« first day (848 days earlier)      last day (4330 days later) » 
00:00 - 10:0010:00 - 00:00

10:00
@AntonyVennard The one I've got. Great stuff... LEDs died long ago but it's still working flawlessly. Shame it's not GB tho (oh, and a huge stable power brick, you don't get those anymore)
@RoryMcCune That's an insane download speed, and yeah, that's a good reason to need Gbit!
@TildalWave Mine has gigabit. I wonder if they changed the version scheme or something?
@AntonyVennard ah gs sorry
@TildalWave Ah I see, you have one of the 100Mbit ones. It's essentially the same indestructible blue case, just it does gigabit.
We had a 10Mbit one at home back when I was little and that was all you could have.
@AntonyVennard it just looks exactly the same as mine that's why I confused the two ... mine is fs105
@TildalWave Aaaah okay. Yep, it looks the same as the one we had 10 years ago, I don't think the design has changed much.
10:06
@AntonyVennard Netgear is pretty solid stuff, just stay away from those cheap white plastic ones that look like some LinkSys rejects
@TildalWave I hate those just on their look. Not geeky enough by far!
@AntonyVennard it's not just the looks it's also features... they just seem like they have completely separate QC... I couldn't even setup port-forwarding for HTTP on one (those really popular ones, whatever was their name) and moving the IP in question to DMZ didn't help either. Half of the packets were lost gowd knows where, so I gave up debugging, pulled it out and gave away one of mine for free just to save myself from headaches
@rorym .... But ... But ... No fair. I was impressed I can now get 2.3Mb down....... :-(
Need to do you a deal on point-to-point wireless link, maybe....
@TildalWave Really? Ah okay, thanks for the heads up! I've always avoided them based on the look factor alone...!
10:30
@RoryAlsop cheers for taking on my suggestion for the edit! ;) now let's wait for the chooo chooo :))
Although, that "Remember, as the defender, you must win 100% of the time. A hacker only needs to win once." seems to be winning the hearts over faster
10:47
Was browsing onwards from the overclocking proposal and I see that lock picking is close. We just need five more questions to reach ten upvotes. Must be doable.
133
Lockpicking

Proposed Q&A site for study lockpicking methods and ways to prevent it.

Currently in definition.

@tildal - yeah, simple phrase....
@RoryAlsop Let's just make Sec.SE actually just about security, and include lockpicking as a tag. That would be cool
4
11:02
It has been proposed many times :-)
Originally Sec.SE was just IT Security, but we have general approval that it included those wider things in a security professional's remit such as procedures, policy, regulatory requirements and so on
If lock picking fails as a proposal, I think it will be firmly placed with us
Yay - the hacking question is at the top of the supercollider
Wonder if there's anything I can add to it
@TildalWave @D3C4FF thats a great set of questions. too bad you can only vote for 5.
@manishearth - almost certainly. I think we are seeing that the majority of the popular questions are ones that are at a level that most people have an opinion. Some of the ones I like most as a long term security professional are of little interest to the average visitor so don't get the attention.
I mean, is policy structure of interest to most SE folks? No. But hacking is, and most programmers realise they need to know a fair bit in order to build secure code
I completely agree with you.
Not about the policies, that's just boring. ;-)
Yup - but needs to be done
And needs to be done correctly, generally, to reduce risk
11:18
oh I agree. I just feel more like a lawyer when doing them, than a technology specialist.
Yeah - scary isn't it
You know when you have a lower traffic site, and are just a couple of votes off your 4k? Time goes so slowly......
Productivity is a difficult one. The graph is going the right direction, but we just aren't attracting enough good questions
@RoryAlsop I guess most of your users are too busy getting shit done.
@RoryAlsop heh well in reality this would mainly be "because I can" than a real requirement. but yeah the point to point would be interesting. some of the ubiquiti wireless gear looks quite nice for that sort of thing...
@D3C4FF [ee.se] seems to have some overclock q's too.
@avid - yeah, we had that discussion in the chat room. No one is ever there as they are out being productive
11:24
@RoryAlsop At the risk of upsetting the people behind the lockpicking proposal, I'd really love it if it became part of Sec.SE
@Adnan meta post here first, see if you want to expand the scope
5
Q: What about Physical Security?

DKGasserIs Physical Security something that's allowed/supported here at all? Obviously there's things like egress paths and lock picking that aren't really "IT" at all.. my gut says that really isn't the sort of questions this exchange is designed for? But also there's "IT" physical security... keypads...

11:50
@RoryAlsop Added my votes ;) And since we're pushing our favorites:
62
Pets

Proposed Q&A site for pet owners, caretakers, breeders, veterinarians, and trainers.

Currently in commitment.

Could use a bit of a boost ;) Put your GFs to it!
@TildalWave you want us to come pet your proposal?
@AviD aye ;) anyway, I think it's a good topic for this Q&A format here
(not my proposal BTW)
@TildalWave I don't have a pet. Unless kids count.
well, I plan on petting my new computer often...
Another help required... what's that song that the father of Manny (Moo-Pa) in Black Books is singing?
what's the title of this song?
"Chattanooga Choo Choo" is a song by Harry Warren (music) and Mack Gordon (words). It was recorded as a big-band/swing tune by Glenn Miller and His Orchestra and featured in the 1941 movie "Sun Valley Serenade". The song was an extended production number in the film. The Glenn Miller recording, RCA Bluebird B-11230-B, became the #1 song across the United States on December 7, 1941 and remained as #1 for nine weeks on the Billboard Best Sellers chart. The song opens with a dialog between a passenger and a shoeshine man, :"Pardon me, boy, is that the Chattanooga Choo-Choo?" :"Track ...
duh it was in the title of the video LOL
@AviD Overclocking quickly becomes electrical engineering
12:04
rep train anthem :)
12:22
@AviD Would be good then to define a clear line between the two. OK so EE will always cover it, but OC shouldn't stretch into pure EE. I think modding is that line. Thoughts?
3 different online sorting hats put me into ravenclaw. i am impressed at the consistency.
@RoryAlsop When we did our competition I tried to seed a couple of physical questions, it didn't seem to go very far. We just seem to have too many goddamn programmers.
12:39
I missed a rep train. :(
9
Q: How is "hacking" even possible if I "defend" properly?

Jane BermanOn Linux-based server, I follow basic practices as below: Make admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable time). Monitor every incoming network traffic to the administrative files. To extend the layer of protecti...

@TildalWave yeah, a clear line is a good idea, and also with SU. However I wouldnt know where that line is - e.g. soldering things onto/off the mobo, is that normal for HCOCers? I have no idea.
@TerryChia I missed it as well! But I'm actually planning to create one
I think the line is anything that is typically done on either end of typical OC would be ontopic. building a mobo from scratch would not.
@TerryChia I'll let you know beforehand.
@Adnan yay! :D
@AviD People do that?!?!
12:41
@TerryChia I have no idea! ask @D3C4FF
but I have seen people stripping the IHS off the cpu, and soldering onto that. so, yeah, I guess...
A mobo is filled with sensitive electronics throughout its surface area. I can't imagine anyone taking a soldering gun to it.
Surface mount soldering seems tricksome.
thats my point. I don't know if they do or they don't ("they" being typical HCOCers).
Also I'm really enjoying saying HCOCer.
@ScottPack not that hard, really
@Manishearth yeah, yeah, that's what she said.
12:59
@Terry - and looking at Graham's answer which has shot ahead of mine, I think I used too many words :-)
I'm just trying to put off the inevitable @polynomial overtake
He is only 600 behind me
Ooh - I see @gilles is almost a 10k-er here
@RoryAlsop BLINK that's it, he's gone.
Heh
And @iszi nearly there too. That will be half our front page of users with 10k privileges. Excellent
aww maan, we wont be able to hide secret messages in deleted posts anymore!
At the current rate, AJ Henderson will reach 10k before @Iszi. ;)
Is that @JeffFerland I see in the top right?
13:04
I'm hoping to break 8k by the end of the month.
@TerryChia you snooze you lose ;o)
@RoryAlsop like my battle to stay in the top-10. hanging on so far :)
@RoryAlsop @Polynomial @RoryMcCune Any idea if this is a hoax? panarabiaenquirer.com/wordpress/…
Seems to be propagating on Twitter and Facebook
@Adnan definite hoax
@RoryMcCune ehh. I used to be #1, gave that up long ago. Now I try to not care about staying in the top 2nd row.
Seems likely only if the rows get wider.
13:07
herro
@AviD Seriously? The first decent mobile OS they've had in years (if not ever) - and one that's actually gaining in market share? I find that claim rather dubious.
@AviD yeah but I've been top 10 for aages and I'm hanging in there for now..
@RoryMcCune Yeah, it seemed like an obvious one. But I couldn't find credible source saying it's fake.
@Iszi as do I. Hence my doubt.
13:08
@RoryMcCune I was #1 till close to the end of beta...
@LucasKauffman CloudFlare doesn't work on filtering illegitimate traffic IIRC. It's about load balancing the request through multiple caches using anycast. (this is from memory, correct me if i am wrong).
@AviD personally I think there should be some kind of rep multiplier for all the old-timers who were in the first 50 users to the site ;o)
Wow. I've been wondering why I might possibly want a phone with a screen bigger than 4.5". Apparently, an extra column of apps is why.
@RoryMcCune yeah!
@RoryMcCune Suggest that on Meta.SO. I dare you!
@TerryChia yea but if the service itself isn't run on cloudfare it all comes back to the same endpoint
@RoryMcCune Big thanks!
@Iszi What? That looks horribly cluttered.
@TerryChia ok you're right top 50 is to much , say top 38
@AviD Follow the article link I posted after.
13:10
@LucasKauffman Yeah, but the points I was trying to drive at is that it is near impossible to stop DDoS attacks on a local level. :)
In his specific case, restricting his admin login page to vpn-only seems like a good alternative.
@TerryChia indeed
It's more an app-level attack rather than network traffic.
or filter on IP
@TerryChia Also, very poorly photoshopped. I mean, who's really going to have an identical row of apps on the same page?
@Iszi what I find with the Xperia-Z is the larger phone form factor makes me more likely to use it for general surfing, so I carry a tablet less often..
13:12
he could also drop all IPs trying to log in, depleting all of the attackers IPs
@RoryMcCune Galaxy Note!
@RoryMcCune For me, 4.5" is just about right. My thumb can reach about 75+% of the screen holding the phone naturally and it can hit the other 25% with a slightly modified, but still single-handed, grip.
@LucasKauffman yeah although that is really super-sized
Any larger screen, I doubt I could manage like that.
@Iszi yeah the 5" of the Xperia is a bit too big at times, but I can still type one-handed on it ok..
Yknow what they say about a man with large hands.
13:16
@RoryMcCune I don't like it at all :p
overall I'm quite liking the Xperia. It's quite a good phone, the tethering works well, and the screen is v.nice
@RoryMcCune I think it's going to be awhile before I really call typing on a touch screen "ok". I still miss being able to touch-type on my phone, even if it was using T9.
@Iszi have you tried swiftkey?
@RoryMcCune WP8?
@Iszi ahh sorry android only :(
13:21
@RoryMcCune you tried this?
that's cool if it works :p
@Iszi gesture typing on touch make going back to tapping painful..
@LucasKauffman not yet, but I've heard field reports of it being dunked in pints of beer and surviving
it does take the risky feeling away from using it outside in the rain..
@RoryMcCune challenges over beers, never a good idea :p
@LucasKauffman not when then involve expensive electronics anyway!
@lucas - one of my friends has that done to one of his work phones and so far it works. He is a field engineer for an electricity company so is outside in all conditions. Think he is one of a few beta testing ...
@RoryAlsop I always love the equipment field engineers have, like those laptops that are made to survive high falls
13:37
@TerryChia He's that asshole that recommended ShieldsUp too.
So, yeah. That happened.
@D3C4FF - don't think that one is spam. It is another approach, and he did disclose his affiliation.
So have any of you guys ever tried to figure out Nessus' user password hashing?
@ScottPack given a set of hashes and their initial inputs, how hard is it to do that?
Nope, sorry
@Manishearth That depends entirely on your skill set and experience.
13:49
@rorym - no good version of Swype appears to exist for iPad. Typing on this thing is such a pita
@ScottPack Ah.
I was getting ready to expand out our nessus puppet module to allow for account creation, feed/SC registration, etc. Their user management is a bit weird.
There is no user and/or shadow file.
Users are assumed to exist if a directory /opt/nessus/var/nessus/$username exists and the password hash is stored in a file /opt/nessus/var/nessus/$username/auth/hash
Where the file hash contains two 33 character hex strings separated by a space.
Hahaha -
You made me even more paranoid now, god damn bears.
1
A: How do I ensure that a VPS host will keep my information private?

Tom LeekStrictly speaking, you cannot. You want to use a VPS for your browsing because you fear that some unnamed but powerful evil people would spy on you. How can you know that any given private business, that you don't know beforehand, is not in league with your enemies ? And if I did point you to a s...

14:08
@LucasKauffman Note that these devices don't "make cold"; they move heat around. You would still need a big radiator somewhere, possibly plunged in a big bucket of oil.
14:21
Oooh, that's cute:
0
Q: Study on IT Security

KumarI want to study IT Security for windows and Linux.Please provide me best tutorial links so that I can understand and grab it easily. I have not much reputation to ask in chat room. That's why asked here.Thanks in advance.

Bless his heart.
@ThomasPornin I actually hadn't thought about what to do with the heat
@LucasKauffman Ye cannot defeat thermodynamics.
Is anyone proficient here in Prolog?
@LucasKauffman I once had some introductory course on Prolog, from which I concluded that the less Prolog I do, the happier I will get. The concept is amusing, though.
14:27
@ThomasPornin If even you don't like it I think I will have a really bad time
Is it just me, or does Sec.SE questions reach the top slot of the supercollider with worrying regularity ? Are there statistics on that ?
@ThomasPornin the supercollider is haxed
14:45
@ThomasPornin SecSE, ProgSE, SU, SO, and Math
@lucas - haha. Wonder if SE have ever worried about that...
14:57
@RoryAlsop We probably have enough rep-train specialists at Sec.SE to do a reasonable job of gaming it, if we got it in our little heads to coordinate and do so.
Come on, ride the train Woo woo, hey, ride it, woo wo
@ScottPack Link link link
Oh what? I was just singing.
@ScottPack Damn it! Whenever I hear "train". I start thinking of my potential answer.
@ScottPack DAMN YOU!!!
15:10
:)
Hahahahaha. Woo woo.
@RoryAlsop No worries
@AviD @TerryChia Soldering direct to motherboards is quite rare. I've never done it and i've never seen anyone else do it. I've seen some GPU hacks but that's about it
@LucasKauffman Pretty sure that's not the one @ScottPack was talking about.
15:25
@Iszi @Lucas is too young.
In other news, my boss just said, "Man, parents just don't understand."
@ScottPack True.
Interested to see if late shouty bear jumping on rep train changes the profile in any way. Will bear gain votes at this late stage or has the choo choo sailed...?
@D3C4FF I have seen someone do it. He was working on a new prototype FPGA board, a PCI extension card plugged in an Alpha station (it was in 2001). He was using his soldering iron on the live system, checking with some commands what his tinkering was doing on the PCI bus.
Crap. Little Bear is about to pass me. That's the last time I'll see #5.
15:47
@ThomasPornin That's some crazy stuff!! Older hardware (more than 10 years) was easier to experiment with...
You've got layers of circuit traces, insanely detailed IC's which may or may not have any kind of information provided about them...
@JeffFerland not on my watch!
@ anyone. Can someone grab their credit card, a high powered torch, and back light the 'signature panel' for me?
I found something odd with some of my cards...
If you shine a light thru em they say VOIDVOIDVOIDVOIDVOID insert random letters and numbers here* VOIDVOIDVOIDVOIDVOID
@D3C4FF The VOIDs are to prevent signature erasing.
@D3C4FF Not odd in the least. It's a form of fraud protection.
@Xander @ Iszi Ah, that makes sense... I've never had it show up when i've erased a signature though...
15:51
Scratch off the signature surface, and you'll see it, too. I actually had one card where the signature surface got totally worn away - if I still have it lying around I might take a pic for you later.
@Iszi I did, it didn't show up so i figured it was part of the panel...
Any idea what are the random numbers/letters for?
Funny thing, though: Most retailers don't give a crap. I mean, who's actually checking the signatures (if they're even taking them) these days anyway?
@Iszi Lol, no-one.
@D3C4FF Haven't seen that bit on my cards. Dunno.
Does anyone know of any good examples of micro-print as a security feature?
15:53
@D3C4FF Nope. I have different patterns on different cards. Some seem to be data (like issue date) some seem to be arbitrary, and some of my cards have none at all, just rows of the VOID text.
Do any bank cards have it?
However, you should notice there is probably another location on the card that actually says "Void without signature". Technically, this could mean that retailers should not accept your card unless you've actually signed it.
@D3C4FF US Currency has microprinting.
Again, not that they check.
@Xander Yeah that was my finding to. I couldn't see a pattern in it...
15:54
@D3C4FF Those that also serve as debit/credit cards do.
@Iszi As a general rule, i dont sign them until someone demands that i do. Which is on average about a year after its issued
:P
@Xander I've got a few bills about and i've checked em out. I noticed, entirely by accident, an old international student card that i found had micro-printing holograms!
I was very impressed (given that you could peel the hologram back and insert new photos with ease >_> )
With regard to microprints, i've seen customs/border guards in the EU using magnifying glasses to check for them...
CAnt remember if it was belgium or holland
@Adnan @RoryAlsop I'm actually quite fond of this idea. Sec.se isn't ITSec.se :P I wish there were more room to discuss physical security/lockpicking/alarms etc
@D3C4FF Actually, it didn't even start as ITSec.SE - it was AppSec.SE. Then it got expanded. Still dunno why they decided to make the domain just Sec.SE though.
@Iszi Cause it sounds better? :P I've seen a bunch of A51 proposals about lock picking and physical security but all of them are moving fairly slowly and i'd expect they'd do poorly in the beta
@LucasKauffman Yeah, the automated system isn't going to roll that back at midnight... :)
@JeffFerland probably not!
16:07
@Iszi think it'd be beneficial for all if the general umbrella of security was used here, but i dunno, i'm new. What do the modz think? :P
Ooops. Sleep deprivation is kicking in and one eye has rolled backwards.
Sleep time!
@D3C4FF There's been some proponents of the idea in Meta, and resistance has generally been nominal. However, there also hasn't been a lot of actual activity on the site to support it either.
Alright, who's posting AMAs on Reddit?
16:34
ah, it's you!
@JeffFerland It's been a really fun AMA actually.
16:45
ahh reddit, still one of those uncharted territories for me, like Canada.
4
@lynks It's wild out there. Canada has bears. Reddit has narwhals.
@JeffFerland Fun fact: bears also enjoy bacon!
@JeffFerland I tend to just have one 'hangout' at a time. it always used to be a guild-chat of some kind. now i guess i have ended up here. some backwater bar at the seedier edge of the internets.
@LucasKauffman You are trying to determine the threshold for the serial upvoting script ?
@ThomasPornin Little bastard's betting on both sides! :)
16:49
@ThomasPornin yes, but I haven't upvoted you tho
@ThomasPornin how are we defining 'serial upvoting' contiguous upvotes by the same user on the same user?
well I have actually upvoted you today, but not massively
@lynks I am defining "serial upvoting" by "whatever triggers the script on SE servers, which results in cancellation of a bunch of upvotes with the message 'serial upvoting reversed'"
Since the script details are not public, we can know it only empirically.
@ThomasPornin ahhh i see
I wonder what is worth more SE rep or Bitcoins
16:52
Apparently @Jeff got a lot of upvotes about one hour ago, on distinct questions, and I suppose the culprit is @Lucas. He is not denying. What remains to be seen is whether the script will be triggered or not.
@ThomasPornin I acknowledge nor deny involvment
i will selflessly submit myself as a guinea-pig for any further upvote tests.
@ThomasPornin I did have that happen to me on ServerFault once. Someone upvoted 25 - 30 of my answers within the space of a few tens of minutes. Was slightly disappointing when all the rep disappeared the next day.
@Ladadadada sounds like a great way to ruin someone's tomorrow.
@lynks I am not sure what the consequences for the upvoter himself are.
17:10
@ThomasPornin Just wasted votes. No big deal.
@ThomasPornin ...unless it looks suspicious
@AviD That's already modding, so unless it's trivial I'd leave that to EE. OC can have plenty of topics regardless with new chips coming out and more HW to OC. A few topics would be bordering SU tho, but should probably be left on the site they were posted, such as firmware flashing. Maybe custom firmwares tha are relevant to OC should be on OC, but then there's also a proposal for Repurpose Hacking.
17:45
Serial upvoting reversal happened to me also on SO when my better half got a bit carried away. Not a big deal and I've asked her not to from then on, but I've learned that she used my profile page as the source, so I imagine the detection must be linked to the referrer string, too. Anyway, when I told her how those accounts are called, that did it for her. She clearly didn't want to be called as someones sockpuppet, and especially not mine LOL... yeah... go figure!
17:56
The only almost surefire way to make hacking unfeasible is to (1) destroy what you are trying to protect, (2) hire someone you trust to ensure no one is capable of backwards time travel to get at it before it was destroyed, (3) ensure there are no copies of data and that no one knows it, which means you likely have to commit suicide or have someone kill you that you trust, and (4) ensure no one can revive you, and that you will not remember the information if you are ever revived in whole or part or reincarnated and have past life recollections. It's not as easy as it sounds. — Gary S. Weaver 52 mins ago
I would like to know what he was smoking :)
 
2 hours later…
19:37
I HATE MY ISP.
They randomly decided to start leasing me a non-routable IP this afternoon. I was offline for an hour and a half before they got their DHCP server sorted and I could get a real IP again.
@TildalWave marrying a sockpuppet? I've seen a lot on the internet, but that's novel.
@CodesInChaos Don't wanna Rule 34 that.
20:09
@RoryAlsop do you have CRISC?
20:28
"The US Air Force has reclassified a half-dozen cyber tools as weapons
to increase the chances they will receiving funding within the
Pentagon's tight budget."
20:41
@TildalWave he seems perfectly coherent to me
Science Fiction & Fantasy actually gives other methods, such as traveling back in time to ensure that the information never exists, or magicking it out
0
Q: Why can't the police/government shut down black market websites?

Olly PriceI've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy explanation as to why they can't get shut down. I'm talking here about websites such as Silk Road on To...

do we want this on Sec.SE? I don't see it being answered usefully on CS
and I'd have a hard time arguing for it to be on-topic where it is
20:54
@Gilles Feels dupe-ish.
I agree with @Iszi
@LucasKauffman I agree with @Lucas' agreement with @Iszi agreeing with @Gilles
@ScottPack DAFUQ? I never agreed with @Gilles - don't put words in my mouth.
@Iszi I'll put anything in your mouth I want mister.
4
@ScottPack Ok, then. As long as you wash it first, baby.
5
21:19
@Iszi link?
@Gilles Hrm? Sounds like work.
oh well, if it's dupe-ish it means it's on-topic
@Gilles That's rather presumptuous. Without the dupe being specified, how do you know the dupe wasn't closed as off-topic?
@Iszi sounds like work
but now anyone on Sec.SE can do it
22:06
@Iszi @Gilles @LucasKauffman Yup, dupe. security.stackexchange.com/q/24985/12
@Xander thanks, VtC'ed
23:42
@LucasKauffman no - was toying with it, as it is relevant, but I have just dropped CISSP as I have C|CISO, CISM and M.Inst.ISP and I don't think I can afford to pay for another at the moment.
@Gilles Closed - and bedtime. Night all :-)
00:00 - 10:0010:00 - 00:00

« first day (848 days earlier)      last day (4330 days later) »