« first day (603 days earlier)      last day (3001 days later) » 
00:00 - 14:0014:00 - 00:00

2:03 PM
Really? How come?
 
I don't like the way they operate, without consideration for the consequences of their actions. Whilst they have done some good stuff, a lot of the things they released SHOULD stay secret for a reason.
 
You do realise that they operate responsible disclosure policies such that all time-sensitive data is released after the expiry, right#?
e.g. names of agents in the field are not released, and details of operatives movements are redacted / leaked months afterwards.
 
@Polynomial Haven really kept up with them. But i had a few bad impressions awhile back which made me dislike they way the operate.
Can't recall what those were though.
 
most of the uber-secret stuff never gets released at all, unless it's directly related to privacy concerns or other human rights issues.
the whole TrapWire thing is sick though. government installing facial recognition cameras all over the country to monitor the movements of citizens, and in some cases listening in on conversations.
 
@Polynomial Which country is that?
 
2:07 PM
USA.
(no surprise there)
it's completely warrantless surveillance.
 
It's like we're turning into England, only without good beer or healthcare.
 
Ah i see. Doesn't the UK have something similar?
 
no, we have cameras in a lot of places for crime prevention, but no facial recognition / tracking
and it's all in city centres and areas with high crime. I generally don't mind it out there.
 
Oh i see.
Luckily my government doesn't pull crap like that.
 
I seem to recall seeing statistics that the UK has more cameras per square mile than any other developed country? Or something like that.
 
2:10 PM
but facial recognition matching to known activists and "potential trouble makers" (i.e. anyone they like) and tracking of citizens' movements is disgusting and moral-less.
 
/me drops his source less data indiscriminately.
 
Awesome blog post from Lucas.
 
Yeah, the UK has a lot, but they're mainly in tubes / train stations.
there's loads in London, and quite a few in major cities.
 
@ScottPack 67% of all statistics are made up. Including this one.
 
2:11 PM
Statistics: The only science where two experts can apply the same methods to the same data and produce completely conflicting results.
 
probably.
(ucwatididthar?)
 
@Polynomial nah.
 
statistics. probability.
 
@Polynomial i'm kidding. lol.
 
As someone said earlier, A joke explained, not a joke is.
^_______^
 
2:12 PM
We need moar bears
 
Let's all change our names to @ThomasPornin and DPs to bears.
 
Everything needs moar bears.
 
Nah, it's not bearday yet.
 
@ScottPack When is bearday? Gotta mark my calendar.
 
Checking
Having a hard time finding it. RoryDay was much easier to find.
 
2:16 PM
That needs to be in the wiki post if you ever find it.
 
RoryDay?
 
Both.
 
It was referenced in the RoriesRuleSecurity meme post, but not explicitly defined.
 
Can we have a bacon-flavoured-strippers day?
 
While it was not difficult to determine the date of the Birth of Our Great Progenitor, it is not my data to out.
meh. Sure.
 
2:19 PM
tasty!
Though in reality, I don't actually like strippers. A little seedy for my tastes.
I'll just stick to bacon.
 
@Polynomial You lie.
 
Shush you.
 
Let's be very clear that we are not discussing stripper-bacon either.
4
@AviD Speaking of which. Could stripper-bacon be kosher?
 
unlikely.
it's certainly not Halal.
 
We (generally) don't have to worry about cloven feet. Strippers do slither, but not on the ground.
 
2:22 PM
@Iszi - did you see: engadget.com/2012/08/10/…
@Polynomial and weren't the ANPR cameras included in those stats
 
@RoryAlsop If they were, that's pretty silly, since they don't record pictures at all.
 
ANPR is already used to track criminals and could very easily be used to track, well, anyone
 
yeah, I guess ANPR could be used for vehicular tracking on citizens too.
though I have to say I am a fan of ANPR.
last cop I spoke to said they have to get a written record of tracking by law anyway, but obviously that can be ignored as it'd be difficult to prove
but they found the guys that mugged me via ANPR, so I'd argue it's a good thing (for now)
 
@RoryAlsop I've heard.
 
@Iszi bit disappointing, but very spectacular
 
2:33 PM
Indeed. Boooom!
 
3:05 PM
@RoryAlsop I didn't see it as quite the same - hence my asking if you wanted it. The one I asked about seemed to me to be a case of How can I find out how it was done, rather that what should I do to fix it now it's happened
 
Good Morning Folks, Posted a question on Meta.. meta.security.stackexchange.com/questions/895/…
 
@DigitalFire I'm sorry, I don't see how that is on-topic for this site. It seems you've posted it to Meta because it is a "discussion" topic that wouldn't fit on an SE main site. However, Meta is supposed to be for discussions about the main site - which that is not.
 
@Iain I didn't mean that one was a dupe, just that it was a useful reference
sorry to cause a misunderstanding
 
@DigitalFire I agree with @Iszi on this one. Completely off topic. I also removed the first paragraph, as it didn't really have any bearing on the question.
 
@DigitalFire - @Iszi and @Polynomial are spot on here. Unfortunately I don't think we have a site for that kind of question. Even if the Ethics proposal comes about it will be too much of a discussion. We don't do questions asking for an opinion.
 
3:17 PM
@DigitalFire Additionally, I'd recommend not advertising to the Internet that you've been part of potentially illegal activity regardless of how Anonymous (pun intended) you think you are.
@Polynomial Thank our room owner, @ScottPack
@Polynomial I don't get this one. I can't really recall it having been used much on Sec.SE. Care to add some case examples?
2
A: The Memes of IT Security

PolynomialMeme: Mafia Originator: @Rook (probably) Cultural Height: Mid-2012 Background: The term "mafia" is frequently used to refer to "organised bad guys". A side-effect of its use is that it makes you look like a crazy person. Most people generally assume that users of this meme wear a tinfoil hat, ...

 
@Iszi It's mainly the Rook comment that I linked, and some of Andrew Smith's markov-chain-style ramblings which I didn't want to quote (he's a douche, he deserves zero credit!)
 
@Polynomial To be a meme, it presumably has to be fairly widespread and/or in recognizable common use within a community. I fail to see that with this one, in the Sec.SE community.
 
@Iszi It's kinda a lesser known emerging one, I guess. A few others in here recognised it immediately as a Rook / Andrew Smith thing.
 
On the meme topic, I dunno if I've mentioned but I plan on doing the write-up for S&M... from home. I'm having a hard time tracking down the origin though, 'cause chat search hates simple terms.
 
Look for comments from me. That sounds like something I would say.
2
 
3:29 PM
First one I found when searching for close S&M was this one. Definitely not the origin point...
Jun 19 '11 at 23:47, by Scott Pack
Oo....new close method. "Not Constructive". I like the implied tone way better than S&M.
Voting to close this one. OT/TL:
0
Q: How much does network security audit and patch work?

Namhow much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have about 15 workstations that consists of Sales Dept, Accounting Dept, and Shipping Department. i ...

 
3:43 PM
The mafia meme confuses me.
 
You too? A while back everyone was happy with it. Now everyone's saying they don't get it.
It's mainly based on Rook and Andrew Smith being paranoid.
 
It's completely new to me :)
 
@ScottPack I think if it was worded more along the lines of Fed/Paranoia/Tinfoil hattery it might be recognised more widely
 
@RoryAlsop Perhaps. I recognize Andrew's gravatar, but I don't have any associations with him. The bird, however, always struck me as more douchey than paranoid.
 
@RoryAlsop It is not a meme, it is a disease.
5
 
3:50 PM
Well, this is amusing. I just checked out trunk from a googlecode repo. It appears to be 6 revisions behind the trunk checkout I did back in April.
 
@RoryAlsop Maybe I should delete it and add "Paranoia" instead.
 
@Polynomial maybe not delete, but replace Mafia with Tinfoil Hattery
 
yeah
 
as it is a phrase I have always loved
 
4:13 PM
@Polynomial I like this version betterererer
 
@Polynomial Bonus points if you can find and link to recent experiments demonstrating tinfoil hats are actually counter-effective.
 
5:15 PM
@RoryAlsop does this question for your site?
0
Q: Client-side cross-site access in SSL environment - when it's still possible to do?

kagali-sanI'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing connections enabled, and all incoming connections will come from local SSL frontend using self-made CA a...

 
@ScottPack Thank you for not putting that as an image in chat.
 
5:35 PM
@ScottPack Hahaha, love that advert.
 
6:01 PM
Would you guys consider "voodoo" as a meme? i.e. security voodoo / crypto voodoo, where something is done without really knowing what it achieves in terms of security, but it feels like "you've done something, so it should be ok... right?"
 
@Polynomial A phrase we use around our office is the IT Security "hummana-hummana". (Usually said while making the sign of the cross.)
 
6:16 PM
Great quote I saw in an article today: "Simply put it is possible to have convenience if you want to tolerate insecurity, but if you want security you must be prepared for inconvenience." General Benjamin W. Chidlaw - December 12, 1954
 
awesome quote.
 
6:38 PM
Interestingly, guys, that's not the comment I was actually linking to. I dunno why it failed
 
I've initiated the discussion on clarifying our stance on Black Hat here
0
Q: Clarify our stance on black hat questions

GillesIn the site FAQ, it is written: Black Hat vs White Hat - This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a v...

Once this is done we can go to the Computer Security Hacking! and see if there are any questions there that would be ok for Stack Exchange but not for Sec.SE
 
7:04 PM
@RoryAlsop, can we edit the advertisement banner to link the text instead of that annoying "CLICK HERE"?
 
@HendrikBrummermann Ah, yes please!
 
I don't know how. Perhaps that can only be done by staff.
 
Oh, by the way. Until I can dig up more...
0
A: The Memes of IT Security

IsziMeme: S&M Originator: Unknown Cultural Height: Unknown - nearly as old as Sec.SE itself. Background: Prior to being renamed to "Not Constructive", the close option that described questions that would "likely solicit debate, arguments, polling, or extended discussion" was called "S...

 
7:26 PM
@HendrikBrummermann is this okay for your site? chat.stackexchange.com/transcript/message/5725685#5725685
 
@RoryAlsop When I wrote my latest meta question I expected to be lobbying for allowing more black hat content, and then I realized that 1. the FAQ doesn't actually really prohibit black hat content, only the kind that would be NaRQ anyway, and 2. the constant stance on Meta.Sec.SE is that we don't discriminate against black hat stuff
I have, however, seen many comments on questions like “voting to close for black hat content”
 
@Gilles That's right. We don't discriminate against blacks - we're not racist, here. ;-)
 
So @RoryAlsop @AviD @HendrikBrummermann have questions been closed and deleted for being black hat, that were not NaRQ anyway?
 
7:48 PM
@Gilles Black-hat content which is of sufficient quality to be shared and discussed on a serious site like sec.SE is actually not called "black-hat content", it is called "advanced research in security".
What makes the hat black is not the stuff that is discussed, but the intent of the hat wearer and, to a large extent, they way it is discussed.
5
 
@ThomasPornin I agree... Which is why I don't want to see comments/downvotes/votes-to-close for questions that happen to discuss how to write an exploit
 
@Gilles I see comments claiming "black hat content" as a concise way to say "quality of content is too low to qualify as research".
Anyway, week-end. See ya.
 
8:15 PM
Have a nice weekend Mr. ****in
2
 
 
1 hour later…
9:19 PM
That curry was a worthy foe.
 
@phwd yes, please migrate it.
 
Done
 
@Gilles I am not aware of any. But I have edited questions to generalize them and change the focus.
 
 
1 hour later…
10:50 PM
Got my Role-playing Games swag today. Came in an SE branded box this time. Cool!
 
11:11 PM
@RoryAlsop (and other mods) what do you think about meta.security.stackexchange.com/a/893/5501 and specifically about "official guidelines allowing moderators to delete bad answers regardless of their score."
 
11:41 PM
I went and looked for comments complaining about the black hat nature of a post that do not correspond to the dominant sentiment on meta, which is that good questions about attacks/exploits are fine
This seems to be too much on the black hat side, and as such is out of scope for this site. Feel free to bring the question inline with the faq and we can re-open. We are looking at ways to make questions like this more appropriate - this is not a 'black hat hackers site' - as per the faq it is for security professionals in an enterprise environment (with some leeway around that, I guess) — Rory Alsop Jun 11 '11 at 0:04
From the faq: Black Hat vs White Hat -This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a virus, it may be moderated. Show us where the value is to a security professional, ie white hat rather than black hat. Yes, it would be different to provide info on securing a captive portal- much more value. — Rory Alsop Jun 11 '11 at 14:51
@RoryAlsop The question FAQ-compliant since revision 1. It's vague but not terrible. And “for the threats you list, what mitigation scenarios are effective” looks pointless and out of place
welcome to IT Security! "How to exploit" smells like a black-hat question, which is not in scope for IT Security. (If you were asking whether it is OK to use this code, that would be in scope, but I think we don't need to know how to exploit it to know the answer to that question.) — D.W. Aug 2 '11 at 20:13
This strikes me as a blackhat kind of question. I expect that these sites can be used to facilitate some kinds of attacks on websites, and to conceal your identity when attacking a website. But what is the positive purpose for this? If this is a blackhat question, it does not belong here. — D.W. Aug 11 '11 at 19:57
“If this is a blackhat question, it does not belong here.” is plain wrong. The question is bad but for other reasons
Hi @filip I'm afraid this isn't the place to come for exploit code. We can give answers on protection strategy and explanation of technique, but we avoid the black hat end of things. A quick google will get you lots of exploits anyway. — Rory Alsop Oct 2 '11 at 16:15
“we avoid the black hat end of things” → again, not really. But the question is NaRQ material
since I have enough rep now, I voted as such
-1
Q: What is the best tool to anonymize your scans (network/ports)?

BnhackWhat are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but tor has limits and I would like to know what other tools are there to do this. I want to run my to...

@Ali - I'm having trouble seeing what possible use-case or scenario in which one would legitimately have this requirement. As others have mentioned, this seems to the result of unethical (black hat) activities. These are not welcome on our site. — AviD Mar 15 at 20:10
@ScottPack @Iszi @AviD There is no basis in any meta discussion to close this question
Shadier than a 100 year old oak. — Rook Mar 15 at 18:14
but Rook answered anyway
Conclusion: it doesn't come up often, but there is a disconnect between the outcome of meta discussions and what happens on some questions
 
@Gilles The question has no use for a white-hat. That's really all there is to it. @AviD's comment says just as much. Anonymization in this context is only useful to conceal the identity and/or origin of an attack. One who is performing an authorized penetration test has no such need. As for chessbird answering the question: He's well-known in this community for being more black-hat oriented than the majority.
 
11:56 PM
@Iszi I disagree that the question has no value to a white hat, and in any case there is no reason to close this question
 
00:00 - 14:0014:00 - 00:00

« first day (603 days earlier)      last day (3001 days later) »