-3

Source post on hold: for reference

The entire post was about hardening Chrome, referencing vulnerabilities, and offering solutions.

enter image description here

He does not believe hardening chrome against the latest TLS_RSA, CBC & QUIC vulnerabilities has to do with security, as noted in the image below.

enter image description here

He said my post looks like a duplicate of an 5 year old security post about RC4 ciphers. The commandline in the post no longer works with chrome. Developers have since changed the code. This was the original reason I posted. Cipher names were no longer working. They removed a zero from some of them, others they left alone. It no longer lines up with the standard on SSL-Labs. Information rectifying this is relatively new and sparse. I received the appropriate answer on wilderssecurity and shared it here... after posting my answer, schroeder mod suggested I delete the post, claiming I had merely misspelled the code. However, its relevant code and not widely available and important for users concerned about their online security, unlike the link he linked which provided outdated inoperable code.

One of the answers includes working with Chrome developers to implement better in-browser cipher selection functionality, the only approach to the roadblock of limited, poorly writ security functionality. He says that is not relevant.

Elsewhere he claims

"You are mixing up "what cipher suites should be disabled?" with "how do I disable cipher suites in a certain product?"

How confusing can you get. Nowhere did I ask what ciphers should be disabled, I asked how to disable them.

enter image description here

For the owners of this site please take appropriate action to ensure moderators do not abuse their power on here.

23
  • 2
    Can you see how this is a microcosm of the other question? What you have asked is for the site to take appropriate action, but your text is all about drumming up support for your idea. Also, you continue to misrepresent the facts, take my statements out of context. Not all questions about security are on-topic here. Mostly, it has to do with the format and applicability. Which I have tried to explain.
    – schroeder Mod
    Feb 12 '19 at 15:39
  • 1
    Big difference between "secure all the things!" and a well-formed question that is on-topic on a Q&A site.
    – schroeder Mod
    Feb 12 '19 at 15:40
  • 2
    As my chats clearly explained: how to launch Chrome from the commandline to disable certain cipher suites is a product use question, and is either a duplicate of the other similar questions, or it is a SuperUser question.
    – schroeder Mod
    Feb 12 '19 at 15:42
  • How to disable certain sets of cipher suites results in a problem where we will end up with a different question for each set of ciphers to disable. The list of Chrome syntax for the different cipher suites is easy to look up (even when they change).
    – schroeder Mod
    Feb 12 '19 at 15:43
  • 1
    "OMG! Everyone should disable these cipher suites now and Chrome is irresponsible for making it too hard!" Is simply not a question. And your defence of the question is to flip between one stance (all I want is to disable cipher suites!) and the other (the devs are bad and won't someone think of the children!) which makes it difficult to provide a straightforward explanation for you.
    – schroeder Mod
    Feb 12 '19 at 15:46
  • 2
    So, no, your statements about my beliefs are wrong and misrepresented so you can drum up support. You had a poor question for here, and I'm far from the only person who beileved so.
    – schroeder Mod
    Feb 12 '19 at 15:49
  • 1
    Again, nope "schroeder mod suggested I delete the post", what I suggested was the post be closed if the problem was a syntax error on your part.
    – schroeder Mod
    Feb 12 '19 at 15:59
  • 1
    Again, nope "He said my post looks like a duplicate of an 5 year old security post about RC4 ciphers who's commandline no longer works with chrome.", the syntax for how to disable cipher suites is the same. The syntax for which cipher suites to refernce has changed, but that should not matter because we're talking about a different set of ciphers.
    – schroeder Mod
    Feb 12 '19 at 16:02
  • I assure you coding to ensure software is user friendly is not a bad thing. Archaic systems used in chrome do not meet the demands of the average user and do not function when loading URL's outside of the command-line. Its just not practical. Chrome changing the cipher syntax is also problematic, as the code you dubiously claimed was a duplicate no longer works either. The answer is to incorporate a better system, preferably one that helps to educate the public about cipher security and make it accessible as cookies. I provided a link to a feature request I created on Chromes developer page.
    – Tyler
    Feb 12 '19 at 16:15
  • There is only so much room in the title of the question for practicality; otherwise I would add more, but I assure you I already know what I am asking, so I provided that in detail within the post.
    – Tyler
    Feb 12 '19 at 16:16
  • And none of this matters
    – schroeder Mod
    Feb 12 '19 at 16:16
  • 3
    Please feel free to create a blog post and outline all that you have discovered about how to block the ciphers that have been recently been problematic. Use social media to get people to push the devs to make changes. But those things are not on-topic here.
    – schroeder Mod
    Feb 12 '19 at 16:17
  • 1
    And yet that list is not exhaustive. For instance, nothing on that page talks about duplicate questions. You're trying to find a path here, but I think you should stop. You are no longer making sense.
    – schroeder Mod
    Feb 12 '19 at 16:36
  • 1
    If you only see prejudice, you are choosing to ignore all the reasons I have laid out.
    – schroeder Mod
    Feb 12 '19 at 16:52
  • 1
    "are petitions/feature requests allowed in questions" - no. Are questions about how to disable cipher suites on-topic here? No. They belong with the dozens of others on SuperUser. Is it on topic to ask about which cipher suites to disable? Certainly. As long as it is a question and not assertion. But then there are already others to point to as duplicates. All of these things are points that have already been brought up.
    – schroeder Mod
    Feb 12 '19 at 22:08
6

We can help you answer which ciphers you should enable or disable based on your stated threat model, but we cannot help you answer the question of how to select them. This would apply regardless of who asked the question. If I asked whether or not a given mandatory access control policy would provide certain security properties, the question would be on-topic. If I asked how to configure said policy in AppArmor, however, the question would get closed. If you want to know how to configure a security policy, you should either look for online guides, or ask on a relevant site like SuperUser.

Also just a nitpick, but hardening a browser and hardening a web app are different tasks.

2

Meta is the mechanism for oversight and disputes on questions. This is the appropriate action that the site owners have provided.

1

There is some nuance and shades of grey to the "no product-specific help questions" rule. For example, we have many well-liked questions about different Google Chrome settings, like the Remove RC4 from SSL/TLS ciphers in Chromium question which has over 27,000 views. Some other examples are:

In general, the question is whether it's a "How does this work?" question, or a "how do I?" question. Is the question a unique need-instructions issue, or would the answer be a little more architectural and informative to the average user. However, at the end of the day it's an arbitrary distinction that weighs a lot of factors like obscurity, product ubiquity, and how well-worded the post is.

This matches what others have said here that "which ciphers should I disable?" or "how are those ciphers vulnerable?" are good questions, but step-by-step instructions for enabling them usually are not.

Feature requests are similar in how they're not outright banned in all cases (see some examples here, here, here, here, and here ) but they're generally avoided when it distracts from actual Q&A discussion.

I'm taking a real-world approach rather than a rules-lawyer attitude here when it comes to moderation, since inconsistency makes our rules confusing and somewhat arbitrary. Moderators shouldn't be surprised if inconsistent closing of questions on new users turns small issues into heated rules-reading debates.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .