The DMZ

12:05 AM

@AJHenderson Are you following that discussion in the comments? The guy is the embodiment of everything I hate about Microsoft - incompetence, irrelevancy, unjustifiable self-pride, and lack of vision.

Simon

@TildalWave Hence why he's a Microsoft fan.

TildalWave

@D3C4FF well dunno for others but I'm for my second time in hairs with some MS dude

Xander

12:33 AM

@TildalWave With due respect, I think descending into ad hominem accusations is probably going a bit far.

The man has 230K rep on SO. Of course he's going to get votes anywhere he posts on the SE network.

The fact that he's an outsider on Sec.SE aside, he's well known and very well respected in the developer community at large, and has been for many years.

If you want to take issue with his answer, I don't have any problem with that, but claiming that he's voting for himself is a serious accusation.

TildalWave

@Xander Noted. Still, OP just explained to him in the comments how his answer is (for the most part) irrelevant to his question. I think that nails it down fair and square. My accusations aside, the guy is still way over his head and he didn't consider not for a split second I might be trying to help him get the answer on track, and make it more relevant.

It is and will be, after all, the most read answer in that thread. The way it reads now - that's rather unfortunate.

Xander

@TildalWave Sure, and again, I think taking issue with the answer is fine.

TildalWave

Oh, and the question is being pounded with more ridiculous answers, of course. MD5 for string evaluation purposes, anyone? :)

OK now let's see where the best answer so far lands:

1

A: Why is blog spam always written so badly?

spamdexing I've been getting a few of the first one on my blog. While it looks harmless, they're actually spamdexing (a little bit of "black hat seo") by trying to associate their user account (and website links by extension) with the keywords in the blog. When you click on the link it counts as...

that +1 it currently has is from me

Xander

12:54 AM

@TildalWave And me. :-) I don't think it's that much better than Eric's answer though. It's still a single potential reason that's plausible, and probably true in at least some cases, but not backed up by any sort of research.

TildalWave

@Xander We likely won't see a complete answer, because it's all based on speculation until someone actually waterboards the script kiddie responsible for these exact spam messages OP posted as an example. But, so far, it gives the most plausible explanation IMO. I'm fairly confident the explanation I gave is widely used, but I always suspected there's more to it (besides also avoiding spam filters, which was described as a possible reason before)

Problem with me is, that I'm really not that versed in Wordpress and other ready-made blog interfaces, because I roll my own for such needs (blog is fairly simple matter actually, if you already have well developed framework and CMS). I've seen them, I've been following a few other discussions about them, but I've never had to deal with them inside a less than ideal tool to do the job.

D3C4FF

@TildalWave Wut? 'Im for my second time in hairs with some MS dude'?

Makes no sense

@TildalWave I for one offer my waterboarding script kiddie sevices

TildalWave

@D3C4FF hehe... probably, but you still extracted the intended meaning, or are translation services in order? :P

D3C4FF

1:33 AM

@TildalWave Translation required

TildalWave

@D3C4FF oh... well dunno obviously it's not immediately apparent to English speakers, but in my language "being in one's hair" would be a polite translation for bitch fight (you know, pulling each other's hair out and similar)... and MS = Microsoft ;)

copy

We have the same expression in German

Still the English sounds confusing

D3C4FF

@copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste

@TildalWave Ah. Yep. That expression is not recognised by me.

"Being in ones hair" is something of a reference to being bothered by someone i think, but its not used often

TildalWave

1:50 AM

@D3C4FF that would work also then :)

@D3C4FF so, what are you up to today?

Simon

2:21 AM

@copy So you're German, eh. You must be the dude who made the AMA about being a botnet owner then.

copy

Am I the first German here?

Also you must be Canadian, because you're using eh

Simon

@copy It doesn't change the fact that it is you!

@copy Hell no! Whistles

copy

Hell no, eh!

Simon

@copy sssshhhhhhh

D3C4FF

2:42 AM

@copy hahahah

@TildalWave "pre-sales" meetings :P And setting up GPG for my email accounts :P

TildalWave

@D3C4FF so extortion and blackmail all in a single day?!

AJ Henderson

2:59 AM

@TildalWave wow, never thought I'd actually disagree strongly with lipert on something

though the dude is kind of the shit when it comes to .Net

TildalWave

@AJHenderson a certain song by Ultravox comes to mind ;)

AJ Henderson

@TildalWave not sure which one

but overall, I respect Eric, though I still disagree on anti-spam as security. It's filtering

when it is forum spam, it becomes more grey I suppose

TildalWave

@AJHenderson ♫♪♫♫♪♫♪♫ ...it means nothing to me, this means nothing to me, oh Vienna. ♫♪♫♫♪♫♪♫

I'm not being overly proud or anything like that (frankly, I think my answer is lacking on a lot of points - I just didn't have any more than what I posted and you didn't already), it's just he's probably God in stuff I honestly don't and will probably never find any use for, so I'm Eric's deity status agnostic (read: impartial)... still, it's a good song :) :P

AJ Henderson

yeah, it also doesn't stop me from arguing with him a bit. SPAM isn't an exploit

which is part of his own definition

it's using the system as it is designed, just the content is unwanted

now if they start hacking around a captcha or some registration mechanism, NOW it becomes a big security issue

but if they are just doing what a normal user could, it's filtering, not security

TildalWave

@AJHenderson I've noticed what he said yes... and this exploting registrations is exactly where my answer comes from. Spamming on forums is not merely posting as unregistered, unprivileged user... and that obviously creates the need to prove exploitability by covert means, which is what these messages we were discussing could quite reasonably be (or some share of them at least). Why would we assume script kiddies have any spam worth posting and at the same time their user accounts deleted for it?

Terry Chia

3:11 AM

We need to ban questions containing "NSA" or "PRISM".

TildalWave

@TerryChia that one is a dupe anyway ;)

Simon

To bypass a blacklist of a certain character, would converting to unicode work?

TildalWave

@Simon dunno, worth a try... where?

Simon

@TildalWave Well, it's in DVWA. It tests the String with a black listed array and replaces it with null.

"&&" and semicolon are blacklisted. I need one of them to pipe a command execution.

LOL, duh, piping. The character | works.

AJ Henderson

@TildalWave he's personally helped me with one or two things over on SO

since I'm a software architect working in .Net world, I tend to push the envelope a bit and go in to territory that literally just about nobody has gone

makes for some issues I run in to very hard to find, and since he basically wrote the expression system in .Net, I appreciate his insight on LINQ and Expressions

but that also doesn't mean I give him god like status in other areas :)

Terry Chia

3:22 AM

@AJHenderson Software architect. Fancy title for a cat!

2

Simon

As much as I hate MS, I must say that LINQ is pretty cool.

Terry Chia

@Simon LINQ is the best part of .NET

Simon

@TerryChia Sweet, that means I have no reason to study it if I've already seen the best of it.

TildalWave

@AJHenderson Look sure, I have nothing against him personally, frack I don't know the guy at all, but I disliked his handling of what was discussed there and some comments are not even worth replying to IMO... I realize I've needlessly suggested a few things here in DMZ, but that's DMZ and we kinda understand each other that sometimes some just need to let some steam off... fine with me when it's others too, as long as it's not on the Q&A... and his last comment to chill, it's just SO...

AJ Henderson

@Simon pretty cool when it works, a major pita when it is misbehaving

Terry Chia

3:24 AM

@Simon Hehe. I really like C# as a language. Although my favorite language is still python.

AJ Henderson

it's getting better, but there are some really weird subtleties to it when you start dealing with generic cases

which is pretty much what my job is

I would challenge that EF and Expressions are actually the best part of .Net

Simon

@TerryChia C# was the first language I learned. Python looks so interesting, I really wanna get into it.

Terry Chia

@Simon I like python because it's damn easy to script up something simple to automate task. It also has a huge amount of third party libraries available so many task simply boils down to importing the right libraries and calling it in the right places.

Simon

@TerryChia I've been wanting to code a brute-force lately, for shit and giggles. So, you're telling me that it wouldn't too hard to code it in Python?

AJ Henderson

oh yes, and the bain of my existence in C# is the lack of covariant returns

Terry Chia

3:28 AM

@Simon Brute force of what?

AJ Henderson

ie, if you have a method in class Vehicle that returns Passenger you can't have a class Car that inherits from Vehicle have an overload of that same method return CarPassenger even if CarPassenger inherits from Passenger

Simon

@TerryChia Web-based.

Terry Chia

@Simon Ahh, should be pretty simple. See: docs.python.org/2/library/httplib.html

Simon

@TerryChia Awesome, thanks.

Alright, time to go to bed, see ya everyone.

AJ Henderson

3:44 AM

horray, my Poweredge 2850 finally detects it's raid array in Windows 2012 install

Scott Pack

I spent about two hours attempting to diagnose why my Tenable appliance upgrade wasn't going well, only to find out that, since Tuesday, they had released a hotfix that corrected the issues I was trying to diagnose. >_<

AJ Henderson

haha

yeah, that sounds like the hour and a half I spent trying to figure out why the DVD wouldn't boot before realizing it was a CDROm drive

... oops

so I had to go out and buy a thumb drive because somehow, with all the gadgets I have, I never once bought a thumbdrive

probably because I've always been able to either put the files on my phone or just upload them to my server directly

Terry Chia

@AJHenderson heh. i'm gonna grab me one of these when it comes out: amazon.com/Corsair-Flash-Voyager-Turbo-CMFGTT3-128GB/dp/…

AJ Henderson

nice, yeah, I have several high speed memory cards for my camera

and a USB3 card reader

they fly

ut oh, my install took a tumble

Scott Pack

4:00 AM

@AJHenderson I've done that before. This was more annoying to me because it was during a scheduled change and a sysadmin wasn't available to actually click the 'Start' button on the vm after I power cycled it.

AJ Henderson

@ScottPack ouch

Scott Pack

Frustration Station

AJ Henderson

it's certainly been an interesting experience. It's my first time actually working with a high end server

even if it is an old high end server

I spent about an hour and a half just looking through all the different bios and firmware screens

there's atleast 5 or 6 of them on this one

Scott Pack

Yeah, there's a few of them. Have you looked into OpenManage yet?

AJ Henderson

no

Stack Exchange

4:10 AM

Data adapted from 'The Laurentide and Innuitian ice sheets during the Last Glacial Maximum' by A.S. Dyke et. al., which was way better than the sequels 'The Laurentide and Innuitian ice sheets during the Last Glacial Maximum: The Meltdown' and 'The Laurentide and Innuitian ice sheets during the Last Glacial Maximum: Continental Drift'.

Scott Pack

It's the hardware management system for Dell. It's a webapp that lets you do things like monitor the raid controller, network interfaces, etc. It's worth looking into as well.

Score! As soon as the job runs I'll get Copy Editor on SF.

AJ Henderson

actually, anyone have any good recommendations for a cheap gigabit switch

I'm out of network jacks

I'm using two routers running DD-WRT but have no ports left

Scott Pack

For unmanaged I've had good luck with d-link and trendnet.

I suppose it really depends on your definition of "cheap".

AJ Henderson

4:32 AM

I'm gonna try TP-LINK it looks like

they have good reviews and can get a 24 port for $106