3

I was asking about RetroShare security issue. Community user robot locked and deleted my message quickly. Why? Someone suggested, because of spamming, but this is not spam and also how could it detect it as a spam.

  1. I am not a RetroShare developer and had no intent to advertise this GPL software.
  2. There is lots of similar question "is secure"
  3. Personally I does not need to put more details, but stacks asked to make question more verbose.

I want to suggest make able to not make errors regarding this. Let real community make final decision. What should I do to unlock? I can not even edit the post. This is definite error. Can someone give back my points?

  • Why it migrated to security meta? Has it own spam detection robot implementation? If not then please, migrate back. Its about bug that affect all StackExchange sites. – Sergei Oct 14 '16 at 14:35
  • 4
    because it wasn't a robot and therefore not a bug ... – schroeder♦ Oct 14 '16 at 15:00
  • @shroeder, please, explain. You say Community user is not a robot? Because it is bot. – Sergei Oct 14 '16 at 18:37
  • 3
    You have misrepresented yourself in these questions and you are trying to get us to prove your own ideas so that you can get attention by the code maintainers. Guess what, this is a form of self-promotion and a form of spam. You are advertising your own problem and trying to get us to buy into it so you can use that as leverage against the developers. The lack of disclosure, the manipulation, and the seeking of personal gain, actually makes this spam. – schroeder♦ Oct 15 '16 at 7:48
4

If you cannot edit your post, make a new one. That post received -3 downvotes and no upvotes, so there are no points to recover.

Most "is X secure?" questions get closed as too broad. The mods, who volunteer their time, cannot catch every one, so some get some answers. So, yes, we do need a more focused question when you post again.

  • 1) If you cannot edit your post, make a new one. - not if it should not be deleted, I am interested to edit it and turn back with my points. 2) That post received -3 downvotes and no upvotes, so there are no points to recover. - I had 100 points took off by bot because of its bug. 3) I looked for such a question for RetroShare and took note how it asked to make same way and there are questions that not closed. Such questions may only be called too broad by error. Because it takes a lot of effort to review. If someone did than the someones input is terrific to answer such questions. – Sergei Oct 14 '16 at 18:45
  • But my question is how to edit&unlock – Sergei Oct 14 '16 at 18:46
  • I've asked an absolutely relevant and specific question here security.stackexchange.com/questions/139794/… that has need of real experience and expertise to answer. – Sergei Oct 14 '16 at 18:53
  • @shroeder, what you mean by "so there are no points to recover"? – Sergei Oct 14 '16 at 19:13
  • You did not say that you were at 101 rep points and lost all your points because of the spam flag - I thought you meant that you wanted to reclaim your points you gained in that question. I have undeleted the post and will look at how to recover your 100 points. – schroeder♦ Oct 14 '16 at 19:43
  • @schroeder It may be undeleted but it is still locked (and can't be edited by the OP). – DavidPostill Oct 14 '16 at 20:35
  • @Sergei I have restored your points by clearing the spam flags. The post is also open for editing. – schroeder♦ Oct 14 '16 at 20:40
  • @DavidPostill Yeah, I wanted to make sure that I was not going to do something that would make it more difficult to restore the points. – schroeder♦ Oct 14 '16 at 20:41
3

I agree with schroeder, a plain "is X secure" is a type of question that is too broad, mostly because such a question (1) allows for opinionated answers (2) shows little effort from the poster of the question.

Regarding RetroShare just a quick search at a CVE repository returned a libupnp (firewall hole puncher often used by P2P software) bug reported to mageia linux. That CVE is less than three months old therefore it is a good start (Debian Jessie and Testing is still vulnerable to that, i.e. at the time of this writing).

It also provides a good way to make the question: by listing the dependencies of RetroShare, searching for vulnerabilities pertinent to these dependencies, and then asking for mitigation techniques if you happen to use a vulnerable version of the dependency. (e.g. to mitigate the vulnerability in libupnp you could run RetroShare in a chroot jail)

  • Thank you for answering my original question. As I see this might be useful for people with same question and the question was useful. The problem is about inability to select multiple right answers. This might be overcome by editing selected right answer to add additional vulnerabilities if someone found new. – Sergei Oct 14 '16 at 18:56
  • I wish to upvote, but "Community – Sergei Oct 14 '16 at 18:57
  • sorry, I wish to edit my comment but "community" bot took off my points – Sergei Oct 14 '16 at 18:58
  • @Sergei - That would really be a start, something like RetroShare uses a lot of code/dependencies. And that is often the misery (in terms of security) of such software. The example here is just an example, I'm sure there is much more if you dive deeper into the rabbit hole. – grochmal Oct 14 '16 at 19:07
2

Sergei - when I look at your github account the first big thing I see there is RetroShare.

When I saw the flags and commentary on your post, I have to say I agreed:

Looks a lot like spam to me!

  • Oh, I see I really tried once to contribute but there is no my commits there. – Sergei Oct 14 '16 at 18:32
  • But my question is how to edit&unlock – Sergei Oct 14 '16 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .