The DMZ

Iszi

8:00 PM

@Gilles Works now, thanks.

Shog9

8:10 PM

@Iszi ok, this is pretty rough, but as always it's a wiki make it better if you wish:

58

Q: What should I do if a user posts sensitive information as part of a question or answer?

I've observed several incidents where users inadvertently posted detailed, sensitive information. For example, a Server Fault user who posted a question with working login credentials to his actual production server, or the Stack Overflow user who posted actual medical records as example data for...

Iszi

@Shog9 @Gilles already edited the FAQ to point here:

18

A: Allow moderators to hide a revision

Up until last week, moderators would have to contact the Community Managers to redact private information from a post, but thanks to Jarrod this is now been turned on for moderators to handle. By going to the post revision page, mods will now see a redact option: Choosing this, you'll be...

Shog9

@Iszi yeah, that's... the announcement of the redact feature, but not really a FAQ

Iszi

@Shog9 Also, I did post a comment-question on that.

Shog9

@Iszi yeah... Advice for years has been, if you can't quickly redact then delete.

Iszi

@Shog9 One of the reasons I was suggesting that redactions appear immediately effective, but remain undoable by moderators until the flag is validated.

Shog9

8:16 PM

@Iszi the problem here is normally that by the time a moderator gets to it, it's already been visible for a good while - probably the bulk of the time it will be visible.

Not that there's any harm in reducing the time it's visible after that, but any moderator can trivially do that via deletion.

The hard-to-solve problem here remains the time between when it's posted and when a moderator finds it.

The ideal case here is probably the author deleting it themselves (which happens)

Gilles

@Shog9 I used the first reasonable-looking post about the feature that I found in a search. If this isn't the best, fix the relevance search result order :p

Shog9

@Gilles well, the faq-proposed hadn't been updated, so there was no mention of "redact" in it. I've remedied this.

Gilles

cringe

Shog9

how much of that was copied I wonder...

Reads like the reports I'd write based on encyclopedia articles when I was 10

Gilles

@Shog9 not from the internet

Shog9

8:20 PM

@Iszi Anyway, when the ideal doesn't happen the next-best thing is for someone else to quickly edit out the problematic text. Still technically public, but much, much less accessible.

Iszi

For the sake of protecting the information from public view, deletion and redaction are mostly the same. Important differences being:

1.) Redaction allows the question/answer to live on and continue to serve its audience, without having to be re-posted.
2.) By leaving the post alive, authors will have less reason to feel negatively about redaction than they might about deletion.
3.) Redaction requires another moderator or CM's concurrence *before* it is effective to the public eye.
4.) Deleted posts are visible to non-moderators. (10k+ users)

Ohnana

@Gilles eeeek!

Gilles

@Ohnana It's basically ok, actually, but that sentence in the middle really hurt

Iszi

@Gilles I'm not sure it's "basically okay" at all. I mean, he's not wrong. But he's also quite nearly unintelligible.

Gilles

@Iszi My comment refers to the sentence that I edited out of the answer

l1thal

8:27 PM

@Gilles Shouldn't this post be in crypto?

Iszi

@Gilles Well. Technically, he's still not wrong. He said "are used", not "should be used".

Gilles

@l1thal a lot of crypto, including this, is computer science

l1thal

i c

Gilles

@Iszi With my logician's hat? Yes, absolutely. With my programmer's hat, or my security architect's hat? Hell no.

l1thal

neways. What's up, all of you many moderators and homies?

Simon

8:29 PM

@Shog9 pls

Iszi

@Gilles Oh, I wholeheartedly concur. However, that does not restrain pedantry.

l1thal

There's like 4 mods on rn. Did I miss something?

Iszi

@l1thal @Shog9's been hanging out a bit more often since the Tildal thing. And I think @Gilles came around when I flagged something in another room.

Ohnana

poor mods, can't just hang out without people seeing them as the harbringers of doom

Gilles

@Iszi ??? I've been a regular of this room for several years

Simon

8:31 PM

lulz

Iszi

@Gilles More off than on lately, AFAICT.

Gilles

@Iszi No

l1thal

Aboutta hit 200 rep on Sec.SE

bout time

Gilles

I think my participation here has stayed about the same in absolute terms, but since there's a lot more traffic now it's shrunk in relative terms

Mark Buffalo

Hi, @Gilles

@Iszi Even I know about @Gilles, wtf. Lol

Shog9

8:34 PM

@Iszi what you're overlooking here is the potential for abuse. Redaction is potentially very dangerous, if used incorrectly; it allows changing a post in ways that cannot easily be observed by a casual or even reasonably-savvy reader.

Ohnana

@Shog9 isn't that why it's a mod only tool?

if you can't trust mods, the SE structure kind of falls over

Shog9

@Ohnana what gives you the idea you can trust mods?

or rather, why do you trust moderators?

Mark Buffalo

@Ohnana Mods frequently abuse power. At least it feels that way sometimes.

I don't mean SecSE mods.

Iszi

@Shog9 Which it's why the function is restricted to moderators only - who should be quite nearly the least likely people to abuse the system. (Only less-likely should be the Community Managers, Developers, and System Administrators.)

David Freitag

@Shog9 There must be a reason why they were given the responsibility of being a mod.

Mark Buffalo

8:37 PM

SO mods are the reason I don't post on SO

I had a mod take the content of my post and delete my answer so he could get more up votes

Shog9

y'all are way too trusting for a bunch of Sec.SE users.

Mark Buffalo

I deleted my SO account shortly after that

David Freitag

@Shog9 If you look at my rep you'll see that I'm a mere fly on the wall

Iszi

@Shog9 It's also why my suggestion is to keep the validation process in place. Thus, the change is ultimately reversable - and can be reversed by someone of the same authority as the one who initiated it to begin with.

Ohnana

@Shog9 i mean, technically SE could be harvesting all my data to make buckets of money, but i trust you aren't

same way i trust mods to not be flabby genitals about things

(but history shows otherwise)

Mark Buffalo

8:39 PM

@Ohnana Do I detect an elaborate substitution for the C word?

schroeder

@MarkBuffalo I'm watching you .....

Mark Buffalo

@schroeder :ooooooooooooooo

Iszi

@MarkBuffalo Could be a D word.

@MarkBuffalo Or a couple different P words.

Shog9

it's entirely possible to have extremely careful, conscientious moderators who try to always act in the best interests of the people they represent... And who still overstep and misstep and make a complete hash of things. Or has one bad day, spends too much time arguing with a troll, and starts tearing down the walls.

Ohnana

@MarkBuffalo @Iszi por que no los dos?

Iszi

8:41 PM

@Ohnana I'm learning German, not Spanish.

Shog9

@Ohnana what? Yes we are. What do you think pays for all of this? Folks aren't showing up here and giving us money because we make really beautiful site designs, they like all this stuff y'all write. We host it publicly and folks come to see it and occasionally click ads and such.

Ohnana

@Iszi ...you live in florida

Mark Buffalo

@Ohnana Something about a poor guy named Que who didn't lose his DOS installation?

MSDOS

Iszi

@Shog9 Again, this is why moderators should be equally capable of undoing a non-validated redaction as they are of initiating one. Meanwhile, the protection user's personal information remains paramount.

Ohnana

@Shog9 yes, advertising, not selling profile data to headhunters and the like

so s/data/personal information

not q&a and stuff

Shog9

8:44 PM

@Ohnana we sell access to it, if you decide to publish your resume on SO. I mean, we don't sell a big fat spammer DB or anything, but the idea that folks will pay to look at your details is a pretty important part of all this.

Ohnana

@Shog9 exactly

it's a controlled process

Shog9

@Ohnana which you know because...?

l1thal

Hey guys, I've got a 64gb iphone 5s right now and I'm going to be getting a nexus 6p. Should I get the 64gb or the 128? The phone I have now I've had for yeeaars and it still has 23.5gb left on it. I plan to be loading nethunter on my nexus 6P and messing around with it (probably a lot). Should I go with more memory or just leave it at 64gb?

Ohnana

@Shog9 you posted on meta. i read meta. i bask in the glory of SE communication

Iszi

@l1thal If the Nexus has a microSD slot, I say don't bother with the bigger one. But I don't use my phone storage heavily.

Shog9

8:46 PM

@Ohnana right. You know because we make as much stuff public as possible. What we're doing, why we're doing it, what folks don't like about what we're doing, waffles, hopes, dreams, fears...

You trust because you can verify

Iszi

@Shog9 Uhh, no. We trust because we have to if we want to use the system. You posting stuff on meta doesn't provide verification at all. We still have to trust that you're only posting the truth.

Shog9

so, this raises perhaps the critical question here. Is it better to...
...trust that folks won't abuse something without oversight and provide a recovery plan if they do anyway, or...
...require oversight and *still* provide a recovery plan in case of abuse?

@Iszi so why would you believe it then? We could be making all of this up, as a cover for our organ-harvesting scheme.

Ohnana

see ya guys

l1thal

It's just got a nanoSIM slot

Shog9

I mean, data brokering.

l1thal

8:49 PM

If I want to go 128gb it's another $100

Iszi

@Shog9 In cases where "something" is "feature which has the primary purpose of protecting user data" and "folks" are by nature presumably "the most trusted and respected members of the community", I go with the first option.

Henry White Hat Hacker

Hello World!

l1thal

What's up, Mr. @HenryWhiteHatHacker

Henry White Hat Hacker

@l1thal Learning Python!

Shog9

@Iszi the intent of the feature is protecting user data. Really, just allowing us to be a Good Internet Citizen. It's entirely optional, but it's a Nice Thing To Do for someone when they make a mistake, which everyone invariably does.

l1thal

8:51 PM

@HenryWhiteHatHacker Nice! I love python.

Shog9

But it's purpose is to allow changing what someone wrote without leaving a public audit trail.

Henry White Hat Hacker

@l1thal Me too

Iszi

@Shog9 Fair enough, but the impact if the data remains unprotected can still be quite substantial.

@Shog9 Can you give me another good reason why such a feature was implemented?

Shog9

@Iszi simplest way of allowing the intended use while still providing some oversight

Iszi

@Shog9 I meant at all. With or without a validation process. For anyone - moderators or no.

Shog9

8:54 PM

@Iszi same

Iszi

What I mean is, what other reason would you have for implementing any feature that allows making a change that cannot be publicly audited?

Shog9

we built this with the idea that it would be audited. The old, internal-only system involved hard-deletion of data.

@Iszi we wouldn't. At least, I can't think of one off-hand. That doesn't mean it can't be used for any other purpose.

I mean, there's a similar feature in chat, which exists for the same reason

Iszi

@Shog9 Hence why my earlier statement said "primary purpose".

Shog9

It can be and has been abused for other reasons though.

There's nothing in its design that particularly discourages other uses

@Iszi say waffles

Iszi

@Shog9 Which is why there's a contingency plan. Also consider this: If redaction requires validation before it is applied, why not moderator-applied deletion?

Shog9

8:57 PM

@Iszi deletion is more easily audited

Any 10K user can view a list of recently-deleted questions

view their own deleted posts

Iszi

But the effect is the same - it's not publicly auditable.

Unregistered users can see edit histories. Not so with deletions.

And 10k users are quite rare on many sites.

Shog9

@Iszi right now, the only people who can audit redactions are moderators and employees. That's a lot fewer people than those who can see deleted stuff on all but the very smallest sites.

Lemme throw out a fairly benign example here... tags

(I say "benign", but folks get really worked up about them sometimes, so...)

Had a moderator a while back who decided that a certain tag was not good for a certain site. Decided to merge it into another tag, and then rename both of them to "untagged" or some such. Ended up hitting a good chunk of questions on the site, completely ruining the ability of folks to follow questions, making a big mess and driving away a bunch of the top users.

All with the best of intentions.

Had another moderator who got a similar notion in his head and thought he'd be clever and avoid disrupting folks on the site by locking the affected questions before doing his merges into the big ball of trash.

That didn't even get noticed for like two months, took me a couple of days to even sort out what was going on, and it's still not completely cleaned up a year or so later.

All with the best of intentions.

Gilles

Don't we have a canonical question on why passwords should be hashed, not encrypted?

Shog9

You can be a good, trustworthy person, act selflessly and try for the best outcome and... Still make a terrible mess of things.

And plenty of people have. I have.

SEJPM

489

Q: How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database, and not any other type of attack, such as bruteforcing the login page of the application, keylo...

appsec cryptography passwords hash

Gilles

9:07 PM

ah, it's a blog post

@SEJPM no, different question

0

A: Difference between hashing and encryption?

Framing the question as “difference” is weird: they're completely different concepts. It's like asking for the difference between a fish and a bicycle. One is an animal, lives in water, has fins, etc. The other is a human-constructed object, has wheels and handlebars, etc. Encryption transforms ...

Shog9

@Iszi So... In my experience, it's a lot less strain on the community to have as much as possible done out in the open, or at least done with cooperation and oversight, than to try and patch up mistakes after the fact.

Right now, I'm trying out a new protocol for destroying tags over on MSO, because the old one resulted in too many well-intentioned mistakes - by the folks on meta, and by myself. When you don't get enough eyeballs on a problem, it's hard to see the flaws in your solution until it has become a pain to correct.

And that's for tags. Imagine what a well-intentioned editor with redact rights could do if, for example, they decided that correcting some small error in a thousand posts was important enough to be worth doing, but not important enough to actually bump a thousand posts via editing.

Gilles

@Shog9 oh? What's the new protocol?

Shog9

73

A: Make it easier to prevent new questions being added in a tag

There are two big concerns that need to be addressed here, IMHO: Folks propose a lot of really terrible burninate requests. "I don't know what this word means, you should burn it" type of stuff. Those need to get weeded out. Also, Hans and Ian both mention the problem of folks wanting to burn t...

Iszi

@Shog9 If any mods are really likely to use redaction for anything other than what it's actually meant to be used for - and I'm assuming the only intended use is to protect information that should have never been posted - then you've really got a bigger problem.

Either in mod selection, mod training, UI, or all three.

Shog9

@Iszi I agree. So worth trying to make that unlikely, eh?

Iszi

9:15 PM

@Shog9 No, worth fixing the bigger problem first.

Shog9

@Iszi the bigger problem is... Mostly human nature.

It's easy to become myopic, to pursue a goal (especially one you feel is worthy) without regard to the side-effects

Gilles

@Shog9 Thanks. On a related topic, do you have a good citation for “don't discuss unrelated tags in the same meta thread” (more generally than burnination)? I've seen “tag spring cleaning” pop up on many sites, and I never seem to convince people to shut them down (unless I can wield a diamond and shut it down myself)

Shog9

@Gilles I just hate them because it's really hard to focus on individual tags or even determine if anyone's read the whole list

Iszi

@Shog9 Posting a good chunk here. Mind that this was mostly written before the thought of a mod hitting 1k+ posts with redaction (Which really should just be impossible - what's the legitimate use case?) came up. Still, I think this together with previous points statnds.

Here's another way to look at it: Firstly, I'm obviously dismissing the risk that this will be used by any moderator without the best of intentions. Or that a malicious moderator would abuse the feature on a large number of questions at once. The first, according to our processes, should be extremely unlikely. The second, several orders of magnitude more so.

Given this, how likely is it really that a well-intentioned moderator is going to even make a single bad redaction in their entire tenure?

Let's say a worse case happens, the mod gets a bit over-zealous and redacts several or even a few dozen questions in a fairly short time. Public log or not, this is something that actually can become noticeable by regular users. I'd wager any substantial hit would probably be raised to other mods or CMs within 6 hours or so for most sites.

For the sake of argument let's say it takes a whole day before a slew of bad redactions are noticed. What's the real long-term impact to the community if, at the end of that day, all the redactions are reversed?

Gilles

@Shog9 Yes, I was in that big mess on MSO a couple of years back. That's why I'd like to be able to cite you as authoritatively saying “don't do that”.

Iszi

9:23 PM

Now, consider the types of information that actually warrant redaction. I'm not a mod or SEI employee, so I can't attest to any real statistics or experience. But I've seen some of the stuff that's been called out in discussions about the feature.

What's the impact to the user, or possibly the general public, if somebody with intent and ability to exploit the leak happens to capture that information while the redaction is waiting for approval?

Shog9

> If you think this is the case, then raise the matter for discussion on meta. Share your research, as outlined above, making your case for burnination. Use the tags discussion, burninate-request - and include the tag name in the title. DO NOT try for a two-fer - one tag per discussion.

Gilles

@Shog9 yeah, saw that, but I was hoping for something not buried in other stuff and not open to the counterargument “but it's only for burnination, not for manual cleanup”

Shog9

@Gilles yeah... I don't have anything off-hand, although I've probably ranted about it a fair bit in comments on such posts (which I just close if they're on small sites).

Go ahead and toss up a discussion on MSE if you want something to point back to.

Gilles

@Shog9 does that include private betas?

Shog9

@Gilles yeah

got one handy?

Gilles

9:26 PM

grrrrr, I so miss the privilege to edit tags on meta when I don't have it

because of course that question isn't tagged tags

Ah, wait, yes it is, but it got closed as a duplicate for some weird reason

well, as long as it's closed, that's fine

Shog9

@Iszi the impact is usually small. There are a few fairly horrific examples that I'm familiar with, but the common case is "posted a config file without redacting login details". Which, of course, could be abused... But the real danger lies in leaving these around indefinitely, making these sites into a great treasure-trove of credentials. The more we remove them, the less a tempting target we become for that.

(also, if your production credentials are world-visible for even a few minutes, you'd best change them - there's nothing we can do to quickly get them out of Google)

So again, this boils down to being a Good Internet Citizen; we can't actually rewrite the past when something like this goes sour.

ArtOfCode

@Iszi cheers, wasn't around at the time but it's good to know what got flagged

Iszi

The problem with "you'd better change X" is:

1. It assumes that whatever high-risk data was posted is something that *can* be changed.
2. It assumes the author realizes that they've posted something they shouldn't have.

The first assumption is very flawed, because it's obviously false for many types of information to begin with. Further, for the particular case of "production credentials", just because something can be changed doesn't mean that changing it is trivial or fast. The second assumption is also flawed because, logically, if the author knew the information shouldn't have been po…

Mark Buffalo

@Shog9 Pay me to tinfoil program for you

Shog9

@Iszi Not saying those assumptions always hold, but I / we can't do much to change the situation.

Iszi

9:39 PM

@Shog9 What we can do is help to reduce the exposure, and do it quickly.

Shog9

So, I looked this up... For now-redacted posts created in the past 30 days on Stack Overflow, the average wait time for approval of redactions was 97 minutes. The average time between the creation of the post and the redaction was 3620 minutes.

Which is about what I expected; it takes a lot longer for the redaction to be initiated than for it to actually take place.

@Iszi if you want to do that, best focus on reducing that first number.

Iszi

Also consider this, about deletion: Yes, it hides the data from an extremely large majority of users on the site. But, as stated, 10k users still have access. And literally *anyone* can become a 10k user - for the practical purposes of this discussion, there's really no discriminatory selection or vetting process in place.

In fact, the people who might be able to exploit the leakage of data which should be redacted are also extremely well-equipped to *become* 10k users.

@Shog9 30 days? I have no control over the criteria used for your survey. ;-)

Shog9

you could just ask...

ok, second number then

third

dammit

Iszi

lawl

Shog9

trying to modify this query while chatting isn't working well :-/

Snail Mail

9:46 PM

Is this the de-militarised zone?

I have a history question, if you wouldn't mind?

Shog9

@SnailMail either of those would probably be more helpful ^

ArtOfCode

No history of security... hmm

Iszi

@Shog9 Yeah, 2.5 days is kinda nasty-long. But still, 1.5 hours of additional exposure on our site is nothing to sneeze at either.

Gilles

Snail Mail

@Shog9 Ok Thanks :)

Gilles

9:48 PM

@SnailMail history of what?

ArtOfCode

@Gilles Are history questions on topic?

Gilles

If it's related to information security, I doubt that it would be on-topic on History of Science and Mathematics

Snail Mail

@Gilles It was about the Franco-Russian alliance

Iszi

@ArtOfCode Depends on what sort of DMZ you're referring to.

Gilles

they don't do history of technology AFAIK

@SnailMail errm, then you want History

Iszi

9:49 PM

@SnailMail Yeah, I figured something on those lines. History.SE

Shog9

PostsRedacted AvgRedactionWait AvgPostWait Site Name
------------- ---------------- ----------- ---------
26            97               3620        Stack Overflow
1             322              1859        Gaming
1             102              86          Statistical Analysis
1             611              31          English Language and Usage
1             2                184         Ubuntu
1             172              289         Unix and Linux
2             97               251         IT Security

Full data, if interested

Gilles

I mean, unless it's about encryption used by the alliance or something

Snail Mail

No, it's about the 1890s :)

Thanks anyway

Iszi

@Shog9 So, third column is "wait until first moderator action" and second is "wait until redaction is validated"?

Shog9

@Iszi right

Iszi

9:51 PM

@Shog9 It's interesting to see because some of these results actually demonstrate how much worse the wait for validation can be for individual cases.

Shog9

@Iszi the problem with avg

lemme see if I can remember how to do a median in tsql

Gilles

@Shog9 each time I want to do that, I search on Stack Overflow, see 50-line solutions, and decide that I'll do without it

Iszi

@Shog9 Or if there's a quick/easy way to just get one line per post, then take the data set to something you already know the solution in.

@Gilles Of course this is also why people do things like use Excel as a database.

(Of course, I say that knowing full well that my own suggestion above follows the same logic. And yes, I'm notorious around here for using Excel as a database.)

Shog9

I think I got it; should take about 4 minutes to run

Gilles

0

Q: Are general tag discussion threads ever useful?

I've seen “tag spring cleaning” meta threads on many sites, where people are invited to raise problematic tags, one tag per answer. They usually end up in a mess: after the first few, nobody pays attention to anymore, and being able to discuss things only in comments is stifling (is this tag real...

discussion tags per-site-meta

@Shog9 ^^^^ it's been 5 minutes and random didn't close it as a duplicate

Shog9

9:55 PM

good sign

ArtOfCode

Is that the new Meta mark of approval?

Shog9

MedianRedactionWait MedianPostWait Site Name
------------------- -------------- ---------
9                   225.5          Stack Overflow
322                 1859           Gaming
102                 86             Statistical Analysis
611                 31             English Language and Usage
2                   184            Ubuntu
172                 289            Unix and Linux
57                  64             IT Security
301.5               358.5          Science Fiction
11                  74             Code Review

I don't know why I bothered running that on all sites. Most of them only had one redaction anyway.

Iszi

Actually, the real beauty of my suggestion is that it gives you an isolated copy of the lowest form of the data that you need. That way you can quickly re-run queries & analysis on only the data of interest without having to wait for one against the full database. So, it wasn't all that bad.

Shog9

@Iszi so something should kinda jump out from the data here... It takes a lot less time for mods to get to a flag they know is high-priority than to dig through the massive pile of "other" flags to find it.

Simply adding a separate "redaction needed" flag would probably reduce response time considerably

Of course, adding a separate flag for a problem that crops up less than once a day has its own problems

A trigger based on keywords would accomplish a lot without adding much complexity

Iszi

@Shog9 Assumes that most or all redactions are in response to user flags. Probably not false, but also not proven by the data set at hand. (I'm willing to accept it. Just wanted to raise awareness.)

@Shog9 What's the time unit there?

Shog9

10:03 PM

@Iszi looks like two of them didn't

OTOH, one had three

@Iszi minutes

Of the two that didn't, one was an answer on a question that did

which just leaves one question a moderator happened to see an API key in

Iszi

@Shog9 Raises question: Does the moderator flag queue shift priority based on number of flags per post?

Shog9

@Iszi yeah

Iszi

Figured probably. Good to know.

Shog9

which isn't always ideal either, but...

I have a script floating around with other sorts; oldest, most helpful flags for flagger, etc.

keep in mind, flag-handling on SO is a completely different beast from most other sites

there are 800-some flags in the queue right now, which isn't even high

Iszi

@Shog9 Given the data available, it's one of the most obvious and objective, and possibly even most reliable, means of determining which items are in most critical need of action.

Gilles

10:08 PM

@Iszi not really, that privileges what a lot of people are viewing, not necessarily what is most problematic

Iszi

@Shog9 Instead of most helpful flags for flagger, I'd go with a flagger's ratio of helpful to unhelpful. Or at least make sure that factors in strongly.

@Gilles Arguably, "a lot of people seeing something wrong" is something wrong in itself.

Gilles

e.g. a plagiarized answer on a highly popular question is less urgent than a leaked credential in an obscure debugging question or a flamewar in comments on a questin with 3 views

Iszi

@Gilles Certainly, but there's not a lot of reliable and machine-trainable means of distinguishing between the two.

JukEboX

Just rename this room to "The SE Mod Chatroom" already. Sheesh

lol

Iszi

@JukEboX Hey, I don't see anyone trying to talk about boobies or whatever right now.

JukEboX

10:12 PM

@Iszi I just got back. And I love boobies

3

Gilles

@JukEboX in cranberry sauce?

JukEboX

Right now I am trying to figure out what to do about this printer that isn't even printing a test page and it is brand new

@Gilles Peanut butter

Iszi

@Gilles I wouldn't complain.

Ohnana

@JukEboX capital punishment

Iszi

@Gilles It's like how I don't understand the expression "useless as tits on a board". I personally have a hard time imagining any place where tits would be useless - in fact, I think there's a good number of ways they could be useful on a board.

JukEboX

10:15 PM

@Iszi they easily quell the masses unless the masses have tits

Iszi

Now, I realize you probably weren't trying to imply that boobies in cranberry sauce would be a bad thing. Still, I think my point stands.

@JukEboX Even when they do, there's a non-zero portion who would likely be fairly well pacified.

(In some situations, that may even be all of the masses.)

Mark Buffalo

@JukEboX pcloadletter

Iszi

@Shog9 Is it ever clear? How quickly are those actually accumulating? I mean, da-yum.

Mark Buffalo

@Iszi They're useful anywhere

Iszi

In a box, with a fox, on a train, in a plane...

Hm... in a fox, maybe still...

Shog9

10:19 PM

@Iszi occasionally, yeah. ~67K flags in the past 30 days, so...

Mark Buffalo

In the car, on the floor, up against the minibar

@Shog9 That is a lot

Iszi

@Shog9 Geez, more flags per day than I have rep on most sites.

Though, that's not saying much when you consider that, for "most sites" I have rep on, the rep I do have is only from the association bonus.

Gilles

@Iszi IIRC the total number of flags ever on SO is about the same as the total number of questions on SE excluding SO

Ohnana

@Gilles :O

@Iszi fox fur scarf maybe?

Iszi

@Gilles It's like SO is Jupiter and the rest of SE are just its moons.

Shog9

10:22 PM

a bit over 3 million flags, excluding close flags

Iszi

@Shog9 That's just (or primarily) spam/offensive?

Gilles

I've been a mod on several small sites for 5 years. I must have processed about 4k flags. That's something like a week's worth per mod for SO.

Shog9

@Iszi probably NAA mostly

Rory Alsop

That's a terrifying stat

Gilles

@Iszi no, mostly custom flags, and VLQ, NAA, spam, offensive

Rory Alsop

10:24 PM

As is your network wide rep, @gilles

Ohnana

@Gilles oh my goooood

Rory Alsop

:-)

Ohnana

how many mods are on SO?

Iszi

@Gilles Crap, man! You need to get another k quick!

Or maybe delete a k-rep worth of users. Whatever works.

Shog9

Name                                         Flags   PctHelpful
-------------------------------------------- ------- ----------
Answer Not An Answer                         1424336 94.61 %
Post Low Quality                             506214  79.44 %
Post Other                                   295767  75.09 %
Comment Not Constructive Or Off Topic        218278  85.61 %
Comment Obsolete                             188389  98.05 %
Post Spam                                    175346  91.19 %
Comment Too Chatty                           125751  96.56 %

Gilles

10:25 PM

@Iszi er, what?

Iszi

@Gilles Your network-wide rep is currently 666k.

Rory Alsop

The rep of the beast

Gilles

oh, I have about 6xxk rep network-wide, I think... Am I at 666k?

yes

well, y'all know how to fix this...

AviD

DOWNVOTE

LOTS

Ohnana

@Shog9 QuestionExcessiveAnswersPostedForAllTimeAuto ?

@Gilles DOWNVOTE ALL YOUR THINGS!

AviD

10:26 PM

kidding

Iszi

@Ohnana My guess: Questions that have gotten way too many answers across their entire lifetime.

Gilles

@AviD As Napoleon (allegedly) said about the casualties in a battle: a night in Paris will compensate for that

Iszi

@Ohnana As opposed to: Questions that got a crap-ton of answers very quickly.

Gilles

@Ohnana that flag must have been named by an iOS developer

Ohnana

@Gilles i mean, it's very informative with a bit of context

Iszi

10:28 PM

I didn't realize there were so many auto-flag reasons.

Shog9

For comparison, this is Sec.SE:

Name                                       Flags PctHelpful
------------------------------------------ ----- ----------
Answer Not An Answer                       7251  93.81 %
Post Spam                                  6637  98.73 %
Post Other                                 2783  88.18 %
Post Low Quality                           2274  87.51 %
Post Low Quality (Auto)                    1830  96.67 %
Comment Not Constructive Or Off Topic      1015  71.13 %
Comment Obsolete                           745   88.19 %

Ohnana

so many flags

Iszi

I just realized, and I like, that you have "PctHelpful" for all flags. So you're taking user (i.e.: mod) feedback on your own system as you go?

Shog9

@Iszi in theory, although most of that feedback is meaningless

comes into play occasionally when we're trying to figure out whether a given flag is effective or not

Iszi

What's up with "Post Invalid Flags"? I mean, that really looks like shit.

It's the only one with anything near that low a score on either list.

Shog9

10:31 PM

that's obsolete; in the old 10K flag queue, that was how you said "no"

as you can see, the 10K flag queue was... Not terribly effective

this is, by the way, why /review is so important. If a NAA or VLQ flag that can be handled there, it doesn't need a moderator (in most cases; there are some heuristics to allow correction of edge cases)

Ohnana

haha! i feel so vindicated right now

Iszi

@Ohnana Stuff it. We know you're just brown-nosing to the stats for the next mod election.

Ohnana

sometimes i feel bad for turtling the review queue instead of posting answers

BUT NOT NOW!

Iszi

Wondering if I should actually leave The h Bar this time, or lurk around in case there's another flag to follow over there?

AviD

@Gilles pretty sure Rick Salomon said that too.

Shog9

10:35 PM

On this site, roughly 33% of LQ review tasks are handled in review (not preempted by the mod flag queue) (the median time for completing a task is 117 minutes, vs 71.5 for moderators, hence the number of sniped tasks)

AviD

(heehee I had to look that up)

Shog9

on SO, that's ~60% - mods aren't really much slower, but there are so many flags it doesn't matter (also there's a longer period of exclusivity for review there)

Iszi

@Shog9 Some flags go exclusively to 10k review before mods? I presume that's the automated ones?

Shog9

@Iszi to /review/low-quality-posts

Iszi

@Shog9 Still, just automated or all?

Ohnana

10:41 PM

LQ isn't a 10k task

Shog9

27

A: Hide "not an answer" and "very low quality" flags in the moderator flag queue

Part of this is implemented, although not quite in the way you suggested: Very Low Quality and Not An Answer flags do not enter the moderator queue for 15 minutes after they're raised. This applies network-wide, except on Stack Overflow, Mathematics, TeX, Salesforce and Stack Overflow em Portugu...

Iszi

Ah, k.

Ohnana

@Adi @MarkBuffalo have either of you ever adopted the name "titi" ?

Simon

As if Markus would admit it, jokes like these get his life going

Iszi

11:03 PM

Dunno why, but I'm suddenly tempted here.

16

Q: How does someone become a man in the middle?

As I understand it in order to commit a succesful MiTM attack you need to be "sitting" somewhere along the traffic path. I assume this means being hooked up to one of the nodes inbetween the end points, physically splicing the wire connecting them, or intercepting air waves. Are my assumptions...

man-in-the-middle

Answer to title Q: It happens sometimes after his best friend's been dating, or engaged/married to, his sister for awhile.

SmokeDispenser

@Iszi: haha.

I'm tempted to edit my answer;)

Iszi

Know what? Yeah, I'll comment.

SmokeDispenser

Nah

That's too chatty.

;)

Iszi

Answer to title Q: When your best friend has been together with your sister for awhile, these things can happen. — Iszi 16 secs ago

SmokeDispenser

well

There, have an upvote.)

Iszi

11:09 PM

Not at all talking from experience, BTW. In fact, I wish my sister had ended up with my best friend growing up. He'd be a hell of a lot better than the guy she did end up marrying.

Iszi

11:20 PM

@RоryMcCune You around?

Adi

@Ohnana What?!

Titi?

Ohnana

@Adi there's someone in contact with me who claims to be you

Iszi

@Ohnana And they're claiming @MarkBuffalo is a sock puppet?

Ohnana

@Iszi no, they've adopted Adi's moniker and claim to be you

also posted a pic of socks as verification

Iszi

That makes even less sense.

Iszi

11:48 PM

Yikes! From HNQ:

33

Q: Is watching porn in university a crime?

I am about to start my graduate studies in an American university, moving from my native Peru. Over the course of my under-graduation, I have developed this strange habit of watching porn at odd times, say afternoon, or morning. Sometimes I watch in classroom too, of course, reducing the volume t...

graduate-school university legal-issues

2

Ohnana

@Iszi yeah that one was a doozy

Iszi

11:59 PM

Apparently there's something of a dupe spun off on Law.SE: law.stackexchange.com/questions/8361/…

Transcript for