as the US.

nobody

00:48

I guess that's why they busted most US operations in the first place :)

forest

All these "antivirus companies" are actually threat analytics companies, and their software is just a way to distribute their ability to collect intelligence. That means, of course, that the US-allied ones bow to the US' corruption.

Kaspersky probably bows to Russia's corruption, but we need all sorts if we want to stay safe.

nobody

Right. That's why you should have someone from both sides on the playing field

forest

But the US doesn't want that. They want a monoculture.

googleprojectzero.blogspot.com/2022/04/…

> While we often talk about the number of 0-day exploits used in-the-wild, what we’re actually discussing is the number of 0-day exploits detected and disclosed as in-the-wild. And that leads into our first conclusion: we believe the large uptick in in-the-wild 0-days in 2021 is due to increased detection and disclosure of these 0-days, rather than simply increased usage of 0-day exploits.

@nobody I believe this is what explains the uptick you noticed.

More vendors are admitting that a fixed bug was exploited in public prior to the fix.

nobody

Probably. Also, kudos to P0, they seem to have a significant role in this increased detection.

Also, thanks to NSO group ironically :)

forest

lol yeah

As much as I dislike the mentality of "find then patch", P0 is doing a great service to show us just how many bugs there are, and will hopefully lead us to better mitigating them before they are discovered.

I just wish they did more *nix reporting.

And maybe Firefox stuff too, which they tend to neglect.

nobody

00:56

Perhaps they find FF hopeless :)

Anyways, got to go. Later!

forest

Then they should be pumping out 0day reports like there's no tomorrow. :P

Firefox has actually gotten quite a bit better in the last few years (though it's still far behind Chromium).

Later. o/

nobody

@forest Too easy, so its no fun :D

Rory Alsop

07:25

room topic changed to The DMZ: A serious place where infosec is discussed PS we don't do hardware/software support (srs face -.-) security.stackexchange.com [404-errors] [moderate-anarchism] [pretending-to-work] [staring-into-the-abyss]

morning :-)

A. Hersean

08:41

MS Teams is worse than Windows ME and Outlook combined.

I had to say that somewhere. Sorry for the disruption. You can now go back to a normal activity.

Rory Alsop

08:52

@A.Hersean erm... functionally, in the company I work for, it is really rather good. It works perfectly and fully integrates with everything we need. Outlook on O365 is okay.

ME is the worst!

A. Hersean

09:22

The only good things with Teams, is its (minimalist) integration with Office and its integration of Skype for calls. Everything else is crap. It's so buggy and there so many UX counter-patterns everywhere. Way worse than Mattermost or Discord (I never used Slack). And compared to Discord, the only thing lacking is its integration to Office, because the calls are well handled by Discord too, even with workplace requirements.

A. Hersean

09:48

@MechMK1 Do you have a quotable reference to a paper or an article? Anything looking more serious than an URL to a obscure chatroom where half of the content is trolling. An answer on security.SE could be fine too.

nobody

I've only used MS Teams for classes, so I don't know how good it is for work, but god, it was chock full of bugs. Glad I don't have to use it anymore

@A.Hersean eprint.iacr.org/2017/375.pdf

Figure 1 of that paper provides a nice little flow chart for it

nobody

10:19

multichain.com/blog/2015/11/…

Interesting that a blockchain company actually says that blockchains are overhyped

A. Hersean

11:55

@nobody Thanks for those links!

A. Hersean

12:29

Interesting, but not surprising: stackexchange.com/security.txt

nobody

@A.Hersean Leads to a page not found for me...

A. Hersean

12:47

Yes. It should not.

rfc-editor.org/rfc/rfc9116

Fire Quacker

13:12

findsecuritycontacts.com

As of today, only 15.4% of the top 500 websites provide security contacts through security.txt or through DNS records

A. Hersean

Addendum: The correct link should have been stackexchange.com/.well-known/security.txt

ThoriumBR

14:06

We used IBM Sametime for a while, it was dated and missing some features, we migrated to Slack that was way more modern, and now we are migrating to Teams.

I still didin't used Teams enough to have an opinion, but will have one in 6 months. I have a deep mistrust of Microsoft, so I can say that in 6 months I will be complaining. specially because I'm a Linux user

RoraΖ

@ThoriumBR What's your Linux distro of choice?

ThoriumBR

distro of choice: Mint
corporate mandated distro I have to use: RHEL

RoraΖ

mint's still a thing? I thought they got into some security trouble a little while back.

ThoriumBR

mint works well, all packages I need are there, those who aren't I can find on PPA, and there a lot of documentation and troubleshooting online

RoraΖ

I'm sorry you have to use RHEL at work

ThoriumBR

14:16

@RoraΖ yes, they had. someone pushed a backdoored image on the official site once, it was noticed in hours and they took it down

RoraΖ

I'm increasingly unhappy with Ubuntu so I'm looking for a new distro that has reasonably up-to-date packages

Which is always the drawback of some of the more independent distros.

ThoriumBR

@RoraΖ Mint is an Ubuntu fork, but they have a Linux Mint Debian Edition that pulls packages from Debian upstream

you could run Arch or Gentoo... they have fast package updates

I tried Gentoo once, but it's a lot of work... took me a week to have X running and Firefox loading

@RoraΖ it makes sense corporate-size: it's stable, have proper support, have management tools for them, so it's good for them. I had to choose between mac OS, Windows or RHEL. I didn't even had to think about this choice

if I feel constrained on RHEL I would feel in prison with either of the other options.

I once had to work on a Windows-only environment, with mandated antivirus, AD policies and so on. I ended up converting Windows to a virtual machine and ran Ubuntu on the host. when IT came to see anything I would put Windows fullscreen without the VirtualBox toolbar and they never realized...

RoraΖ

Yeah I mean it's definitely the lesser of 3 evils. I just hate the RHEL distros.

Fedora's probably the best for RHEL

ThoriumBR

I never used Fedora, for principle... I used and was a fan of the old redhat distros, and one day the RH CEO said "Linux is for servers, desktop users should use Windows"...

I moved to another company a few months later, got a computer to install whatever I wanted, and I heard Debian users were flocking to something called Ubuntu. I got to their site, said something like "put your address and we ship you a CD". I did and a week later I got some CDs.

used Ubuntu since 2005 until 2011, when Unity came. I migrated to Mint and use it until today

RoraΖ

Damn you old then

ThoriumBR

14:27

corporate side I need to use whatever is available

@RoraΖ I use Linux since 2000, at least... I am at 40's

RoraΖ

I think my first Ubuntu version was 06.04

I'm closer to 40 than 30 lol

Unity was awful, they went away from it in 18.04. But they've been upping the telemetry stuff with each subsequent version.

ThoriumBR

my first was Hoary Hedgehog (5.04)

I used each one since that until natty

A. Hersean

14:41

I'm in team Manjaro. It's Arch, but way faster to install. I still use Arch when I need something custom.

Or for servers.

ThoriumBR

Arch is something I will try someday. well, I say I will try, but with 3 small kids and working overtime there's no way to try...

maybe in a VM

my servers all run Ubuntu server

A. Hersean

You can easily spend 1 or 2 days installing Arch, depending on your requirements. Manjaro is as simple to install as Ubuntu.

ThoriumBR

I remember when I used to install openbsd for fun...

RoraΖ

15:03

@ThoriumBR I did Linux From Scratch once

Which was actually kind of fun

ThoriumBR

it is when you are doing because you want to

A. Hersean

The only downside of Manjaro is that the kernel is not in a rolling release, unlike all the other packages. So it's not a true rolling release.

RoraΖ

Rolling release is tough to manage. I don't think Ubuntu started doing that until 16.04?

A. Hersean

Ubuntu is not a rolling release.

RoraΖ

No? I thought they updated their kernel

ThoriumBR

15:15

for a while I ran ubuntu with the upstream kernel as soon as it was released

back when I was single, no kids, all the time for myself

A. Hersean

Except for a few packages, they stuck to old versions until you manually upgrade the version of the distribution (6 months or 2 years for LTS). They just made python 3 the default version.

RoraΖ

Wasn't Python3 the default version for 18.04?

A. Hersean

No

I'm still using LTS 20.4 at work, with python 2 as the default.

RoraΖ

That doesn't seem right

Although I always do the min-install and install what I need.

So it's possible I just always install python3 without realizing the default.

A. Hersean

They have to spend a lot of resources backporting security fixes, and that's far from enough. So those distributions are full of known and unpatched security holes.

Maybe "python3" is installed on ubuntu by default, but if you type "python --version" in 20.4 LTS, you get python 2.

RoraΖ

15:20

If you do the min-install python isn't installed at all

A. Hersean

When you should have "python" (v3) and "python2".

ThoriumBR

it should be, lots of tools are made in python

Ubuntu 20.04:
Command 'python' not found

RoraΖ

Yeah I have a screenshot but no way to paste it easily lol

ThoriumBR

ubuntu 18.04:
Python 2.7.17

@RoraΖ imgur.com

RoraΖ

ThoriumBR

15:23

I have flameshot, it takes screenshots and uploads to imgur automatically

A. Hersean

End-of-life for python 2 was 2020-04-20

RoraΖ

yep

A. Hersean

Announced in 2014

So they supported, in a LTS, a package that would become EOL days later...

RoraΖ

Yeah I guess I just though 18.04 had python3 as default. I've just been using it so long that I don't remember anymore.

Hey you're not a Linux distro if you don't allow users to shoot themselves in the foot.

A. Hersean

@RoraΖ So in 20.4 you have to install an optional package to make "python" the version 3.

ThoriumBR

15:27

I don't think they should "force" EOL on python2

RoraΖ

Yes you do

ThoriumBR

let someone keep maintaining it, until nobody was interested anymore

RoraΖ

I think @A.Hersean is arguing that on the DESKTOP version it should be defaulted to Python3 in 20.04

Server version is another story, but the Desktop version there's no reason not to.

ThoriumBR

kernel 2.2 wasn't EOL-d when 2.4 or 2.6 were launched, people kept maintaining them until nobody was interested anymore

I don't remember if there are new releases for 2.2

A. Hersean

@ThoriumBR They could have done like every other distribution: ship python 2 as "python2", and python 3 as "python".

RoraΖ

15:28

And modern network products use 2.6 still today!

A. Hersean

@ThoriumBR Python 3.1 was released in 2009, python 2 EOL announced in 2014 for 2020. Plenty of time to switch.

ThoriumBR

but why switch?

if python3 is compatible, it's just a new release. if isn't compatible, is another language

RoraΖ

Python3 is compatible up to.... 3.5? I think 3.6 breaks everything.

ThoriumBR

looks like MS force-upgrading your windows 7

I once installed windows 7 on my game desktop (a stock thinkpad t430, laugh if you want), let it turned on during the night and woke up to windows 10 there

A. Hersean

Python 3 was never backward compatible with python 2.

valid python 2 and invalid in 3: print "hello wold"

It was intended

ThoriumBR

15:34

so let it be different languages, and tool devs would choose what they want to use

A. Hersean

You can still use python 2 if you want

ThoriumBR

I am not a python programmer, but I think "python2 is dead, learn python3 or be left behind" was the wrong approach

RoraΖ

oh that's right

They're not that different. They just changed the approach to the language.

A. Hersean

The issue is to maintain an obsolete codebase. It costs a lot of resources.

ThoriumBR

maybe this was what stopped me from learning python a while ago... nobody seemed to agree if I should learn python2 or python3. at the time, they said "python2 is being abandoned, but there's few packages on python3"

RoraΖ

15:36

It also costs a lot of resources to update when your stuff is working just fine.

A. Hersean

A tool was even provided to translate python2 code into python3. Worked for 99% of the cases.

ThoriumBR

python2 was working fine

A. Hersean

lol

RoraΖ

Just learn Python3. Most packages are default now, and it's just not as type agnostic as 2.7.

A. Hersean

That's not what the developers and maintainers of python thought. And some issues remain in python 3.

RoraΖ

15:37

Know your data and what your manipulating, you're fine. I like it better.

And F strings are amazing

ThoriumBR

I can program in Python now, I was kinda forced to learn to work on a NLP project

A. Hersean

It's really easy and fast to learn python 3 when you know python 2.

It's really a no brainer.

ThoriumBR

and I still scream at Code every time Python complains about a misplaced SPACE...

A. Hersean

It's not like learning a new language. Most of it is the same as before.

ThoriumBR

"crappy language hurt by spacebar..."

jk

python is powerful. I am biased against it because I learned PHP in the 2000's, and for my work tasks php is way faster

I had a crypto bot written in python and the roundtrip for a transaction was around 750ms. I ported it to PHP and now the roundtrip is around 50ms.

the same backend, the same server, just rewrote it in PHP

A. Hersean

15:42

Python is slow.

Python is monothreaded.

But python is a good glue between other compiled components when speed is not important.

ThoriumBR

yes, and python is easy to learn

A. Hersean

That's what I was writing ^^

ThoriumBR

it's not as verbose as Java, not as rigid as C, more consistent than PHP and javascript...

I am still learning Nodejs and promises and await and everything... asynchronous programming is still something I couldn't wrap my mind around

I still program with linear thinking and unsurprisingly everything is right but nothing works

A. Hersean

Since a few years, the rudiments of Python are taught in French high schools.

ThoriumBR

or ^C ^V, they work but not make sense

belkarx

16:37

Somewhat discontinuous with the conversation but LMDE is really nice, Arch is great except for when it breaks (which does happen every once in a whole), Ubuntu devs are getting greedy (canonical is IPOing soon), LFS is fun but tedious - it's worth doing once if you have the time though

@A.Hersean This is great. In modern times, younger people should at least know a scripting language; it's extremely useful

ThoriumBR

16:50

canonical doing an IPO is good. devs have to make money.

opensource is great but depending only on voluntary unpaid work is a liability... one key guy from openssh or openssl dies, and it's over.

or kills his wife...

belkarx

@ThoriumBR I agree. But monetary motivation means the main goals of the company and product will likely change

ThoriumBR

they will change. but they will survive longer than non-paid devs when their personal life change

I used to have a blog 20 years ago, the dev of the engine was doing for his own blog and shared the code. I liked it but after 3 years the dev got kids, lost interest and abandoned the project

if he had a company behind another dev would step up to keep it going

reiserfs was good, I used it for some time, but when Hans Reiser was jailed the project died like his wife...

belkarx

17:08

@ThoriumBR Interesting piece of lore, didn't know that

ThoriumBR

her body wasn't found, IIRC there were a drop of blood in his car but could not confirm her dna, he denied having killed her, but something was amiss with him and he is in a health care facility

Hans Reiser

Hans Reiser (born December 19, 1963) is an American computer programmer, entrepreneur, and convicted murderer. In April 2008, Reiser was convicted of the first-degree murder of his wife, Nina Reiser, who disappeared in September 2006. He subsequently pleaded guilty to a reduced charge of second-degree murder, as part of a settlement agreement that included disclosing the location of Nina Reiser's body, which he revealed to be in a shallow grave near the couple's home. Prior to his incarceration, Reiser created the ReiserFS computer file system, which may be used by the Linux kernel, as well as...

he is in jail, other prisoners gave him a heavy beating, he pleaded in 2020 for parole in 2023 but was denied

belkarx

17:39

She was found apparently
> Oakland homicide detective Lt. Ersie Joyner recalled that Reiser led them directly to the exact site, without any hesitation or confusion. On July 8 (2011), the coroner positively identified the skeletal remains as those of Nina Reiser.
Lol
> Reiser acted as his own attorney during the trial and tried to argue that he killed his wife to protect their children
Great opsec /s
> They also indicated that they had found in the car two books on homicide investigation purchased by Reiser on September 8 — five days after Nina Reiser's disappearance

ThoriumBR

sfgate.com/bayarea/article/…

belkarx

That's from 2008

ThoriumBR

I didn't kept up to date with his case

@belkarx reminds me of Ross asking on SO about libbitcoin and PHP with his own email...

nobody

18:26

flag-plz security.stackexchange.com/a/261621/235964

belkarx

18:51

@nobody I feel like that's an okay question if edited

This individual has, according to his other questions, been plagued by a "hacker" that absolutely owns him, so I guess he's concerned about that? idk, post history is somewhat interesting

Fire Quacker

@belkarx Actually nobody was linking to a (now deleted) answer. Presumably spam.

belkarx

@FireQuacker Ah, missed that. Sorry.

nobody

Yeah, it was spam

For a hacker for hire. We get that a lot.

belkarx

Lol, I haven't seen that yet. Good job mods!

nobody

Lol the questions from that person are also similar to something we get very often: schizophrenic people claiming that they have been hacked by an uberleet hacker who is bent on destroying their life

RoraΖ

19:01

I'll keep those questions to a minimum

nobody

@RoraΖ So all of those were just your sock puppets? :D

And here I was thinking that everybody has a neighbor or an ex with nation-state level capabilities...

ThoriumBR

some create accounts to give each other enough reputation to comment spam.

belkarx

Does SE have anything against voting rings in place (or is the rep threshold good enough)

belkarx

19:27

Apparently not. "Flag for moderator intervention" seems to be working well enough I suppose

RoraΖ

Yeah I haven't seen anyone really be able to take advantage of something like that.

nobody

@belkarx Maybe the mods do have some tool, but if they do they won't talk about it.

But I guess its mostly just, if anyone/mods see anything suspicious mods go investigate.

ThoriumBR

and the effort/profit ratio is too low...

you need a lot of effort to gain little advantage

belkarx

20:05

There's no good end goal of gaming the system. You might make certain questions more popular but this isn't a huge media site - when people come to SE as a whole, it's usually in response to a question asked to google or to ask your own question, so they aren't looking at others. And not many people go to HNQ, especially proportionally to other social media sites.

So even if you make a popular question, it won't have as much visibility as the same amount of effort might have given you on, say, reddit.

nobody

Gaming the system on SO might net you enough to put your account on your resume though.

I don't know how useful that would be for getting a job, but still...

ThoriumBR

and the recruiter gets to your profile and it's underwhelming...

nobody

Well, not necessarily. You write good answers on SO but still not have a lot of rep

SO is much harder to earn rep on because a) HNQs are very rare, and b) posts get buried on the home page very quickly

That's where gaming the system could come in

ThoriumBR

just have an active twitter account, post your answers and share the link

RoraΖ

And if you're not following their rules they just close your question or delete your answer.

ThoriumBR

20:11

not much people on SO follow twitter accounts...

@RoraΖ I never had an answer by them, some by me... the rules are elementary

most of the deletions are for spam, commenting instead of answering, not answering the question, things like that

and it's good for you to have those types of answers removed, they keep your profile clean. I wouldn't want an answer where people comment "did you ever read the question?" on my profile...

RoraΖ

@ThoriumBR I had a question once after searching SO for an answer and couldn't find one. It was immediately closed for being a duplicate and not following some sort of format they like. When I tried to get it re-opened because what they linked to wasn't an answer to my question I was ignored.

ThoriumBR

If it was closed as a duplicate, you get the link to the answer it was deemed a duplicate

RoraΖ

Which after getting 10K rep here, I figured I knew how to ask questions and do due diligence.

@ThoriumBR I'm very much aware. And it did not answer my question.

ThoriumBR

do you still have the link for the question?

RoraΖ

I edited my question to try and make it clear why it didn't, but literally no response.

So I just don't even bother with that site.

It was years ago now.

nobody

20:27

Yeah, SO is a bit of a shit show. Way too many people going through close vote review queue without understanding most of the questions.

So one idiot VTCs as duplicate of something random and others pile on

I personally think SO has grown too large and should be split into multiple sites

ThoriumBR

yes, they are too big now...

nobody

If someone has 3k in python tag, there is absolutely no reason why they should be able to VTC a C++ question

ThoriumBR

makes sense

RoraΖ

So SO becomes the Meta exchange for a bunch of coding language exchanges

ThoriumBR

I was writing about dividing the queue depending on your badges

RoraΖ

20:32

I could see that working

I wonder how the transfer of tag rep would work though.

Maybe we should ask SO

Fire Quacker

Rep for privileges has always been a little goofy. I'd rather it be tied to other things. Like get edit privileges after 200 accepted edits, get CV privileges after 200 helpful flags, etc

3

RoraΖ

I like that idea

nobody

Yeah, that sounds pretty logical

Although it might result in new users doing lots of random edits and flags though

RoraΖ

That already happens

nobody

Well, its gonna happen a lot more then

RoraΖ

20:36

Depends on whether that threshold is high enough for people to feel like it's too high to try and spam.

Plus you're already rate limited on edits and flags.

ThoriumBR

@RoraΖ I am writing something on meta...

@FireQuacker 200 helpful tags is a heck of an effort...

RoraΖ

flags*

ThoriumBR

flags...

I am here for close to 9 years and have 166 flags

nobody

The real problem though is not the need to come up with good solutions, the folks at MSE already made many helpful proposals, the problem is SO the company doesn't really like devoting resources to the public platform.

And when they do devote resources to the public platform, they like doing it their own way instead of trying to implement anything the community proposes.

RoraΖ

I used to flag quite a bit

ThoriumBR

20:40

0

Q: Divide StackOverflow close queues by tag or badges

I saw more than a couple questions voted to close that had nothing wrong, and probably the ones voting to close were not proficient on the language the question was about. It happens. SO now have so many users with closing powers, and not everyone is versed on every language. I believe this could...

my first ever question!

been around for a decade, never bothered to ask anything...

nobody

@ThoriumBR You're going to be disappointed man...

The meta folks are brutal. Just wait for the downvotes to roll in

ThoriumBR

I am not easy to disappoint... and with 100 rep I have little to lose

and I am expecting lots of criticism, so if there's little criticism I will be disappointed

nobody

@ThoriumBR Yeah, you can just delete the your Meta account and start over :)

Already one dv

ThoriumBR

it had one upvote, I got +8... now it's gone

-3! it's crashing!

nobody

You still have net positive of 4 rep

Told you :D

ThoriumBR

20:47

it's a good experience

belkarx

I had around a 50-50 ratio of up to downvotes on the one question I asked on that site ...

It is certainly brutal

comparatively

nobody

Here's the trick for rep on Meta. Wait for the Winter Bash in December, and then post on all the Winter Bash related threads.

In particular, make sure you post on the "Show off your hats" post early

Its easy, and mostly gets upvotes

ThoriumBR

rep on Meta isn't that important to me... rep on security is.

and on serverfault... I have to scoop more questions there...

I will have an interview for sysadmin next week, so a little more rep there would be good

nobody

I thought SF was dead

RoraΖ

Wow well done @ThoriumBR already -3

ThoriumBR

20:53

0

Q: Divide StackOverflow close queues by tag or badges

I saw more than a couple questions voted to close that had nothing wrong, and probably the ones voting to close were not proficient on the language the question was about. It happens. SO now have so many users with closing powers, and not everyone is versed on every language. I believe this could...

feature-request tags vote-to-close

RoraΖ

lol

ThoriumBR

moved to Meta SO

RoraΖ

already deleted

ThoriumBR

I deleted it

well, time to log off...

RoraΖ

haha

gg

ThoriumBR

20:53

back tomorrow...

I deleted it... will post later this week when I have time to fight for the question... or not..

@nobody I never was downvoted so fast in my life... I am impressed!

RoraΖ

Maybe we post it on MetaSec first to flesh out immediate problems. As a way to filter it down a bit better.

Like a code review :D

nobody

Since it targeted for StackOverflow, it would only fit on MSO

It would be offtopic anywhere else

RoraΖ

Well one of Meta's concerns was how it would affect smaller sites.

We could tackle that portion itself.

nobody

It shouldn't affect smaller sites at all IMO. We are mostly fine as is.

RoraΖ

With our powers combined, we can get a positively upvoted question on MetaSO!

nobody

20:57

You underestimate the power of SO regulars :)

2

nobody

21:09

@FireQuacker Just realized, if you completely decouple reputation from privileges, you would remove one of the main incentives to gain rep (and contribute to the site).

So changing that might result in negatively affecting the effectiveness of the SE rep system

Fire Quacker

Good point

forest

21:38

@RoraΖ It's not just that backdoor. They tend to not backport important security fixes either.

belkarx

21:58

Whyyyy is Web3 on a blockchain? It's a great idea, it could work well with just p2p (in freenet-style), but nooo put it on eth or similar - am I missing any motivation here? Why would you implement it with blockchain besides the hype?

forest

wut

nobody

@belkarx Why is it a great idea?

forest

It'll never take off.

There might be a few platforms which use blockchain for social media messages.

But the web itself won't change in any way. We're having a hard enough time switching to IPv6, and we had 30 years to prepare for that... And just to make a point: blockchain is a stupid buzzword.

Transcript for