All Questions

Filter by
Sorted by
Tagged with
50
votes
6answers
3k views

A Security Stack Exchange CTF team

Updates: Added first challenge to prepare We have a CTFTime team, secse. Please join this. We communicate over Slack. To get an invitation to the group you can contact Benoit Esnard, HamZa, Xavier59,...
31
votes
9answers
2k views

Clarify our stance on black hat questions

In the site FAQ, it is written: Black Hat vs White Hat - This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require ...
12
votes
2answers
243 views

Building our own migration list [duplicate]

Now we've graduated from beta, wouldn't it be time for us to set our migration list? I would propose: meta.security of-course superuser serverfault webapps math / theoretical.cs / stackoverflow ...
26
votes
8answers
2k views

Design for IT Security

I'm Jin, and I'll be working on the designs for the Stack Exchange sites as they graduate from the beta phase. Each site will have its own unique theme that will reflect its topic. However, all sites ...
21
votes
5answers
944 views

Requests for Question of The Week blog posts

Since starting the Security Stack Exchange Blog on 15 July 2011 we have some excellent blog posts, and a large number of these are from our Question of the Week posts. Going forwards, it is probably ...
41
votes
6answers
430 views

Can people please be a little less zealous with close votes?

This question currently has 3 flags against it for "primarily opinion based". If you read it, and its edit history, at no point was it opinion based. It is quite clearly asking whether VSTs could ...
1
vote
2answers
159 views

Merge with the security proposal?

Should this site merge with the Security proposal, and other security-related Stack Exchange site proposals such as Cryptography and Social engineering? In spite of the previous merges, this site ...
9
votes
2answers
167 views

Has the IT Security S.E. evolved into a S.E. for information security?

I'm supporting the privacy SE proposal in Area 51, and have read a lot of responses in which people argue that a separate privacy SE site isn't necessary. The reason being that all privacy questions ...
98
votes
20answers
21k views

The Memes of Information Security

There are memes common to whole Stack Exchange. But after spending some time in The DMZ it becomes evident that Information Security has it's own memes (e.g. rory). I therefore propose that this ...
28
votes
4answers
595 views

Are the wrong questions and answers getting too many upvotes?

On the Tour page for Security.SE it states: Information Security Stack Exchange is a question and answer site for Information security professionals. However, when I see questions like this Does ...
9
votes
5answers
252 views

Regarding Our Scope: What's Acceptable, What's Not

This has been asked, but this will be a list rather than a question (hence I recommend everyone CW's their responses). Regarding this: What about Physical Security? What specific topics and types of ...
3
votes
1answer
127 views

Contradiction towards the policy regarding on-topic subjects?

By reading again what are on-topic questions, I found that discussing security tools are among on-topic subjects; but then I see many questions closed as being tools recommendations. Why this ...
13
votes
8answers
395 views

Where to draw the line between “IT pro” vs “end-user” questions?

I thought this question (How to open a file from the Internet in a secure way?) would be off-topic, but apparently some people seem to think otherwise. Where do we draw the line between professional ...
13
votes
7answers
518 views

Security Stack Exchange's Anniversary Competition

July the 12th marks one year since we came out of beta: And we have had continuous growth ever since, steadily gaining new users and questions, and the odd peak where a particular incident or burst ...
11
votes
4answers
254 views

What about Physical Security?

Is Physical Security something that's allowed/supported here at all? Obviously there's things like egress paths and lock picking that aren't really "IT" at all.. my gut says that really isn't the ...
14
votes
5answers
411 views

Should we accept question about making exploit or building malware?

The kind of question I am referring to is a little bit like this one : Malwares source repositories. Where? Question that are around the subject of "How can I make virus/malware/exploit/etc." are ...
63
votes
0answers
879 views

Please do not dump Wikipedia into tag wikis

Please do not populate tag wikis by copying text from Wikipedia. Reviewers, please reject tag wiki suggestions that are copied from Wikipedia or other sources, or more generally that suggest content ...
18
votes
8answers
879 views

Do we want to continue with our blog?

Firstly - yes we have a blog - with 91 posts over the last 5 years (although the last 8 months has been a bit of a desert, for various reasons - one being the removal of support for blogs.) Now, ...
10
votes
4answers
346 views

What determines if a question should be considered Blackhat?

I asked this question recently which got a lot of votes and people thought was interesting, as well as some very interesting answers. It could have been the start of a very interesting discussion, ...
15
votes
4answers
310 views

How do we provide value to white and grey hats?

So it's something we're kicking around in chat for a while about a specific question, but I think it goes to the style of the site. We as a community are answering blackhat style questions. Do we ...
8
votes
4answers
379 views

Should we allow questions/answers that appear to include or request exploit code?

I don't speak SQL myself, so I'm not sure if this is a good example, but here is the question that prompted this query: How to exploit the "PHP_MAGIC_QUOTES ON" vulnerability in order to ...
4
votes
2answers
215 views

Lists of Featured & Proposed Blog Questions

I wanted to throw this up so that we have a place to list proposed Question of the Week Blog posts, for future reference. This question should have two CW answers: Questions which have been featured ...
30
votes
1answer
2k views

I hereby declare the 22nd of September each year to be Bear Day!

Thomas Pornin, one of the most distinguished members of our community has reached 100k rep, a terrific milestone! A complete list of his contributions to the site is probably way too long to fit into ...
19
votes
21answers
838 views

The great 2015 tag cleaning [closed]

With every passing year and our growing popularity, we see lot of new questions. This is a good thing :) Due to the nature of question tagging, we are generating lots of new tags every week. It's not ...
16
votes
5answers
281 views

Downsides of migrating questions from high-volume sites

I've noticed a number of questions that have been migrated from, say, Stack Overflow.SE to Security.SE -- where the migration has occurred after the question already accumulated a number of erroneous ...
7
votes
1answer
71 views

What are good ways to publicise security.stackexchange at conferences and events

As an extension to this question, we plan to publicise this forum at the B-Sides in San Francisco and London, so are thinking up useful marketing ideas - but thought it would be useful to get the ...
12
votes
1answer
247 views

Newbies can answer, but not comment, what's a SME to do?

In Unknown Asian/Chinese registry keys, @user27140 described a security concern which @bobince then identified in his answer as a software bug with (apparently) Syncovery. A new-minted user named @...
11
votes
3answers
239 views

Can we finally sort out our migration sites?

We had a proposed list of migration sites a few months back, but nothing ever came of it. The community has matured enough now that we're having to do migrates daily, and it's (probably) becoming ...
10
votes
1answer
203 views

OWASP Conference Sponsorship

In the spirit of this post, and several others on this site and on the SE blog, I'd like to see if SEI and ITsec can sponsor the upcoming OWASP regional conference, in Israel (in September). A ...
8
votes
1answer
385 views

Should white hats know methods that can be used by black hats to attack them?

In my opinion to be sure that protection mechanisms work, you should know what attacks can be performed against them. Only if you know techniques that can be used to attack you, you can be sure ...
6
votes
2answers
56 views

Discussion questions

Are discussion question okay? I'd like to start a discussion on why XSS should be renamed Script Injection, and if there is agreement on that (I've got a few arguments), if and how we could go about ...
3
votes
1answer
89 views

Why can't we retract a close vote?

When question has been closed or is on hold and has been edited, SE system considers that the question might worth to be reopened and therefore put it on the reopen queue automatically. In other words,...
58
votes
7answers
1k views

“Is (x) Secure” Question Anti-Pattern

A common problem that I see with questions is that they ask something like "Is (x) secure", which to me is an unanswerable question, the same way as asking "is the city north", it has no meaning in an ...
23
votes
8answers
359 views

We still don't have a 404 image

Back when we were discussing site design, @Jin came up with this design question and we do have some answers which could be relevant to our 404 page. I think we need to get something defined, as ours ...
17
votes
7answers
501 views

Site promotion suggestions

Update as of May 26th: We need more users and more questions. But there's no lack of competence, after all, 99% of all questions have a answer and we have a answer ratio of 3.0. But we only have 5.4 ...
17
votes
3answers
363 views

How can we help make StackExchange more secure?

As a site dedicated to IT Security, we commonly find ourselves preaching about things like HTTPS, salted and hashed passwords, and such. However our own website is in violation of some of the ...
27
votes
0answers
458 views

Praise the day! Our ursine overlord has brought more glory than ever!

Thomas Pornin, our ursine overlord has reached the milestone of 200,000 reputation on Sec.SE! Before we delve into the bear's amazing here are some facts about his account(s): The bears are the only ...
23
votes
4answers
751 views

Code review / Deobfuscation: Why is it considered off-topic here?

I viewed the help center multiple times and, unless I'm missing something, I didn't see anything related to code-review being off-topic, so all this time, I assumed it was allowed here. Let's take ...
14
votes
4answers
161 views

Should we support anonymous postings?

I think it's beneficial to prevent social engineering attacks based on content our users post in this site. One example of the problem is responses to this question, where users are asked about their ...
21
votes
2answers
557 views

Blog - actions required

As discussed previously on this post and this one, the current SE hosted blog service on WordPress is going away - with an ideal timeline of 1 Jan 2017. It shouldn't be immensely complex, but there ...
18
votes
1answer
320 views

Are there plans to support https?

Are there plans to support https? I think it is very ironic to have a site about IT security which itself has such a huge security issue. Edit: In the mean time the situation got worse: Now accounts ...
11
votes
9answers
485 views

Community Promotion Ads - 2015

The dawn of a new year, 2015, now approaches, or has already approached, either way it means that it is now time to reset our Community Promotion Ads! What are Community Promotion Ads? Community ...
8
votes
3answers
226 views

New blog - call for volunteers

From the discussion over on this post, and from discussions with regular contributors in chat etc., it looks like we have a yes to go ahead with a new blog. Discussion on platform is split - so I'm ...
8
votes
6answers
551 views

DEF CON CTF 2013 qualifiers: 15–17 June (ended, including write-ups!)

DEF CON CTF 2013 qualifiers will start on Saturday, 15th of June 2013 at 00:00 UTC, and will last 48 hours until Sunday, 17th of June at 00:00 UTC (so midnight to midnight throughout the weekend). ...
6
votes
3answers
213 views

Is asking a question about the legality and ethics of hacking back out of scope for this forum?

I've posted a question about the usefulness of hacking back to corporations, asking the question to be taken apart from legal and ethical concerns. The legal and ethical concerns are an interesting ...
5
votes
1answer
42 views

Should we reduce the limits for editing the tag wiki?

Currently when clicking on a tag, and then the encouraging offer ("The cryptography tag has no wiki summary, would you like to help us create it?") you learn that: Tag wikis can be edited by users ...
17
votes
1answer
183 views

Lets allow tool recommendations in specific circumstances

In general, Sec.SE bans questions on tool recommendations. This answer appears to be the most recent statement by a moderator. I propose we reconsider this ban and allow tool recommendations in ...
15
votes
15answers
874 views

Community Promotion Ads - 2013 [duplicate]

We never really gave you a proper thread this past year, so your previous thread was exceedingly stale for a while. As such, here comes a brand new, shiny thread for y'all! Community Promotion Ads, ...
11
votes
1answer
116 views

We don't need the security tag

The tag security exists on the site. It should be an intrinsic tag (blacklisted, but treated as a site tag when evaluating incoming migrations). Please add to this the information-security tag too... ...
10
votes
2answers
104 views

Should we add #infosec to our Twitter bot's posts, for publicity?

This idea is spawned from @ScottPack's post in the thread about distinguishing blog posts in Twitter: How should we distinguish blog posts in the Twitter feed? I think it could bring a bit of ...

15 30 50 per page