Would checking a client's cookie with the request cookie be good enough to avoid request forgery?

@Gilles that took me a moment. :-)

Deep Web is about to be launched! Didn't think it would get this far...

geez

66% of curious or beginner... that will be an interesting beta

Yeah, I do not see that go very far

but who knows

A whole bunch will be 100% on topic for Tor.SE, some will be relevant here, some will be off topic for SE because of criminal activity, and the remainder will probably be "unknown"

@Downgoat your website offline?

@RoryAlsop if it goes live,it will be merged soon with security.stackexchange soon since it has limited scope,i am still wondering how still tor survives :(

Tor is not a subset of security

Some of it is, and some is a subset of network engineering

I have a bit that problem with some new proposals/beta... that I see them fully as a subset of another already existing site

Yup - the boating one is entirely a subset of outdoors

I am/have been a bit active in Language Learning, but the more I think about it, the more I think it should go to Linguistics...

coffee is a subset of seasoned

@RoryAlsop Morning! Where are all the donuts like simon and dave?

@JukEboX: Simon was violently murdered or something.

O_O

@ThomasPornin how are you?

Knowing all the chat about questions and what not they were talking about all the time instead of network sec. I thought they moved to a SE meta chat

@Kalina gone too :(

There is a SE meta chat?

I figured this would be it because that is all they talk about

Now this chatroom is practically dead

@ThomasPornin more likely eaten

@JukEboX not totally dead. Just not as active as it was

@JourneymanGeek when did this start? I got away for a few weeks to take care of my kid and all the originals leave. Did all the new people scare them way. Even David is gone :(

@JukEboX er...

maaan, do I need to recount drama?

@JourneymanGeek unless you can link me to the convo

There were some conflicts of personality, some disagreement, some people stayed, some people left.

Or you give me the tl:dr

But the channel room isn't dead or abandoned.

@JourneymanGeek I was wondering as well. Ok that explains some.

(and of course, I'm on... close to a dozen chatrooms here, so I'm where there's activity that interests me. Quiet channels beget quiet me ;p)

There's probably bookmark of the drama(s)

@JourneymanGeek so what happened?

Drama?

#allthedrama

yeah tell me

I want to knows

how about reading the logs of the chat?

Any specific place to start?

I don't know myself... I'm just looking around to see if I can find something relevant... but if you've been away a few weeks, then that give you a time to start

oh jeez. Gonna be reading for dayz

So no idea where I start?

I don't know, but I'd venture a guess between April 6th and April 14th

let me look for bookmarks

Hmmm I think one is missing

I think I found it

But please link if you can @M'vy

oh damn that day was .... active

Probably even a multy day event

I found some discussion on the 5th of April... but I don't know if that triggered much... and I don't have the time now to read more into it

yeah 5th seems good

Yeah that is what I am reading

standby

have fun. It rippled a lot.

Wow I actually chatted that day

So I guess it builds up until it got to chat.stackexchange.com/transcript/message/28770116#28770116 and then degenerated probably.

Well then that escalated quickly. So no more @Simon @kalina @DavidReiltag ?

@RoryAlsop I commend you. I kind of agree with @HamZa. Kalina's attitude was never really conducive to a positive chat environment.

@Simon on the other hand was at least tame :) He made me laugh

Have they all moved on to bigger and better things?

And hello @bilbo_pingouin I don't think I met yhou before unless your Penguin :)

Who knows

@JukEboX he's nt

@M'vy at least your still here and the 2 @RoryAlsop @RоryMcCune and @RoraΖ :)

Did they call get banned?

No one got banned

(actually, chat bans are super rare. Suspensions... are a pain for longer ones)

@JukEboX as M'vy mentioned, I'm not that Penguin :-) I've spent some time around, but I don't have much to contribute, so I am usually silent.

@bilbo_pingouin Sorry I have been gone a while. And its cool. At least your here :)

What's new everyone?

No, there has been suspensions involed at some point, causing another kind of drama, but globally it's ok now.

@bilbo_pingouin How do we know that you are not the penguin? We never see the two of you together.

I have to say that I found the chat a bit... rough sometimes. But I think that's ok so long as everyone agree to that. I guess, that ship hit an iceberg.

What's it with chat and drama lately? Mos Eisley wasn't enough warning to the rest of them?

@ThomasPornin we were actually. I can't remember the day, but it happened :)

@bilbo_pingouin @Mast meh, its not everywhere.

@bilbo_pingouin NOT A PROOF EITHER.

And (in my non modhatted opinion) its much more productive to talk to each other over minor things, and save flags for things that need to be handled right now

@TomLeek lol

@JukEboX is a shame, when you started talking about the lack of dmz activity we started discussing letting you into the private place

To be honest with you I completely forgot about flags :P

and then you went and said that

@kalina YOU LIVE \o/

don't act like you care

Aaaaaaa that feel more DMZish

And I figured you all retreated to a private place

@TomLeek I can repeat the argument from back then... he is a penguin, I'm a pingouin, not the same species :)

I'm highly offended in all honesty

@bilbo_pingouin but that's exactly what you'd want us to think.

that you think I was the problem

If I'm the problem can you explain why chat died when I left?

@bilbo_pingouin Ah, that is a good argument. The penguin would not know the difference.

and then you whine about how chat is dead

back to the fun place

@ThomasPornin see? :-)

anyway, have fun and don't break anything... I'm off :)

@kalina so you think your what makes this chatroom? In the spirit of talking things out, I will say that others besides you are what make this chatroom have character. The fact that you brush people the wrong way and it makes the chat active is part of it. Admittedly I have been brushed the wrong way but I never flagged you or asked you to be banned. We step away and get over it.

I resent you for making me come back again again

blame @ThomasPornin

(a) no I am not conceited enough to state "I am the chat room" but when you're responsible for 40%+ of the messages in a room it causes more people to gravitate towards the room because it's active

@kalina like they said its better to talk it out in chat or private chat. But I doubt you would accept my private chat

(b) I don't give a squirrel about talking it out

(c) bla bla bla character

@kalina oh I get that

(d) I don't give a tiny badger that I brush people the wrong way, you accept me as I am or we part ways

#kalinastwoshits

@RoraΖ lol

@kalina agreed. As I said we step away and get over ourselves and come back and move on

(e) unfortunately you require a unanimous yes vote according to the rules in the new dmz

and I said no already

you are teh weakest link

I may have had a problem now and then but I never took action to get you flagged or banned

enjoy your kalina-free silent chat room

And away she goes!

Off to the super secret DMZ for cool kids it seems

For someone who says accept me for who I am she really passed judgement on me pretty hard.

That is kind of funny though. It's like a ghost. You invoke their name and they appear. LOL

this is getting annoying now, I had better things to do with my time

you should stop messaging people trying to get them to join private rooms

and yes we're all in another place on another site because apparently I'm not the problem

and yes we're all unfortunately laughing at your expense

woooooooooooooosssshhhhhh

be-nice

All of you.

@Mast Which brings us back to my point:

Wow she is on fire today.

@HamZa who knew everyone was so clique.

@JukEboX it's only normal that people move where they want to belong.

folks - drama is done and dusted on this, I hoped. How about not continuing to discuss it

agreed, sorry.

Agreed

Anywho

thanks

Microsoft to remove WiFi Sense \o/

...fogey here - what's wifi sense?

windows.microsoft.com/en-us/windows-10/wi-fi-sense-faq

github.com/mwielgoszewski/python-paddingoracle

Hi @Xander :)

@JukEboX Howdy

Whats shaken?

@JukEboX that sounds shocking!

@RoryAlsop Right? I never liked it to begin with.

And to make it more crazy they tied it into your friends list somehow so if you went to your friends house and you didn't know their password and they had the option enabled it would pass their wifi password to your device without you having to tell them

wow

@JukEboX Really? I thought it only worked for unsecured networks.

It was an option you need to allow for. I turned it off when I upgraded to Windows Phone 10

@JukEboX @RoryAlsop there were a few additional criteria.

@JourneymanGeek yup

but everyone thought it was terrible

I don't know anyone who used it

Pretty sure one of my friend had that, not sure

I feel like I just missed the biggest gripe about encryption on private systems for private information sharing ever.

@RobertMennell How's that?

The discussion of W10 sharing wifi information over friendslist looks like it's people griping about a feature without fully looking into it.

@RobertMennell totally agreee

But they should automatically Opt you in for it

should or shouldn't? If it's Shouldn't I would agree.

And if it's should, I would apprehensivly agree on certain editions.

@JukEboX ah forgot the mention to notify you XD

Shouldn't *

No need to notify I can read :P

yes, but in a professional setting boss keys are a thing XD

But hey the same hate happens with new features all the time until proven innocent.

granted this one is a little harder to do

Very true but that is a little intrusive I think

Granted most home users just set an open leave and forget it network... Maybe it should be opt-out by default.

it should be

@RobertMennell it is a feature I would never ever want on any of my machines

It's crazy

Damn right

Depends on the use case for me. I like it on y network at home, but would like it more if I could just limit it to a specific friends list inside of the macro fiends group(s).

On a business level it'd be awesome for guest networks. Just enter your email address to a slave account, and it's in a locked down, isolated at the hardware level network with full tracking.

plus to rotate users out you just remove them from the friendslist.

internet access based on email instead of key. Sounds pretty legit to me.

That would work well. Many people can't be bothered to edit their friends list

And if they were going by their FB friends list since it is lumped into your People Hub it can get overwhelming when Everyone is your friend

FB wifi slave accounts... Might be a lucrative marketing business too.

"Such and Such checked in here with Wi-Fi"

Very true. But the amount of discounts given would suffer

I'm not sure I'm following here... Amount of discounts given?

@RobertMennell heh - macro fiends

@RoryAlsop you fiend you!

//furiously adds Rory to the Fiends List

furious fiends :-)

On Facebook - Robert wants to add you as a fiend!

evening

evening

-non time dependent greeting here-

@Developer it might be a good idea to type @username of the person who was helping you last so they can be notified.

@RobertMennell i was talking to different period over period of time :/

I used ophcrack to get the hash, but I am not sure what to do with it now lol

I don't know the exact circumstances so I wouldn't be able to help(and even then I probably wouldn't be able too XD)

that means you don't know about cracking sam ?

I don't know the specific tools or techniques you're using. I understand the security and inner workings, and algorithms. As for specific programs... I'm not that guy.

@RoryAlsop Oh hey your thing got six votes in the community promotion ads! Walt's that event about anyways?

Yea, how did it get that many votes without explanation?

@Mast who and for what

@Mast I think I asked for some publicity for that one - it's only relevant for the next 6-8 weeks but in that time could be useful

@RoryAlsop You don't explain it though.

It just links to Travel

@Mast I did explain it. Not on the post - explanations are not necessarily relevant on the post

@RoryAlsop Perhaps, but that makes me wonder how it got voted so high, I don't see any reason without the explanation :-)

Perhpas there's a joke in it somewhere.

@Mast nope - I chatted to folks and said it would be a good thing

So they got you the votes.

@Mast some of them, almost certainly - why? I'm not sure it matters on any meta site - it's not like there is rep for it. It's publicising an event on another SE site

@RoryAlsop You're publishing an event without telling what the event is. Doesn't that strike you as odd?

@Mast that's 100% incorrect

@RoryAlsop I think you got an odd definition of 100%, but feel free to enlighten me.

When I popped the ad up there, for an event on the other site (which you can go and look at if you want - nothing to do with me) I spoke to various folks here and in other chat rooms

It's not my event

I think it's a good one

Anyone can pop any advert they like in there you know

We almost never add a comment in about it

you can read it

It doesn't link to an event. It links to a SE site.

This is why I am unsure what you are talking about

So for anyone 'passing by', it's completely unclear what it's about.

It doesn't matter - when it is June visitors to that site will see what it is about

Something about bounties in June, probably on Travel.se. Doesn't tell me a thing.

It does matter! Ads without clear purpose are lousy ads!

I didn't need to know anything else to agree it seemed like a good idea

if you don't like the ad, don't click on it

It's not even got a huge number of votes

Some of the more formal ones get 15+

I don't see ads either way, whether I click on it or not is irrelevant.

There's only one ad scoring higher at 16.

So - couple of questions for you: are you interested in Travel.SE?

@Mast this year. We do ads every year

Fair nuance.

w0rd

last year we had 9

@RoryAlsop Whenever I travel, which isn't as much as I'd like. 1 question, 2 answers.

12 the previous year

15 the previous year

Top 5 posted by you, so you must know something about adds.

@Mast okay, so you may be interested in whatever the event is this June on Travel.SE. I can see it involves bounties

But all those are self-explanatory.

@Mast Not really - in fact most folks know more than me about them as I block most kinds of ads by default :-)

@RoryAlsop An event involving bounties is still a very broad subject. I'd close it as too broad if you'd make it a question.

@Mast and on meta that would be entirely the wrong thing to do

@Mast on that thread it can be as broad as anyone wants

There's 'exploring' and 'way too broad to be sensible'.

@Mast now I really do think you are just trolling me

@Mast I can't imagine the ad makes perfect sense to me and not to you

they didn't even need to explain it to me, and I have explained it to you more than I did when I posted it here

All it means is go visit Travel.SE in June

@RoryAlsop You're an insider, I'm not. Think about it.

I'm not any kind of insider

that's where I'm baffled by your approach here

It's not my event, or my advert

none actually are

I'm not a troll, I'm just curious how that ad would make sense to anyone not familiar to the subject at hand.

@Mast it says - that site, those dates, bounty event

that's what I know

so my assumption is that there will be an event that awards bounties

on that site

between those dates

There's something going on in June involving bounties on Travel.SE. I'd yell clickbait before even considering clicking that ad.

It's not selling a site, it's selling an unknown event.

You're advertising something ill defined.

IMO

Advertising just the site would've been fine.

no I'm not

they seem to work well, and folks seem to like it

Dunno why you don't

I'm more cynical than most folks I guess.

but I'm not really prepared to labour the point any more - feel free not to click it

Let's agree to disagree :-)

At least we talked about it. Got our points out in the open.

@Mast While there are no hard and fast rules that I know of, community ads are meant to be for something related to our community. Advertising for, say, something crypto-related or privacy-related or sysadmin-related on sec.se is fine. Advertising for travel is out of line. I was told by SE to delete such wildly off-topic ads (I don't remember where, might have been in a mod chatroom).

@Gilles the criterion here is "is of interest"

Works for me - and various others who travel a lot

I'm happy with it

the challenge is when things get spammed - which this isn't

@RoryAlsop no, just because there are security professionals who travel/cook/have children/… doesn't mean that an ad for Travel/Seasoned Advice/Parenting/… is appropriate here.

@Gilles It could be

so you are taking offence to an ad that will be up for the most 6 weeks?

keeping the chat here is much more constructive, to be honest

so I've removed the comment on the ad

@RoryAlsop I'm not taking offence (wtf?), just saying that this ad shouldn't be here

@RoryAlsop This, on the other hand, is inappropriate. Please undelete my comment.

@Gilles Let's keep chat in here so it can be discussed

makes for a more useful environment

As many of the regulars may not spot chat comments on the post in meta

@RoryAlsop and vice versa

Happy to copy it verbatim into here

Reply to my comment if you want to have the last word, I'm not going to engage in a discussion, but do not delete my comment.

@Gilles no.

Deleting a comment that criticizes your answer is inappropriate.

nope - lets not use comments for chat. This is where the discussion is happening already, splitting that off is not useful

@RoryAlsop Appropriate move might be to link a comment to the start of this chat thread.

@Iszi sounds like a better plan all round

thanks - will do that

Done

So, anyway, @Gilles - there is a big difference from posting up random external ads, to having a short term ad for a growth event for another SE site

In my opinion it is fine, so when asked I was more than happy to post it for them

it has community upvotes

it's doing okay

@Gilles - really? Please do not make up stuff in flags.

I told you why it was being deleted before I even deleted it

@RoryAlsop making up???

what's gotten into you tonight?

@Gilles you know your stated flag reason is untrue - you even posted that flag after we had discussed it in here. I'm baffled as to why.

you want to bury the discussion where no one will find it

@Gilles what?

Chat is where everyone is most likely to be able to find it

especially as the link is there as Iszi suggested

Chat is for discussion. Fine. We're discussing it here. Comments are for remarks about a post. My comment was perfectly appropriate as a comment. Redirecting to chat would be appropriate for a discussion.

@Gilles which it 100% was. Already

Tell you what - let's come back to this chat conversation here after other folks have had an opportunity to discuss. I'm not really prepared to spend this much energy on something of such low importance when you do seem to be happy to be argumentative.

And deleting a comment on your own post, that's critical of your post, is not appropriate. You should have at least gotten a review from another mod, not deleted it yourself.

So I flagged, because this warrants review from someone else.

@RoryAlsop funny, it says “answered May 13 at 9:57 Rory Alsop♦”. Must be another user named Rory Alsop who's a mod here.

@Gilles so don't use them as a side channel

@Gilles and read further

night

... I'm genuinely interested in the event, hence why I asked. I left to setup a VPN and suddenly it explodes. I feel a little sheepish now. Many security experts travel(audits, jobs, etc.) and information on that site has been useful before. Sure it's not strictly IS related, but it is SE related, and as a part of the larger community I feel it's relevant for us to also vet those communities as well when appropriate. Sure an ad for a travel agency would be inappropriate, but this was a Stack Ad