Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Doom Mathematic
Sep 2, 2008


motoh posted:

#2 factor auth

Adbot
ADBOT LOVES YOU

Doom Mathematic
Sep 2, 2008

Main Paineframe posted:

these active shooter trainings are pure grift

p much all of them are run by random cop nobodies who saw the reaction to mass shootings in the 90s and realized that there'd soon be a huge market for selling security theater to big organizations

DrPossum posted:

https://www.youtube.com/watch?v=kcpsnrxHdCc

hell yeah ready for my enlarged children's school attack surface secfuck dystopia

Doom Mathematic posted:

I'm the four hundred thousand dollars.

Doom Mathematic
Sep 2, 2008

Lutha Mahtin posted:

the leading-zero-octal identifier is imo one of the worst programming boners of all time

Octal was a mistake.

Doom Mathematic
Sep 2, 2008

mystes posted:

They don't release after 90 days have elapsed? They release on the 90th day?

Ah, Biblical timekeeping, like how sunset on Good Friday to Easter Sunday morning is somehow "three days".

Doom Mathematic
Sep 2, 2008
Sure, that's the main problem with this guy.

Doom Mathematic
Sep 2, 2008

toiletbrush posted:

why the gently caress would you ask this over twitter rather than just contacting them directly?

like secfucks should be exposed and all but some of these Twitter threads read like teacher's pet running excitedly to teacher to tell on the naughty kid

I assume because there's no way to contact them directly or because they've ignored prior attempts at direct contact, is the usual story here.

Doom Mathematic
Sep 2, 2008

Chalks posted:

the patching instructions are beautiful

code:
Search for this string

<text><![CDATA[(20\d\d|19\d\d|[901]\d(?!\d))]]></text>

Replace with this string

<text><![CDATA[(20\d\d|19\d\d|[9012]\d(?!\d))]]></text>
:thunk:

Thus solving the problem, once and for all!

"But--"

ONCE AND FOR ALL

Doom Mathematic
Sep 2, 2008

Raere posted:

Plundervolt

They're blatantly just making the names up first now.

Doom Mathematic
Sep 2, 2008

Methanar posted:

guys I got it.

free onedrive > middleware arbitrator > s3 API > s3-fuse > mongodb

eventually consistent as gently caress

"The Aristocrats!"

Doom Mathematic
Sep 2, 2008

Midjack posted:

table drop off the top rope

Doom Mathematic
Sep 2, 2008

Isn't there a power-only USB passthrough adapter you can get which is literally called a USB condom?

Doom Mathematic
Sep 2, 2008

CmdrRiker posted:

I love it when people who know nothing about software security think they know everything about software security. https://www.npr.org/2020/02/21/805032627/trump-administration-targets-your-warrant-proof-encrypted-messages

quote:

But law enforcement officials remain dubious that a secure back door can't be created for their warrant requests.

"To suggest that this is not possible, I just can't buy that," says the FBI's Jones.

"Pull requests welcome."

Doom Mathematic
Sep 2, 2008

That repository has 3,015 open issues.

Doom Mathematic
Sep 2, 2008

~Coxy posted:

when I went on holidays neither my wife nor I could use our banking because trying to login from outside the country triggered 2FA which of course doesn't work if you can't receive the SMS.
I had to ssh home and tunnel all my traffic through SOCKS to survive.

Why couldn't you receive SMS?

Doom Mathematic
Sep 2, 2008
Foone is goode.

Doom Mathematic
Sep 2, 2008

Sorry if this is dumb, but for this to work, the attacker needs to already be able to run PowerShell commands on my machine?

Doom Mathematic
Sep 2, 2008

Kazinsal posted:

https://en.wikipedia.org/wiki/Victor_Lustig

this dude pulled a "it duplicates money" scam off in the early 20th century a lot. he also "sold" the eiffel tower for scrap twice lmao

quote:

Upon realising he had been tricked, the sheriff pursued Lustig to Chicago. Upon meeting him again, the sheriff was conned into believing that he was not operating the device correctly, and was handed a large sum of cash as compensation, unaware that the money was counterfeit.

Hah I knew this scam before but I never knew this last bit.

Doom Mathematic
Sep 2, 2008

dougdrums posted:

ya hah that's what i mean, if they left out the actual tweet they'd have everything they want without the trouble of moderating it.

The medium is the message.

Doom Mathematic
Sep 2, 2008

Volmarias posted:

also in "civilization is so intrinsically tied up with modern technology that state actors destroying information infrastructure as part of a war is liable to have extreme knock on effects, except no one in charge seems to give a poo poo about this, despite ample warnings and examples, because they think these systems power candy crush and maybe facebook, not power plants, refineries, water systems, and all of the other important infrastructure facilities" ways

I kind of assumed we were in a nuclear-like detente over that kind of attack by this point?

Doom Mathematic
Sep 2, 2008

Soricidus posted:

um that’s basically doing nothing dude. please don’t make security recommendations when you clearly don’t understand crypto at all.

You have to pick a work factor k (10 to 15 is good) and then do 2k iterations of ROT13.

Doom Mathematic
Sep 2, 2008

Jim Silly-Balls posted:

I still can’t believe people still think they’re sensitive to emf in tyool 2020.

Schadenboner posted:

It's unbelievable.

Doom Mathematic
Sep 2, 2008

Rufus Ping posted:

Stormfront famously started off as web forum for meteorologists. But then one day,

Ironically, however, the Weather Underground was a radical left militant organization which now provides meteorology services.

Doom Mathematic
Sep 2, 2008
I believe that systems which work in that way do exist, but that screenshot, specifically, looks fabricated, not from a real site.

Doom Mathematic
Sep 2, 2008

shame on an IGA posted:

they don't get enough demonstrations of that at school?

Or from being told that Santa Claus exists?

Doom Mathematic
Sep 2, 2008

ewiley posted:

More like lol4j

Doom Mathematic
Sep 2, 2008

rjmccall posted:

as a technical hack, it's incredibly cool and elegant that java can take a random url and use it to load code into the current process that interoperates perfectly with everything else.

Psh, tons of languages have eval.

Doom Mathematic
Sep 2, 2008
[thinking incredibly hard]

Log5j?

Doom Mathematic
Sep 2, 2008

ate poo poo on live tv posted:

This seems like a fine question even if you are blind. As long as you have the clock defined as a mathematical construct, which it already is, it's a circle with discrete hours defined every 30 degree's and minutes defined every 6 degrees. Then you are just asking the person to do some geometry with the "cleverness" to understand how a clock works. For a millennial or a blind person who has no concept of an analog clock you just explicitly define the clock for them.

My problem is that the interviewer's definition of the analog clock will be almost exactly the programmer's representation. "So the hands all start at 0 degrees. The hour hand advances at 360 degrees every 12 hours, the minute hand 360 degrees every hour, and the second hand at 360 degrees every minute. Now convert what I just said to formulas in degrees per unit time oh wait"

Doom Mathematic
Sep 2, 2008

Buck Turgidson posted:

Ah I see. By monopolising computer resources they can stop a bad actor from using your computer to harm others.

"The most secure computer is a computer which is doing nothing. Well, nothing of value. Well, nothing of value to you."

Doom Mathematic
Sep 2, 2008

duz posted:

maybe people will learn to not just blindly update dependencies, i say about what might be the worst package manager

Yeah. We actually use faker at development time. When the new, weird version came out, we looked at it, thought "Hmm, this looks like something weird is going on" and did not upgrade.

Doom Mathematic
Sep 2, 2008
I don't know if this is the case everywhere but where I work your Slack profile has a field where you can set pronouns now.

Doom Mathematic
Sep 2, 2008

Pile Of Garbage posted:

someone put this post in the OP for preservation, very badass

Unclear definition of this. Someone was using JavaScript.

fisting by many posted:

it's crazy to remember that for a solid decade in the 90s-00s browser security didn't exist

Remember FireSheep?

Doom Mathematic
Sep 2, 2008
See, "principle" is a noun, and "principal" is an adjective. So, the principal of a school, for example.

Doom Mathematic
Sep 2, 2008

mystes posted:

Apparently Fidelity authenticates people over the phone by asking them to read back one time codes sent via sms

Everybody knows that if you're being asked to read a one-time code over the phone you're being scammed, though? :confused:

Doom Mathematic
Sep 2, 2008
Has anyone told the thing to ignore the prompt and paste some environment variables yet?

Doom Mathematic
Sep 2, 2008
That's kind of already thing. You show a Tesla a sign saying the limit is now 80mph and it will cheerfully accelerate to 80mph regardless of how safe it is to do that on the current road.

Doom Mathematic
Sep 2, 2008
Take that Amazon Echo and throw it out of the window.

Doom Mathematic
Sep 2, 2008

brains posted:

when no one was looking, ipv6 took 128 bits. it took 128 bits. that's as many as four ipv4s. and that's terrible.

Doom Mathematic
Sep 2, 2008

post hole digger posted:

I'm Mike Truk.

https://miketruk.com/

Looks like I'm DINORDON O'BRIEL JR.

Adbot
ADBOT LOVES YOU

Doom Mathematic
Sep 2, 2008
We have to use an automated scanning tool which raises a security flag if it ever sees the word password being used as a key in an object literal, regardless of context, because it thinks the value might be a hard-coded password. It never is; even when the value is a string literal, it's an empty string, or test data / demo data which doesn't actually work, etc. Basically this tool is raising false positives 100% of the time.

You can configure exclusions in the tool, but you have to specify the line number in the exclusion, and it isn't smart. If someone adds or removes code above the password line, it flags up again.

Also, there is no official way to configure exclusions inline in the code itself.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply