« first day (83 days earlier)      last day (5095 days later) » 
05:00 - 22:0022:00 - 00:00

05:32
Posted by Joel Spolsky on March 8th, 2011

It’s been a while since we’ve done something arbitrary, complicated, and confusing, so today I’m happy to announce that the name of the company has been changed, effective immediately, to Stack Exchange Inc!

There’s a method behind this madness, of course: we want to emphasize the importance of the 45 sites in our network, which has long since stopped being about programmers:

That, plus, whenever we told The New York Times that we were “Stack Overflow,” they would go to stackoverflow.com and have a heart attack. At least this way people wondering about the company understand that we’re about more than just programmer questions. We have Battlestar Galactica too! …

 
8 hours later…
13:16
Mornin' all... or @packs - whichever the case may be.
13:36
This one's setting off my (overly sensitive?) "black hat" alarms.
0
Q: hacking my wireless router

Badescu AlexandruHello . I would like to hack my router through brute force ( i have WPA2 on my router ) . I don't want to use programs like aircrack , i wish to code my own program . As i generate all the possible passwords, how can i enter them and test them against the routers stored password ? (i.e. how can...

13:58
@Iszi!
Based on his activity on other SE sites, he looks like a student
@packs Hadn't gone that deep myself, to notice.
He's not overly active anywhere, but has a few handfulls of questions between SO and Math
Ah, and based on his clarification in the comments, he's trying to break the password on the device
@packs Clarified it already? That was quick.
@packs It sounds like he more wants to break WPA2 to me.
According to the question? yes
shit, sorry
You're right
I missed the "not"
Well, that means my smartass reply is meaningless
Actually, that sort of still works.
14:07
It needs a step 4
Last I checked though, WPA2 takes a long time and a lot of computational power to crack. Not something he's just going to be able to do on his home computer, against any reasonably strong PSK.
No kidding
That's kind of the point
It's not hex, it's alpha/numeric/special characters
Wow, no sense of humor
Blah. This now earns my close vote.
I always assumed a hard reset wiped out all the settings.
I was going to let it go and give him a chance to re-write, but it's just all gone splat.
@packs It should. Perhaps his router came pre-configured with a WPA2 password.
14:18
He even said that he was going to abandon it
That's true, it could have come pre-flashed with settings.
When we were putting a computer in every dorm room, we got Gateway to have our BIOS default settings flashed at factory.
So I have actually experienced precedent.
Granted, we went with Gateway because they were the only company willing to do that.
@packs Sweet.
@packs Bummer.
I'm actually glad I missed that boat. By the time I got here most everyone had their own computers anyway, so the project got phased out pretty quickly.
A lot of manufacturers are getting wise to wireless security these days. More often now, you'll find that APs and routers are coming with a pre-set WEP or WPA key and/or pre-set Administrator password. The codes are non-generic, and usually included in the product documentation or printed on the device itself.
Now that you bring that up, my folk's ISP ships a modem/wireless/router with that
I found it pretty novel, that was the only time I've seen it.
@packs I've heard of some ISPs that ship the gateway device with that pre-configuration and won't let you change it - which is why I tell them "Just give me a simple modem, I'll handle the rest".
14:26
Interesting.
Yeah, except for my folk's place, I haven't run into that.
Oo..I have an excellent starter for an answer to the keyboard thing.
I just need to find that paper...
14:48
2
Q: Is AJAX fundamentally insecure?

C. Ross Possible Duplicate: How to do Ajax securely? At my workplace many people believe that AJAX is fundamentally insecure. I am under the impression that AJAX is exactly as secure as any other page load, it depends on how you code the call/page. Is there a fundamental security flaw in A...

Really a dupe?
15:03
Trying to find an image that sort of highlights Telnet as an insecure protocol via cultural reference or something.
Definitely trying to be more subtle than this, while still getting the message across:
Or, if it's as straightforward as that, would rather do it via a cartoon or something.
@Iszi that's pretty accurate
btw, is this your day job?
@CRoss For a presentation, yeah.
15:31
@CRoss - Could you bring down the mod hammer on that "wireless router" question, and perhaps nuke it in a day or two if it's still not going anywhere?
I'm not a mod here
@CRoss Oh, right... Hey! When did you jump in here?
(Just realized we're not in RPG land.)
just a few mins ago, had a question about AJAX security. People at work think it's "fundamentally insecure"
Don't know much about AJAX myself. Sorry.
hence the questions about the day job
15:41
I don't feel qualified to answer, but my gut tells me fundamentally? No. Can it be done in a bad way? Oh sure you betcha.
Why not? Everything can be done in a bad way. :)
It's magically been reopened, though.
Funny how that works.
 
1 hour later…
16:59
@Iszi- yep, sorted
@CRoss - thought your initial q was asking the same as the referenced question, your revised q is more open.
Basically as @ThomasPornin says - Ajax does all the stuff a normal web page does, however it does some things in a more hidden way, and generally more stuff is pushed to the client (ie untrusted) side
17:24
my impression is (and I've done some prototyping of this) is that you can kick back nonsense and validate at the interface (ie those json or xml gets or posts to the server)
 
2 hours later…
19:05
heya guys
sorry to be offradar so long...
@Iszi about that hacking wifi question - I've come around and will hammer it, but... "not a real question" is not accurate.
"not a good question" would be a better close reason...
@AviD Yeah, but that's not available. I called it "not a real question" because the asker himself is even backing out of it.
yeah. ehh, whatever. i'll take that reason....
when the site gets out of beta, we should change around the close reasons....
I don't think we can.
@Iszi yes, its possible, after beta
for example we MUST have a "blackhat / unethical" type close reason
@AviD Oh, cool.
@AviD Absolutely.
19:12
ok, what about this:
-2
Q: Security attacks and exploits : Denial of service, man in the middle......

curiousI'm thinking of using this question to create a list of attack types and exploit types as a reference for others. Help me out with links and explanations. What are all (well/little) known types of attacks? Denial of service Man in the middle Cross-site scripting SQL Injection Rainbow table at...

any reason not to hammer it?
bad question all around
btw @Iszi from one of your comments: if the crapton is metric, it should be spelt "craptonne". I'm sure @RoryAlsop will back me up here....
@AviD I think that's just looking for a general glossary of terms. I wouldn't call it a "bad question" but it's definitely in need of refinement if we want to keep it. One could also make the argument though, that it's not an "expert-level" question. Deciding on that depends on how high a standard we want to set here.
@AviD Oh, you're right... fix that for me?
@Iszi ccchh
@Iszi I dont think its even asking a question. just asking for a generic shopping list of all possible attacks...
I'd do it myself, but there's that whole timeout thingy for us lowly regular users.
not a terminology type question, either...
@Iszi lol
@Iszi you can copy, delete, paste, edit, enter
Can the number of votes required to close be dependent on the reason?
19:16
@packs heya @packsie
@AviD Yes, but then that takes it out of context (there's replies already).
no clue
Avi!
dont think so...
I wouldn't have thought so
19:16
@AviD Right... which can be interpreted as a glossary...
For the "blackhack/unethical" question, I could see it being a little higher than 5.
@Iszi even better! commenturity by obscurity
Only because of the extra subjectiveness of that reason
@packs Very much doubt it, and I'm not sure I'd want it to be.
It generally takes quite a bit for a question to actually gain 5 close votes in my experience.
@packs ah, thought you were asking something else
i.e. 2 people vote to close "narq", and 3 people vote "ot"...
19:18
@AviD There's that to be considered, also.
@Iszi dont think so...
@AviD את מספר הקולות הנדרש כדי לסגור להיות תלוי סיבה יכול?
Better?
:)
@Iszi and by the time it hits 3 or so, one of the ninjamods jump in and hammer it
@packs lol
You'd have to implement a weighting system if you wanted a per-reason threshold.
@packs not really....
19:19
Until we get big, then the mods are too busy with flags to do stuff like that.
google translate doesnt work well on complete sentences. grammar confuses it...
I'm not sure how well google translate works
The further you get from the original language..yeah
@packs hey we had 3 today!!
@AviD I need to start flagging shit to get that deputy badge
I'm well on my way on SF
i.e.: Need 100 close points to kill a thread. NaRQ = 20, OT = 25, Offensive = 33.3333...
19:20
I'm really enjoying that my 'reset your router' instructions are going over so well
@packs yeah, i think @Mark is ahead of you there....
Well, I know how to fix that.
I'll just flag all of his stuff
@Iszi eh. I prefer to keep it simple.
Me too. Having one threshold across the board makes sense.
if 5 people want to close it, i dont think it much matter that they agree why
@packs lol
19:21
The problem you would run into with different thresholds are when you have one question with multiple reasons
@packs Which is why I was saying you'd need a weighting system.
Oh, that's what you meant.
Sorry, I'm working on something else.
@packs @Iszi can you run google translate on that for @packs?
I hear they do pretty well translating between the same language.
@GrahamLee real sorry I missed the [sz] convo...
19:23
@packs I'm pretty sure I've even seen bugs there.
Scores very well on the computation complexity as well.
@packs hehe. actually didnt used to...
And by "same language" I mean English.
Because, well, we all know the rest are just dialects anyway.
@GrahamLee and the cross-mod edit wars with @RoryAlsop
@Iszi i wanted to ask/tell you something about this one:
10
A: Stopping someone with physical access from hacking a Windows XP account password

IsziThe real issue here is that the attacker only needs physical access to your hard drive in order to read or manipulate the files which contain your password hashes. There is already a thread on SuperUser which has some recommendations, which I will likely repeat here. http://superuser.com/q/2220...

@AviD Shoot.
19:26
but I have no recollection of it whatsoever....
That's not a very helpful question there, hoss.
I love that it went from zero to "great answer" in just a little over a day.
The downvote is frustrating though.
That's probably because of all of your sockpuppet accounts.
@packs lol
Very clever of you to have downvoted yourself as well. Really puts one off the scent :)
19:27
@packs First you accuse me of being a different gender. Now I play with sock puppets?
@Iszi dont fret. probably D.W., for the reason he states in his comment, and answer
So, my daughter's school takes pictures of the activities they do and will ship out a 1-2 page pdf with some of the pictures and a write-up of what they did and how it went.
I just got like 5 of them in a single email.
@Iszi yeah, this site is actually quite active. passively so
Seeing this stuff is way too cute
@AviD Holy self-contradictions, Batman!
19:29
@packs aww... she's in college? ;)
@Iszi It probably makes sense in Hebrew.
@Iszi caught that, didja? ;)
@AviD She'll be 2 this week, close though.
@packs hehe
2 is such a fun age
tiring, but fun
yeah......
19:30
@AviD ...and we're off on tangents again. The poster asks about defense against a specific type of attack and everyone piles on to address the broader scope.
(And worse, berates the others for not.)
@Iszi I feel like that's probably a common thing with security guys.
Of course, by "everyone" I probably just mean @D.W.
I'm not so sure...
I think it really comes down to a different perspective
or risk analysis
or risk tolerance / appetite....
call it what you will.
I prefer risk voracity!
I've noticed that D.W. is a lot more hardline, and speaks to what should be. I used to do that...
19:33
As opposed to focusing on what can be done, you mean?
where the rest of us (mostly) try to aim for a decent tradeoff that makes sense to the business.
@packs lol, what now?
@AviD I don't disagree with the perspective, but there's a way to do that without attacking those who don't.
@AviD Right... because of the little thing the rest of us recognize as reality.
@Iszi ayup
Pretty much exactly what you later said :) Focus your energies on determine what kinds of protections can reasonably be performed as opposed to the Perfect Security Model from On High
to be fair, first couple years of mine in security i was the same way...
@pack aint gonna like this, but it was @BruceSchneier that talked me out of that way of thinking
not personally, of course...
19:35
@AviD You mean you publicly bashed others for not having your same perspective?
@Iszi hehe I still do that...
(Sorry. Perhaps I'm being a little over-sensitive with the D.W. thing.)
My opinion of Bruce is a little more nuanced than that, @AviD. I do appreciate that he focuses on implementing protections that work and are reasonable. I just find a lot of his other ideas not to be based in reality.
@Iszi Looking at those two answers, it certainly seems like he's trying to take the One True Model approach, where as you're being a lot more reasonable.
And as I recall, you have a background in Customer Support, which in my opinion is a big plus.
As it strongly affects your perspective on what can be accomplished and what can't be.
@packs Thanks. I personally prefer to avoid end-user contact at all opportunities, but experience in that particular trench does change one's perspective a bit.
Come on! I am tired of rain.
19:48
Okay, I'm about to throw a really exotic question out there. Just warning y'allz.
Does it involve hacking the weather control stations to give me some fricken sun?
@packs Nope, sorry. Encrypted wired keyboards.
You read that paper, eh?
No, but I'm aware there's been studies.
Just thinking @D.W. would love this.
Hey, @Iszi, look! There's more than just us in here :)
19:54
@packs More than just us and the less-frequent regulars, yes! Quite exciting!
cue xkcd: people on the internet are wrong!
@AviD That syndrome is actually exactly the thing that kept me up the other night.
Much as I hate to admit to such obsession
@Iszi lol
@packs like what?
(btw having power outages, so I might drop off again like I just did...)
@Iszi I got the feeling that D.W.'s background is somewhere around cryptography... maybe not as heavy as Thomas's though
but still, it also changes your perspective... in the other direction
@AviD Ah, right. Those tend to be the more paranoid ones.
user image
2
@Iszi lol, yeah thats pretty much on the nose
and the difference between cryptographers and security professionals...
20:00
@AviD Bit late to the conversation here but got the notification when you mentioned my name. Didn't even realise there was a Badge for flagging stuff, I just hate SPAM.
crypto is just one tool in the toolbox. the 5$ wrench is another one...
@MarkDavidson lol, good for you
as do we all....
What is the maximum flag weight anyways?
I vaguly remember reading something about it changing on meta a week or so ago.
@MarkDavidson dont really know, havent started looking at them yet. I think its out of 100...
not enough flags for it to be really important
.... yet
fair enough. As long as I can flag I'm happy I really don't think any of us want to buy slippers or jeans from dodgy Chinese sites.
There. I think I've gotten my idea down properly.
0
Q: Keyboards immune to signal monitoring?

IsziReading a couple questions and answers here recently got me to thinking. Wireless keyboards run the inherent risk of exposing their data due to the relatively broad transmission range, and the ease with which highly sensitive receivers (remember, making an RF signal audible is more the job of th...

20:04
@MarkDavidson right. we want to by them directly from dodgy american sites.
now, boots, on the other hand....
Thanks to whomever starred the XKCD strip. That got me the "Talkative" badge, here!
@Iszi how dodgy is your cleaning lady.
@Iszi lol, youre welcome
@MarkDavidson We've got some pretty dodgy ones here.
there are some xkcd's that are just.... iconic, i guess is the word, for our site
20:08
thats my favourite xkcd, my colleagues kept sending me it after I got an Ironkey.
@Iszi do they sell jeans or slippers?
@MarkDavidson yeah, thats one of the problems with biometric authentication, too
do you really prefer they cut off your hand, than steal your briefcase?
or, ala demolition man, cut out your eye to access the computer?
@Iszi [signal-leakage]? really??
@AviD Yeah, its a fairly specific type of vulnerability.
hate to be picky @AvID but he actually stabs a fountain pen in his eye and pulls it out
@MarkDavidson ahhh same thing, eye exits body...
and actually it was to escape, not access the computer.... :$
I remember doing crypto course work at uni and the lecture mentioning a russian technique for extracting crypto keys.
thermorectal cryptanalysis
20:12
@AviD If by "briefcase", you mean "football", it's probably happening anyway.
@Iszi huh. you're right, its a real thing....
didnt think they called it that...
@Iszi exactly
risk transferance can be a good thing, as long as its transfered in the right direction - away from you
And here we go with the super-paranoid over-broadening of scope again. Am I the only one that gets really annoyed by this?
@Iszi sometimes...
other times it makes sense, because often the question being asked is the wrong question
to be fair, in this case, your question started off being overly super-paranoid in the first place. So, why not take it further?
(being devil's advocate here....)
@AviD Point taken. But, still...
maybe the faw needs to clarify a bit more, about risk tolerances / risk management / perspectives / etc
20:22
The question was also written to address a very specific vulnerability.
you seen that @Iszi
AES encrypted keyboard apparently
@Iszi true. But, there have been times when someone is trying to solve an issue, which is pointless to solve in the first place, and it's more than legitimate to say "your aim is off"
@MarkDavidson cooool
@MarkDavidson Haven't. And it's pretty awesome-looking. Sadly, it still isn't an answer to my question.
you guys ever check the /review page?
@AviD I would if it were more accessible than just /review. (Yeah, I just don't want to have to bookmark that.)
20:26
yep every day
@MarkDavidson ahh, that explains it :D
I think the most secure you can get a keyboard built to, would be to have on-board encryption on the keyboard and have an add-on card in the computer (physically locked case, of course) that connects to the keyboard via proprietary connector and does on-board decryption.
@AviD ;) didn't know about it for ages saw it mentioned on meta now I make a point to check it every morning when I get to work.
@MarkDavidson I only get to it every couple days or so... but by that time you've already jumped on everything ;)
Jimminy! Where did this wall of text come from
[signal-leakage] sounds disturbingly like what happens after eating too much Olestra.
20:31
aaaaand we're back to food
Just had to google what Olestra was
@MarkDavidson That's okay. I Wiki'd it.
Yeah, those 3-4 months when it first came into use were interesting.
Speaking of which, we now have support for secure Wikipedia for those who don't know!
Olestra (also known by its brand name Olean) is a fat substitute that adds no fat, calories, or cholesterol to products. It has been used in the preparation of traditionally high-fat foods such as potato chips, thereby lowering or eliminating their fat content. In the late 1990s, Olestra became infamous in American popular culture for its unpleasant side effects. Commercialization Olestra was accidentally discovered by Procter & Gamble (P&G) researchers F. Mattson and R. Volpenhein in 1968 while researching fats that could be more easily digested by premature infants. In 1971 P&G met ...
@Iszi It looks like the dude who answered your question didn't really get the idea.
20:32
Oh, wait... that doesn't link to the secure wiki...
The whole point of intercepting RF from the keyboard is that you don't have to have physical access.
Just proximity.
@packs Well, I did pose a physical access scenario also - the "cleaning lady with a keylogger" thing.
Oh, sorry. I just breezed through it.
I got challenged to get a snort sensor deployed by the afternoon. Shouldn't be too hard except most of the time is spent on disk IO and waiting for the addresses
@packs Good luck.
I should have a chat with dierre. His/Her gravatar is horning in on my territory.
20:40
@packs aww no, she is SO much hotter
might be the red hair...
i'm sorry, was that inappropriate? I can never tell....
I'm reddish, though it is, admittedly, hard to tell through the sepia.
Y'all mind supporting this one, so it gets noticed?
The comment may, or may not, be inappropriate. I largely let that depend on my professional relationship with the person and whether or not they might be offended by it.
0
Q: Secure Wiki Oneboxes don't link to secure Wikipedia pages.

IsziThank you very much for adding support for secure Wikipedia pages in Onebox. However, I've noticed that secure Wiki links get converted to normal links when they're Oneboxed. Can this be fixed?

i meant derierre
20:42
Like, when I told one of our lady sysadmins that she needs to just take the shoes off and get back in the kitchen.
dierre?
aww maaaan
Neither of us were offended, although apparently someone in earshot was :)
hehe
@Iszi I agree in principle, but... what exactly is the point of securewiki?
really, any sensitive (C or I) info there??
@AviD To keep Big Brother from knowing what you're searching for? I dunno. I didn't even know it existed until HTTPS Everywhere applied it. I suppose there may also be some risk of Firesheep-like hijacking of your Wikipedia account if you have one.
well, I meant if you dont have an account...
big brother eh
bigger fish to fry
aaaand we're back at food.
i guess thats a sign im hungry...
bbl
20:47
@AviD Well I don't, but I'm sure many out here do since this site is sort of inspired by Wiki and all...
I thought this site was inspired by ExpertsExchange
Wiki is mentioned in there.
@AviD There you go.
ah, beat me by a few secs
20:51
@AviD Only because I was lazy and didn't fish out the link for the picture. Kudos to you.
:D
Yeah, I remember that. I have a shadow of a memory somewhere back where on the podcast while SO was being developed mentioning something about being fed up with how ExpertsExchange constantly came up so high in search results.
speaking of, if our current rate keeps up, we should be ready for our end-of-beta party within a few weeks... discuss.
Drinks at Jackie O's or Casa
@AviD We really need a link to the Area51 stats on the homepage.
20:53
@Iszi there are some stats there...
118
IT Securitysecurity.stackexchange.com

Beta Q&A site for security professionals to discuss vulnerabilities like XSS, buffer overflows, SQL injection, CSRF, clickjacking, as well as system and network security. Discussions related to OWASP projects, tools, papers, and other materials are encouraged.

Currently in public beta.

2
@AviD That offical is that site actually coming out of beta soon?
That's about as good as I can do right now.
@MarkDavidson ah no. but the stats there look almost cooked, and the one weak spot -q's per day - has been picking up this week...
@MarkDavidson No. Even after the regular public beta period, there's still a waiting list.
20:56
@Iszi yeah, takes a while to push it out.
@AviD Right, but they're not always the same (or calculated the same) as the ones on Area 51 and they don't give the ratings.
@Iszi area51 stats lag a bit
Any notion how often they are calculated?
Cool well hopefully out of beta hopefully the site will get a good design to go along with it.
@MarkDavidson commence discussion!
21:00
how about a nice design based on the windows xp ui ;)
@AviD Oooh, logo?
Did you hear that, @AviD? I think I heard old man Aslop offer to buy the first round at the coming out party.
@MarkDavidson I think we're gonna have enough linux geeks on here that that won't fly.
@MarkDavidson What's XP?
@packs lol, luvvit
@Iszi logo, name, background, etc,
check out some of the other sites, to get an idea
gaming, apple...
21:02
@Iszi Yea thats true I'm one of them.
@MarkDavidson sorry
I think the cooking one has best name
food now, bbl
@MarkDavidson I think you just broke Avi
Seasoned Advise
21:05
I really dig their design
Edited my keyboard signal leakage question. Hopefully that will clear things up for future answers.
yea its good. just went on there found i got a popular question badge :)
@MarkDavidson Surprise!
gaming.stackexchange.com got quite a cool theme going on. trying to think what would fit in with security. do we have to have a site covered in padlocks or something.
That might conflict with bondage.stackexchange.com
Or is that inappropriate?
21:15
na i saw your proposal for it on area51 i think its appropriate ;)
Eggselent
Actually, it would probably get merged with this one
71
Everything You Always Wanted to Know about Sex but were Afraid to Ask

Proposed Q&A site for anyone who likes sex and thinks it's a fun and pleasurable thing; anyone wanting to improve his/her sex life.

Currently in commitment.

there really are some strange proposals on area51 these days.
http://area51.stackexchange.com/proposals/11942/game-of-go

what the hell is the game of go?
It's fun stuff
I have a set, but have only been able to use it twice.
Hard to find people to play with me.
It's a territory control style.
looks quite complicated wiki article is as long as chess one
21:39
The rules are easy and not many of them. Lots of strategies.
Once AI solves chess, go is considered the next step.
05:00 - 22:0022:00 - 00:00

« first day (83 days earlier)      last day (5095 days later) »