The DMZ

Iszi

03:41

This guy is starting to frustrate me.

0

Q: I have windows, but I manage multiple websites. It is suggested to get a Mac or install Unix/Linux distros for security?

Since I manage multiple websites for my business, is it recommended to use a Unix/Linux distro, or get a mac for security purposes?

He hasn't been on any SE sites for more than 20 days (and that's only on SO - the rest he just joined today) so he probably should get a little newb slack.

But he's already got a question migrated from SO for being off topic, another off topic that's waiting to be nuked/migrated on RPG, one on SU that's a duplicate of another one of his own questions there, and then there's this one.

Iszi

07:07

@GrahamLee @AviD @RoryAlsop - Might you guys take a look at @techuser7777777's accounts, and see if we should take action on our end? He's been suspended on SU already, for an unknown amount of time. I'm not sure if that's just due to his multiple closed posts, or because he edited one of them to essentially say F*** StackExchange - for the latter, I'd have voted him be banned. In any case, I don't think this is a user we'd like to see back here any time soon.

Why can't I post?

That was odd.

Anyway, I was trying to say I found his account has been suspended for 7 days. For some reason, I missed that note earlier.

AviD

08:43

@Iszi closed it... yeah, he really looks like a fun user. We'll keep an eye on him, for now...

@RoryAlsop w0000t!! :D

@RoryAlsop looks like we take turns answering questions, and bumping up...

@RoryAlsop @GrahamLee, did either of you talk to powers that be at SEI - @Robert, @Rebecca etc - about getting on the list to move out of beta?

oo, lots of work to do that... gonna be fun :)

@Iszi re "mods taking action against flatly-incorrect answers", I'm not thrilled about the idea.

I mean, who's to say that any one of us happens to know best? As awesome as I am, I have been proven wrong from time to time... ;)

I think it best to let the community take care of that, as long as the answers are not improper. As I wrote on meta, you can always downvote it, comment to either the answerer or the asker, etc.

Rory Alsop

@AviD Heh

AviD

@Rors!

its early hours by you, innit?

<8am... on a sunday...!

Rory Alsop

It's my wife's birthday, and Easter, so we have a million hyper kids on chocolate running round

How you doing?

we have already completed baking rice crispie cakes for the day

AviD

@RoryAlsop oo fun fun

well, I have kiddies home all week, and all last 2 weeks...

Rory Alsop

I've adjourned to the computer room for a short while :-)

AviD

08:51

passover holidays

Rory Alsop

yeah - school holidays - who'd want em, eh

AviD

"adjourned" == "hiding"?

Rory Alsop

yep

at least my tree go back on tuesday

and I have the week off, so will actually get to see my wife for a bit

Will need to keep an eye on that techuser guy.

AviD

@RoryAlsop nice. compensates for all that lost time...

@RoryAlsop ayup, he looks like a real stand up guy

so, about going live... didja already talk to anybody?

I should we all try to swamp them?

Rory Alsop

Heh - I haven't yet - I wanted to make sure we were out of worrying on all topics then ask

swamping could be amusing - not sure whether good or bad

I think meta.so is the place to do it - or have you seen how others have done it?

AviD

08:55

I think robert expects it... especially from us

on meta, yathink?

dunno, I assumed to contact them in the lounge.

saw a few nudge via there.

Rory Alsop

oh - that would do it too. I'll ping em a note in about 3 hours, to make sure those Americans are awake :-)

and you reckon Robert is the best guy to aim it at? Thinking Jeff as well perhaps?

AviD

dunno...

Rory Alsop

stats are looking better and better

163

IT Security – security.stackexchange.com

Beta Q&A site for security professionals to discuss vulnerabilities like XSS, buffer overflows, SQL injection, CSRF, clickjacking, as well as system and network security. Discussions related to OWASP projects, tools, papers, and other materials are encouraged.

Currently in public beta.

AviD

ah no, dont think jeff. robert used to handle that, but then he got rebecca on staff, and then dori, and... well, I cant keep track!

Rory Alsop

it's a pity that stackapps thing (over in the starred box) doesn't quite seem to work for all the betas

I tried it out, and the owner was going to try and fix it

using it for graphing growth of some of the other sites is really useful

AviD

08:59

yeah, its cool... but hurts my head

Rory Alsop

hahahahaha

AviD

@nealmcb re the memcpy question... I'm really not interested in coddling the inflated egos of a bunch of "unix neckbeards", as @GrahamLee called them... If they are offended more that I suggested that something they do is not the correct way (since it causes BOs), or that MS is trying to help the situation a bit - well, I don't care.

I dont have time for religious wars, I'm too busy getting things done.

anyway, I gave up from all the inane shouting, and just had the question there deleted. It was obvious that those that were willing to answer, had no understanding of the issues, and it seemed that those who did, were too scared from all the personal attacks I was undergoing.

it's a shame really, but I've had that conversation with those types before.

it's just that its usually a bit more... civil.

I hate seeing people's brains so poisoned, that the mere mention of MS in a non-derogatory fashion completely clouds their vision, and they cant see the rest of the question.

Rory Alsop

It's a bit tough when the religious wars kick in - that annoys me as well. I'd far rather folks could be rational and accept that sometimes the evil enemy (Microsoft :-) does good things

AviD

ahhh... end of rant for me, thanks :S

@RoryAlsop agreed.

btw, there was one answer on the ITSec version of the q, from one of them...

5

A: Secure memcpy for pure C

Let's be clear here. insecure is a matter of context, not a case of "the use of" a specific function. If I use memcpy insecurely on a process running as a user with little to lose, no setuid or any such flags, the "worst" I can do is get a shell for that user and go from there. To achieve priv...

I found it condescending and sarcastic, but thats just because of his previous comments on the SO q.

no, not just because of that... but having it in that context, it really annoyed me.

that, and his double-talk worthy of scott adams.

Rory Alsop

Ahhh - I had wondered if there was history

AviD

09:15

as it was, his answer may have been good for a newbie C programmer, that didnt know what this "buffer overflow" feature was.

Rory Alsop

I actually considered his answer the least contentious of those posted at the time

AviD

and didnt bother answering the question.... except for trying to show me why I know nothing about security.

@RoryAlsop really?

Rory Alsop

well, I also liked Toby'S comment - "Stop using C/C++" is not a useful answer. The languages are the correct tool for the job in certain circumstances (mem/cpu efficiency sensitive applications or circumstances where you cannot require the distribution of a vm/framework)

AviD

I know I'm already annoyed about this, but I've waited a couple days in between, to clear my head... tried rereading it, still seems very argumentative.

@RoryAlsop Oh that I agree with.

I wish it were, but as I said to @thomas it aint gonna happen.

but the 2nd part of @Thomas' answer is very relevant - there IS a standard, but it wont be implemented any time soon.

@frankodwyer's answer was the least argumentative of the anti- crowd.

Rory Alsop

@Ninefingers answer was aimed at quite a low level, yes, but from an external perspective I didn't take it as being sarcastic or patronising. I thought he was trying to put info in that would be relevant to a large number of folks.

@Frank's was good - yes, sorry, I may have got fed up with the argument and gone away for a bit:-)

AviD

09:19

bottom line, @GrahamLee is the only one that actually gave me an actionable answer. though Im not sure how practical, given that it requires rewriting a sizable chunk of code

Rory Alsop

I didn't see it first time round

And have only just seen Graham's now

excellent stuff

AviD

@RoryAlsop dont blame you.

Rory Alsop

note to self - use (active tab) not just (newest) at top of page

AviD

I really try avoiding that type of issues, and if I wasnt involved in it, I would have tried to shut it down faster...

@RoryAlsop ?

Rory Alsop

@AviD yes?

AviD

09:22

@RoryAlsop i dunno?

1 min ago, by Rory Alsop

note to self - use (active tab) not just (newest) at top of page

Rory Alsop

yeah - quite often I browse questions by newest, which means you get the new stuff coming through, but sometimes means you won't see an active discussion

AviD

@RoryAlsop ah right

Rory Alsop

so although I had seen the argument when there were just a few questions on there, I hadn't actively revisited it

so missed a couple of the answers

AviD

yeah, our traffic is still low enough, that I try to catch all the updates.

does get to be a lot after a couple days off, though...

Rory Alsop

yeah - it varies around the day job though. Sometimes I'm much better than other times

Oh - on catching up with the Lounge - looks like we need to get a tipping point

:-)

think we got a good boost from B-Sides London

will have to try and keep that going any way we can

AviD

09:26

@RoryAlsop what, you think we need them all to be "Excellent"?

awww maaaan

Rory Alsop

it doesn't sound like that is mandatory - as the DIY site went live well before that, and the reason pointed out was that it had a tipping point in terms of usage:

12

Q: What are the criteria for getting Money.SE out of "perpetual beta?"

The Area 51 status for Money.SE reads thusly: This site will remain in beta indefinitely so it can grow; we will continue to evaluate its site statistics and overall health. Why the concern with how it's going now? If I recall correctly, other sites were launched before there were five "ex...

discussion

that graph was linked to by Robert

as a good example

as opposed to the finance one:

so it sounds like getting everything to excellent would do it easily, growth is the key one, which is why I was trying to hunt down apps to show me that data

For us, we should soon have three excellents (number of users is growing well, and we have direct control over number of answers per question and %age answered)

visits per day will grow with users

as will questions per day

AviD

09:41

hmm

@RoryAlsop having more users wont necessarily generate more questions, there are plenty of lurkers

Rory Alsop

sorry, yes - active users

AviD

I guess you're right, it comes back to that tipping point...

we'll get there soon enough, though - over half our traffic is already coming from google...

Rory Alsop

yeah - it has got dramatically better even over the last few weeks

AviD

ayup

Rory Alsop

a key is pinging out liks to the popular questions (not necessarily good ones)

ones which will attract folks in

AviD

09:50

heh, we could probably pull a crowd with my memcpy question, but I'm not sure we want to :D

speaking of, the user that gave that long answer, had his account removed from the site :(

drive by poster...

Rory Alsop

oh - I hadn't spotted that

AviD

my fault, I guess...

well mate, gotta go feed the li'l ones....

have a good week

bank holiday, is it?

@ScottPack @Iszi are US businesses also off this week?

Rory Alsop

yep - you too sir!#

bank holiday, then some royal wedding is happening next week so more holiday

(am avoiding the wedding by having a gig:

facebook.com/event.php?eid=177833228933941

AviD

10:37

@RoryAlsop cool, looks like fun

are you playing the wedding??

Rory Alsop

14:30

@AviD Hahahahahaha - can you imagine?

Scott Pack

@AviD Some might be, but it's not unversal.

Some places are closed on Good Friday, some on the Monday after.

My place of work isn't closed at all around this holiday.

My brother's is closed next week.

Rory Alsop

15:24

@Scott - as a contractor I was kind of hoping to work this coming week, as it'll be a zero income week, but in saying that it will be nice to spend a week at home for a change

Thomas Pornin

16:06

@nealmcb There is no much to add at that point. There is no Really Standard, Approved way of hashing passwords. Among the non-standard ways, you could do worse than using PBKDF2.

If I were to implement a system with password storage, I would first try to use PAM, so that the system can use external passwords -- e.g. an already deployed LDAP server.

Possibly, I would consider the passwords as part of a PAKE protocol such as SRP -- which specifies what should actually be stored.

Most of the time, the question "how should I store passwords ?" really means "I have already decided to do it the wrong way, how should I cope with it ?"

2

Rory Alsop

@ThomasPornin Too true! Then we get called in to assess it after go live... <sigh>

Thomas Pornin

@RoryAlsop "Stop using C/C++" is a way of stating that the contexts where C or C++ is "the right tool" are much rarer than usually assumed.

This is a classical question, doomed to end in flames

My answer fared quite well, actually. Some of the discussion was even informative.

Virtual Machines are a good example.

IBM wrote a Java VM entirely in Java (well, not "entirely" -- there is a native code loader, just like a bootloader for an OS).

I have already written VMs in Java, too (for a Forth-like interpretive language, for in depth debugging)

Rory Alsop

16:21

I thought despite there being some low value input, yours was good

After the first day of arguments I avoided that q for a while, but went back to it today after @AviD pointed out it had settled down

now I'm in two minds about that q - it attracted more attention, sure, but was a bit of a battle:-)

Thomas Pornin

Also, once, I was challenged with an embedded platform with only a sub-standard C compiler (an old GCC with a skeletal library), and I had to implement some heavy stuff it for it (PKI, SSL server, X.509 validation...).

So I ended up with writing my own Java virtual machine.

It was a lot more fun, and I daresay more secure, than rewriting X.509 validation in C.

@RoryAlsop I think it is a fine question -- it demonstrates that such an inflammatory concept can be debated with minimal heat on security.stackexchange.com

Really, it went about as well as it could

Iszi

16:53

@AviD Some might be shut down for one or two days around Good Friday or Easter, but there's never a universal week-long shutdown.

@AviD Sad thing about downvotes is they don't override an acceptance. Accepted answers stay on top.

Graham Lee

17:06

hello again

Thomas Pornin

hello

Graham Lee

@AviD Do you know about CERT guideline STR08-C "Use managed strings for development of new string manipulation code"?

hey @ThomasPornin

So all of the questions asked today have been closed? Classy.

Rory Alsop

17:28

Hey @Iszi and @Graham

happy zombie jesus day :-)

2

(best tweet I saw all day)

Graham Lee

@RoryAlsop thanks for reminding me it's the day that the dissident nailed to the plank brings us all rabbit eggs made of chocolate

2

...or something. Never did understand the details.

nealmcb

19:06

@AviD Yup - more than enough said ;)

nealmcb

19:41

@AviD Can you clarify "had it removed"? Did ninefingers remove his own account? Did someone else remove it? I assumed his answer just came from SO.

Rory Alsop

19:56

@nealmcb I only just noticed his account had gone - refresh must have been slow here

I thought his answer was okay, tbh

nealmcb

So you're sure it was here in the first place?

Yeah - I thought it was a very good answer.

Rory Alsop

@nealmcb Oh yes, he even appeared on chat once, I think

nealmcb

I guess if an answer is transferred along with a question from another site, the user shows up as a ghost

Why would someone delete an account?

Rory Alsop

@nealmcb dunno - if it's one you don't use you just ignore it, surely

nealmcb

And can they reclaim it later?

Rory Alsop

19:58

now that I dunno

frankodwyer

20:23

that's strange...never seen that happen with an SO / SE account before

Iszi

@nealmcb You can't delete your own account, but you can request the mods (and I think this goes even above diamond-mods) do it for you. Essentially, it's just saying "waaah, I'm taking my ball and going home".

0

Q: How do I actually remove my account?

I've seen some people vanish from rpg.stackexchange.com so I assume there's a way to delete the account, but I can't seem to find said mechanism. Note, I only want to remove from rpg, not from the whole stackexchange/stackoverflow/et al suite.

support

Actually, it looks like diamond-mods can do it, too.

frankodwyer

thinking maybe this q could be reopened if the last 2 sentences were edited out? security.stackexchange.com/questions/3293/…

Rory Alsop

@frankodwyer I think you're right - lemme quickly have a tweak

Iszi

@frankodwyer Nah. It's still fairly subjective and really doesn't actually address any problem.

frankodwyer

well, 'top 10' is subjective i guess. but examples of breaches probably useful to many people.

Iszi

20:31

According to standard-issue SE FAQ: You should only ask practical, answerable questions based on actual problems that you face.

Rory Alsop

thinking I could edit it to ask for examples of high value breaches, along with info on that value

that should work, no?

could still be a bit CW though

Iszi

I don't think a history question is really an example of a "practical...question based on actual problems that you face".

Rory Alsop

hmmm - I was looking at it more along the lines of - people have a lot of difficulty arguing for security, as it has no obvious ROI, so impact information is often all we have

actual problem - yes. Practical - a bit, maybe

frankodwyer

@iszi well i guess the question is about getting business buy in for security - no doubt someone will come and ask it from a better perpective sooner or later tho.

Iszi

Maybe make that just a bit clearer, and I can see the logic.

Rory Alsop

20:34

lemme try and sort the wording - you can shoot me down later :-)

Iszi

@RoryAlsop Blasphemous as it may be, I love it!

You should have re-tweeted it so we could pass it around.

Rory Alsop

@Iszi I will after my next G&T :-)

Iszi

@RoryAlsop G&T? Gin & Tonic?

Rory Alsop

ayup

it's happy zombie jesus day - G&T works after dinner and before the whisky

Iszi

Oh, right. It's what? 2038 for you?

frankodwyer

20:39

on similar topic “@FAKEGRIMLOCK: HAPPY "ROMAN NEWBS FORGET TO CAMP JESUS'S RESPAWN POINT" DAY!” (via Twitter)

Rory Alsop

@frankodwyer that's excellent

nealmcb

@RoryAlsop Excellent work!

Ninefingers

@nealmcb I can clarify that situation. I asked team@so to remove my own account. The reasons for that ought to be self-evident if you have a look at the chat history here for the past 24 hours and the comments on my answer (now edited).

Iszi

@frankodwyer - Are you @frankodwyer on Twitter as well?

nealmcb

@Ninefingers thanks for the clarification. I want to do what I can to make this a place where folks like you with valuable input enjoy contributing

Ninefingers

20:53

For the record, I didn't comment at all on the StackOverflow question. I initially voted to close it as a result of the ensuing argument. I then asked a mod to sort out the comment thread as it degenerated into personal attacks

frankodwyer

I'm fodwyer on twitter

nealmcb

@Ninefingers so some comments were deleted? It seemed like it. Anyway, if you see more stuff that deserves deep-sixing, let us know. And thanks for your answer.

Ninefingers

@nealmcb On SO yes, by Bill the Lizard at my request.

frankodwyer

@ninefingers - why remove your account tho? was it cos of stuff on SO or here? stuff on here seemed like it was civil to me, maybe i missed something

Ninefingers

Being accused of rhetoric, condescension and sarcasm is very borderline behaviour for a moderator. Being described as worthy of a dilbert comic is downright rude.

nealmcb

20:57

@Ninefingers +1

Ninefingers

Check your chat log.

nealmcb

I have. I've also discussed this at some length before here, in an effort to defuse it.

frankodwyer

sorry, didn't follow the chat...thought it was something on the question that i missed

nealmcb

But I didn't recall any over-the-top comments in the actual site before, though I didn't look at the SO question much at all. Anyway, I gotta run now - but hopefully we can learn from this....

Ninefingers

I also take objection to the now edited comment made on friday describing Rook's profession as "the lowest level of security research". @RoryAlsop stepped in on that one.

frankodwyer

21:01

jeepers. well i thought that compared to the SO q, the responses on here were much better. a range of opinions sure but pretty civil i thought. but like i say i didn't see it all.

best response is to flag it tho, no?

Ninefingers

Don't get me wrong, Rook definitely stepped over the line first, but there was no need for any retaliation.

Also, add chat.stackexchange.com/transcript/message/862831#862831 to my list of complaints.

I assume that comment is also in reference to Rook, given the earlier remark about CVEs.

@fr

@frankodwyer I did flag the offending remarks. I also appeared to have lost flag weight as a result.

Rory Alsop

21:16

@Ninefingers we do try and keep the peace where possible, when we see it in time. I think @frank is right: our signal to noise ratio here is not too bad and we do usually get around to flags pretty quickly

I thought your answer was well thought out, and hopefully the response you had won't stop you participating

Ninefingers

21:30

@Rory The problem isn't the single response. As I said, it's borderline. The problem is that here, on a public forum, my involvement in Stack Overflow was misrepresented, I was described as one of the "unix neckbeards with inflated egos". Specifically "one of them".

Rory Alsop

ahhh - gotcha. I did read that and not see where that had come from on here or the remnants of the SO bit.

Ninefingers

this: chat.stackexchange.com/transcript/message/878567#878567 and this: chat.stackexchange.com/transcript/message/878569#878569

Rory Alsop

Okay - didn't read that into it - in reading the chat history, I think I maybe either missed it or just wasn't rising to it

As I hadn't seen the SO history I wasn't really in a position to comment on that

Guessing it was pretty full on flamewar though, huh?

Ninefingers

@RoryAlsop Yep. I didn't comment on the question itself at all. I voted for it to be closed, flagged it (for the comments) then directly contacted a moderator. I have no involvement in the original SO question apart from a slight rewording of my answer which was copied there after a reopen.

Rory Alsop

gotcha

Ninefingers

21:42

@RoryAlsop It has been deleted on SO and I don't quite have sufficient rep to be able to see it, but I don't think much of what I said was any more or less argument worthy than here. I condensed the initial part I think, that's about it.

Whilst we're at it, status of C99 support in MSVC stackoverflow.com/questions/2812433/… and stackoverflow.com/questions/139479/…

Rory Alsop

To be honest then, I am glad you are here discussing rather than giving up on the place, and that hopefully you are sticking around. @AviD is regularly on here and is generally a good bloke, although by his own admission he said he got very wound up by the SO end of things...so hopefully you guys can bury the hatchet.

@Ninefingers Ahh - good to know, cheers

right - got to tidy up and try and get to bed before midnight for once :-) Hope to catch you again.

Ninefingers

21:59

@Rory I decided the speculation might be more unhealthy than an explanation from my point of view. Make no mistake though, I am still massively offended by the situation as a whole. It goes completely against the "be nice" principle.

@Rory I would in the strongest possible terms advise that this kind of event should not ever be repeated, especially by moderators. This chat log is publicly available and does not require login (although as an anonymous user you cannot actually talk), so anything that occurs here will negatively impact the site as a whole.

Ninefingers

22:16

Right, I've stomped my foot enough for now. I'm off to write fully ISO/IEC 9899:1999 compliant C using ed (but make no mistake, I'm only using ed because my butterfly supply has run low) making sure to introduce lots of buffer overflows with memcpy, trim my neckbeard and read dilbert for tips on how to inflate my ego.

2

Transcript for