Luc

three three three three yay mee

yeah I know, but if I can push their edit with a single approve (my own), why doesn't a normal approve just apply their edit already? There's a discrepancy there

for those who don't spend a lot of time in that review queue: if you approve+edit then you don't need a second person to also approve it, it bypasses the second check

Spent an hour getting to the bottom of something for a suggested edit, approve the edit.... stupid decision. Should have approve+edited because I want to add s/he/they/ on top anyway, but figured someone else can take a look at well because math is not my expertise. Now the next person comes in and rates the edit as "defaces the post". One more such rejection and that time was for nothing...

@nobody Thank you a lot for saying so! I often feel like I'm too {mean, confrontational, correcting, lecturing, pushing my opinion} on the internet (though also offline somewhat). My meta answer is not nice, but I hope it's at least objective even if it's rather long and perhaps too detailed in pointing out every little flaw I perceive. I'm glad to hear it's not only me. Only just now saw it has any upvotes, apparently those don't give a notification on meta, that's also nice to see

still brilliant :)

@FireQuacker unrelated but have I ever mentioned that I love your username?

shrugs guess I'll just let this go? If OP comes back they can just revert or re-edit or whatever

agreed, but the edit doesn't do anything towards that

it also doesn't help the author for someone to give their professional opinion based on the very biased post that OP wrote, of course they're going to agree and go "yeah I suppose you're right" and then OP goes "well thanks I kind of figured, now what"

not sure whether to revert because imo this conflicts with the author's intent, and from my perspective the question is now more off-topic because it's now "you guys think this might be malware?" (an opinion: how could we know for sure?) than before ("how do I fix this security issue?")

I guess but is the point to reopen the question? It seems kinda weird to change a closed question that is not your own and not for cosmetic / http->https / archive links / that kind of edits

am I crazy or does this edit completely change the question? security.stackexchange.com/review/suggested-edits/155659

thanks FQ!

where does one report spam? security.stackexchange.com/users/220461/…

yeah I'm not worried about kids either

@A.Hersean on a related note, apparently it has been shown that loneliness kills. Covid isolation boredom is one thing, but elderly people being lonely is a thing. Call your parents and grandmas people!

must be a conspiracy :D

what are the odds?

@MechMK1 hehehe :)

but I try to keep out of the loop on sensational topics that have no bearing on my life whatsoever

I honestly have no clue at all who epstein is other than the dude who invented the Epstein Drive in The Expanse and that's what killed him

that sounds sensible in general

or not believing scientists but believing random dudes on the internet instead

like, if someone says the sky is blue, a "stupid skepticist" would say "but maybe there is just a big screen and beyond that screen it's green!"

@MechMK1 the thing is that it's fine to be skeptical, or to just not have an opinion on something. If you think some company is covering up that sugar is bad for you, despite research and convincing arguments that supports that claim, sure. But there is such a thing which I've heard described as "stupid skepticism" which is rejecting everything except stuff that is unconventional

yeah same with those, I hear lots of jokes about them but until now I was convinced that the only reason a lot of people think there exist flat-earthers, is because everyone keeps the joke alive

@AJHenderson By it being trivial to skip to the intermediate password, you mean that an attacker would just modify the server's code to stop it from sending the necessary JavaScript to the client, so that the client submits the password instead? In that case, see the FAQ at the bottom, it's an argument I frequently see and I just don't think it's enough to negate all of the advantages.

"If the server is ever compromised, the attacker would immediately have access to all user[s]" Woa, big surprise! Someone who owned the server can actually access things on the server! Sarcasm aside, I feel like this answer does not highlight the right things. Sure, one should do a fast hash on the server, but why else do we bother with slow hashes and salts if not for the user's protection? Client-side hashing has many advantages and I consider preventing a login to be a nice side effect that is by no means essential for system security.

@JCRM that isn't really how that works. Yes, it may be guessed the first time, but the odds are so ridiculously negligible that everyone on earth could bet their entire life's savings and future income against you guessing that 128-bit random string correctly on the first try and not one of them needed to be worried in the slightest. We could colonize another galaxy with ten quadrillion people and it would still be a safe bet for everyone. You're technically correct of course but... don't draw wrong conclusions about how much it reduces this risk by. It removes the risk, practically.

@StevenGraeber Which one do you use? I don't know for all of them, but KeePassX allows you to configure how strong the key derivation is under Database Settings -> Transform Rounds. The benchmark button seems to go for about a second of computation on your current system - updating that after getting new hardware would be good (and definitely change the default).

So add a bit of buffer for the next couple years and you're at about 14 characters or 6 words from a 12'000-word dictionary (or 7 words from a smaller dictionary, your choice; I think diceware's is a bit small but it's up to you). It also matters how the password is stored. If you're talking about Windows passwords, then the above applies. If you have a proper password manager or disk encryption with a key derivation function that takes 1 second to run, then you should be fine with e.g. 9 random characters.

@StevenGraeber With modern computers, guessing a random string of 128 bits takes an amount of power that would evaporate all oceans or something crazy like that. Double it to 256 bits and you're also quantum-resistant. We can't possibly crack that with technologies from the foreseeable future, including quantum computers. But to be fair, 256 bits is a lot: 43 characters upper+lower+digit or 18 words from a 20'000-words dictionary. With today's actual technology, realistic is cracking up to about 72 bits entropy: a more manageable 12 alphanum characters or 6 words from a 4000-word dictionary.

@reed Depending on how thorough you want to be, let's say one day of hands-on working time and a few days of cracking time. After you've done it once, you can re-use the Wikipedia 'dictionary' or re-use the scripts. Depending on how good one is with shell scripting, a few hours would be enough for text processing (excluding downloading/processing/cracking time). Projects where password cracking is relevant are usually a bit larger than a web pentest, say 2 weeks times 2-3 persons, so spending a day of testing on one of the primary access methods seems reasonable.

Sad to see you @Daniil didn't make it (I changed my vote and put you as first choice), hope you're not too bummed! Good answers and enabling others to find them are the most valuable things on a site like this, so I guess there are still lots of ways you can contribute to the site, in case that helps :)

@Catija I see, thx Colleen and Catija :)

but thanks for the rest of the info, good to know what this site is facing to prioritize the votes better :)

@ColleenV Losing privileges? Does one lose any privileges by becoming a mod? I don't understand this last message

stackexchange knows what the average attention span is I guess ^^'

and then still, people have to read that far and care that much. I think I take this thing more seriously than most, looking up post histories and trying to find meta posts about what is currently an issue in this community

oh, didn't know that. Maybe a link to another post would have been good where this is explained, but yeah it's tricky to argue for yourself like that, it would kind of have to be someone else (with more history) that claims it

@Daniil fwiw, I did change my vote. Not sure it feels right to say how exactly I voted before the results are known, but I'm happy the election isn't over and I can still reconsider my choice with new information :)

@Daniil yes, nice job. I noticed this too, that your ELL account is the only one and I can't say that it helped the feeling of a fresh, throwaway account

@Daniil I feel you, I'm so sorry (for the situation and injustice I mean, though also for what I said of course) :/

@Daniil I think an an apology is in order. I did not know stackexchange was so uptight about the age thing, that's ridiculous. Your account having been deleted by a moderator was a major red flag, but you may have found the only legit reason I can think of and others corroborate the story. I'm sorry for speaking out against you without knowing all the facts.

so that left three candidates and three votes... bit of a weird election

Daniil most of all, with an account that looks like it was newly created. Can't tell if it was a previously-banned troll that made a new account and is quickly pushing some answers to be able to run for moderator, or if it's legit... so I'm not sure that anyone who doesn't personally know them should vote for them, it's kind of fishy.

I got a notification to vote in the election and was surprised to find nobody has both experience with moderation tools and is actually active on the site :|

As a Dutchman I'm quite curious what this word is. What is it that your assessor thinks is wrong?