The DMZ

Rory Alsop

18:06

never got the chance :-(

tempted to close this one. What say you guys:

0

Q: What is the method used by china hackers to hack the NY time?

and another thing is that Is there any evidence that these attacks were launched by china except the proxy? how they gain the access to enter in to the server?

Gilles

@RoryAlsop if we allowed questions about CRIME before the attack was made public, why not this one?

Rory Alsop

@Gilles well, it's just badly written, shows no research at all, and just seems crap... but I wanted to see what others thought

Gilles

@RoryAlsop feels like a reason to downvote, but not to close

Rory Alsop

@Gilles fair enough - shows asking here was definitely a good thing (tm)

:-)

@Gilles - on that note, what do you think of this one?

0

Q: Do javascript:// URLs allow XSS?

I found out that I'm using a markup processors that allows users to include arbitrary links, as long as they contain a "netloc" (// after the first :). Due to the myriad of exploitable protocol handlers, this is certainly a bad idea. But does it allow XSS on a system without vulnerable protocol h...

xss

Iszi

18:23

@RoryAlsop Looks like a crap question, but not quite close-worthy.

phihag

@RoryAlsop Close first, ask later, eh? (Ok, I'm not particularly impartial on that)

Could you elaborate why it is crap?

Gilles

@RoryAlsop uh? @phihag clearly doesn't understand XSS. The proper response is to explain that if something is part of the page itself, it's not cross site scripting. What's unclear about the question?

Rory Alsop

@phihag generally ones that are flagged up for attention I'll have a look at and close if relevant. If I just come across one that I think is close-worthy, I'll usually ask the folks in here first, as there is no way around mod votes being instant :-(

phihag

@Gilles The input comes from a user, and the web app is re-rendering it (but wants to allow only formatted text). Isn't that the generic XSS example?

Rory Alsop

@Gilles I think @TildalWave explained it nicely :-)

Gilles

18:27

@phihag if you allow an external source to generate that link, then yes, it's XSS

a javascript: link isn't “formatted text”

phihag

Gilles: Sure, but that wasn't the intention of the library I'm looking at - it just wanted to allow arbitrary schemes, such as tel: and mailto: , but decided (foolishly) to declare all schemes with netlocs as safe

Gilles

@phihag ok, then it's a major bug in the library

phihag

@RoryAlsop Ok, it just wasn't obvious at all for me - I should have asked you guys earlier. And since when is answering your own question not explicitly called for?

Iszi

When was IT Security (full site) actually launched?

Gilles

Oh, and I shouldn't have said that you “don't understand XSS” earlier — I hadn't noticed you'd self-answered

sorry about that

Polynomial

18:31

@Iszi the public beta started on 2010-11-18

Rory Alsop

@phihag no - answering own questions is actually encouraged :-)

Gilles

@Iszi http://security.stackexchange.com/q/1

Polynomial

@Iszi reference: area51.stackexchange.com/proposals/8431/it-security

Iszi

@Polynomial Ok. I want the part after that - when we got the shiny new makeover.

Gilles

or did you mean graduation from beta?

Rory Alsop

18:32

@Iszi 12 July 2011

Gilles

I don't think the switchover is tracked, but look for the design threads

phihag

@RoryAlsop In any case, then please close it as off-topic in order to not confuse anyone else.

Iszi

@RoryAlsop Where do we get that info (aside from the first question)? I can't find it on A51.

Gilles

@phihag it's not off-topic

Rory Alsop

@Iszi - I cheated - there is a shiny button in the mod analytics tool

Iszi

18:33

@Polynomial Can't find that on A51 either.

Gilles

it shouldn't have been closed

Polynomial

@Iszi right hand fixed-width column, look at the Public Beta date

highlight the "2 years ago" text, it'll show the exact date/time in the hover text

that's the case for almost all durations on StackExchange

Rory Alsop

@Gilles you think it is on-topic and relevant? Happy to reopen if told - I'm sure half my job as mod is being told "You got it wrong - reopen" :-)

Iszi

@Polynomial ...except the Launched date. Interesting.

AviD

@RoryAlsop and to the anti-security devs too - android is wide open, for the most part.

but yeah, definitely much more customizable.

there are a few things I would like to change in my WP7, that I dont have the option to - but these are mostly little irks, and really not a big deal. (or perhaps, might need to develop an app to do it for me, at which point it's just doesnt bother me enough...)

Gilles

18:40

@RoryAlsop yes, sure. How is XSS not on-topic? And what's unclear about the question?

It's not a very interesting question, but they can't all be gems

Rory Alsop

@Gilles I didn't read it as XSS - but agreed with the flag: that it was more of a query as to why javascript URL's behaved like that

AviD

@RoryAlsop @Iszi I disagree? I think there is a solid question there, and it was asked pretty decently. I dont understand what you guys see there that bothers you?

Rory Alsop

reopened - @phihag, can you add some of the content you described here in your discussion with @Gilles into the question.

Iszi

Couldn't help but share our migration frustration, here.

Note: Migration paths on graduated sites aren't even guaranteed for awhile. IT Security has been live for about a year and a half, and we still don't have options other than IT Security Meta. — Iszi 10 mins ago

@AviD I don't believe I've commented on that question. I was talking about the one @RoryAlsop posted earlier.

Rory Alsop

@AviD those are 2 different questions

AviD

18:44

@Gilles unfortunately, XSS is not always about "cross-site". It should be known as "HTML Injection" (or "Script Injection"), but XSS is the generic term for this. Sadly.

Rory Alsop

@Iszi good man!

Iszi

@RoryAlsop Really loved being told to do what we've already done five times over.

AviD

@Iszi ohhh. Sorry (btw I think @phihag thought your crap comment was on him)

Iszi

Oh, sorry about that. No, @phihag, I was saying this question is pretty crappy as-is.

Rory Alsop

@Iszi upvoted your comments

phihag

18:46

@AviD No, I did understand. It's not my first question on SE.

AviD

@Gilles I second that.

@phihag apparently it is mine.

Scott Pack

@Polynomial What type of regexes are you dicking around with now?

AviD

Or maybe my (markdown) reading comprehension just sucks today.

Polynomial

@ScottPack haha, it's for username validation.

Gilles

@AviD yeah, cross-realm, but cross-site is the common case

Scott Pack

18:48

@Polynomial No, I mean is it pcre, posix, yourmom?

Polynomial

@ScottPack it's for PHP, so PCRE, I believe.

Scott Pack

@Polynomial You can use the carat to do negation in pcre

Polynomial

only in character classes.

I need to say "don't allow two spaces in a row"

[^\s] matches anything that isn't a space character.

my solution works efficiently anyway

Scott Pack

(?:[^\s]{2}) ?

AviD

@Gilles not necessarily even cross-realm. What about persistent XSS? same realm.

Gilles

18:50

@AviD What's persistent XSS? (I'm not a web sec guy)

Polynomial

@ScottPack that matches any string that isn't two spaces in a row. not quite the same :P

phihag

Ok, thanks for the details. @RoryAlsop, I added some details from our chat to the question, and renamed it in order to reduce confusion

Iszi

WTF? @RoryAlsop @AviD @JeffFerland - I thought you guys had brought this up to SEI a few times by now?

@Iszi Fantastic. First time I'm seeing these, but I'll take a closer look. Thanks for the links. — Anna Lear 51 secs ago

AviD

@Gilles XSS stored in the app's database (or such)

Polynomial

@Gilles content stored persistently (e.g. in the db) that results in an XSS when displayed back in a page.

Rory Alsop

18:51

@Iszi yup - dunno if it was specifically to Anna, but yes - raised it in TL a few times

Polynomial

so for example if you sign up and can put an XSS in your username, it'd throw that XSS in whenever a page showed your username

AviD

@Iszi hehe, yes, we did. Dont know specifically @Anna, but it was raised.

Gilles

@AviD so still cross-realm then, if the content didn't come from the application

AviD

@RoryAlsop Damn you.

Scott Pack

@Polynomial So you want to match any string that doesn't contain two consecutive spaces?

Polynomial

18:51

@ScottPack precisely.

Gilles

ok, if it's the right content in the wrong place, cross-realm doesn't apply

Iszi

That's it. If/whenever I run for mod again, I'm making that a point in my campaign (presuming this actually happens now) - that I got the migration options done.

AviD

@Gilles It is coming from the application, since I consider the database part of the application.

Rory Alsop

@phihag Thanks, and my apologies. The good thing is that the community corrects us mods when we do get it wrong :-)

AviD

@Iszi good luck with that.

and if you dont, do we get to behead you?

Iszi

18:53

@AviD Only if I'm last in line. :-P

Rory Alsop

@Iszi Ubuntu.. go, now:

askubuntu.com/election

Polynomial

@ScottPack but my method works equally as well. the first part checks for any string that matches [a-zA-Z0-9\s] but with no leading or trailing spaces. if that matches ok, the second part checks the full repeated [a-zA-Z0-9]+\s? pattern with a non-space at the start and end.

Jeff Ferland

@Iszi Yeah, I tried that too. Still don't have options. :(

Scott Pack

@Polynomial I still refuse to believe there isn't a better way.

Gilles

@Iszi Migrations are only opened to the community if there are enough happening

Polynomial

18:54

if I don't do the first check, it has to do some horribly inefficient checking (100k+ steps)

Gilles

if there's a migration a week, custom flags are good enough

Iszi

@RoryAlsop Oh, not at all. Don't have enough expertise to feel anywhere near qualified. Thanks, though.

Gilles

10kers can see migrations from the past 3 months at security.stackexchange.com/tools/posts/migrated/away

Rory Alsop

@Gilles Certainly as mod workload, migrating ones that are flagged to us here is not a problem, however we know the common destinations, so it can be easier just to have them implemented

Gilles

for example, in the last 90 days, AU has migrated 2 questions away to U&L, 2 to SO, 1 (rejected!) to SU and 1 to TeX. That doesn't warrant a migration path

Mind, I'm surprised at the low figure to U&L, what with the Mint questions AU gets

Rory Alsop

18:57

whereas we have had 41 migrations

Gilles

3

A: Can we finally sort out our migration sites?

Latest data from last 90 days: 15 Crypto 12 SU 9 SF 7 SO then some others to UL, Ux and CS

Rory Alsop

and about the same to us

Gilles

there are no migration paths to beta sites, so Crypto is out

David

Morning everyone.

Rory Alsop

@Gilles might need to update that

Gilles

18:57

4/month to SU isn't strenuous

Rory Alsop

Crypto is now in second place

Iszi

@Gilles While I was not party to the TL discussions, none of the five meta threads on the topic have received a response from SEI that clearly indicates this.

Rory Alsop

@Gilles that's what I said up there^

3 mins ago, by Rory Alsop

@Gilles Certainly as mod workload, migrating ones that are flagged to us here is not a problem, however we know the common destinations, so it can be easier just to have them implemented

Gilles

@Iszi I don't know what the threshold is, but it's roughly “becomes a non-negligible proportion of flags”

Rory Alsop

Its now SU, Cr, SO, SF then way lower we have CS, Webmasters, U&L, Meta and Bitcoin!

Iszi

19:00

@Gilles Of course you don't know what the threshold is - SEI almost never reveals that part of the recipe.

Scott Pack

Do we know why the refusal to act, even given a preference for migration loads? If anything it seems to me that, considering our outbounds have been so consistent, that it just sends the message that the site isn't important enough.

Iszi

@RoryAlsop @AviD @JeffFerland - Out of curiosity, what does the mod interface for migrating look like? There's a lot of SE sites now, so I imagine it could be quite a mess.

Jeff Ferland

@Iszi We just type in the name

Rory Alsop

@Iszi it's a search box

autocompletes

Iszi

@ScottPack I think that's pretty much what I'm saying. If there's a reason, give it to us in our Meta, where all our users can see it, so that we know to stop asking.

Rory Alsop

19:01

@ScottPack those top 4 have been consistent throughout, yes

Lucas Kauffman

I guess we shall have to march on New Yorks SE office...

Scott Pack

@RoryAlsop Then that pretty much solves it all. Migration list is 5: 4 sites + meta.

Lucas Kauffman

5

Scott Pack

@LucasKauffman As a Gen Y'er I feel the need to decline. That sounds hard.

Iszi

@LucasKauffman I thought activists these days were more into the teleworking thing?

Lucas Kauffman

19:06

@Iszi nah, we just tend to kill ourselves sometimes...

AviD

@LucasKauffman Oh that is just adorable.

@ScottPack Y? Aren't you X? And where is the cutoff?

Lucas Kauffman

@Iszi too soon?

Scott Pack

@AviD Good question. To the Wikipedias!

AviD

@ScottPack NOT @ISZI!!!

Scott Pack

@AviD It looks like we are, at that. Oh well, it's not like we're any less apathetic.

> Demographers, historians and commentators use beginning birth dates from the early 1960s to the early 1980s

AviD

19:08

@ScottPack the 60s? really?

So what does that make @RoryAlsop? ;-)

Scott Pack

@AviD I think the idea is that GenXers are the children of Baby Boomers.

Rory Alsop

@AviD quit it, you :-)

Lucas Kauffman

@AviD Gandalf?

Rory Alsop

@AviD - I'm still planning on having a social drink with you in a month's time

Scott Pack

That's generally considered 1945-1950 (I think). So if they were having kids at 20-35....

Lucas Kauffman

19:10

on the other hand @RoryAlsop loves nature so maybe more of a Radagast

AviD

@RoryAlsop yeah baby!!

Rory Alsop

@LucasKauffman I'm down wid dat

Scott Pack

leans back and imagines @RoryAlsop driving a rabbit sled

Yess.....

AviD

@RoryAlsop I think I'm the next oldest one of the regulars here, after you.

Ah well, other @Rory too.

Rory Alsop

@ScottPack I'm sure I have a picture of me doing something like that :-)

AviD

19:11

now that @neal doesnt hang around us anymore...

Scott Pack

Sometimes I miss Neal. I think we ran him off with our off-topic shenanigans.

AviD

@ScottPack as opposed to our on-topic shenanigans?

reallifecomics.com/archive/130131.html

Scott Pack

So is Neal our Tony?

Rory Alsop

@ScottPack I'll view him in a totally new light :-)

AviD

maybe we should get him back...

@RoryAlsop you should superping him.

repeatedly.

Rory Alsop

19:16

I should ping him? But I am watching over a rather nice looking pasta bake...

to feed my minions

:-)

surely any mod could do that

(not feed my minions, obviously)

they are dangerous - and have teeth and other weapons

Thomas Pornin

@AviD At that time they had not invented letters yet.

Rory Alsop

@ThomasPornin :-) we had urgh, argh, and eeeeep

(the latter caused by bouncing the stone club off any delicate part of one's own anatomy)

Iszi

@AviD That's been a fun arc.

Rory Alsop

@Iszi definitely - I like Tony

In Metaltech, I am Tony - expand the BIOG section here: facebook.com/metaltech/info

AviD

@RoryAlsop nice. Liked.

@LucasKauffman note the nipps on their FB page.

Iszi

19:30

Wow. Who knew a tie in a logo could be so controversial?

nbcnews.com/business/…

Interesting quote here, too:

> "I don't know for a fact, but I strongly suspect most companies operating in Florida are business casual,"

Lucas Kauffman

@AviD what?

Iszi

I recall our Director saying that, at an Agency-wide conference, the Floridians stood out as being dressed much more casually.

AviD

@LucasKauffman facebook.com/metaltech, scroll down

Gilles

Do programmers and sysadmins wear a tie in the US?

Lucas Kauffman

ooh boobies

Jeff Ferland

19:32

Well, how we close questions is going to change a lot in the next 2 months

AviD

@Iszi huuhhh?? Women can wear ties too.

Jeff Ferland

@Gilles Only in banks and such

Gilles

In France, the only guys in a software company who wear a tie are the sales people, if they're meeting customers

Jeff Ferland

... or CPA firms :(

Iszi

@Gilles Not usually this far south.

Lucas Kauffman

19:33

@RoryAlsop if you buy a tshirt, do you get whats in it as well on that picture?

AviD

when I travelled, I would (almost) always suit up, tie included. Especially in Europe.

But then, I was a consultant, not programmer.

@JeffFerland whys that?

Iszi

@JeffFerland Eh?

Lucas Kauffman

meh depends, I never wear a tie unless I have to present something to clients who's positions start with senior or chief

Jeff Ferland

@AviD Big discussion going in Teachers' Lounge. Off-topic, for example, will have site-specific subreasons

Lucas Kauffman

or if the client really wants it

Jeff Ferland

19:35

Questions will say, "On hold, needs improvement" or some-such rather than closed.

AviD

@JeffFerland ah that.

oh gorramit, is the chatcast on now?

Jeff Ferland

Yes

AviD

forgot about it. joining now.

Lucas Kauffman

chatcast?

Thomas Pornin

@LucasKauffman A chatcast is SE people talking about themselves.

Lucas Kauffman

19:37

aha I see

Scott Pack

@Gilles Our programmers and sysadmins wear jeans and a polo or button down more often than anything else. When I go to lunch with our systems guys I usually stand out as being over dressed in my khaki slacks and button down. Or this time of year a collared shirt under a sweater or pullover.

Gilles

Do you wear a tie for a job interview?

Scott Pack

Definitely, more likely a suit.

Gilles

I wouldn't

not for a dev job

Iszi

@Gilles Most times. I don't wear a suit often, though.

Sweet. We have a commitment to a response.

@Iszi Certainly. I will respond one way or another. :) — Anna Lear 2 mins ago

Scott Pack

19:43

@Gilles I wouldn't ever interview for a dev job.

Thomas Pornin

@Gilles I would, but that's because I look good with a tie.

Scott Pack

@ThomasPornin Or, at the least, anachronistic.

Stack Exchange

Blog - Stack Exchange: Podcast #42 – It’s The Exception That Proves The Rule

Alex Miller on February 05, 2013

Welcome to Stack Exchange Podcast #42 – it’s our usual gang back this week with Joel, Jay, David, and Producer Alex. There’s plenty of inside baseball, so put on your rally caps and make sure to stick it through to the end!

David Mamet, apparently. Jay was a drama major.

Michael forgot to pay the Google bill, so our hangouts are back down to 10 person limits (but its fixed now!)

We have one big thing to talk about that made a change and generated controversy. Joel correctly guesses what it is: we no longer display your accept rate (the percentage of questions you asked that you accepted an answer for). …

Gilles

@ThomasPornin hmmm

3

naaah

Iszi

@Gilles I move that @ThomasPornin replace his avatar with Yogi, and @ThomasLeek with Boo-Boo. Anyone second this motion?

5

AviD

19:51

@Iszi (my star represents my seconding. I recommend you all do the same.)

Iszi

20:06

Wow. I just had to type a four-letter acronym starting with an N and containing an A. My mind had me auto-type NARQ.

^ Sign I spend too much time on SE.

AviD

@Iszi okay, if we add up the stars and add the two commenters who cant star their own post, we're up to 8 voting for new bears.

Scott Pack

AviD

Two more and I will mod-replace his avatar for them.

2

Scott Pack

Ok, that was way more work than it should have been.

AviD

@ScottPack lol

Iszi

20:08

@ScottPack -FACEPALM-

AviD

@ScottPack yes, and I assume you enjoyed every second of it.

Scott Pack

Meh. If I had properly enjoyed it I would have done a better job. Put the ties behind their hands, stripped off the back bit, whatever that's called.

Thomas Pornin

@AviD Mods can do that ?

Iszi

@ThomasPornin How else are they supposed to handle Pornin avatars?

AviD

@ScottPack your attention was probably placed elsewhere in the picture.

@ThomasPornin you think @Iszi likes his green square? @JeffFerland and I keep putting it back every time he changes it, just to mess with him.

Scott Pack

20:12

@AviD Notice how the guy on the left is plagued with hairloss?

AviD

@ScottPack NO.

@ScottPack I keep reading that as ""tied their hands behind their backs, stripped them bit by bit...". Sick, you are.

Rory Alsop

@LucasKauffman oops, forgotten about that :-)

Gilles

@ThomasPornin mods can see and change every editable field in your profile except the openid

being able to change the picture without changing the email is a recent thing

40

A: Support disabling Gravatar on Stack Overflow

We will be rolling out an alternative to Gravatar in the next couple of weeks. You'll be able to either use Gravatar or upload your own picture from your computer - or switch between the two whenever you like. This feature is now live: Please try it out and report any bugs you find.

AviD

@Gilles hahah, really forgot about that. I was totally trolling...

Lucas Kauffman

Y U NO SERIOUS @AviD

AviD

20:22

@LucasKauffman I have powers I did not even know about.

NOW LET THE GALAXY TREMBLE BEFORE ME.

I promise to tremble right after the galaxy does.

Tom Leek

@AviD OH. I'D BETTER CANCEL THE TWO THUGS I SENT TO BREAK YOUR THUMBS, THEN.

Scott Pack

@AviD The galaxy always trembles first.

AviD

@TomLeek heh, good luck with that one. Hope they catch me when I'm asleep.

Scott Pack

20:41

@AviD They'll just call in Dr. Ruth.

AviD

ouch.

Scott Pack

She knows the terrain and you'll never see her coming.

Polynomial

21:07

bah, metasploitable is no fun. used the samba exploit and got a root shell in less than a minute :(

g3k

ms08-067 for the win

Scott Pack

ms03-049

Polynomial

^

in this case it was CVE-2007-2446, since it was smbd.

Rory Alsop

@Polynomial the oldies are often the best

Polynomial

@RoryAlsop indeed. sadly it meant I got a root shell in no time and didn't end up having much fun with it :P

Scott Pack

21:29

Root shell?

Rory Alsop

@ScottPack it's a unix thing :-)

Scott Pack

Right, he's talking about compromising a Windows box.

Rory Alsop

yeah, but just cos Windows uses the wrong name ... :-)

(okay I got confused, despite the use of the word Samba, and the MS numbers...)

Polynomial

@ScottPack no, I'm rooting a Linux box running smbd.

this Metasploitable instance runs smbd (Samba daemon)

Scott Pack

Whatever.

Polynomial

21:36

CVE-2007-2446 doesn't have an MS number because the bug doesn't affect Windows.

also, I just found a 0day in an Android app.

full remote root shell, too.

Lucas Kauffman

@Polynomial is your device rooted?

Polynomial

yes.

Gilles

U&L is usually better than most non-Sec.SE sites at security, but ouch

Lucas Kauffman

tssssk tsssk

Polynomial

the app requires root in order to run

Gilles

21:41

3

Q: Writing /dev/random to file?

If you ran the following, what would happen? cat /dev/random > ~/randomFile # don't run Would it be written until the drive runs out of space, or would the system see a problem with this and stop it (like with an infinite symlink loop)?

kernel devices random

Lucas Kauffman

@Polynomial is it a special app?

and will you be selling it on the black market D: ?

Polynomial

it's a samba filesharing app

I'm emailing the creator now

g3k

Anyone use an all in one wifi site survey tool/tablet/etc? AirMagnet has ignored our request for a quote.

Scott Pack

Too bad, it's a good system.

Lucas Kauffman

@Polynomial aha I see ransomware, good thinking!

:P

g3k

21:57

Captain Crunch?

:P

Rory Alsop

@Gilles oh dear

Gilles

@RoryAlsop hmm, on second reading it's not that bad

Rory Alsop

@Gilles - well, compared with the sensible versions...

Gilles

except for vonbrand's comment

sure, it's a useless use of dd, but that's not a hanging offense

Rory Alsop

I thought your comment was about vonbrand

Lucas Kauffman

22:06

@Polynomial ah poly before I forget, have you put captchas on your flag submission field?

Polynomial

@LucasKauffman I'm still working on the new version, but that's one of the features I have on my list.

Lucas Kauffman

hahaha

NSFW: i.qkme.me/3sv0sz.jpg

Gilles

@LucasKauffman this is the scariest picture I've seen in a long while

Polynomial

@Gilles It's the teeth that freaked me out.

Gilles

22:21

@Polynomial ditto here

AviD

@LucasKauffman Do I want to google that? I dont want to google that, do I...?

Or I could Bing it. I could bing that sh*t.

Iszi

@AviD You most certainly don't want to Google that - especially if you're at work.

Gilles

@AviD I thought you worked from home

AviD

@Iszi I work from home.

but still...

@Gilles and, sometimes kids around... not now, but sometimes.

Iszi

@AviD Well, then... not while VPN'd into an employer or client's network.

Gilles

22:30

@AviD well then, you can explain that word to them...

AviD

@Gilles hehe, nooooo

wiki'd it. Not as bad as it could have been, worse than would have been appropriate.

seems there is also a noodle dish known by that name.

Gilles

@AviD why, what do you have against Japanese cuisine?

Iszi

@AviD "Noodle" dish... right...

AviD

@Iszi hehe. Really, "noodle"?? Tsk, tsk.

But really, there is.

Transcript for