59

Meme: Don't be a Dave! Originator: @Polynomial, @LucasKauffman, others Cultural Height: December 2012 Background: One of our most popular questions of all time, with over 17 thousand views in the space of 3 weeks, had as its subject poor old Dave: My developer, let's call him 'Dave', insists on using a home-brew script for hashing passwords. See Dave'...


54

Meme: Nuke it from orbit. Originator: Aliens Cultural Height: TBD Background: When a machine is infected, the only way to be sure that it's clean is to "nuke it from orbit", i.e. wipe the system to the fullest extent possible, or entirely replace the hardware. This has become the default advice for most questions related to malware infections, but ...


52

Google-searching is a rarefying skill. It seems to be a question of generation. Let me put some historical context. In days of my youth (say, 25 years ago, in the late 1980s and early 1990s), when you wanted to learn about something, you went to the public library and looked it up in an encyclopaedia. You also scanned the books on display to see if there ...


50

We should judge each answer on its own and whether it provides valid advice. The fact that the author is a malware developer is irrelevant. If the advice is good, then upvote it, if not, then downvote it.


44

Meme: Security Monkeys Synonyms: Chimpanzees, Chimps Originator: @ThomasPornin, @TomLeek (for Security Monkeys), @TomWijsman, @CharlesDarwin (for Monkeys) Date of conception: March-April 2013 Cultural height: TBD Purpose: TBD (see below) Background: Thomas' answer to a question What technical reasons are there to have low maximum password lengths? ...


43

Shaul - first off, the moderators had nothing to do with the close. It received 5 community close votes. Secondly, there is nothing that says anywhere that this was closed because you were a 'noob' or not professional. The problem with is, and various commenters tried to explain to you, is that the question is too broad. This is why it was closed, and the ...


38

The Bear approves of your oath of fealty. You may keep on chanting the glory of your ursine overlords.


31

Yes! Gimme dem hats! I want all sorts of winter themed nonsense!


31

Thanks - this is a good call. Generally, unless a username is flagged as offensive, we leave them alone, however after testing this with a varied set of devices, I'd have to agree - it does break things badly on one of my Android phones. I'll edit and leave a note for the user in this instance - and please flag up further instances that cause rendering ...


31

Your listing seems to imply that the director of information security will respond to the CTO. This may be suboptimal. The CISO, theoretically, should respond only to the CEO and the board. (At least so it says in the CISM manual.) An enlightening (or not) metaphor is that the CISO is Darth Vader: Springs into action to plug a critical data leak. Runs from ...


30

I don't think we should lock it. I fundamentally disagree with the poster's immoral stance. But see, in the information security field, this is what we're up against: people who don't care who they hurt. They'll justify it all they can. That answer is a good reminder of what we face daily, and it's technically correct anyway. It's also a good reminder ...


29

Flag it as spam. I think that's such an edge case it's not worth trying to document and I got plenty of flags on the question. Offering money for a pentest is solicitation of commerce at a point-in-time, so it's not helpful in our Q&A site format for the same reasons that link-only answers are discouraged.


29

I know what you are talking about. I've puzzled over the same thing. Answers need to be Answers and stand alone as definitive. Hints and prompts are not Answers. So, how can we provide help without providing an Answer? I use the Comment section to provide hints, and if the discussion gets long, I move it to chat. Once the OP comes up with an answer, I ...


28

I have certainly seen my fair share of questions that are unanswerable without context and / or a threat model. Having something in the FAQ to point at would be amazing. I also like the content of your FAQ blurb, but would lower the language to make it a bit more accessible. Maybe something like: Security is always relative, and depends on the context. A ...


26

To complement what @Rory says, I'd like to point out that there is no rule that says that any question fits somewhere in the StackExchange network. By design, the SE sites concentrate on questions that can be answered in about one page of text. Of course, longer answers exist, because some people tend to exhibit a larger than average level of verbosity, ...


24

I personally prefer "Information Security" because "Security" alone has too high a potential for drifting into really distinct areas, e.g. politic issues with regards to terrorism ("Homeland Security"), unemployment ("job security") or police forces. It is a bit too broad to my taste. Thinking about it, I would say that the point is that the site ought to ...


24

The session cookies (or at least, what looks like session cookies to me) acct and sgt are both served with the HTTPOnly flag. This means that client side Javascript can't access them, making it hard to session hijack using things like XSS vulnerabilities or similar. This does not protect against at attacker who can intercept your traffic, but in that case, ...


23

Meme: It depends Originator: Anyone with an InfoSec job Cultural Height: It depends Background: The most common answer on the Security StackExchange, owing to an imprecise formulation of questions. Most users not versed in the arcanes of information security fail to understand the importance of a threat model in assessing the security benefit or risk ...


23

As stated by Jeff Atwood himself, StackExchange uses several techniques to reduce spam. captcha script detection heuristics and "honeypots" user flagging (spam / offensive / moderator attention) auto-removal of some items based on certain flag thresholds being met active moderator participation throughout the day to look at moderator flagged ...


23

Plenty of good reasons: there might be only partial, disparate answers and no central knowledge repository the size of StackExchange with an authoritative answer there might be contradictory answers and expert help is required to make sense of them existing posts on other sites might not cover the context / hardware / software the OP is interested in the OP ...


23

This questions did strike me as especially hard over on SO, where new and/or low rep users regulary get downvoted and closed very fast. Over here on Sec.SE, because there is way less traffic, the problem is not as maddening as on SO, but still a problem we as a community should try and take care of. In fact, on SO there is a "SOCVR" team in an ...


23

I would say keep it, but stay away from Wordpress (unless you want to use the blog as a live demonstration of the dangers of automated vulnerability scanners). I'd say a static site (published on Github Pages) would be a great idea, as it's quite easy to set up, requires no maintenance/updates, and it's easy for everyone to contribute and improve other's ...


22

Meme: Security is Hard™ Originator: Unknown. More recently proliferated by James Arlen on the Liquid Matrix Security Podcast. Cultural height: Late 2012 Background: Security is Hard™ has been used by a lot of people, to (often condescendingly) remark on the apparent difficulty many people have with security. Its use ranges from genuine cases of difficult ...


22

I would definitely say there is an overlap in terms of what is on topic. I've even found some similar questions on our site : How to identify the presence of rootkits from an image of Linux memory? -> Are there any artifacts for filesystem forensics in memory?, How would one know if they have a rootkit? How can I read data via ADB if an Android device is ...


21

Absolutely not. If an answer does not address your question, then you do not have to accept it. People may upvote answers because they like it, or because they agree with the statements made, or whatever. If you are asking about the answer I think you are asking about, in my opinion, it does not address your question at all, it only picks apart an example ...


Only top voted, non community-wiki answers of a minimum length are eligible