The DMZ

Terry Chia

01:01

@TildalWave Thanks. :)

Iszi

01:32

@David Best password checker ever.

MMavipc

02:15

in Security.SE CTF Team, 33 mins ago, by D3C4FF

Fuck this stuff is doing my head in. Alright. Lets see what happens

oops, wrong one

in Security.SE CTF Team, 23 mins ago, by D3C4FF

I find that knowledge of Assembly is inversely proportional to life satisfaction.

TildalWave

@MMavipc You know you can edit a post in chat by pressing the up arrow key and editing it? :P

MMavipc

didn't know it worked for links

TildalWave

@MMavipc works for anything

@MMavipc That boils down to ignorance is bliss basically ;)

MMavipc

@D3C4FF Hear that? look at @TildalWave 's message

TildalWave

@MMavipc you should tell him you're gonna send your garbage collector on him if he doesn't stop trashing assembly lol

MMavipc

02:21

lol

D3C4FF

@MMavipc Maybe i should expand upon that by saying that the more of assembly i know, the more i realise i don't know.

And then i look at that not-so-small stack of ugly Intel manuals and i cry a little tear

Scott Pack

02:43

Jesus. Considering that it's a step by step wiki page you would think converting XBMC to a mysql backend would be straightforward.

AJ Henderson

03:05

can we get a "Closed as Don't Roll Your Own" option?

@Iszi but where are the lasers?

TildalWave

03:23

21

A: The Memes of IT Security

Meme: Don't roll your own. (AKA: The first rule of cryptography.) Originator: Unknown. One of the most infamous uses on IT Security is by D.W., here. This meme is also related to / a synonym of "Don't be a Dave!" Cultural Height: TBD Background: Everyone seems to want to write their own ciphe...

@AJHenderson You might want to reuse the pic there LOL

or imgflip.com/memegenerator

MMavipc

Happy diurnal isomorphism

Iszi

@AJHenderson Gotta get a GIF editor now.

TRiG

So, my antivirus won't allow me to read this question. Hmm.

Iszi

@TRiG Avast?

TRiG

@Iszi Kaspersky.

Iszi

03:36

Oooh.

Multiple tools flagging it... can't be good.

TRiG

@Iszi I might try again from my Ubuntu computer ... when I have an Ubuntu computer. It's currently in a repair shop where the nice man is trying to work out why it won't turn on. (I told him not to hurry: I'm moving house soon, and I don't drive, so it's simpler if it stays in the shop till I'm moved.)

Iszi

0

Q: Question being flagged by Antivirus

This thread is being flagged by Avast and Kaspersky antivirus products. Avast flagged it as Threat:JS:Decode-XA[Trj]. Could someone look into this and get it cleaned up before Sec.SE ends up on a search engine's blacklist or something? (Thanks to @TRiG for pointing this out in chat.)

support

Ping @RoryAlsop @JeffFerland @AviD

TRiG

There's an image you may wish to incorporate into your meta question.

TildalWave

@Iszi I believe it's just false positive based on text match algo. Since its not in the real code, but actually displayed as a HTML formatted code sample, I think @D3C4FF's addendum to his answer there is correct: "EDIT: I've just noticed that accessing this page flags it as malware via kaspersky internet security. It's obviously aware of the script and define it as HEUR:Trojan.Script.Generic"

It must have some part of it tagged for matching that's exactly the same if HTML encoded or JS code ... which is rather lame actually

If you want we can try here which part of the code gets detected... I just copy parts, and later delete... you tell me at which edit you got the warning

TRiG

@TildalWave Kaspersky even blocks the Web-Sniffer view of the code, which is encoded again.

TildalWave

03:50

@TRiG meaning it only is defined in the definitions as a simple string that doesn't receive special HTML chars

your AV is doing DoS on you LOL

TRiG

@TildalWave Pretty much. Yup.

Scott Pack

@Iszi Works fine for me. Clearly a user problem.

3

TildalWave

@ScottPack LOL :))) that's hilarious

Scott Pack

@TildalWave For the record, my first technology job was customer support for a small telecom company who sold (amongst other things) dialup service. The majority of my time was spent talking to the Amish.

TildalWave

@ScottPack hehe where do you get these?

Scott Pack

03:55

@TildalWave I think you misunderstood the first professional entry on my resume for a line from a humor site.

TildalWave

@ScottPack Funny I get on your LinkedIn profile the get introduced link (through RoryA and Avi) :) What does that do then? :O

Scott Pack

Hm. Looks like some jackhole from Slovenia has viewed my profile.

TildalWave

We have one thing in common = Linux LOL

Scott Pack

I should probably update my profile. It's very generic.

TildalWave

@ScottPack I almost never go there TBH... set it and forget it

@ScottPack want me to endorse some of your skills? double-entendre?

adnan maybe? :)))

Scott Pack

04:03

If you want. I'm not sure how I feel about the endorsement system.

In theory it's a not unreasonable idea, but just like anything else crowd sourced there's a few dozen pounds of salt involved.

TildalWave

@ScottPack well I have icons endorsed by someone :)))

Scott Pack

Yeah...I've deleted a few things people have tried to endorse me on.

Personally, I'm really stinking careful about who I endorse, what I endorse, who I agree to be a job reference for.

I figure all I really have to work on professionally is my name and reputation. If I go around saying people are awesome at everything, when they aren't, then it's going to go bad on me eventually.

TildalWave

invitation sent ;) maybe it'll come handy one day but I've yet to see that work to any good really (I mean the whole LinkedIn system)

Scott Pack

The first time I had to tell someone that I would be a personal, but not professional, reference was tough. Granted, we had never actually worked together, but we had known each other for years and went through college in almost all the same classes.

@TildalWave It's largely an exercise in personal branding. :)

I pretty well treat my contributions on SF and sec.se the same way. :)

TildalWave

@ScottPack only that it weights more here IMO ... I mean it's based on real contributions, not how well you connect with others that can obviously endorse false claims

Scott Pack

04:10

I can't disagree.

D3C4FF

@TRiG @TildalWave @Iszi do you want me to edit my answer to remove the potentially offending code? Might have to edit the question as well to link to the code on something like pastebin

Scott Pack

So I finally figured out what I needed to do to make XBMC go against a remote mysql database, instead of a local sqlite, and now here I am, 12:15am, waiting for the damn library to finish importing

TildalWave

@D3C4FF It could be that the question is the problem? Plus there's another similar answer than yours (also with code included)... I think it should be left to mods to decide

D3C4FF

Well, i've suggested and edit, its any/all related code that's being flagged by KIS.

TildalWave

@ScottPack which reminds me... good night all! ;)

D3C4FF

04:16

Question code is not on the page anymore, but my answers still have it there.

Scott Pack

@TildalWave G'night sweetness.

TildalWave

@D3C4FF If you want to test where the problem is then make a local copy of the page and start deleting from it line by line... eventually you'll see ;) ok... I'm off

D3C4FF

@TildalWave Not worth fighting with my AV for that :P

Stack Exchange

'All time machine systems nominal ... T-minus ten ... eleven ...'

D3C4FF

04:40

"To my dismay, Internet cred does not share a 1:1 ration with street cred"

2

ManishEarth

06:34

2

A: Link preferences: http vs. https

Firstly, note that very few sites offer both HTTP and HTTPS. There's only one that I can think of -- Wikipedia. GMail used to; but we don't link to GMail on Phys.SE and it's pure HTTPS now anyway. What is HTTPS, and how does it work? See this post if you're interested to know more. Or, y'know, ...

I want Sec.SE reps for this answer :P

Rory Alsop

My upvote gave you Physics rep :-)

ManishEarth

@RoryAlsop it's on meta :P

Lucas Kauffman

06:54

@ManishEarth I added you to the CTF list as well :)

ManishEarth

07:13

@LucasKauffman great :) Any idea when the next event is?

In the meantime I'll keep trying to get past blowfish.

@LucasKauffman Should I give myself explicit write access?

Lucas Kauffman

@ManishEarth explicit write access for :p?

ManishEarth

@LucasKauffman the secret room-thingy

Lucas Kauffman

not sure I've been pretty inactive myself but other members like @TerryChia @D3C4FF and @Gilles have

ManishEarth

As a mod, I can mess with the access myself

Lucas Kauffman

oh yea

yea add yourself

ManishEarth

07:15

K done :)

@LucasKauffman You guys need a superping to notify everyone about the next event

Lucas Kauffman

how can you perform a superping?

ManishEarth

@LucasKauffman I can, RoryAlsop can, you can't. It's basically a better version of a normal chat ping where the user gets pinged immediately regardless of whether or now he/she has been in the room for a while

What I can do is craft a message full of superping codes that can be copy pasted by a mod into chat when it is necessary to summon the team (when there's an event in a week, etc)

Lucas Kauffman

@ManishEarth that would be nice

ManishEarth

@LucasKauffman On it. When you want to ping the team, just ask me or Rory to use the superping

I'll fetch all the superping codes in the meantime

Lucas Kauffman

cool ^^

much appreciated :)

ManishEarth

07:23

@LucasKauffman Do I assume that everyone with explicit access to the room is a team member?

And are there any team members without access?

Lucas Kauffman

@ManishEarth normally they are and I doubt everyone has access

ManishEarth

@LucasKauffman should I cross-check with the team page and fill in the gaps then?

Lucas Kauffman

sure :p

ManishEarth

@LucasKauffman Where's Sadaluk? He's not on Sec.SE

Lucas Kauffman

@ManishEarth not sure, but normally he shouldn't be on it if he isn't on sec.se

wait let me check my requirements

ManishEarth

07:31

And what about this guy?

randomdude

463 1 1 4

malware network sniffer truecrypt usb-drive virus windows

He's on the list

Lucas Kauffman

well let's say if they haven't logged in the last month or so, just leave them out

ManishEarth

ah

Lucas Kauffman

maybe I should clean that out :p

I've been slacking a little on it ^^

MMavipc

in Security.SE CTF Team, 7 mins ago, by ManishEarth

@@6738, @@63964, @@74179, @@61723, @@9269, @@31768, @@48517, @@58016, @@42156, @@61622, @@12409, @@1516, @@66815, @@15, @@240, @@27025, @@9882, @@20882, @@41829,

ManishEarth

in Security.SE CTF Team, 12 mins ago, by ManishEarth

Ping all team members (mod only). Use to notify everyone about a coming event: @@51908, @@6738, @@63964, @@74179, @@61723, @@9269, @@31768, @@1344, @@2794, @@62299, @@45112, @@48517, @@58016, @@42156, @@61622, @@12409, @@1516, @@66815, @@18123, @@15, @@240, @@27025, @@9882, @@20882, @@41829,

Done

Ping me or @RoryAlsop when you want to ping everyone about an event or something

Lucas Kauffman

07:41

thanks :)

MMavipc

@ManishEarth from checking out your account, do you live your whole life on SE?

lol

ManishEarth

@MMavipc Check out @RoryAlsop's account, it is way better than mine :P

But nope

I do spend lots of time here though

Lucas Kauffman

08:01

sometimes I wonder if @RoryA is actually more than one person

and the mask is just a way to hide these different persons

ManishEarth

@LucasKauffman Well, he does seem to have two jobs

@LucasKauffman Probably long ago SE accidentally merged all the Rory's and we got RoryAlsop

Antony Vennard

@ManishEarth That's an old name of mine, sorry!

ManishEarth

@AntonyVennard you're ninefingers as well, no?

Antony Vennard

@ManishEarth Yep. I went through a name changing spree, but have now settled on my real name for a bit.

Got bored of being my useful nine fingered self.

ManishEarth

@AntonyVennard ah. Added back to the list :)

Antony Vennard

08:11

@ManishEarth Which list is this sorry? I've only just "woken up" digitally speaking...!

ManishEarth

18

Q: A Security Stackexchange CTF team

Updates: Added first challenge to prepare We now have an IRC channel! Join us in #SecSE-CTF on Freenode: chat.freenode.net:6667 So I'm participating in my first CTF at the moment, the biggest challenge is getting a good team together. CTF's contain multiple challenges which are often too m...

discussion ctf

I was updating the access list

Antony Vennard

@ManishEarth Ah okay, thanks.

ManishEarth

and I found a few folks who aren't on SecSE/chat or who haven't been online in a few months, crossed them out

Could't find Sadaluk, so I crossed him out :P

Antony Vennard

@ManishEarth Fair enough. The character he was named after is a bit of a bad'un so I'd have crossed him out too.

ManishEarth

@AntonyVennard lol

Lucas Kauffman

08:13

@AntonyVennard or is it your real name?

Antony Vennard

@LucasKauffman I can neither confirm nor deny my real name.

CodesInChaos

09:35

@TildalWave If you have a 1:n homophinic mapping then you can do a search with n queries. For small n this should be feasible. But obviously security decreases as n goes to 1.

Ladadadada

09:46

Just heard about Lockitron. People are calling it "Two-factor authentication for your front door."

The trouble is, you can unlock it with your phone or your physical keys.

I like to call that half-factor authentication.

3

Lucas Kauffman

@Ladadadada that sounds like a really stupid idea

Ladadadada

Their security page is full of nice looking buzzwords but I don't see any mention of any testing by a third-party company.

I suspect a Wifi Pineapple would negate the warning you get when someone unlocks your door manually.

CodesInChaos

10:08

I'm not a fan of counting authentication factors in the first place.

IMO the only reason for using "something you have" is because our brains are too dumb to do crypto.

Tinned_Tuna

@Ladadadada heh, "secure" ... ¬.¬

Lucas Kauffman

10:35

@Ladadadada They are focusing on the supporting web application, I really wonder how they will implement security when opening the door through text message.

Ladadadada

@LucasKauffman You have 160 characters in an SMS. Subtract some (maybe 20 characters) overhead for message headers leaves you with 140 characters.

Do SMS support Unicode natively or only ASCII?

Should still be enough room to pass SHA2 hashes across.

Lucas Kauffman

@Ladadadada the problem is SMS is not encrypted and spoofing the sender ID is super easy

Ladadadada

I'd be surprised if they relied on the sender ID for anything at all. Based on their security page, I think they have enough focus on the encryption that that is not where the first flaws will be found.

Although I'm not ruling out idiocy with trusting the untrustworthy.

lynks

any idea what this guy is talking about?

0

Q: How to select secret identifier?

For an ecommerce website I need to create an identifier, that will represent the user's order. It can't be order's ID in database as it's assigned in predicateble manner. So it needs to be some pseudorandom string (ideally a-zA-Z0-9), that will offer increased security, because it won't be guessa...

e-commerce

Lucas Kauffman

10:50

@Ladadadada the thing is that they claim it can be used from any phone

how can you implement authentication and secrecy on any phone without an app?

@Ladadadada lockitron.com/help/mobile#smsaccess

that says it all, there is no encryption

Ladadadada

@LucasKauffman Oh dear. That's awful.

Good thing I didn't rule out idiocy.

Lucas Kauffman

I also wonder how the app reacts in case of untrusted SSL certificates

Ladadadada

Four-digit PIN? So I can get into anyone's house for the cost of 10,000 SMS?

CodesInChaos

Is this on-topic on security.SE?

0

Q: Create groups of keys

I looking for a solution to encrypt, sign documents or email a key group and send to one customers. The group of keys are had already created user keys and I would like to use them. Is not an option to generate one key for a group of users. I need a solution that automates the the process of the...

encryption signature keys

Personally I don't think so, since it's too much of a recommendation question.

Lucas Kauffman

@Ladadadada I've sent them an email

CodesInChaos

11:10

Just read the writeup on Plaid CTF

Lucas Kauffman

@Ladadadada I might order one and test it

CodesInChaos

For the hypercomputer challenge each time he was patching, I was waiting for the anti patching traps

and each time I got surprised he didn't trigger any

Tinned_Tuna

@Ladadadada lol, you think that people do choose highly-random 4 digit pins. No, you start at things like their birth year, their spouse's birth year. You'll probably get it within 1,000 for most humans.

Lucas Kauffman

and the funny thing is they can't block your door because otherwise you can't get in anymore

Ladadadada

DoS attacks sound particularly funny.

Terry Chia

11:16

@LucasKauffman DoA attack. heh.

Ladadadada

Actually, hack someone's door but don't unlock it. Wait until they get home and then lock it again just as they try to walk through it.

Lucas Kauffman

So basically know someones phone number

send 10.000 sms starting with known info (birthyear) and chances are you will get in quite fast

if you get an sms gateway it will only cost you like 50 USD

(you can send a text message with a pin to open the door)

Tinned_Tuna

50USD to steal a 500USD tv, computer, 179USD "lockitron" door-locking device ...

Terry Chia

@LucasKauffman @Tinned_Tuna The documentation isn't clear. What number do you send the SMS to?

Lucas Kauffman

@TerryChia probably theirs

Tinned_Tuna

11:27

Alternatively, you get yourself a software defined radio, listen to the GSM traffic, and crack the A5 encryption to read it all out

easy as pie.

since A5 is know to be exceptionally weak

Terry Chia

@LucasKauffman That might slow down the attacker somewhat if he doesn't sniff the SMS traffic like @Tinned_Tuna suggest.

Still ridiculous though.

Lucas Kauffman

@TerryChia sure it will slow you down, but all you need to know is the pin and you can come back later

Terry Chia

11:41

This is an interesting article: blogs.kcrw.com/whichwayla/2013/04/…

2

Lucas Kauffman

@TerryChia that's really daring

Terry Chia

12:52

Scott Pack

13:13

I just turned on Airplay on my xbmc box. This is like living in the future.

I'm playing music from my laptop through the ether and it's coming out of my stereo system.

Terry Chia

@ScottPack Welcome to 2010.

Scott Pack

Like I said, the future.

Ladadadada

Terry Chia: @ScottPack Welcome to 2010.
Scott Pack: Like I said, the future.

Someone's been taking their XKCD a bit too literally.

Terry Chia

@ScottPack I must say, Jamie Lannister is an interesting character. More so in the books compared to the show.

Scott Pack

13:33

@TerryChia I like how he becomes so much more interesting as his sister devolves into something approaching insanity. Almost as if her decline is permitting his ascent.

Terry Chia

@ScottPack I am only at the part where he had a conversation with Catelyn. His blunt honesty about his role in pushing Bran is admirable.

Scott Pack

@TerryChia Pretty much at the beginning of his capture?

Terry Chia

@ScottPack I think it's right before Catelyn released him in exchange for her daughters.

ManishEarth

@TerryChia A lot in the books

Ladadadada

I just realised what a good TLD .log would be.

Scott Pack

13:37

@TerryChia Read. Faster.

Terry Chia

@ScottPack The book is long.

Scott Pack

@TerryChia There's only 5 of them.

ManishEarth

@TerryChia That doesn't change anything. Read faster-er-er

Scott Pack

I decided to do a complete reread of WoT since the last book (finally) came out. I have no sympathy for you.

Terry Chia

@ScottPack :(

TildalWave

14:22

@CodesInChaos Thanks for confirming that. I just wasn't sure and it's kinda essential for the understanding of the latter part of your CipherCloud related answer. Cheers!

Scott Pack

15:04

@TerryChia Dude. That fucking series is 14 books long with a total (hardcover) page count of nearly 12,000. You've only got a total of 3322 to plow through.

makerofthings7

15:28

@Ladadadada Lockitron is probably pronounced "lock it wron"

wron(g)

ManishEarth

@ScottPack WoT? Web of Trust? Winter of Thrones? Wheel of Torture? Winter of Targaryen? :P

Ladadadada

@makerofthings7 Hee hee.

Scott Pack

@ManishEarth Wheel of Time.

ManishEarth

@ScottPack ah

I thought it was a misspelled abbreviation of Game of Thrones

Scott Pack

15:47

Nah. I was mocking him because he's reading so slowly.

ManishEarth

ah

Lucas Kauffman

15:59

ismytwitterpasswordsecure.com

ManishEarth

Saw that already

I did not see that coming

I opened the network monitor on chrome dev tools and went to enter some fake details (to see what they were doing with it), and then nearly fell off the bed laughing after typing the first character :P

Ladadadada

That site is somewhat more boring without javascript.

Scott Pack

You know, I hadn't actually typed anything into it until now.

That's pretty freaking fantastic.

ManishEarth

@ScottPack I was actually going to go so far as to setting up a fake twitter account to see what happends :P

Scott Pack

That sounds suspiciously like effort.

2

ManishEarth

16:08

@ScottPack Well, I went to type in a random email and password first :P

@ScottPack I am bored

lynks

16:23

@ScottPack your auto-generated 'tag' expertise is listed as "hardening, privacy" :P

Scott Pack

@lynks que?

lynks

security.stackexchange.com/users

Scott Pack

Ah. For the month view, sure. I got a shitload of upboats off that Shodan question.

I like my privacy intact when getting hard on the network.

2

Iszi

@ScottPack What do you call that, now? NICrophilia?

Scott Pack

Wow.

TildalWave

16:33

@ScottPack oups I didn't realize Aarthi is a woman. And she was here in DMZ that smells of testosterone like some men's locker room :O

Scott Pack

I had to go through 20 minutes of terrible...and I mean awful jokes from my barber this morning. Please don't make that a thing.

@TildalWave We're usually less crude than The Comms Room, which probably isn't saying much.

I rather like Aarthi, though. She seems like an absolute peach.

TildalWave

@ScottPack heh yeah, but we drop towels all the time here, I feel rather awkward now

Scott Pack

She stops by occasionally, but not frequently.

TildalWave

Someone should yell lady present so we start behaving like we ought to, tho

Iszi

@TildalWave It's not like this room doesn't have a persistent log.

TildalWave

16:37

just to think what was there on the stars wall ... embarrassing LOL

2

Thomas Pornin

@TildalWave You know, rude behaviour is no less rude when there is no lady to be offended by it.

11

Scott Pack

@ThomasPornin Fun Fact! In Kentucky there are laws forbidding the utterance of profanity in earshot of women or children!

3

You know, I think that's worth pinning.

3

TildalWave

@ThomasPornin while I agree, I wouldn't call DMZ rude... just riddled with shibboleths that can be seen as rude by the uninitiated

I went through my crash course of yo mammas and what she said too

Aarthi

16:56

Hello, gents!

For what it's worth: I went to business school at "frat boy college"

Nothing you (or really The Comms Room, either) can shock me.

Anger me, on the other hand, is a different game.

Shog9

@TildalWave hate to break it to you, but this room smells like rosewater. Whoever sold you that "testosterone scented cologne" ripped you off.

5

Thomas Pornin

@Shog9 I have no need for testosterone. In my veins flows pure liquid awesomeness.

2

ManishEarth

@Aarthi The new gravatar and the smidgen of blue made me first think that you were some new mod that I hadn't seen yet. Y U NO PONY?

Aarthi

@Shog9 Sounds like it was pheromone cologne instead?

Scott Pack

Ladies. Gentlemen.

ManishEarth

16:59

And bears. Don't forget the bears.

Scott Pack

A pair of bears no less.

Aarthi

@ScottPack Aw shucks. You're quite the upstanding fellow yourself, Mr. Pack. :)

ManishEarth

@ScottPack Where's the other one?

Scott Pack

Tom Leek

22.3k 4 24 65

ssl authentication encryption cryptography passwords web-application certificates

Tom Leek

@ManishEarth WHO DARES UTTER MY NAME ?

Aarthi

17:00

egad, man.

Scott Pack

@Aarthi gush

ManishEarth

@ScottPack Oh, I know who he is. I just thought that it was ~~inhuman~~ inursine to have only one bear cooped up in this room, all alone

Scott Pack

@ManishEarth They're free range.

ManishEarth

@ScottPack Ah, then it's OK

Thomas Pornin

@ManishEarth We bears have a... mutual understanding. We can take turns for each other.

ManishEarth

17:02

/proffers fish

@ThomasPornin ah

Aarthi

Anyway, as you were, gentlemen. Gentlebears. /waves~

Rory Alsop

Evening all!

It has been a many-Rory-ed day at BSides London and Infosec today

Scott Pack

@Aarthi Have a lovely day!

Thomas Pornin

@RoryAlsop Welcome, @Rory-the-unambiguous.

Rory Alsop

No bears though. ..

Thomas Pornin

17:12

I am due for BSides Québec, May 31st - June 1st

Rory Alsop

Excellent! This year I was just mentoring a guy on the rookie track, and he did well!

And mostly walked round London with my wife:-)

Adnan

Everybody here is blue!

ManishEarth

@Adnan go away, serf

We need all blue!

:P

Scott Pack

@ManishEarth So you want everyone to get married?

ManishEarth

@ScottPack did not get the reference to marriage

Adnan

17:23

@ScottPack Well, everybody here is old AND blue.

@ManishEarth I guess.. en.wikipedia.org/wiki/Something_old

Scott Pack

@ManishEarth ....I'd rather not have to describe it.

ManishEarth

Oh ah

Scott Pack

We can't find the sixpence the wife wore in hers.

ManishEarth

I knew that tradition, didn't make the connection

Scott Pack

:(

ManishEarth

17:25

@Adnan I'm not :P

Adnan

@ManishEarth Well, then you're "new"

ManishEarth

@Adnan lol

Adnan

@lynks juuuhuuu.. what an excellent answer.

a bit paranoid though

kinunt

This question has been closed: "What are good free opensource tools for helping in manual source code reviews?" because it seems non-constructive but questions like "What are some good ways to secure personal computers" are not. Why are questions from users with higher "karma" much less questioned than questions form new users?

I also see that perfectly valid questions about programming and security are accepted and good rated in sites like stackoverflow and very similar questions focused on security are closed in this site

ManishEarth

@kinunt Recommendation questions are network wide off topic

Nothing to do with rep

kinunt

17:32

"What are some good ways to secure personal computers" is not a recommendation question?

It seems very very wide in my opinion and not conforming to site "good questions" definition

Adnan

@kinunt blog.stackoverflow.com/2010/11/qa-is-hard-lets-go-shopping

kinunt

@Adnan hehe, I agree and I know that each one gains its reputatio and rights to vote for closing a question

ManishEarth

enwp.org/WP:OTE

kinunt

I don't say that the question "What are good free opensource tools for helping in manual source code reviews?" is ok but I look for valid questions to learn how to do a correct question and I see the question of the people that have voted for closing my question...and I also see shopping list questions, wide/recommendation questions, etc...

ManishEarth

@kinunt Policies evolve over time

kinunt

17:37

I'm just commenting, I know that there are not a solution

ManishEarth

Late last year the policies on such questions were less strict

kinunt

@ManishEarth that is an answer, thanks

Adnan

@kinunt I'm just a user like you, I'm not a mod, so this is just my opinion. a question about good practice to secure a personal computer can be generically answered and the answer can apply to a wide range of users.

kinunt

I asked for good practice to pentest an internal network and the question was closed too for being too wide

Adnan

@kinunt A question about tool/application recommendation, will probably be case-specific. Those are usually closed as not constructive or too localized.

kinunt

17:40

and the question seems very similar that good practices to protect a personal computer

Adnan

@kinunt Not at all. Allow me to tell you why

kinunt

I think that we are back-rationalizing the reasons why one question is closed and another not

but both questions are too wide, both are not specific questions to solve a problem...that seems to me

Adnan

You can secure your personal computer by having an updated antivirus, patching/updating your OS and applications, and practising safe browsing (not do download or click on untrusted things).

That's about it

That can apply to almost every user in the world

kinunt

I don't necessary agree

I can argument that installing an antivirus can increse the attack surface and that if you apply security updates to your system with an antivirus it will be less secure...

you are answering with a list of things

not a solution

don't think so?

Adnan

@kinunt Oh yes, true. I think you're right.

@kinunt I must be missing something.

Good luck with your next questions.

kinunt

17:45

no @Adnan, just different perspectives

good debate for me

I'll try to frame the question in a better way next time

not trying to troll anyone :)

ManishEarth

Blog - Stack Exchange: Good Subjective, Bad Subjective

Robert Cartaino on September 29, 2010

Stack Exchange is about questions with objective, factual answers. We’ve been crystal clear about this for as long as I can remember, even back to the earliest, pre-beta days of Stack Overflow. It’s right there in the standard Stack Exchange FAQ:

What kind of questions should I not ask here?

Avoid asking questions that are subjective, argumentative, or require extended discussion. This is not a discussion board, this is a place for questions that can be answered!

Thus, questions that are not answerable — discussions, debates, opinions — should be closed as subjective. It seems simple enough: Fact good; opinion and discussion bad. But why? …

Blog - Stack Exchange: Q&A is Hard, Let’s Go Shopping!

Jeff Atwood on November 23, 2010

Over the last 2.5 years, we’ve identified a few problematic classes of questions that tend to get asked on our sites. Many of these are documented in our standard set of close reasons: exact duplicate, off-topic, subjective and argumentative, not a real question, and too localized.

However, as we launched the great Super User experiment, a new, previously unknown class of problematic questions emerged — the shopping recommendation.

That is, on Super User we began encountering questions like: …

TildalWave

@Shog9 well I always miss the best bits :) Hey @Aarthi! (wink) t'was not me they made me do it! LOL :))

@ManishEarth Most problems seem to be coming from members not realizing some question might be subjective, argumentative,... tho. I think that what research have you done before asking your question? question isn't pushed enough, it ought to be there on top of the new question form. Or maybe we should consider question templates with required fields? Just some ideas off the top of my head ;)

kinunt

@TidalWave, thats a good point, a close reason "needs for research before being answered" or something like this

TildalWave

Hey @Adnan ;) wink wink

ManishEarth

@TildalWave I once requested this. The current draft isn't that great, I'm rewriting in the summer

Thomas Pornin

17:56

@TildalWave Now, that nails down why I don't ask questions. I do the research first, at which point I have no question anymore, just answers.

TildalWave

@ThomasPornin hehe yeah... but you understand what you read. Not all do. I hardly think it'd bring these websites to a standstill if more is demanded of questions, especially since now not much is.

ManishEarth

@ThomasPornin ask and answer it yourself then :)

2

Adnan

@ThomasPornin !this

@TildalWave You have a very young soul, don't you?

TildalWave

@Adnan I'm not sure YouTube has any effect on bears ;)

ManishEarth

@Adnan physics.stackexchange.com/users/2451/qmechanic physics.stackexchange.com/users/10851/chris-white and a few more

0 questions

TildalWave

18:00

@Adnan I'm nearly a virgin :)))

Adnan

@TildalWave @ManishEarth I was just referencing opposite of the "No answers; only questions" song.

TildalWave

@ManishEarth that's because asking a good question is always more difficult than answering them... they're just lazy :))

ManishEarth

ah lol

@TildalWave yep

AviD

18:19

@RoryAlsop heya @rors, anything interesting going on there?

meet anybody I know...? :-)

Scott Pack

@RoryAlsop The Big 4 tend to have post incident forensics services, yes?

AviD

@RoryAlsop you let the rookie walk around Londong with your wife??

@kinunt in addition to what others have said, there is a world of difference asking for recommendations for a product, and asking for recommendations for a practice.

Iszi

@AviD The hell is Londong? The phallus of the U.K.?

7

Antony Vennard

@AviD Gotcha. Going to ask "What is your favourite way to read your favourite security book?" right now ;)

On no wait that's still bad subjective. It'll have to be:

"I'm trying to read my favourite security book. How do I achieve this? For example, I am not sure if I concentrate best in low light, or in the sunshine on a summer's afternoon. Should I use a bookmark, or try to remember the page number? By the way, incidentally, if your answers could actually mention your favourite book, that would be handy"

Rory Alsop

18:53

@AviD - you almost made me snort Irish coffee out my nose. Claire says hi!

Infosec was especially boring this year. BSides was pretty good. Didn't see as much as I wanted - the trade off with escorting my wife round Longdong on her birthday:-)

@Scott - yes. Extensive forensic response teams.

Scott Pack

@RoryAlsop I thought as much.

Rory Alsop

Claire says she is the rookie. Totally failed to buy anything other than a coffee! Heh.

Rory Alsop

19:08

@scott - what you need to know. I ran a couple of forensic teams.

Scott Pack

@RoryAlsop A guy was asking for recommendations for when something happens. We do all our stuff internally so I've never had to deal with it.

Rory Alsop

19:29

@scott - happy to go into detail if you need on Friday. Currently post-con and drunk so not useful

Scott Pack

@RoryAlsop You mean it's possible for a Scotsman to be too drunk to be not-useful?

CodesInChaos

@ThomasPornin My questions usually are idle curiosity where I'm too lazy to do the research. Since crypto.SE is low on questions I simply ask them if I think somebody else might find them interesting as well.

kinunt

@AviD ok, that's another point and a good directive to improve my questions, thanks

ManishEarth

I wonder what happens if I ask "How do I crack RSA?"

CodesInChaos

Personally I'm far more temped to ask for product recommendations than actual technical questions.

AviD

19:35

@Iszi lol, shuddup.

CodesInChaos

For technical things a bit of research usually answers the question.

AviD

actually noticed the typo, decided not to fix it, in that context it actually works.

CodesInChaos

For shopping having somebody who actually used the product is invaluable.

AviD

@RoryAlsop hehe, I see that is going to be a new meme... ?

Thomas Pornin

@ManishEarth If @RoryAslop is not drunk enough, he closes your question or migrates it to crypto.SE. Otherwise, you might get a Bear answer about field sieve, laser diodes, and Babylon.

3

AviD

19:37

@RoryAlsop that must be hellish. "I screwed up, now you fix it oh and by the way its all your fault".

ManishEarth

@ThomasPornin ah

CodesInChaos

Probably by the other bear

AviD

@Adnan is about to burn out his light bulbs, switching them on and off like that...

Transcript for