Tavern on the Meta

12:30 AM

Hello, I’ve background in searching vulnerabilities for well known internet companies like Github (you see my profile on bounty.github.com) and Google purchase order № 434622 and № 423269.

Some months ago, I started studying security issues on stack exchange since they launched a bug bounty program on hackerone… In some cases, I approached near completion for reporting to the stack exchange staff recently.

user2284570

12:43 AM

And today, I learned Pickpocketing isn’t limited to pedestrians, and can also happens at high speeds. I learned you can pickpocket someone (someone being myself) while driving a motorcycle if you drive without wearing a motorcycle helmet (I can remember the face of the thief)…

Journeyman Geek

0_0

user202362

user2284570

As result, my tablet was stolen and on it, an unencrypted ꜱᴅ card containing all my mostly ready work on stackexchange security… Which means important data landed on the wrong hands.

user202362

you know what I see? - stockholm symptom

Journeyman Geek

Assuming they know what to do with it.

Also, you do have backups, right?

user2284570

12:49 AM

I am concerned to what can happen to stack exchanges users.

user315433

What's the worst that can happen? A loss of imaginary brownie points.

user315433

And that's pretty far fetched.

user2284570

@Desire unsandboxed ʀᴄᴇ ?

Journeyman Geek

cause a pickpocket's likely to not be technical outside 'wipe the device and resell'

user202362

if you force a baby mammal to be next to you, then you feed and care for it for a period of time, eventually it will display a strong sense of stockholm symptom & becoming your pet

user315433

12:51 AM

Overall, it's all far fetched. Someone hacks SE and turns it into a malware-serving site.

user315433

I'd worry about getting personal stuff erased from that tablet, if you have remote wipe.

user315433

And leave it for other users to worry about their own security.

user2284570

@JourneymanGeek everything is detailed… By the way, he must have seen he was stealing a Samsung galaxy tab while taking it… He must have stolen it for data since Samsung devices like this have their samsung accounts tied to the serial number (you can’t register it under an other account unless the owner remove the device serial number from it device list)

Journeyman Geek

He must have seen someone with a device that was grabbable.

ɥʇǝS

@user2284570 you think he knows that? xD

Journeyman Geek

12:57 AM

I suspect you also overestimate your importance, and the average intelligence of the average snatch thief.

user202362

@user2284570 are you a troll?

user202362

who stores all the sensitive information on a SD card in a tablet?

user202362

secondly, unless you are targeted, thinking about the probability of your tablet stolen by a highend hacker who is also a decent at pickpocketing

user2284570

@Desire : far fetched, just follow the pocs. He must at least knows someone with sufficient knowledge for unlocking the device…

@Telkitty no I’m not web.archive.org/web/20160503035035/https://bounty.github.com bounty.github.com/researchers/ytrezq.html

user202362

that's P(hacker) x P(thief) ... less than 1% probably

user202362

1:01 AM

@user2284570 how does that prove that you are not a troll

Journeyman Geek

@user2284570 also. you do have backups, right?

user2284570

@Telkitty : of course, I wasn’t specifically targeted… I think he just did this in order to see what kind of interesting data on devices he can get by stealing… like banking details…

Journeyman Geek

@user2284570 or to just resell a tablet.

That's a thing

user202362

@user2284570 you don't need to worry about that, your bank probably implements 2 tier authentication for sensitive transactions

Journeyman Geek

and/or change your password

user2284570

1:08 AM

@Telkitty yes, through the Google authenticator android app. I’m locked out for changing my password until bank opening next morning… But that’s unlikely he can bypass Samsung knox in one night in order to unlock… So I think it isn’t a problem…

On the contrary, the ꜱᴅ card just needs to be inserted into a computer…

@JourneymanGeek : unlikely with those devices… As long as I don’t remove the tablet from my Samsung account, it will get located as soon as the tablet gets connected to internet (though Samsung own’s portal)… Even with all the data erased since it’s the serial number which is used… He may be young and beardless, but not that stupid…

Journeyman Geek

20 mins ago, by Journeyman Geek

I suspect you also overestimate your importance, and the average intelligence of the average snatch thief.

See the second half ;p

Or the average fence I suppose

No one's gonna go "OH MY GOD, ITS A SAMSUNG! NO WAY I'M GOING TO BE ABLE TO RESELL THAT! I KNOW, I'LL SELL THE CONVENIENTLY UNENCRYPTED VULNS ON THE SD CARD TO THE RUSSIANS!"

user2284570

@JourneymanGeek : I don’t think this is the first galaxy tab he stole…

Journeyman Geek

@user2284570 Citation Needed

You're thinking like an ivory tower security guy. Think like someone on the streets.

Quite often the most dangerous things are the simplest. Like a UPS plugged into itself.

user2284570

1:23 AM

@JourneymanGeek he needs experience for pickpocketing successfully… Even more for doing this while running without getting an accident…

Journeyman Geek

but he probably dosen't care if its a galazy tab, ipad or chinese self destructive piece of garbage.

user2284570

@JourneymanGeek : it was partially out of my pocket… and that’s the only thing he stole. I had the remark that I wasn’t carefull

user202362

Podcast #118 – What’s a Travel-Hacker, Anyway?

Journeyman Geek

> it was partially out of my pocket

user202362

like a thief hacker who travels to steal SD cards?

Journeyman Geek

1:25 AM

helloooooo target of opportunity.

(also what kinda security guy walks around with a tablet full of unencrypted data? ._.)

user2284570

@JourneymanGeek If I would have encrypted it with my tablet, I wouldn’t be able to use it with my computer and vice versa…

user2284570

1:39 AM

@Telkitty teenager who is currently experienced experienced in robbing things in general and might become a murderer later (which means he can leave his fingerprints)… because the local police lacks money and so prioritize action on murders (and because jail is sometimes the place to start using drugs).

Fingerprint analysis is mostly done in case of serious injuries… not for thieving a Mercedes (unless you’re related to the president liberation.fr/france/2007/01/30/…)… Theive just don’t need to use gloves

user315433

2:10 AM

I think I'll try the life of a weekly commuter in the spring semester... the thought of 100% moving to Long Island is unbearable.

user310756

12 hours old, how amazing is that?

user310756

@Telkitty allo!!

user202362

2:18 AM

@YvetteColomb omg, amazing!

user315433

> you'll stop people in their tracks with your new widened physical make-up

user315433

Yeah, getting around fat people on a sidewalk. :/

Journeyman Geek

3:36 AM

→ 7 messages moved to Chimney

\o/

Catija

@JourneymanGeek Um... can you get rid of mine, too? It looks weird now.

Journeyman Geek

→ 1 message moved to Chimney

@Catija done

Catija

HA HA HA HA HA

Journeyman Geek

→ 5 messages moved to Chimney

I probably shouldn't be throwing those there but shrug

who's looking, right? ;p

Catija

It's smokey related.

redhand

4:58 AM

Magisch

6:10 AM

@JourneymanGeek gz

Journeyman Geek

@Magisch bz?

;p

TheLittleNaruto

Good job @JourneymanGeek

SmokeDetector

6:44 AM

[ SmokeDetector | MS ] Manually reported answer (batch report: post 1 out of 2): Export iTunes music library information (album, artist, track names) to CSV or spreadsheet format? by Angela71 on apple.SE

[ SmokeDetector | MS ] Manually reported answer (batch report: post 2 out of 2): How can I copy a Playlist from one iTunes library to another? by Angela71 on apple.SE

SmokeDetector

6:56 AM

[ SmokeDetector | MS ] Mostly dots in answer: Однажды и т.д. by user187575 on rus.SE

user310756

@Telkitty the pics I promised. It was great to see you today!!! Look forward to seeing you again soon xoxoxox

user310756

user202362

<3 @Yvette

user202362

7:04 AM

💖

user310756

Those I took yesterday - I got there quite late @Telkitty

user202362

nice :)

user310756

@Telkitty I love it!! The two best friends. Did you take any others?

user202362

7:07 AM

better start posting solar panels and power tools before people start thinking we live on farms :p

Journeyman Geek

... you don't?

user310756

LOLOL

user202362

@YvetteColomb I took similar ones, better not spam here

user310756

@JourneymanGeek no I rent that land - agistment. It's 12 minutes from my home. I will show you where my home is

user310756

@Telkitty text them to me!

Journeyman Geek

7:09 AM

ah ;p

user310756

I live on the next ridge over - I drive around on a third perpendicular ridge to get home

TheLittleNaruto

What is this ?

Oh

Those arrows are really helpful to understand

user310756

@TheLittleNaruto Telkitty and I live near each other and catch up regularly. I keep horses close by and we hang out there with my horses and the owners chicken

user310756

We are thinking of getting some chooks together and keeping them at the horses

user310756

7:11 AM

@TheLittleNaruto joking right?

TheLittleNaruto

Woah! That's awesome

user202362

@Yvette & I were talking about start a rescue chicken sanctuary with rescued baby chickens ... (how to make things sound better than it actually is :p)

TheLittleNaruto

@YvetteColomb smart gal

user310756

@TheLittleNaruto would you believe I draft maps for NASA??

TheLittleNaruto

I never rode a horse

user310756

7:12 AM

really??

TheLittleNaruto

@YvetteColomb No I wouldn't. That would be too much for my belief

user310756

I first rode when I was 4 and fell in love instantly. Life long. My old girl Penny smells like the first horse I learnt to ride on

TheLittleNaruto

@YvetteColomb Yes.

@YvetteColomb Is it hard to control 'em ?

user202362

not if you have apples or carrots, no

TheLittleNaruto

It's not like I never got chance, but I always get scared.

user310756

7:14 AM

@TheLittleNaruto not if you're experienced

user310756

I have lost my nerve a lot these days. Most people do as they get older, we don't bounce so well

TheLittleNaruto

You guys are lucky living in a place like that

horses, nature

@YvetteColomb How old are you if I may ask ? ^^

user310756

@TheLittleNaruto we live in the largest city in the country.

user310756

@TheLittleNaruto 50

TheLittleNaruto

@YvetteColomb I see

user310756

7:16 AM

It cost $200 per week just to rent the land alone for the horses. We're lucky there's still some places that have land.

user310756

Hay and feed is also expensive in the city 1.5 - 2 times more than in the country areas.

user202362

the one in the picture is Penny or Cleo? @Yvet

Journeyman Geek

ow

user310756

Cleo

TheLittleNaruto

Well you're a developer.

money doesn't matter

user310756

7:17 AM

@TheLittleNaruto Exactly

user310756

well it does - cos I only work remotely and don't want to work full time :)

Journeyman Geek

@TheLittleNaruto citation needed

user310756

@Telkitty Cleo's hair is like yours, Penny's is like mine

user202362

:D

user310756

LOL

user310756

7:18 AM

One mroe pic

TheLittleNaruto

@JourneymanGeek :)

user310756

Penny with her fly mask

TheLittleNaruto

Here in marriage ceremony, bridegroom needs to ride a horse in order to go to the place where marriage ritual will take place.

@YvetteColomb

rene

!!/coffee

SmokeDetector

7:26 AM

@rene brews coffee for @rene

user202362

yeah you can get married over the internet in a game too

user202362

ride a e-donkey (not e-mule)

user202362

then live happily ever after in a e-mansion, eating e-food - all very technologically advanced

rene

... e-divorce ... sounds awesome

TheLittleNaruto

7:48 AM

Lol

!!/coffee

SmokeDetector

@TheLittleNaruto brews coffee for @TheLittleNaruto

TheLittleNaruto

@rene add tea command too

kicks @redhand out of universe

redhand

one simply can't click me

Journeyman Geek

@redhand clicks on @redhand

Derpy

@TheLittleNaruto you need some "ginseng that really sings" tea bag.

Journeyman Geek

8:05 AM

@Derpy really really sings?

and what ~~does the fox say~~ does the ginseng sing?

Derpy

8:23 AM

@JourneymanGeek seems oddly similar to "Whistle Glouglou"

user310756

@TheLittleNaruto nice romantic

Sinister

@TheLittleNaruto It's there already.

!!/tea

SmokeDetector

@Sinister brews a cup of lemon tea for @Sinister

user310756

!!/vodka

user310756

hahahaha

Sinister

8:32 AM

@YvetteColomb Hands a glass of Vodka for @YvetteColomb

lol

user310756

@Sinister thanks!! :D

user310756

I'm studying so alcamohol is the last thing I can drink O>O

user310756

I can drink cyber alcamohol

user202362

:'(

user310756

lol

user310756

8:40 AM

hm goes to charcoal to talk to the guys about this

Journeyman Geek

;p

rene

@YvetteColomb hand down the bottle. I'm done with the water ...

user310756

8:58 AM

@rene Sure!! :D

user310756

I wish we could all have a big meet up. That would be awesome

TheLittleNaruto

9:19 AM

@Derpy lol

@YvetteColomb XD

@Sinister I see, Thanks

Magisch

9:32 AM

finally done catching up with flagging

tfw 105 pending custom mod flags

Success

hhh... when they killed the color on the review icon... I wish they bring it back, otherwise there's really no indicator of pending review even on smaller sites >_<

oh wait, it should lit even now?

Sinister

@Success I feel the same. There's no indication of pending posts. It's never becoming red on beta sites.

TheLittleNaruto

9:59 AM

@Telkitty gives cake to @Telkitty that she had cooked 7 days back

XD

rene

10:25 AM

> Or it might be a cached value from the future, where the cache defies the linear concept of time.

Journeyman Geek

0_0

user202362

10:45 AM

TheLittleNaruto

10:59 AM

@Telkitty This one is best cat gif so far: i0.kym-cdn.com/photos/images/newsfeed/000/016/551/…

user202362

12:01 PM

@TheLittleNaruto Cat> don't be mean #truelove me & meh tail ...

TheLittleNaruto

12:58 PM

:D

Journeyman Geek

1:41 PM

→ 10 messages moved to Chimney

redhand

Magisch

I like cats

Success

I like dogs

and also catdog

rene

I like when it rains cats and dogs

Journeyman Geek

it gets a bit messy. ANd loud

MEAAAAOWWWSPLAT.

user202362

1:50 PM

@rene me too ... especially when my enemies are outside ... without an umbrella...

rene

:D

redhand

@Success me too

Magisch

I have a soft spot for cats in particular

no clue why

Derpy

in Shadow's Den, Dec 5 '14 at 13:20, by SPArchaeologist

@Magisch nyan?

redhand

@Derpy UnICaTs

Journeyman Geek

1:55 PM

@Magisch brain parasites are a good reason ;p

rene

I recall a meta post where an external company offered money to users if they created an account on SO and worked on it to bring it to a certain rep-level. I found this but that is not where an external business is involved. Anyone with better search terms then these ones: meta.stackexchange.com/search?q=money+reputation

Journeyman Geek

@rene I wouldn't be surprised if a question like that got nuked

rene

That could well be

Maybe I should ask on reddit ...

Journeyman Geek

(and anyone who remembers would probably need to have seen it ;p)

rene

That is also true. I guess @bart would have seen it ....

Journeyman Geek

2:07 PM

If its on SO/MSO I wouldn't have seen it

I've only really been active on MSE in the last year or so

rene

Maybe this is close to what I remembered: meta.stackexchange.com/questions/181153/…

Success

I kind of remember that, with a link to a job offer. Probably on MSO

rene

@Success yeah.

Magisch

@JourneymanGeek You mean toxoplasma gondii?

Success

@rene this?

Journeyman Geek

2:11 PM

@Magisch Yup ;p

Magisch

Last time I was in austria the host family's cat had kittens while we were there

ridiculously cute and amazing to have 7 kittens around all the time

rene

@Success yes, that is it thanks

Journeyman Geek

meta.stackexchange.com/questions/148785/… comes close?

this is the one I remember buuuuut no one's offering money for creating an account on SO and...

Oh, there was a voting ring on SU a few years back where there assignment was to get a certain level of rep on SU...

I think they all failed.

rene

@JourneymanGeek yeah that one is related but not the real deal

Magisch

@JourneymanGeek What kind of stupid assignment is that

Journeyman Geek

2:15 PM

@Magisch one which the whole class failed :)

rene

@JourneymanGeek SE staff did that in april/may this year, to get to certain rep, not the voting ring part ...

Journeyman Geek

@rene without a voting ring

Magisch

@JourneymanGeek As far as you know. Maybe some of them got it legit and you didn't notice because they didn't partake in the voting ring

rene

@JourneymanGeek ;)

Journeyman Geek

@Magisch in their case, mission accomplished.

@rene that's presumably pretty fun in a subject you know.

rene

2:18 PM

@JourneymanGeek Jon Ericson picked up on ruby on rails, which he was not familiar with.

Journeyman Geek

Well site

TheLittleNaruto

2:32 PM

Guys

Please edit if needed: meta.stackoverflow.com/questions/357749/…

Journeyman Geek

@TheLittleNaruto less content than "who watches the watchers"

The easiest way to run a chatroom is to actually have folks who're respected enough to "soft set" rules

TheLittleNaruto

true

That's why we want one more chance

Bart

@rene yup, that happened

I even recall someone asking for a reputation exchange by offering bounties against payment

Journeyman Geek

2:48 PM

0_0

Bart

And then there was the guy who said "I have the answer for you, but I need x amount of rep first before I give it to you"

Journeyman Geek

That's being an arse.

Pardon my anglaise.

Bart

Iirc his account wasn't around for long

rene

The story is even better then I remembered :)

Derpy

3:07 PM

@JourneymanGeek define "soft set" rules. Most of the problem we have with "long established" rooms is that some "respected enough (by the other people in the room" folks suddenly decide that their "own room culture" does make them "entitled" to forego the network rules in favor of some "more relaxed ones"

Success

I'm a trusted user. Bow before me!

redhand

5:30 PM

2 hours later...

When engineer try something new

TheLittleNaruto

ikr

NVZ

6:00 PM

Thoughts?

6

Q: EL&U's top bar's stopped being elegant since 2013

This is how the top bar appears in October 2017 on my desktop. I like the search box, it's larger and it is clear. But it's off-center, it's like a picture frame that's askew, I want to align the search box either to the extreme right (or left) or place it bang in the centre. I can live with the ...

Jon Ericson

@NVZ Deep cut. Nice to see people still carry a torch for the pre-black top bar site designs.

Magisch

6:22 PM

Heh

I wonder how much heat y'all get regarding the new topbar

I'm ever so slowly getting used to it and in like half a year I won't care anymore probably

Bart

Gah ... I'm an idiot. Forgot to go home early so I could have a late skype meeting from home. Now I'm stuck in the office until 10pm or something like that

Catija

6:38 PM

@NVZ On a site with hundreds of different communities it would be an extreme amount of work for the design team to keep up with custom top bars for every site.

user315433

6:59 PM

Jul 27 at 1:37, by Alex

Maybe if https://www.selfserve-stackexchange.com/ offered sites other than the trilogy... ¯_(ツ)_/¯

user315433

FR status-complete. And you can even do geo-targeting for less than 5000 now.

user315433

selfserve-stackexchange.com

user315433

Hm, none of the costs depend on the site, be it SO or Sharepoint.

user315433

Good news: Cross Validated dropped from the list of sites

user315433

7:04 PM

They never got anything remotely relevant for that community. I recall random online M.S. programs in app development.

user315433

7:32 PM

Actually, the current campaign (Azure) at least tries to be relevant by mentioning ML.

rene

8:22 PM

→ 6 messages moved to Chimney

@Bart you can go home now, it is past 10 ....

user315433

Stack Exchange Quality Improvement Project got bumped, which reminded me...

user315433

☐ Allow users to optionally filter out low-quality questions
☐ Feedback requested: New “recommended” homepage, phase 1
☐ What should the system be deleting automatically that it already isn't?
☑ Let's have an explicit triage system for questions from new users
☑ Breaking down question blocks - let's talk about rate limits

user315433

2 out of 5 ain't bad.

DonQuiKong

I have a question about the "rude and abusive" flag: Does this qualify or is it "low quality"? patents.stackexchange.com/q/18566/18033

rene

@DonQuiKong I can live with abusive. Looks like cat on keyboard

Maybe even an hack attempt?

DonQuiKong

8:35 PM

I was guessing some kind of automation fail

rene

@DonQuiKong it is gone now

DonQuiKong

thx ;)

rene

charcoal nuked it

DonQuiKong

gotta get me some smoke detektor privileges eventually

are there people sitting there just waiting for reports to turn up and flag questions? or is is somehow automated - I mean besides the reporting?

rene

@DonQuiKong there is a bot that scans all new posts and then report

Adam Lear

8:40 PM

@rene I did :)

rene

@AdamLear Ah, you're awesome!

@DonQuiKong see also: charcoal-se.org

DonQuiKong

yes, but I meant what happens afterwards? It gets reported, turns up in charcoal HQ and there's always people flagging questions down in minutes?

rene

@DonQuiKong charcoal-HQ gets all posts. In this room they get posted after 5 minutes and then we can flag

@DonQuiKong yes, and there are autoflags

where users opted in to have Smokey flag on their behalve

DonQuiKong

well that's a sure way to get the flagging badge :D

user315433

But manual reports don't trigger autoflags, and probably never will. (Just to avoid a misunderstanding)

user315433

8:44 PM

So those do rely on people keeping chat open in a tab.

rene

@DonQuiKong see meta.stackexchange.com/questions/291301/…

user315433

But there are userscripts to notify of new reports, etc.

DonQuiKong

good thing

better than waiting for our mod on ask patents anyways :P

user315433

Surprised that I'm the only one who's bothered that Own suggested edit is faded out

user315433

Do Meta.SE users never suggest edits?

Shadow Wizard

9:17 PM

@Desire only one who stay anonymous

@Narusan added my meager efforts to the new site proposal. :)

user315433

A recipe to get a quick answer from an employee: ask about Careers or display ads.

user315433

Side effect: can close on Meta now. \o/

Shadow Wizard

@Desire congrats!! No more bounty spree to waste all your rep?

(you could reach 3k long ago, without giving 25 bounties for 1,950 reputation)

user315433

9:33 PM

Shadow Wizard

@JourneymanGeek congrats on 20k! Now you aspire to reach 100k? :D

user315433

? Reopen review also faded out. Any repro? Currently in reopen queue of Meta.

Shadow Wizard

@Desire no repro. Something on your side most likely, first suspect is some userscript or custom stylesheet you forgot you installed.

Next suspect some CSS blocked, check console/network tab.

user315433

That would explain why nobody cared about that suggested edit post.

user315433

Indeed, looks normal in Firefox without extensions. And in Chrome without extensions.

Shadow Wizard

9:35 PM

@Desire well I saw but couldn't just go and suggest a test edit on that site to try and reproduce. :)

@Desire heh, so now just find the bad extension and nuke it with fire. ;)

whoops

user315433

Likely Dark Reader but I like it. Strange that it would mess things up even with darkness turned off.

user315433

Not reviewing is an easier fix.

Shadow Wizard

Heh... is it from Stack Apps? Or not related to SE?

lol

Maybe SE applied some class name used by that extension, dunno.

user315433

Not related, chrome.google.com/webstore/detail/dark-reader/…

Shadow Wizard

I like things bright, like my son. :)

(i.e. my son likes things to be bright, he's not bright ;))

(just brilliant)

:D

He draws better on paper, he still finds it hard to control the computer mouse.

Time to go see Dexter, cya!

user315433

9:43 PM

There's a mysterious inline style "padding-top: 0px; opacity: 0.3;" on div with class "review-content". Maybe something I wrote in my sleep...

Bart

10:25 PM

@rene came home at midnight. I'd say that's a long enough day

Journeyman Geek

10:48 PM

@ShadowWizard 25k first

@Derpy we add on to but not subtract. But with stuff like sticking to English....

On root access, we discourage questions, but not talking through troubleshooting. Helps chat flow. Stuff like that. That said, moderation is smooth cause if people are uncomfortable with things, they know a mod or ro can sort it out.

Shadow Wizard

@JourneymanGeek what for?

@Bart went to LAN party?

Journeyman Geek

11:18 PM

@ShadowWizard gotta be realistic ;p

Shadow Wizard

lol

Catija

@ShadowWizard Your child seems to have turned into a house.

Journeyman Geek

@ShadowWizard I've had a pretty darned spectacular run this year - I could get busy again, or just not find the sort of questions I'm best at answering (Stuff to do with moderation and userside best practices) ;p

also, took me 8 years to hit 100K on SU ;p

Transcript for