A. Hersean

I do not have any issue with the mods usually present in the DMZ, you all do good work. The issue I'm talking about is with CMs that sometimes are overzealous, never have to explain themselves, and can delete traces of their actions.

@forest I am not referring to a discussion about Mech, but about content moderation. Moderation here is discretionary and does not follow the official guidelines and content policies. It therefore imposes self-censorship. The issue is wider than just Mech's departure, and as with the Monica affair that was left to die out without resolution, those are symptoms of a more systemic issue.

I don't have proof because I did not think to screenshot. I did not escalate because I did not want a ban. chat.SE is a censored place, and I cannot support it by staying there.

@forest Overzealous moderation by (I suppose) CM. I've seen entire discussions disappear without leaving traces, even for mods apparently. Kind of like Elon Musk, at least some of them cannot suffer the slightest criticism, even when constructive. Even when the posts respected the official accepted content policy (which is a pain to find by the way).

If you also got one, I'd be interested to follow you there.

However, if you'd like to stay in touch I got a handle in the not-twitter-verse: @[email protected] (I won't include it in my bio).

I do not plan to come more often, because of the reasons leading me to leave this place have not changed.

Hi! It's been a while since last time I came here.

This is strange, I couldn't find in the CoC where discussing moderation is forbidden. This is no more moderation, but censorship. I'm leaving.

I don't know if such an extension exists. But if you find one I'd like to know. I've indeed a few use cases that comes to mind.

Did someone upvoted a bunch of your answers? I suspect a stealthy Mech. That or someone going over my profile by coincidence.

@forest With my own domain, I often have trouble sending emails to hotmail (silent drop on hotmail's end). But I do not have trouble with gmail (just tested).

I meant: your suggestion will never happen and you know it.

Yeah... did you notice he ragequit?

Not that I know of.

Personally, I reduced my involvement in SE. I'm still less involved now than before.

Lots of people left after the Monica drama. In a sense, SE's community suffered from it.

If you got kicked when undeserving it, I wouldn't like it.

@JourneymanGeek That would be an accident, not a choice

@JourneymanGeek No, but SE should have taken the time to think about it. Maybe consulting mods that are frequently in the DMZ beforehand. Maybe trying to understand the situation before overreacting?

@ThoriumBR I say that some mods wrote that discussing it was forbidden here, I don't want to get banned for it, and then today I have a lengthy discussion on the topic with a mod.

Saying you find the CoC too strict is a good way to attract the unwanted attention of a CM.

unless a CM did not like Mech much and came back to check on him

@JourneymanGeek You did what you could, and Mech should have listened.

We know you care for us ^^

@JourneymanGeek No, He got first ban because of intolerance against LGBTs. The second ban was because he was sarcastic. If you did not know the reason for his 1st ban, his new messages would not have been enough to warrant a ban (unless I'm very mistaken).

Again, poor choice of expression from MEch.

This is inaccurate and it doesn't answer the question.

"much more effort" ? It's trivial now.

You even used the same word.

@JimmyJames "Requiring an OV or EV certificate prevents/mitigates the above approach."

And now that EV are not even displayed in browsers, this attack is even easier.

I agree on using DV make the attack easier, what I don't agree on is that EV prevent this attack completely (make it impossible).

You seem to confuse your situation with most situations.

You say that the EV attack is not fair because it relies on human errors. But it can still happen, it indeed happened with Stripe. It is a valid attack. Having a EV cert and a valid domain name is harder than just having a domain (having a DV cert is trivial). But it is still possible and not much harder.

Yes. One attack is easier that two.

It's common.

That's called a social engineering attack.

6) profit

5) register a EV certificate for the company Acme (in Cyprus) and the domain "acme.com" (like it was done for Stripe, but this time the hacker also has the domain).

1) register a company in some other country, like Cyprus, with the name of the target, let's call it Acme with the domain "acme.com". 2) do a DNS attack on the domain name (like the one for the bank). 3) register a DV cert for "acme.com" (a LE cert if you want). 4) redirect (or proxy) users of Acme (including the EV validators) to your servers.

I think that you are thinking that in order for the EV attack to work, another domain name is needed. It is not.

Let me rephrase your question: how did the Brazilian bank hackers managed to redirect the users of the bank to their servers, which served a LE certificate?

@JimmyJames You are confusing the Company name and the domain name. One attack is for the company name, another for the domain. You can combine both.

@JimmyJames In the same way. Instead of a LE certificate, just register an EV certificate under the same name as the bank, but in another jurisdiction where you previously registered a company with this name. Like it was done with in the example with Stripe.

@JimmyJames Your link on the attack on the Brazillian bank explains it: "the attackers were able to change the registration simultaneously for all of the bank's domains, redirecting them to servers the attackers had set up on Google's Cloud Platform."

@JimmyJames If you combine a DNS hack (like it was done in the attack on the bank) with the EV name collision attack, you can reproduce the attack done on the bank with an EV certificate.

@JimmyJames Have you really read it? "All Ian had to do was spend $100 registering 'Stripe Inc' in a different US state to the payment processor you'd normally associate the name with then another $77 on the EV cert and less than hour later, he had this newsworthy result:" arstechnica.com/information-technology/2017/12/…

EV certificates are subject to collision attacks on the names: troyhunt.com/… They are effectively useless to prevent the attack you describe against the Brazilian bank.

twitter.com/SchmiegSophie/status/1553620006688026624