« first day (1112 days earlier)      last day (2127 days later) » 
00:00 - 21:0021:00 - 23:00

12:00 AM
@JimmyHoffa This is a little odd if you add attributes to the relationship. You need one instance of some new class for each unique Foo/Bar combination. And I suppose a method to get that new instance by passing a Foo and a Bar.
12:10 AM
Maybe just having a list of FooBars and if worthwhile an index of Dictionary<Foo,Foobar> and/or Dictionary<Bar,Foobar> would be cleaner.
Obviously a FooBar has a Foo, a Bar, the FooBar attributes, and works flawlessly.
12:38 AM
@psr The link objects would be this way was kind of my point; one for every Foo and Bar combination, except then the Foo owned them.
@psr This makes good sense as well
Doing what you can to keep foo's from knowing bars and vice versa when you have those complex relationships can be good, get's the relationship reconciliation out of the domain of the object itself
8 hours later…
8:35 AM
feel screwed by a slippery review audit? Correct it so that next reviewers won't
A: Bring a "human factor" into review audit composition/selection

gnatWhile there is no officially implemented solution for this, one can use whatever means are at their disposal now in order to bring the "human factor" to audits selection. When you spot a slippery audit, go straight to the "item" it uses and do the action opposite to audit direction. If you fee...

3 hours later…
11:27 AM
@gnat There's a few questions that I've gone back to after failing the audit and starting a real close review process on it.
And I rep capped for the day about 20 minutes ago. Wow!
@WorldEngineer - thanks again for removing the protection on the question. MikeS' question is ranked 3rd at the moment. I think it's a good thing that he was given the opportunity to put his answer in.
11:47 AM
@GlenH7 so did I, with the only difference that I passed these crappy audits :)
> As I typically open the items in queue in separate tab (for more thorough review), it often happens that I spot slippery audit and perform "correction" even before completing review. It feels somewhat weird to click Looks Good at the item you just downvoted but oh well...
12:07 PM
A view into the StackExchange offices:
12:24 PM
five crappy answers quickly posted to this fairly average question, made it enter collider, thanks to broken formula. Most of 600 views it got are likely a product of positive feedback loop, more answers - more visits from collider - more answers - more visits from collider etc, over and over and over again and again and again
Q: Writing Code on Paper?

ComicStixI'm a freshman Computer Science student and we just started doing some actual projects in Python. I have found out that by using the pen and paper method my professor suggested in class I'm very efficient. But when I can't write my problem down and work my algorithm's out on paper I am really slo...

Compare these pumped up 600 to over 4K views in the real thing of about the same age. Side note, those interested in maintaining site quality, consider holding your downvotes until tomorrow, when it fades away from collider lemmings
> It was sort of revelation that happened when I observed particular hot question. Among many others, there were 3 answers of different degree of crappiness, each voted accordingly at -1, -2, -3. Few hours later, all 3 answers were upvoted back to zero, and kept staying there, buried in the sea of other mediocre, low score answers.
When you know what is broken in collider formula, it all too predictable and repeatable
Q: Why is this question good?

DariuszAfter a week of absence I went to last week hot questions, and found Cannot find symbol hasNextInt for a java.util.Scanner? with 37 upvotes. How come 37 people decided that the question shows research effort, is useful and clear? I am being more and more surprised by Stack Overflow community vo...

1 hour later…
1:29 PM
500 (worthless) MSO Rep;
where should it go?
give it to meeeeeeeeeeeeeeee!
Q: Is there a way to check what percentage of your close votes are on closed questions?

enderlandLet's say I have cast 100 close votes. How can I easily determine how many of those close votes are on questions which are currently closed? This would be useful for understanding how well my personal close voting preference matches a site's overall philosophy on when questions should be closed,...

I wish this was possible
@enderland You would need to put an answer in here to be eligible in today's game. Right now, it's just gnat, psr, & jimmy in the running since I can't award it back to myself.
Hahaha. I can't compete with those answers..
@gnat - it feels wrong to award the 500 to you given that it's your question to start with. What are your thoughts?
@enderland I think you just need a more compelling answer than psr's or jimmy's. Props if you were going to take on my answer and the data backing it. :-)
yeah, aint no one got time for dat (except you, apparently? ;)
1:36 PM
took quite a while to assemble the information and then put it in a meaningful format. Assembling all that data really turned my opinion on the collider values. And after watching the interview question yesterday, my opinions on the collider formula needing to change were anchored
I think you can probably get a question to be hot with just a few users
@GlenH7 yeah that would make it look like a slippery ping-pong between asker and answerer
UV a question to 5, have everyone post answers and UV the others
then you have... alot
Two options here...
If I were to throw another answer out there, I would point out that the suggested changes make it more fair to other questions to get visibility. Once the ball starts rolling on a hot question, it's hard to knock it off of the charts
1:37 PM
one is to simply let it go away
another to pass to Jimmy, his answer looks all-right to me
A: In hotness formula, discard answers when voting evidence indicates that these are not good data points

Jimmy HoffaPersonally I think this is a great idea. The collider in my experience clearly habits to attach to a fixed set of questions which all tend to have the same thing in common: Being the sorts of things everybody has an opinion about. If answers that lack distinct quality are not counted in the chanc...

Jimmy's answer had the lead at the moment.
I think we need a "but think of the poor children (answers) who never get a chance!" answer too. :-)
Views are still slowing inching up on the question
"slippery ping-pong between" - because, though I had not yet chance to get in line with my bounty here, it will most definitely be targeted at your answer (and I believe I would be able to prove my choice is fair)
@GlenH7 yup, education effect is just what I am hoping for at the moment. Views matter
@gnat you had mentioned that the views tend to increase in the last day of the bounty. Does that include the 24 hour grace period as well? In other words, in order to maximize views should I assign it soon or wait until end of day but before grace expires?
@enderland it is possible with SEDE, save for that you won't know things about deleted questions (I think I found a dupe to your question sorry:)
@psubsee2003 with some tweaking, SEDE allows to collect user stats on close / reopen votes (as discussed eg here). these stats are kewed though, as there is no way to get it for deleted questions (relatedfeature request here). I think at Programmers I have few thousands CVs that are "invisible" to SEDE due to deletion — gnat Sep 5 at 10:57
@GlenH7 grace period, no. It's only when question is at the top of the featured tab; it goes out of it as soon as grace period starts
huh I'll have to plook at that
1:44 PM
ok, I'll let it ride a few more minutes. Once it expires I'll award it.
VBA error handling is going to drive me nuts
VBA is far easier when you just deny that errors could ever occur
makes for clean code too
10k only link: Beautiful trolling question by Goma, and it earned a reversal: programmers.stackexchange.com/q/106397/53019
@GlenH7 .... this sounds like a great strategy!
not so surprising factoid: all 4 of our reversal badges have been awarded on questions that are now deleted
hah! I have the only one on Workplace
1:55 PM
The title alone on your TW reversal question probably generated all of those downvotes
just read the first version of the question...
the question alone is hilarious
Given how easy it was to manipulate a P.SE question into getting enough votes... and I suspect its just as easy if not easier on 'small' sites. I wonder how hard/easy it would be to do on SO.
great our intranet is super slow today, getting off to a great start.... since I'm dealing with files on network drives, nearly exclusively
urge for self promotion makes some people blind...
"Obviously it's not perfect" -- how does this answer the question asked? "Well designed etc" — gnat 1 min ago
@MichaelT at SO, one would better take care it stays under 2K (better 1K) views when manipulating votes. Per my observations, it looks like SO mods got a habit to pick and track questions at about that amount of views and cut crappy answers outta there (it's easy on no-code basis; we don't have such a luxury at Programmers / Workplace). As a result, there are less SO questions at collider and those with high views appear to have fewer answers (to those under 10K)
they generally are bold on cleaning up high-view questions; I recently noticed that in "croissants" question only because I saw 3 +1 in my rep that were returned as result of removal of 3 answers from it
...and by the way it's not the first cut at Croissants...
> "Croissants" went down from 16 to 14 answers in about an hour, between 1st and 4th revisions of this answer)
2:11 PM
They've got more 20k+ users patrolling the answers... we've gotta rely upon the mods (it will be interesting when we get active 20k reppers going after poor answers).
A: Dealing with "Find out who's going to buy the croissants"

gnatI wasn't going to go out on a limb but since a follow up question has been asked... More importantly, why is it any of your business? ...I would like to address that. I for one am concerned about answers rather than the question. What I see in "Croissants", look painfully familiar to an is...

oh wait it is currently deleted, can't tell if that was done to answers
business as usual, oh well
Aug 2 at 17:14, by gnat
we're pretty strong community to handle that aren't we. At SO in comparison, they started crying and screaming, calling for mods and refunding bounties at single croissant
Aug 2 at 17:14, by gnat
@gnat: Yes, I saw that you posted the same comment below the question. One of the other SO mods had to lock the question again because of all the attention it is getting. The thing would die gracefully if we just all ignored it. If you want to talk about the collider, ask a new question. — Robert Harvey Jul 30 at 15:56
they even delete their whining comments from MSO
I wonder who nuked croissants
@MichaelT agree this could play a role, too
Side bit - programmers.stackexchange.com/questions/209517/… has 4 undelete votes and -1 more required - is this a glitch somewhere?
@GlenH7 ask ChrisF, he's got magic powers over there. Or put a bounty at that MSO question as sort of yet another scream test. At the time of MSO discussion, there was rampant close-delete-undelete-reopen war going there, mods even had to content lock it iirc
2:18 PM
I had hoped to scrape the votes from the timeline and add that to the eventual writeup I'll do on the tri-site question
@MichaelT someone fairly believes deletion was unfair, business as usual. You will be able to tell if it gets undeleted by looking into revisions history
@MichaelT I think Community got out of hand for a bit there. It nuked a couple of questions at that point that it shouldn't have. The other one I looked at wasn't worth salvaging so I didn't flag it. I flagged the FP vs. imperative for review, but all I got was "helpful" on the flag
It's a sad day when I would handle a diamond better than Community does.
That mod being Community?
@GlenH7 the way to avoid cases like this is just to browse cliff questions and upvote worthy posts. I know this because I use it myself; after dropping like 100 first really crappy ones over the cliff I started noticing ones that looked worth moving farther from it. I think I already moved 5-10 questions away from the cliff with upvotes, and there's a couple more waiting in line for that
2:28 PM
@MichaelT yep
At the next election, I'm going to campaign on being a better mod than Community
at least one answer has to have a positive score to keep Community from auto-deleting, right?
@gnat I've done that too.
@GlenH7 A +1 rep on an answer will prevent it.
and likewise, they can get pushed over the cliff with a judicious downvote.... I can make Community do my evil bidding!!!
@MichaelT +1 score ("rep" is a typo right?). But that's not reliable since others browse it, too - their DV would bring it back to zero. I don't know yet how to deal with this; meanwhile I mostly stick with upvoting posts that are already at +1 / +2
hee hee. You can vote to reopen a deleted question. Go look at FP vs. imperative
2:35 PM
terrific analysis for monstrous SO CV queue here...
A: What can be done about the massive Close Votes queue on Stack Overflow?

MonoloThe review queue lengths express the community's collective opinion on the work asked from us. Some queues are always near zero: First Posts Late Answers Low Quality Posts Suggested Edits Reopen Votes This has to mean that the community thinks it is all right to chip in a little work to help...

The close vote queue on the other hand, is a proposition that the community is turning down. In the beginning you could say that it was huge because of all the old close votes hanging around in the system. Now, however, we have numerical evidence that it is growing on a daily basis, and can conclude that it is simply not handled in any meaningful way by the community, compared to the other queues.

I can see no other explanation than the community is rejecting the deal on the close vote queue. If we really wanted to go through it, we could. But we don't go through it, so it must mean that w
@gnat "honey badger don't care...." :-)
markdown can do fantastic things!
A: Nested quote trolling

bfavarettoThat becomes unreadable in the mobile version (screenshot for iOS 6, iPhone 5):

Dude! That's NSFW! — Bart 29 mins ago
Answered my own Q by looking at rep after DV'ing. I want the rep cap more than I care to down vote. <sigh>
@GlenH7 Did you see that graph from my SO rep?
17 hours ago, by MichaelT
user image
2:47 PM
I downvote bad answers to bad questions, community deletes the question, and I get the rep back.
I downvote mediocre questions and mediocre answers
@enderland The thing is, if you downvote closed, negative score questions that have an answer that only has +1, community will activate the roomba and delete the question for you - don't need to involve the manual process of getting a bunch of 10k or mods to clean it up for you.
@MichaelT but do I get my rep cap award for that day back. It's all about the rep caps.
Not sure - you might get it back for the next day to make it easier.
can you sort backwards on votes?
2:56 PM
@enderland ?
but the opposite way, so you see the most downvoted Qs
Go to the last page?
wow. I'm an idiot
Note that the roomba won't clean up questions that have accepted answers either.
2:58 PM
Thus the cliff question query is the best one to run against if you are after finding those.
@MichaelT that's what delete votes are for. :-)
@GlenH7 yeah I'm going to finally run out of votes :P
@GlenH7 In my copious free time, I'll write the 'cliff fenced off junk' query.
@enderland There's a badge for that.... :-)
And it would take a concerted effort to push workplace.stackexchange.com/questions/13593/… over the cliff.
3:00 PM
wooo shiney badges
I think I got that one by UVs once
should have a "negative nancy" badge if you max out voting JUST with downvotes? lol
Wait a moment.... ARRRRR!!!
@MichaelT Dread Pirate Turner returneth?
@GlenH7 It was difficult to choose an "Accepted Answer" as so many people posted useful (and opposing) opinions on the matter. But I selected yours because of the effort you put into being thorough in your post and responsive in the comments. Thanks — kmote 1 min ago
inspired by our recent discussion about Low quality posts reviews...
3:03 PM
@JimmyHoffa I go by the name of "Bootstrap" today.
Q: Low quality, but looks salvageable - trying to pick between 'Looks Good' and 'Recommend Deletion'

gnatDoing reviews in low quality queue I often stumble upon weak attempts at answers that nevertheless look like salvageable. As a rule, these are brief opinions / recommendations that could possibly become of reasonable quality if (note: if) their authors explain why they recommend it as answering ...

It's wrong to suggest they accept another answer so I can get a Populist badge, right?
But I love that rep from accepted answer isn't impacted by rep cap.
@GlenH7 rule of thumb: when you ask yourself if it's wrong, it's wrong in 99% cases. Just saved me from receiving slippery 500 bounty :)
1 hour ago, by gnat
@GlenH7 yeah that would make it look like a slippery ping-pong between asker and answerer
3:07 PM
speaking of which, I'll get that bounty awarded shortly. @enderland - consider this as last call for a shot at 500 MSO rep! :-P
The 'fun' part of going after SO cliff questions - its like shooting fish in a barrel.
yeah no kidding
@gnat - hotness question is eligible for bounty again. :-)
You need to run the v2 version with the proper params to limit it so it doesn't time out - data.stackexchange.com/stackoverflow/query/133171/…
3:09 PM
hit my deletion vote max. only 18? :(
I thought delete votes were 5 base + 1 more per 1k rep past 10k
@GlenH7 I thought so too... might be different on beta-ish sites?
must be? crap I'm going to really need a lot of rep in the future then
could be. TW is still Beta, afaik
For a very long time, in interactions with people in my jobs and at school I always got complaints about arriving at cumbersome solutions and not thinking 'straight', i.e. arriving promptly and at the point to the heart of matters or for not 'just following the orders as told'.

right now I lost a job opportunity that I was looking forward very much to because of that: they said that my code solution (professional programmer here) was too cumbersome and the presentation was suboptimal.

How can I learn to think straight and avoid these traps?
(one of the questions I cast a vote on)
3:13 PM
If the threshold for delete votes is say... 5k, then you've got that as the base with +1 for every 1k beyond?
>I want to start selling muffins at the train stop in the mornings. What do I need to do legally to do this?
@enderland Bake the muffins. It is illegal to sell uncooked muffins.
um, what kind of muffins?
<bragging> I pulled another guru badge from the interview question. Yay me!
Q: What do vegetarian zombies say? A1: BRRRAAAAANNNNN. A2: GGGRRRRAAAAIIIINNNSSS.
I only have 2 of those on workplace? :(
3:15 PM
@GlenH7 Open letter is at +75. A bit more, and I'll have the only great question on M.P.SE
As it is, I've got the 3rd highest rep question there (82, 76, 75)
3:42 PM
@enderland run data.stackexchange.com/stackoverflow/query/133171/… with the parameters 1, 300, 1, 1, 100 against SO.
(the 300 cuts it down to answers that are likely link only or just a code snippit). You can also see the views to see how helpful the answer is to other people - things not likely to be searched for.
realize that I'm running through that list right now too... so...
4:20 PM
"If you don't plan for things, they tend to happen" --- co-worker of mine
3 hours ago, by GlenH7
VBA is far easier when you just deny that errors could ever occur
@jozefg woot last night I finally saw how to and implemented using applicative functors for type constructor validation. Trying to force myself through really groking applicative functors as I kind of skipped them straight to monads (monads are a little simpler in my mind, not sure why they just seem easier) but now I can do get my Header String Int String from getHeader name age state = Header <$> validateName name <*> validateAge age <*> validateState state
moral of the story: automatic partial application is literally the most amazing thing ever
@jozefg next applicative functor to tackle:
getHeader :: String -> Header
getHeader = Header <$> toString takeDrop 15 <*> toInt takeDrop 2 <*> toString takeDrop 2
test = getHeader "AmazingNameOne!88NY" == Header "AmazingNameOne!" 88 "NY"
the takeDrop bit seems far more monadic than applicative functor, but I think it can be done... implementing the toString / toInt functions will be much easier than the takeDrop
@jozefg should be a good exercise to understand applicative functors better, while making something mildly useful, having a way of separating raw input with takeDrop into fields, converting them, then validating them, all in a nice applicative interface that lines up beautifully with a type constructor to get raw data -> structured data (for the set of raw data that is a fixed-width field protocol)
4:39 PM
@GlenH7 thanks! I put a regular :) invitation to volunteers...
in The Water Cooler, 1 min ago, by gnat
again looking for volunteers to put "draw attention" bounty on a request about fake hotness score. I plan to do it myself on Monday, but won't mind if someone else does, to make it look even more like a community effort...
in The Water Cooler, 1 min ago, by gnat
For those interested, here's an explanation why I consider this important. And, if you plan a bounty please don't forget to pick the value from dropdown - I'd recommend minimal value
5:05 PM
in The Water Cooler, 19 secs ago, by enderland
@gnat done. only 50 rep though since I'm rep poor on M.SO :)
for the record, being able to rescind close votes means I don't have to feel bad voting to close a NARQ when asking a clarification question
5:50 PM
I think that wrapping up everything we do in the role called "Programmer" is like wrapping up the work which architects, construction workers, surveyers, eletricians, plumbers into a role called "Builders". The main difference being that people can understand the differences in construction roles. — Neil 10 hours ago
7:03 PM
@MichaelT I was actually explaining that to one of my Architectural Engineering friends. I explained that its a bikeshed problem. Everyone understands the basics of a building. Software, not so much. Project management is a huge part of what I do in my classes.
When I get home, I'll try poking at this question
Q: Which of these two shuffle algorithms is more random?

robosoulWhich of below two shuffle algorithms (shuffle1 and shuffle2) is more random? public final class Shuffle { private static Random random; public static void shuffle1(final Object[] array) { if (random == null) { random = new Random(); } for (int i = a...

Compare the ordered data with each algorithm in ent.
(I'd love having a 'random' tag badge)
@GlenH7 and yea... I'm out of close votes...
7:12 PM
@MichaelT You're currently 2nd for all time on that badge. But you do have a ways to go in order to clear 100 votes on the tag.
@MichaelT I've been refactoring something that was supposed to be throw-away, so I've neglected P.SE today.
@GlenH7 100 in 20 answers for the bronze. Got a ways to go on it for both sides. Just need more people asking random questions.
I have always considered it unethical to retag questions I've answered in order to modify my tag counts. But I find it awesome that I'm 16 votes from a badge with C++
I'm at +26 with 7 answers...
@GlenH7 I think I've only tweaked tags in questions a few times... wasn't for tag count reasons.
there have bee a few licensing questions that weren't tagged with it. And I considered retagging them, but I was pretty close to landing the badge and thought would look murky
7:16 PM
Hmmf... and
there's a subtle difference between the two
not sure if appropriate for a synonym
There is a difference, not a synonym... just a 'hmf'
because I've got 7 in each with no overlap... oh if it was... I'd be at 14 and +75
let the re-tagging begin!
The right answer is to find open questions without good answers in programmers.stackexchange.com/questions/tagged/…
7:22 PM
(that I don't already have an answer in)
(there is some overlap of the tags)
Should we have a tag for ? But it's a short step to from there.
And I doubt that I'd be able to improve upon
A: How do functional languages handle random numbers?

dan_waterworthYou can't create a pure function called random that will give a different result every time it is called. In fact, you can't even "call" pure functions. You apply them. So you aren't missing anything, but this doesn't mean that random numbers are off-limits in functional programming. Allow me to ...

Hmm... maybe I could contribute to finding out how to randomly decide who buys the croissants...
7:26 PM
I would not mind if Tim Horton's chose to invade the US. Their croissants are tasty
@GlenH7 Pfft croissants nothing. It's still unbelievable to me that the rest of the world completely lacks the american biscuit. What the hell do they eat with their gravy??
@JimmyHoffa cookies.
Biscuits and gravy is a popular breakfast dish in the United States, especially in the South. It consists of soft dough biscuits covered in either sawmill or sausage gravy, made from the drippings of cooked pork sausage, white flour, milk, and often (but not always) bits of sausage, bacon, ground beef, or other meat. The gravy is often flavored with black pepper. History American English and British English use the word "biscuit" to refer to two distinctly different modern foods. Early hard biscuits (North American: cookies) were derived from a twice-baked bread, whereas the North Amer...
@JimmyHoffa don't the Brits have tack or similar?
cookies and gravy? yeck. No way, some nice rich thick gravy from cooking your pork breakfast sausage over ... cookies? Nah. Not international "biscuits" either
@GlenH7 "biscuits" exist all over the world, they do not mean american biscuits however.
7:31 PM
@JimmyHoffa clearly I know nothing of the matter then
Its a variation on the european scone.
@MichaelT ?!? American biscuit being a variation on the scone?
There's a tuple right there of (american biscuit, international biscuit)
7:32 PM
Buttermilk scones.
@MichaelT yech. Not the same.
clearly I'm not the expert on pastries I thought I was. I should consume more.
A scone is a single-serving cake or quick bread. They are usually made of wheat, barley or oatmeal, with baking powder as a leavening agent, and are baked on sheet pans. They are often lightly sweetened and are occasionally glazed. The scone is a basic component of the cream tea or Devonshire tea. It differs from a teacake and other sweet buns, which are made with yeast. A scone is not a type of pastry. Lexicology The pronunciation of the word within the United Kingdom varies. According to one academic study, two-thirds of the British population pronounce it with the preference risi...
I need to get sent to some dev confs in Europe so I can sample some more
7:33 PM
and it's not "british biscuit", because all over the world "biscuit" refers to a crunchy semi-sweet or salty thing
That first bit matches a US biscuit description.
the closest approximation to a US biscuit outside of america is a croissant
And back to the biscuits and gravy page:
> American English and British English use the word "biscuit" to refer to two distinctly different modern foods. Early hard biscuits (North American: cookies) were derived from a twice-baked bread, whereas the North American biscuit is similar to a savoury European scone.
oh, well if it's in Wikipedia, it's gotta be right
7:35 PM
Its more the references to other sites that are useful - foodtimeline.org/foodcookies.html
> According to the food history reference books, "Ammonia" cookies are not one specific cookie recipe but a whole host of edible treats employing ammonium bicarbonate, an old-fashioned (probably now hard to get?) leavening agent. Ammonium carbonate is a byproduct of hartshorn, a substance extracted from deer antlers [harts horn]. Hartshorn is most commonly referenced in old cookbooks in jelly recipes. It was also known a source for ammonia, which could be used as a leavener.
That must of smelled wonderful.
"Ammonia Cookies
2 cups sugar
1/2 cup lard
1/2 cup butter (or substitute vegetables shortening for lard and butter)
3 egg yolks
1 cups flour
1 tsp. dry ammonia
pinch of salt
Cream sugar and shortening: add yolks and stir well. Add flour and ammonia; roll dough in hands to size of walnut; bake in moderate oven (350 degrees F.) oven."
---"Mrs. Bert Vium: Presented as 'Original' Cook of the Week,' Racine Sunday Bulletin [Racine WI], May 22, 1955 (p. 29)
7:38 PM
> Take one pound of butter, one pound of sugar, yolks of six eggs, hard-boiled, and flour enough to make a dough that is not too stiff. Dissolve three cents worth of ammonia (hartshorn) in scalded milk. Place the ammonia in a large bowl and pour one cup of scalding milk over it. After this has cooled add it to the dough with one-half cup of cold milk. Flavor to taste. Flour the pans and the cookie dough. Roll and proceed as with sugar cookies."
> Biscuits: These are similar to savoury scones, and biscuits and gravy are a favourite meal here in Arkansas.
(its from a UK view going to the US)
> Diaper: The American word for nappies. My youngest child was so disappointed when she delightedly told her preschool teacher that she didn't use a nappy anymore and was promptly told she'd still need to have one at school - the teacher thought she had been talking about naps.
not sure that I'd want to move from the UK to Arkansas.
7:47 PM
@MichaelT This is just making me hungry; I've been sucked in since I sat down this morning cranking away, no morning breakfast or lunch yet..
> My family and I moved to Arkansas from England two years ago as part of a company move. We were given all sorts of relocation assistance: someone to help find a house, to show us the schools, the athletic clubs etc. We were even sent a book called Hello! USA - Everyday Living for International Residents and Visitors. I dutifully read this from cover to cover and found out that Americans also shake hands, appreciate eye contact, and value personal hygiene and personal space.
@GlenH7 I did know a fella from there, one thing he said was great about it is apparently a vast amount of hot springs (according to him)
> Pants: This word refers to the outer-garments that cover your legs in the US. In the UK, pants are the undergarments worn beneath your trousers.
That could cause some hilarity.
it's a very pretty place too. But the indigenous population can leave a bit to be desired, IMO. I've met a few of the natives and I've been underwhelmed.
7:49 PM
> My son learned this the hard way when, at two-and-a-half-years-old, he was playing in the park and my neighbour asked to see his pants - he was wearing some Disney-embroidered jeans. He promptly dropped his trousers and was startled by everybody's laughter.
@GlenH7 Yeah, ironically the fellow I knew from there, his name was Homer, and I kid you not; he looked exactly like homer simpson. the sprig of hair up top with the wrap around under it, same exact body shape and hygiene habits. acted like him to (dopey as all get out but very friendly). Was an altogether weird experience to know the guy
I was actually brought in to replace him (but subsequently fled for a better oppotunity before my second month ended)
@JimmyHoffa I suspect you've never looked back either...
@GlenH7 Nope. Just one of those strange footnotes everybody has a few of: I was at one point hired to replace homer simpson.
Never knew you were NRC certified as an operator
Hi all, would you happen to know if it is it possible for a user to take advantage of a certain serious loophole in the computer's protection mechanism, by which the user could run his/her own program in the monitor mode or kernel mode?
7:52 PM
True fact, friend of mine was cert'd in a previous life
@stevetronix that's a bit vague, but privilege escalation exploits are pretty dang common
In part, it depends upon OS, if the user has an account on the system, and what else is installed
@stevetronix You're dancing around something here (or perhaps new to software?) but what you refer to is excruciatingly common. The entirety of security is based around the fact that it's possible to elevate your privileges and execute arbitrary code if things aren't properly secured
Injection attacks and buffer overflows are pretty common routes to those types of attack vectors
@stevetronix One place I worked allowed home directories to be mounted on nfs without squashing uid 0. I had a linux box for dev that I had root on (IT didn't want to admin it) - I mounted my home directory, and set a copy of /bin/sh to be setuid 0. I had root everywhere my home directory was (which was further a problem of not mounting the home directories remapping root to nobody). Broken privileges are everywhere.
@MichaelT That's brilliant.
@GlenH7 The operations group glared at me occasionally, but then when they couldn't get sudo access for things they needed from IT, copies of that program found its way to other directories and I didn't get any more glares.
7:59 PM
Realize that the production external facing areas didn't mount home directories.
I have a similar story, but can't share it as I'm pretty the exploitable environment is still in place.
hmm, how can a user make their program run in kernel mode? Would they have to hack the admin account? Can they also have their application make a system call with certain parameters to trigger an interrupt that the user wants in order to gain control of the system?
@MichaelT I wish I could claim that the production environment had been better sheltered than the test environment
@stevetronix yes to all of the above
Are you trying to hunt something down?
or figure out how to hack the system yourself?
no hacker here, just trying to answer a theory question
Q: Difference between processes running in kernel mode and running as root?

LegendI am aware of the difference between a process running in user mode and one running in kernel mode (based on access restrictions, access to hardware etc.). But just out of curiosity, what is the difference between a process running in kernel mode and one running as root?

8:02 PM
there are multiple answers in this case
@stevetronix What's the theory? Have you written much software? Or for very long?
A: Difference between processes running in kernel mode and running as root?

Johnkernel mode and root are two separate ideas that aren't really related to each other. The concept of running a process as root is a unix/linux term that means you're logged in as the administrator of the system. Any process you run, whether as root or a normal user, generally runs in both user ...

@stevetronix not to pry but I could answer in many different ways, most of which would probably not be very helpful to you based on what your understanding is on the topic at hand
@JimmyHoffa it's for a course
Homework or some such? Happy to help, perhaps you could give us a fuller detail of the homework problem you're dealing with?
@MichaelT thanks for the links. I'll be checking them out
The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. Its best-known sub-project is the open source Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. Other important sub-projects include the Opcode Database, shellcode archive and related research. The Metasploit Project is well known for its anti-forensic and evasion tools, some of which are built into the Metasploit Framework. History Metasploit was created by ...
That's the deep dive off of the cliff though
@JimmyHoffa unfortunately the question itself is quite vague

Consider a computer running in the user mode. It switches to the monitor mode (also known as
kernel mode) whenever an interrupt or trap occurs, jumping to the address determined from the
interrupt vector. A malicious user took advantage of a certain serious loophole in the computer's
protection mechanism, by which the user could run his/her own program in the monitor mode! This
can have disastrous consequences.
a) What could have the user possibly done to achieve this?
What piece of information you're exactly looking for isn't clear; your questions ask about an entire field of information rather than any given piece, we could point you to books but other than saying your answers are in those books we can't give you much else
8:05 PM
@stevetronix - part of the problem is we could each rattle off a half-dozen answers or potential attack vectors based upon the peculiars of the environment
@stevetronix Ah this is much more clear!
You're in some lower level coding course then
I'd vote for buffer overflow. Common attack vector, good for escalation
something about operating systems
@JimmyHoffa right on
I vaguely recall some of this from my MIPS programming class.... LONG ago.
8:06 PM
unchecked parameter variables are the key culprit.
@GlenH7 I think it's hiding in the words; the user caused an interrupt vector that pointed to a space in memory where they placed a program
kernel mode could have access to all memory.
Another option would be to insert the program name at a point to where you know there will be a System.exec() call with that program name. It's an older way of launching privileged sessions
@JimmyHoffa soooo many easier vectors though... :-)
Interrupts generally force execution to a particular area of memory. If the hacker found a way to overwrite one of those areas, that would do the trick
depending upon how the stack was composed, you could still use a buffer overflow to make that work
b) - you're at the device driver level. What do you want to do? Scramble a disk? Launch another process with this user's permission? Tweak the process table?
insert a function to randomly twiddle every hundred-thousandth bit. Far more insidious.
8:15 PM
@GlenH7 yeah, I'm just basing it off the idea that in a course they give the information in the question they want you to base your approach off of
Q: Open letter to students with homework problems

MichaelTIt is September once again (today is the 7316th day of September), and once again students are asking their homework problems on Stack Overflow and Programmers.SE. We start seeing questions like: A car dealer has 10 salespersons. Each salesperson keeps track of the number of cars sold each m...

@GlenH7 you and I wouldn't do it that way, but the teacher may want them to think about doing it that way
@JimmyHoffa you're right - and I forgot the rules of academia there. The prof will provide a hint to the answers they want to see.
@JimmyHoffa @GlenH7 yes, that makes sense, the vector points to a place in memory where they placed a program, so the user is forcing execution to an area of memory. How would a user place a program in memory though?
buffer overflow
@stevetronix Just run a program and the kernel gives you memory for your program
@stevetronix All the code is in memory - its just at different places in memory.
8:17 PM
you get the address of the start of an array that holds another program (you could read it in from file) and cause the interrupt to point there. Kernels can access all memory, including the memory in the middle of your usermode programs memory
the application stack has to live in memory somewhere. Find a trusted application running at the right, low address point. Find an overflow attack on that application and you'll get the trusted application to do your writing for you.
Address space layout randomization (ASLR) is a computer security technique involved in protection from buffer overflow attacks. In order to prevent an attacker from reliably jumping to a particular exploited function in memory (for example), ASLR involves randomly arranging the positions of key data areas of a program, including the base of the executable and the positions of the stack, heap, and libraries, in a process's address space. History In 1997 Memco Software implemented a limited form of stack randomization as part of it SeOS Access Control product. The PaX project first coin...
props to the google fu!
just looked at the open letter to students link, sorry guys
@stevetronix Don't be!
8:19 PM
@stevetronix - no, you're fine
You gave us a detailed question, you showed you were thinking about it
MUCH better to ask here in chat. It's a fun exercise for us
It wouldn't necessarily be appropriate for main though.
I really appreciate all the help from everyone
@stevetronix Chat is quite reasonable... and yea, not a good question for the main site, it would be 'too broad'
although at this point, you could pose a hypothetical attack vector once you layout more details
8:20 PM
@stevetronix I was actually pointing out to @GlenH7 that his approach is likely not what the teacher meant (just as that letter says, we think about various ways the teacher may not be intending for you to think about as he hasn't taught you about them)
And we're not giving you "skip to the end" but rather "other directions of investigation"
The way the Q&A side works, it needs an answer which may be skip to the end. We don't need to give answers in chat...
@JimmyHoffa I think I'd target a trusted / kernel mode driver such as keyboard or some other peripheral
mouse driver would be insidious to tap into
no expectation of poorly formatted input from there. "It's just a mouse!"
In terms of question b), my thinking was that once a user is in kernel mode they can pretty much do anything, so the disastrous consequences could be attacking data, attacking other programs, or crashing the system
prank from old days - redirect /dev/random into /tty/mouse on an x windows session someone is using.
8:23 PM
@stevetronix correct. Once you've got kernel access then you've p0wn'd the system
@MichaelT that may actually be the exploit the prof is looking for then
@GlenH7 As would I, but the question speaks about a user 'violating the computers protection mechanism' this sounds like a user mode program violating the kernels memory protections to change the interrupt vector for the next interrupt, "violating the computers protection mechanism' doesn't sound to me like exploiting a driver or kernel mode process
that's fair.
I'll assume we're not allowed to crack the case and alter the BIOS or MBR via hardware attack, right?
<sighs heavily> (taking away all the fun attack vectors)
@stevetronix Yeah you have it, a user who can execute code in kernel mode may do absolutely anything. This also includes them faking users on the system which may have access to other systems, potentially giving them full-privileged access to an entire network of systems
some fun reading from the Jargon file on priv escalations in the OLD days catb.org/jargon/html/os-and-jedgar.html
And then there's the second part of catb.org/jargon/html/meaning-of-hack.html
8:28 PM
> Through a simple programming strategy, it was possible for a user program to trick the system into running a portion of the program in ‘master mode’ (supervisor state), in which memory protection does not apply. The program could then poke a large value into its ‘privilege level’ byte (normally write-protected) and could then proceed to bypass all levels of security within the file-management system, patch the system monitor, and do numerous other interesting things.
One fine day, the system operator on the main CP-V software development system in El Segundo was surprised by a number of unusual phenomena. These included the following:

Tape drives would rewind and dismount their tapes in the middle of a job.

Disk drives would seek back and forth so rapidly that they would attempt to walk across the floor (see walking drives).

The card-punch output device would occasionally start up of itself and punch a ‘lace card’ (card with all positions punched). These would usually jam in the punch.
And a really fun one for those days...
> The Xerox card reader had two output stackers; it could be instructed to stack into A, stack into B, or stack into A (unless a card was unreadable, in which case the bad card was placed into stacker B). One of the patches installed by the ghosts added some code to the card-reader driver... after reading a card, it would flip over to the opposite stacker. As a result, card decks would divide themselves in half when they were read, leaving the operator to recollate them manually.
@JimmyHoffa true, the whole network aspect as well!
for c) could a possible solution to correct the loophole be to check the parameters being passed in system calls as well as some sort of memory protection
That's a good start, yes
8:31 PM
@stevetronix Yeah sure. Think about the first part of what you just said; what would you check the parameters being passed in system calls for, specifically?
MIPS (IIRC) had a different memory segment that was only writeable by kernel...
A: Why in MIPS Architecture program Space divided into 4 areas?

markgzThere are logical reasons for the existence of the memory segments: Caches in MIPS need to be initialized by boot code, (unlike x86 caches which are initialized by the hardware). The memory management unit (MMU) in embedded systems is optional, so it is useful to have explicit physical memory r...

@JimmyHoffa perhaps for what part of the Interrupt Vector Table the user is trying to trigger
> When bits 31:30 are 11, access is to kernel virtual memory. Only code that is part of the kernel can access this space. References to this space are translated through the TLB. The kernel uses the TLB to map kernel pages in memory as required, possibly in noncontiguous locations. Although pages in kernel space are mapped, they are always associated with real memory. Kernel memory is never paged to secondary storage.
8:37 PM
@stevetronix Good thoughts. Keep digging around those holes, you have a solid answer for C, but you can improve it with more details about what you might look for and how you might know the request is bunk vs. safe
@JimmyHoffa is there any way to check if the Interrupt Vector is pointing to an area in memory that has been allocated via user mode (by the user) and then impede it from being accessed
@stevetronix There could be if the kernel made such memory identifiable. How might the kernel do that?
@stevetronix though another thought is: Ask your teacher. He could be looking for totally different information, stuff based on early class topics we don't know about. I'm self taught so about as far removed from knowing what details your course goes over as can be
Based on the questions you posed, the information and answers you're presenting seem totally rational and correct to me, but maybe your teacher was looking for answers like "I would form a security team of members to assess the risks and plan mitigation processes, documented in our disaster recovery ordinance"
ok, I'll try that. So far some of the suggestions are in line with course topics, so that's been helpful
(@ThomasOwens disaster recovery "ordinance". Yeah, I thought you'd like that, you can use it.)
Thanks for your time guys!
8:44 PM
@stevetronix Sure thing
@stevetronix I'll point out that if the high bits of MIPS are '11', its kernel - not user. This is architecture dependent.
00:00 - 21:0021:00 - 23:00

« first day (1112 days earlier)      last day (2127 days later) »