« first day (1426 days earlier)      last day (1800 days later) » 

4:10 AM
@JeffFerland Come to the Googley side. We have cookies.
And nobody will make you write PHP code.
 
 
5 hours later…
9:08 AM
Morning All
Some quality weasel words here kb.vmware.com/selfservice/microsites/…
"err yes we support weak SSL ciphers but, that's not our problem honest"
 
9:36 AM
@tylerl "And nobody will make you write PHP code." Definitely a huge plus to the googlers :-p
Also, I find it amusing how the top two starred comments at the mo. are light-heartedly abusing @RoryAlsop
 
@Tinned_Tuna this may be because I'm one of the 3 people (that I know of) who can pin stuff and lightheartedly abusing Mr Alsop is a hobby :op
 
Morning
 
morning
 
Morning
Each time I see TOTP I still read it at first as "Top Of The Pops" :)
 
10:11 AM
@TildalWave that's what it is, obviously :-)
@RоryMcCune Heh
 
@RoryAlsop Or, considering some of the questions here asking about it, it could also mean "Time Off The Pill"
@RоryMcCune Any blue people and @ScottPack and you can pin messages onto the star wall. So your ability to pin is not so scary as, say, that @AJHenderson can pin them too :)
 
@TildalWave so, if I hold my breath for long enough, I'll be allowed to pin? Cool!
2
 
@Tinned_Tuna you nailed it :)
 
Happy birthday security.SE!!! 4 years ago today, this site was launched into private beta.
11
 
10:31 AM
2
Q: What is the difference between antivirus and firewalls

Chenthil Vel Murugan . AI need a brief explanation about the differences between antiviruses and firewalls

this one needs protection please
(and two accounts /posts nuked)
-2
Q: Why is Connrat's YouTube channel so bad?

Yo MummaWhy is Connrat's YouTube channel so bad? [Channel] why, just why? I don't even..

@RoryAlsop You here? What's two nukes among friends? :)
 
1
Q: How do I predict future root cause analysis in the presence of double unknowns (unk-unks)?

nahrafUsing following concept is it possible to define or layout future risk or in security terms future root-causes that are critical for organization operations and businesses. Those concepts are:- 4 entities known bad known good unknown good unknown bad zachman framework system conce...

 
So, I'm new to reviewing, and I'm looking at a question in the First Post queue. If a question is not on-topic (i.e. requesting support for a specific product), do I simply flag it? Or is some other action appropriate?
 
@Tinned_Tuna Close as off-topic / belongs on a different site / Super User
if that applies of course
if it doesn't then just off-topic / not within scope
 
@TildalWave I don't see that under "flag", am I looking in the wrong place?
 
@Saladin That's just a RFC question ... not what we do here. OP should specify a specific question that can be addressed in answers of reasonable length. We don't "discuss" things here.
@Tinned_Tuna use the close button
it's a big red button top right
 
10:42 AM
@TildalWave I might not have earned the right to close questions yet, I've only got ~500 rep. I think the closest "right action" in this case would be a down-vote and maybe a comment.
or flag for moderator attention
 
@Tinned_Tuna vote, and a flag then to close ... not the mod attention flag but a flag that suggests to the system that the question should be placed in an appropriate review queue
 
@TildalWave what about constructive feedback to new theme or ideas? this site is not fit to provide such....
 
@Saladin it's too broad
or "unclear what you're asking"
same thing here ... doesn't identify a specific question
 
@TildalWave did you saw the prezi preso?
 
@Saladin No, I don't have to, because I read the question and I can't see what the question is. We don't do thesis analysis or alike here, we're a Q&A, simple as.
 
10:46 AM
@TildalWave The question in at hand is security.stackexchange.com/q/72714/7954 I was going to flag it "closed for another reason, off topic". Does that sound right to you?
 
@Tinned_Tuna I guess, I forgot what you have available without access to vote to close ... I voted as "off topic / product recommendation"
anyway, it has 3 votes to close already, it'll be closed pretty soon anyway
 
@TildalWave thanks :-)
 
Uh, so I've self-assigned the task of integrating simple cert validation in Servo. Yay me
I'll probably start of with a very simple thing that checks against a cert whitelist (yay security) and then switch to pkix/certverifier or NSS. (Any other recommendations?)
 
@ManishEarth how high's your pain threshold?
 
@Tinned_Tuna I dunno :p
why?
I'm integrating an existing library
 
11:09 AM
@TildalWave thanks for those - I nuked 'em :-)
 
@RoryAlsop Yey! Thanks! Since you're spending nukes, could you also obliterate this one security.stackexchange.com/a/72696/20074 ? It seems it could be a related account.
Both threads started with "What is the difference between ..." and the answers are/were just some gibberish ... could be some script kiddie that just discovered how to script POST requests
 
@TildalWave yes - how annoying
thanks for calling them out
my modhammer is warming up nicely today
 
no problem ;) where IPs related?
 
@TildalWave not sure - once you destroy spammers, it takes out a lot of info. CM's can see it, but mods can't
Anyone reckon this now has enough info to be reopened?
1
Q: HTTP attack taking down PHP-FPM

MaxriffSomeone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons of different agents xx.xxx.xx.xx - - [10/Nov/2014:5:14:35 -0500] "POST / HTTP/1.1" 502 574 "...

 
@RoryAlsop Do you know of any good example thread on Video Production (or elsewhere) that uses embeded YouTube videos? I wanna answer one of the meta questions in space to enable embeded videos and I think it would be useful, but am looking now for one or two good examples of how that works on SE
 
11:24 AM
@TildalWave Definitely a few over on Music.SE. Hang on
 
@RoryAlsop Not really. I voted to leave closed. He doesn't add any debug info that we could use or changes in request rate. He just adds that "something happened" and that "he hasn't a clue how to extract relevant info"
It could as well be SQLi on one of his pages that others are trying to open and causing the clients to process some JS that POSTs invalid requests and his server trying too hard to make sense of them.
It's still not clear that it's a DDoS and while it obviously is a DoS, the cause of it can't be established by info he posted.
Also - OVH. That's like what you need to be protected from, not where you host your server and aren't protected from attacks from within the OVH network.
That network hosts like 3/4 of all illegal requests I get on my sites. It's usually the first to get its own blacklist policy.
 
12:17 PM
4
Q: Trusting new IT personnel

ItsMeI work in a small software house. We are all developers and we do servers/network management required for our software (many servers per customer). We are expanding with more customers; and the overhead of server management is increasing and now we plan to hire server(s) administrator. Normall...

 
12:29 PM
@RоryMcCune As long as you don't prioritize them over stronger suites, I wouldn't care too much.
 
@CodesInChaos indeed unlikely to be a real-world problem, but to me they're trying to get out of the obvious fix of "disable support for weak ciphers on the server"
 
@CodesInChaos eh. I answered that
 
12:57 PM
> make sure they have the access they need and no more
well that rules out the beer fridge then :)
Note to self: Make sure that the company policy includes refilling the beer fridge and locking it for security purposes. Conveniently forget to include a key issuing and revocation policy as old employees leave and new ones join the corporation.
 
1:15 PM
All I see in here is a bunch of donuts.
 
@Simon any particular reason, or just general Doughnutry?
 
@RоryMcCune Yeah, it just struck me.
 
@Simon but are doughnuts good or bad?
 
@RоryMcCune Well you see, that's the thing, they're vicious. Tasty as nobs but if you eat too much, you'll become as fat as everyone's mom on the Internet.
 
@Simon hmm so you're saying the DMZ is good in small doses but don't be on here too much or you'll end up a lardass
 
raz
1:20 PM
@Simon Your mom's as fast as the internet
 
@TildalWave Clearly. One needs careful use of alcohol to ensure that we have a ballmer peak ;p
 
@RоryMcCune What do you think happened to @AviD? He just became too fat to even press the power button on his PC.
 
And I was very carefully trying not to say principle of least privilege;p
 
@raz Hey, thanks!
 
1:23 PM
@RоryMcCune @Simon - Doughnuts are bad mmkay: metro.co.uk/2014/11/10/…
 
"... after a doughnut giveaway turned sour."
Genius.
However, I think I'm gonna write an email to this person to let him know that he misspelled "donut".
 
@RoryAlsop heh that's those livi northers, uncivilised
 
@RоryMcCune that's exactly what I said to the team here
(one of them came in with a box of them yesterday - he took that train :-)
 
What a train tooker.
 
raz
@Simon No problem! I love a good morning insult.
 
1:29 PM
@CodesInChaos @JourneymanGeek - I had to answer as well
 
2:08 PM
@JourneymanGeek We don't have the Ballmer Peak in the UK. It's called the Turing Peak and it's fueled by correctly-brewed tea.
 
@Tinned_Tuna: Its not just for programming though
There's a reason your tanks have a boiler for tea built in
 
@JourneymanGeek one can't have uncivilised tank-warfare, of course. Also, if you break the gunner's best china... well, let's just say you'd best run.
 
2:27 PM
@TildalWave hey now, are you afraid of quality humor or something ;)
 
One can't simply replace nuclear fusion with foliage infusion!
@AJHenderson More that you'll mention more so bad it's good movies :)
 
@TildalWave wellllllll... now that you mention it
@TildalWave insert link
on a line by itself
the oneboxing is automatic
 
@AJHenderson it doesn't show it to me while editing some question, must be parsed after
 
like this
but in a question
@TildalWave yeah
it's parsed after
a bit annoying, but that's how it works
 
@AJHenderson OK I can find some examples, perhaps not the best ones but they'll do ... one question tho, can they be linked so they start playing at a specific time / position? I.e. does #t= work for embedded YT videos as they're parsed by SE?
 
2:35 PM
@TildalWave I think so, but I'm not positive
pretty sure I've seen embedded clips starting at a particular point
 
@AJHenderson could you please trivially edit some post for me to check that?
surely there's some that embed a video and say "look at this time"
@AJHenderson video.stackexchange.com/questions/4066/… can you try on this one?
(might need a few more corrections than the link alone tho LOL)
@AJHenderson or perhaps a better one: video.stackexchange.com/questions/7131/…
@AJHenderson Doesn't take it does it? Can you try with &t= instead with next edit?
 
it took on that one
apparently it needs the m and s in the time part
 
@AJHenderson Ah cool so it's possible to make it work, thanks!
 
@TildalWave btw, no comment on my beautiful combination of a running joke with your legitimate question, or were you just trying to ignore that hoping it would go away ;)
 
It probably simply cuts at the hook part when parsing so I guess it should still work with &t= in any format, including just specifying number and it then interprets it as seconds from the start
 
2:44 PM
You're a parser.
 
@AJHenderson must have missed it, you know I comment on everything even when no comment needed LOL ... link please
 
I embedded a clip to zoolander as my demo of embedding in chat
 
@TildalWave isn't foliage infusion just a nice cup of tea
 
@RoryAlsop indeed
only worked in Hitchhikers ....
 
before I go asking questions has anyone posted a question regarding whether server/service separation increases the overall security for a site/cluster on the site, and if they have do you have a link to the question?
(I searched and found nothing)
 
2:48 PM
@ThomasW. hmm, can I take a wild stab in the dark guess as to what your question will be if we don't have one and you need to ask it? ;)
it depends a bit on the situation though and what threats you are trying to protect against
 
@AJHenderson If you want, you could. I'm basically echoing someone on Super User who asked if there's any benefit to separating their web server and databases to separate servers, whether the benefits are security or recovery in nature
as I understand the nature of cyber threats, service separation across multiple servers doesn't add any inherent security benefits in terms of protection from threats, DDoS, etc.
 
@ThomasW. I always thought that was more an efficiency improvement than security.
 
but short answer, yes, generally there is a benefit, but not one that should be relied on. It's more of a defense in depth thing
 
@Simon Agreed there, that was my argument, I'm seeking something more detailed :)
 
but it depends on how well configured your environment is
 
2:51 PM
@AJHenderson Right, but defense-in-depth applies to a point - once you have anything web facing you run into a case where you open yourself to attack
and then it comes down to the site/scripting to provide some protection
 
ideally, the user for the application shouldn't be able to do anything invalid for the app to do, in which case you have two systems with different attack surfaces, one that holds the data is more walled off and limited than your publicly exposed web server
 
(in this case, I don't consider any PHP implementations inherently secure)
right
 
but more often than not, that isn't how it is implemented
which results in drastically reduced security advantages
thing is, your DB server shouldn't be web facing
it should be web server facing
 
'Well configured' is key here
 
ideally, internet connects to web server, web server connects (on a seperate interface and possibly across a firewall) to the DB server
and the DB server only answers calls from the web server
 
2:53 PM
segregate Web server from internet and internal network, only allow pipe to db server (or app server if 3 tier)
yep
 
@AJHenderson Just like the "Private Networking" feature Digital Ocean offers.
 
@AJHenderson @RoryAlsop True statements on both counts. In an ideal world, every set of servers would have IDS/IPS, firewalls that are decent to segregate services, etc. I'm judging by the person who posted the initial question I am asking about (because it stirred my interest) that they don't have an enterprise-grade setup
 
yeah, if the DB server is publicly exposed and not properly secured and the web server is running with a full admin user on the DB server, then seperation does basically nothing
 
may be wrong, but that's my take on their issue - in my case, I've got a pfSense appliance on the edge of my network with Snort on there to add IDS/IPS to some grade, and I even firewall my web apps further to specific IP sources
right.,
 
if not make things worse
actually, probably makes things worse
 
2:55 PM
the other consideration is if they're all VPSes - i.e. not on the same section of the network with an Enterprise-grade firewall to segregate access
 
because if they were on the same server, atleast they would probably be bothering to limit to localhost connections
 
then you run into basically everything web-facing to interface with each other server and you have problems
@AJHenderson True.
 
but as you can see, it's a far more complicated issue than it seems at first ;)
since it can range anywhere from fort knox to walking around with your pants down
 
@AJHenderson preaching to the converted.
my tiny residential class network has a pfSense firewall with Snort on it for IDS/IPS... I'm that paranoid :P
and my residential netowrk here is even VLAN'd out the wazoo, each VLAN is separated from each other, with only one computer able to communicate across vlans
even got that with my wifi, I have a guest network for visitors from my classes so they can access the internet - mind you they're restricted to 2Mb up/down shared on that guest net, but still
paranoia sometimes comes in handy :P
 
3:11 PM
yeah, I have a similar setup for my guest wifi network when I have it operating, though I don't leave it on all the time. My personal paranoia is that I operate my own webserver for my file storage and sharing needs so I don't have to trust it to dropbox and the like
 
right, I even go further - the guest wifi has a restricted outbound port set
 
not that I seriously expect them to be going through it, but I have the ability to avoid using them, so why not
 
heheh I agree
i only allow port 53, 80, and 443 outbound destination on my guest network - paranoia in my favor i guess, but that's still a very restrictive ruleset
 
@AJHenderson didn't we discuss this not too long ago and was initiated by one question on the site?
(I'm afraid I don't remember much else about it, so either due to old age or as a defense mechanism if I was wrong LOL)
 
@TildalWave I don't recall
but I might not have been on for that discussion too
 
3:20 PM
it was definitely you, you shared names of bad movies as good examples :P
 
You're a good example.
 
You mean as a specimen?
 
No, as a donut.
 
I'm immune to your nomnomenclature :P
4
 
@TildalWave oh... hmm
 
3:23 PM
10/10 would read again
 
raz
9/9 I'd stop on a dime
 
8/8 donuts money you should donate
 
The top two shelves are entirely whiksy :-D
 
but then only half of it is top shelf
 
3:33 PM
haha
They're out of order compared to when I last went in -- I think they've got more since the photo was taken.
 
@TildalWave you could say they donot apply
2
 
raz
@AJHenderson I think that should be donoted
 
@AJHenderson you mean they donut apply?
 
Please stop with the puns, I donut enjoy them.
 
3:49 PM
@Simon doesn't that normally encourage us?
@TildalWave or maybe a doknot, it could be half way cross between a donut and a pretzel
 
@AJHenderson that's a Möbius strip then :P
besides, anything toroidal in shape like @Simon or doughnuts are always fun to make fun of
Can't swim? Here, have a donut ...
 
David Fullerton on November 11, 2014

If trees could scream, would we be so cavalier about cutting them down? We might, if they screamed all the time, for no good reason. - Deep Thoughts, by Jack Handey

A big part of scaling up an engineering team is getting serious about monitoring and alerts. A good monitoring system collects data from all of your various systems — for example, how fast pages are loading, or server CPU usage, or emails being sent — and alerts you when something isn’t working correctly. When everything works perfectly you can sleep easy at night knowing that you’ll get an alert if something isn’t working correctly. …

 
QOTW!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Said no one ever.
 
@TildalWave or if it has too much glaze, it might become a mobius drip
 
@RoryAlsop I added a comment, I've seen those before. Frankly, I didn't think too much of them, I just always assumed its some decomposed mushrooms soaked in water ... and some do release a whole lot of mucus during decomposition too if you add water, it's just cellulose IMHO
There's also some mushrooms that are nearly translucent, tho that's not it. The image shows multiple stems / hyphae if you open it in full size, so it must be from multiple individual mushrooms
 
4:00 PM
@Simon I think the two we had been hoping for have been a bit busy (cough @Avid and @ThomasP ) and I'm a bit busy myself. Happy to come up with one for Friday. Anyone else fancy doing one? If 5 people all did, we could schedule them in until Christmas :-)
 
@Simon Do you fancy writing a QOTW post? These are actually the easy ones as you just take content from a question and its answers and post it. The self-authored ones are much more time consuming.
 
@RoryAlsop I have no idea what people usually write in there but I might check it out when I get home. I won't promise anything though.
 
@Simon If you have a read of security.blogoverflow.com and look at those questions tagged QOTW, you'll see what is needed
 
@RoryAlsop Cheers.
 
4:29 PM
@tylerl ... aaaaand nevermind. shrug
 
 
3 hours later…
raz
7:21 PM
Any well knowledged people on SE Linux in here right now?
 
@raz well I'm not totally clueless but nor am I @Gilles
 
raz
I came upon this question and answer
15
Q: Network policies under AppArmor/SELinux

PrashanthI am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access to the program being sandboxed. However, is it possible to perform finer grained control, such a...

And I'm curious, if this is the only way SE Linux effects the linux networking stack.
 
@raz ahh that's closer to the gilles level than I get I'm afraid. Never really done anything much with SELinux or AppArmor
 
raz
@RоryMcCune That's cool, I'm only really interested in SE Linux. I figured I'd ask here. Wondering if I should actually post a question or not.
 
@raz seems like a good question to me, but then I'm well known as a poor arbiter of what's a good question :)
 
raz
7:26 PM
@RоryMcCune haha, more minus questions than plus?
 
@raz nah the ones I ask tend to go ok, but I'm far more liberal in what I think is on topic than the mods...
 
raz
@RоryMcCune Get your donuts together Rory!
 
@raz you appear to have fallen into incorrect ways of the doughnut... I'd recommend less listening to @Simon
 
raz
@RоryMcCune but... but... @Simon says...
3
 
7:51 PM
@raz you were just waiting to use that one weren't you
 
raz
@AJHenderson How could I not? And the setup was perfect!
@RоryMcCune with the assist!
 
8:17 PM
@raz oh don't get me wrong, I'm the one who stared it
I'm just glad I'm not the only one with such a bad sense of humor
 
raz
@AJHenderson Ummm, our sense of humor is awesome.
 
you know, it's funny, because people always groan and complain about how bad my jokes are, but I notice I have a whole hell of a lot of stars
 
@AJHenderson that's only to shut you up
:p
 
@ManishEarth by encouraging me?
 
raz
@AJHenderson Ahahaha
 
8:20 PM
Er....
reverse psychology?
 
I'm not sure reverse psychology works the way you think it works
 
otherwise we should be staring simon a lot more
 
@RоryMcCune No, no, no, you got it all wrong. You need to correct your spelling, sir.
 
@simon how is it spelled?
 
8:24 PM
@AJHenderson sweet bagel
2
 
ok, someone start the 5 minute timer
 
wadafuk
 
lol, sweet bagel
 
I CAN'T EDIT IT NOW FFFFFFFFFFFFFFFFUUUUUUUUUUUUUUUUUUUU
 
ftfy
 
8:27 PM
fml
 
well, editing to improve spelling and grammar is a correct reason to edit right?
 
Mess with the blue, sucks to be you
 
@ManishEarth that makes me think of portapotties
 
LOL
 
which, I suppose we both deal with shit all day
and try to make it smell less bad
 
8:28 PM
Kids suck.
And they don't suck donuts, they just suck.
 
if your kids are sucking, you are definitely doing it wrong
sicko
 
What? How do you feed them milk, through their nose?
 
8:59 PM
@AJHenderson Febreeze
 
9:22 PM
So a friend of mine is having some issues with a mouse in his basement, so he set a trap the other day. He went to reset the trap this morning and found that the mouse had chewed its own arm off to get out of the trap
 
9:48 PM
@raz I don't know much about SELinux. We have a few people who do on Unix & Linux
 
9:59 PM
@Simon on the day when the UK is a colony of Canada, perhaps :op
sweepstake on time to exploit on MS14-066 anyone?
 
@DavidFreitag yeah, they have a tendency to do that
it's generally best to either use a quick kill trap or a completely enclosed trap
otherwise they really freak out and do crazy stuff to try to escape
 
Eh, I'd just flood my basement with chlorine. That'll get 'em.
 
@RоryMcCune depends how long it takes for the Bear to get on
 
@AJHenderson 'cause I'm thinking if that's all versions of IIS back to Windows server 2003 land, and an exploit comes out.... it'll get really ugly really quickly
 
@RоryMcCune I may or may not be remoting in to patch my server as we speak
 
10:08 PM
@AJHenderson good plan(tm)
 
aw dang it, I had a previous set of updates pending a reboot already, so now I have to reboot twice :(
 
10:23 PM
I hate applying windows updates remotely with no ability to monitor progress easily
 
11:02 PM
@RоryMcCune Give me a few years, I'll make that happen.
 
11:16 PM
@Simon That could never happen. "Stop shooting at me!", "I'm sorey, eh."
 

« first day (1426 days earlier)      last day (1800 days later) »