Internet Explorer posted:

If this is directed at me, the software requires SMBv1 for pretty much everything. Not sure what you mean by "let the admin install and enable," unless you mean that Windows Server should install with SMBv1 disabled by default, in which case I would agree.

RFC2324 posted:

What is the difference between a bug and "unexpected behavior"?

vOv posted:

If you look at the comment a bit down the page, the '7oz' user gets their thing run as root. Which is idiotic. If it fails to parse the username it should log a message saying so and then fail rather than defaulting to running it as root.

Absurd Alhazred posted:

So bad, the link is broken, too.

Cugel the Clever posted:

Anyone have input on the best alternative? I'm just a poor web deb with limited knowledge of the things my various tools have going on behind the scenes.

Trabisnikof posted:

It is smuggling the data inside the txt record itself you can do it with at least A, AAAA, CNAME, NS, TXT and MX records.

Double Punctuation posted:

Good news, everyone!

(This is officially going to take longer than the death of XP, which is still getting updates through that loving registry hack.)

orange sky posted:

wait what I just spent a million on a flash-only storage gently caress this

22 Eargesplitten posted:

Months ago someone in one of the IT threads was saying there was a problem with fingerprint scanning as security on a cell phone. He didn't specify why, though. What's the problem with it? I got a new phone a few days ago and I know I should probably disable the Touch ID unlocking, but I'm wondering why.

Twerk from Home posted:

DEF CON needs to leave the USA ASAP. Wonder if they could get it done by next year.

Kerning Chameleon posted:

quote:

Open sourcing Flash and the Shockwave spec would be a good solution to keep Flash and Shockwave projects alive safely for archive reasons. Don't know how, but that's the beauty of open source:

maskenfreiheit posted:

HOW CAN FLASH BE BAD IF HOMESTAR IS GOOD. RIDDLE ME THAT LINUX HUFFERS

Moatman posted:

I genuinely can't tell if that site is a big troll or not.

Wicaeed posted:

Is it common practice for a third party we use to host an external support website (these guys are pretty large too) to ask for the following?

quote:

We do not fulfill CSR requests and it should not be necessary in order to retrieve the certificate information from the provider.

For SSL renewals, please attach the following:

New SSL certificate
Respective Private KEY
Bundle (Intermediate and Root certificates)
* If a PASSWORD is required to open the .ZIP file, please make sure you enclose it in a .txt document.

Please do not email the files. Please attach the files to the case in one of the following formats only: .txt or .pem format.

Doesn't sending the private keys to someone that didn't generate them defeat one of the basic points of a loving private key?

CLAM DOWN posted:

If someone tells me they can't generate a CSR, after I giggle arrogantly I usually just link them the google results for certutil or openssl or whatever, because jesus christ it's 2017 and still no one knows what a certificate is or how they work

RFC2324 posted:

sftp. That way you don't have to deal with loving SSL certs in a way that was never intended.

D. Ebdrup posted:

I was talking about piping standard streams through ssh, like you do with zfs send | receive - because I'd just been doing that to back up stuff, and it reminded me that you could theoretically do that.

Internet Explorer posted:

Are you... Are you talking to my grandmother?

BangersInMyKnickers posted:

it's spelled and pronounced "Toronna" please get it right

Potato Salad posted:

CCleaner

Potato Salad posted:

"Hi there's a payload on our installer that we didn't know about"

I actually want to see if cylance picks this up, pinging a consultant

CLAM DOWN posted:

https://nakedsecurity.sophos.com/2017/09/17/vevo-hacked-3-12-tb-of-data-leaked/


aaahaahahaahhaahahahahaha

DACK FAYDEN posted:

edit: actually, also, why does Windows only let you uninstall one program at a time, what data collision is it trying to prevent?

Three-Phase posted:

General ITSEC question - how do criminals afford "junk domains" or whatever you'd call them to host malware/spyware or do command and control and so forth? A single .com domain can be like $10 or more a year, how do they register dozens or hundreds of "kj9fslidjflskdjgflkjdfg dot zyx" or whatever domains?

Or are there just really, really shady registrars that are like "LOL OK here's a thousand domains whatever"?

Absurd Alhazred posted:

WASHINGTON (Reuters) - The U.S. Securities and Exchange Commission (SEC), the country’s top markets regulator, said on Wednesday hackers may have illegally profited by trading using insider information stolen from its corporate disclosure database.

Absurd Alhazred posted:

If the SEC had stocks, I bet people higher up would have sold theirs before this disclosure.

Who's gonna go at them? The SEC?

Proteus Jones posted:

Via YOSPOS Sec gently caress thread


Also:

https://twitter.com/me_irl/status/911328527248699392

anthonypants posted:

D. Ebdrup posted:

I've heard of browsers that seemingly slow a computer to a crawl, but putting a buttcoin miner in an extension is a new high (or low). The author claims that there "has been a hack", but the extension hasn't actually been updated for over a month, so something doesn't quite add up.

Boris Galerkin posted:

https://www.reddit.com/r/privacy/comments/3frjqw/psa_kaspersky_injects_remote_javascript_into_all/



Is this bad

Absurd Alhazred posted:

SMB. Version. 1.