|
slash git slash womb
|
#
?
Oct 25, 2023 20:30
|
|
|
|
| # ? Apr 27, 2024 23:27 |
|
|
https://i.imgur.com/K206TMJ.mp4
|
|
#
?
Oct 26, 2023 09:47
|
|
|
lol it's perfect
|
|
#
?
Oct 26, 2023 10:40
|
|
|
spectre strikes back https://ileakage.com https://twitter.com/moo9000/status/1717264586703773828
|
|
#
?
Oct 26, 2023 10:46
|
|
|
solid 5 minutes of crunching for the demo on what is presumably a fast mac, so i wouldn't immediately lose sleep over it. also pretty clear something needs to be done, but the central glitch seems a trivial fix: safari not creating a separate rendering process for window.open where it does for all other ways of opening another page. Cybernetic Vermin fucked around with this message at 11:18 on Oct 26, 2023 |
|
#
?
Oct 26, 2023 11:14
|
|
|
hahaha
|
|
#
?
Oct 26, 2023 15:45
|
|
|
incredible
|
|
#
?
Oct 26, 2023 16:00
|
|
|
[help!] my security software is killing me!
|
|
#
?
Oct 27, 2023 00:17
|
|
|
Cybernetic Vermin posted:solid 5 minutes of crunching for the demo on what is presumably a fast mac, so i wouldn't immediately lose sleep over it. do the other ways of opening a page provide a script-accessible link between pages? it’s a lot easier to separate processes if they don’t have to have a unified script universe…
|
|
#
?
Oct 28, 2023 03:48
|
|
|
pro tip do not open pages ever
|
|
#
?
Oct 28, 2023 05:09
|
|
|
it is actually always safe to turn off your computer
|
|
#
?
Oct 28, 2023 05:37
|
|
|
Achmed Jones posted:it is actually always safe to turn off your computer
|
|
#
?
Oct 28, 2023 05:45
|
|
|
it is only safe to turn off your computer with an acpi shutdown that ensures all write caches are flushed
|
|
#
?
Oct 28, 2023 05:59
|
|
|
Achmed Jones posted:it is actually always safe to turn off your computer but it’s never safe to turn off your monitor
|
|
#
?
Oct 28, 2023 07:31
|
|
|
Achmed Jones posted:it is actually always safe to turn off your computer sounds like this dude bought a machine in likr 2015 wtf big spender
|
|
#
?
Oct 28, 2023 08:17
|
|
|
https://usa.kaspersky.com/about/press-releases/2023_stripedfly-a-worming-miner-hiding-sophisticated-code-and-espionage-ready-capabilities https://securelist.com/stripedfly-perennially-flying-under-the-radar/110903/ quote:Woburn, MA – October 26, 2023 – Kaspersky experts have uncovered a previously unknown, highly sophisticated malware, dubbed StripedFly, affecting over a million victims around the world since at least 2017. Initially acting as a cryptocurrency miner, it turned out to be a complex malware with a multi-functional wormable framework. It runs on both Windows and Linux, captures and sends a lot of your personal data to the creator.
|
|
#
?
Oct 28, 2023 22:00
|
|
|
turn off..... computer?
|
|
#
?
Oct 28, 2023 22:09
|
|
|
Carbon dioxide posted:https://usa.kaspersky.com/about/press-releases/2023_stripedfly-a-worming-miner-hiding-sophisticated-code-and-espionage-ready-capabilities
|
|
#
?
Oct 28, 2023 22:21
|
|
|
On Linux, the malware assumes the name 'sd-pam'. It achieves persistence using systemd services, an autostarting .desktop file, or by modifying various profile and startup files, such as /etc/rc*, profile, bashrc, or inittab files.
|
|
#
?
Oct 28, 2023 22:25
|
|
|
code:
|
|
#
?
Oct 28, 2023 22:26
|
|
|
ok, scratch that. sd-pam can be legit too
|
|
#
?
Oct 28, 2023 22:28
|
|
|
argv can be spoofed (very easily) you should look at the proc file system for the binary path
|
|
#
?
Oct 28, 2023 22:29
|
|
|
i did, that's what made me say scratch that. the exe is /usr/lib/systemd/systemd which has a good hash
|
|
#
?
Oct 28, 2023 22:31
|
|
|
not saying you're affected, because 99.999999% sure you're not
|
|
#
?
Oct 28, 2023 22:31
|
|
|
nudgenudgetilt posted:ok, scratch that. sd-pam can be legit too spankmeister posted:argv can be spoofed (very easily) you should look at the proc file system for the binary path mystes fucked around with this message at 00:10 on Oct 29, 2023 |
|
#
?
Oct 29, 2023 00:08
|
|
|
DrPossum posted:turn off..... computer? 
|
|
#
?
Oct 29, 2023 00:48
|
|
|
Carbon dioxide posted:https://usa.kaspersky.com/about/press-releases/2023_stripedfly-a-worming-miner-hiding-sophisticated-code-and-espionage-ready-capabilities this malware was discovered six years ago and the vuln it relies on was patched shortly afterward (at least on Windows), so anyone in this thread is probably safe the reason it's getting a new bulletin now is because it was originally classified as just a cryptominer. when it was first analyzed, they saw it mining monero and figured that was it, they didn't realize it did other things too
|
|
#
?
Oct 29, 2023 01:09
|
|
|
work has declared the entire jetbrains intellij idea software ecosystem ( especially the plugins ) to be a secfuck. apparently someone CISO ish saw a review of their code practices by some “independent” security checklist thing which gave them Fs in everything. all jetbrains ide things are now forbidden. and yet somehow vscode and its plugins are OK ???? half the developers in the company are losing their drat minds, and a boatload of them will probably quit over this decision.
|
|
#
?
Oct 29, 2023 15:37
|
|
|
fresh_cheese posted:work has declared the entire jetbrains intellij idea software ecosystem ( especially the plugins ) to be a secfuck. apparently someone CISO ish saw a review of their code practices by some “independent” security checklist thing which gave them Fs in everything. all jetbrains ide things are now forbidden. Reject modernity, return to Vim.
|
|
#
?
Oct 29, 2023 15:46
|
|
|
fresh_cheese posted:work has declared the entire jetbrains intellij idea software ecosystem ( especially the plugins ) to be a secfuck. apparently someone CISO ish saw a review of their code practices by some “independent” security checklist thing which gave them Fs in everything. all jetbrains ide things are now forbidden. any info on this review? i know they have a 9.8 actively explored cve in teamcity but most of the other jetbrains related stuff i’ve seen is eastern bloc panic and solarwinds trying to shift some blame to them
|
|
#
?
Oct 29, 2023 15:47
|
|
|
Volmarias posted:Reject modernity, return to Vim. neovim is modernity 
|
|
#
?
Oct 29, 2023 15:48
|
|
|
fresh_cheese posted:work has declared the entire jetbrains intellij idea software ecosystem ( especially the plugins ) to be a secfuck. apparently someone CISO ish saw a review of their code practices by some “independent” security checklist thing which gave them Fs in everything. all jetbrains ide things are now forbidden. tell the ciso about how NPM works so u can get javascript banned from your work
|
|
#
?
Oct 29, 2023 15:50
|
|
|
it's hard to think of anything in a developer IDE that would rate that sort of severity - what with, you know, being desktop software that doesn't typically get exposed to hostile input until you've already compromised the system unless there's something like "a malformed license server response giving rce" that can be triggered without authentication
|
|
#
?
Oct 29, 2023 15:51
|
|
|
the risk would be compromise in your tools leads to compromise in your output. a supply chain attack type thing
|
|
#
?
Oct 29, 2023 15:52
|
|
|
if someone hacks into your computer and replaces notepad.exe with something that looks like notepad but secretly introduces bugs in your code, that's not a vulnerability in notepad
|
|
#
?
Oct 29, 2023 15:54
|
|
|
Shaggar posted:the risk would be compromise in your tools leads to compromise in your output. a supply chain attack type thing
|
|
#
?
Oct 29, 2023 15:54
|
|
|
Jabor posted:if someone hacks into your computer and replaces notepad.exe with something that looks like notepad but secretly introduces bugs in your code, that's not a vulnerability in notepad no, but if you dont have any protections against notepad replacement attacks and then you ship your code to your clients its a vulnerability in your own security practices
|
|
#
?
Oct 29, 2023 15:55
|
|
|
Volmarias posted:Reject modernity, return to Vim. yall have already seen my rants, yall know IDGAF about any of this because i use the superior vim and terminals workflow. im mostly curious if theres legit actually a code supply chain integrity difference between vscode and jetbrains like the argument against jetbrains tools is that the plugins slurp up your code and send it to a cloud butt service somewhere to do things and make your code more gooder, but somehow the vscode plugins dont?? like maybe if they curate an in house vscode and plugin set with code signing and turn off the ability to install random plugins off github maybe??? but you cant do the same for jetbrains??? or maybe CISO is a moron??? 
|
|
#
?
Oct 29, 2023 15:57
|
|
|
with an IDE devs could write anything. even computer “viruses”
|
|
#
?
Oct 29, 2023 15:59
|
|
|
|
| # ? Apr 27, 2024 23:27 |
|
|
yea and apparently its somehow easier to hack jetbrains itself and plugins to then attack a software companys product to then attack the real target of govt/hospital/largebank but vscode is less vulnerable to this, somehow its like ye old “modify the compiler to add backdoors and modify future compilers to also add backdoors” kinda thinking. which isnt wrong. im just wondering if theres legit a real difference between jetbrains and vscode aside from the size of the wallet you can sue if their crap ends up busted. or maybe something in the licensing that somehow better limits jetbrains liability if they get got??
|
|
#
?
Oct 29, 2023 16:04
|
|