secfuck v18.509 issuance of thread title with short validity period. update: we will not be revoking

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.509 issuance of thread title with short validity period. update: we will not be revoking

«‹›39 »

Shame Boy: Mar 2, 2010

bob dobbs is dead posted:

squash court you mean come on

i looked it up because i remembered it different too but no it was in fact last used as a football field before they built the pile

e: ok wait i see where i got mixed up, the field itself was used for football, the area under the stands where they built the reactor was used for squash

Shame Boy fucked around with this message at 22:09 on Jan 23, 2023

# ¿ Jan 23, 2023 22:07

Adbot: ADBOT LOVES YOU

# ¿ Apr 26, 2024 01:03

Shame Boy: Mar 2, 2010

i think the old professor guy from periodic videos once talked about how if you were doing chemistry in like, the 1700's / 1800's you were expected to do stuff like sniff the vapors of a reaction and taste stuff and and not wear safety equipment or protection at all ever because obviously the noble gentleman scientist must be brave and courageous to discover new truths at any cost

# ¿ Jan 24, 2023 01:43

Shame Boy: Mar 2, 2010

Trabisnikof posted:

they taught us to lick the rocks in my college geology course.

that's fine, the rocks like it

# ¿ Jan 24, 2023 02:45

Shame Boy: Mar 2, 2010

cinci zoo sniper posted:

it is

https://twitter.com/Niah19bunny/status/1617533990394789892

# ¿ Jan 24, 2023 14:52

Shame Boy: Mar 2, 2010

sb hermit posted:

I use keepassxc and it's very nice

same, my only gripe is that the browser plugin for it in chome specifically has problems with like, one or two websites i use regularly so i have to manually open it up and find the entry and plop it in

weirdly the older browser plugin (the non-xc one) worked fine on those sites so idk what's going on

# ¿ Jan 24, 2023 17:06

Shame Boy: Mar 2, 2010

Cybernetic Vermin posted:

lol imagine thinking that the compressed archives you generated as part of you release would be statically the same files over time, fools all

those aren't the ones you generate those are the ones it auto-generates from the tag

# ¿ Jan 31, 2023 13:40

Shame Boy: Mar 2, 2010

Cybernetic Vermin posted:

right, but it is obviously not going to register to any user as distinct. you do a thing causing archives to be available, but in case x they are stable and in case y they are not

i guess verifying the hash of repo source code just seems less important than doing it for actual release artifacts. or well "less important" isn't the right term, it's just as important for ensuring it's intact, I more mean if I were github I could totally see how you could think that it wouldn't affect processes (since obviously people use release artifacts for actual deployment, not source code).

but of course, that assumes your users won't use things however the hell they want regardless of how you expect them to, and whelp

# ¿ Jan 31, 2023 14:38

Shame Boy: Mar 2, 2010

the one time i ever played ss13 someone knocked me out and welded me inside a locker within the first 30 seconds and i spent the rest of the round looking at a black screen, i think that sums up the game pretty well

# ¿ Feb 1, 2023 18:40

Shame Boy: Mar 2, 2010

Blinkz0rz posted:

yeah i thought it was an interesting argument only because security practitioners and the security aware consider sms insecure by default without considering use-cases where it might be the only safe option

"something you have" is only good 2fa if you can actually keep your stuff safe

i would think an abuser calling the phone company and getting them to cancel or port your number would be a hell of a lot easier than even just stealing your phone judging by the fact that randos with absolutely no relation to you that are trying to steal your money seem to be able to do it with absurd success rates, though i guess it's a less obvious choice too

# ¿ Feb 18, 2023 22:08

Shame Boy: Mar 2, 2010

Hed posted:

some shared keybag

that's not a very nice way to talk about your mom :colbert:

# ¿ Feb 21, 2023 17:50

Shame Boy: Mar 2, 2010

not seeing the part where "developers" are responsible, just the companies they work for, did i miss that

# ¿ Mar 3, 2023 20:41

Shame Boy: Mar 2, 2010

oh wait everyone's an independent contractor now, that's how

# ¿ Mar 3, 2023 20:42

Shame Boy: Mar 2, 2010

now that we're done with our fairly reasonable check-the-box security training for our company (which was like, a few courses here and there that involved 30 minutes of watching a video), we now need to do our contract customer's security training.

it's several lessons where each lesson is 5 to 9 hours of "interaction" long and they all have to be done by April :shepface:

# ¿ Mar 8, 2023 16:03

Shame Boy: Mar 2, 2010

Rick posted:

Having a work phone would make my life infinitely better from an IT security aspect of it all, and the whole company's for work life balance stuff, but when I bring this up everyone gets mad because everyone gets an $80 stipend for their phone every month.

lol I would too if you wanted to make me trade $80 a month for that

# ¿ Mar 14, 2023 06:02

Shame Boy: Mar 2, 2010

Lysidas posted:

if my wife is driving and wants me to do something with her phone that is not trivial through carplay, i usually unlock it by covering the bottom half of my face with my hand and trying face id, it works fine since shes sitting next to me, meaning her watch is close by

the mitigation of this loose security is your watch notifying you that it was unlocked, letting you press the "lock iphone" button to make the phone require a passcode

lmao

"this picture of half of someone else's face and a hand is close enough for me I guess"

# ¿ Mar 14, 2023 20:46

Shame Boy: Mar 2, 2010

unbolt the rack from the floor, chop all the cables with a machete, throw into back of truck

# ¿ Mar 20, 2023 02:08

Shame Boy: Mar 2, 2010

haveblue posted:

can I just say how much I love* how bugs and exploits are given marketing campaigns these days

eagerly awaiting the first exploit with a tagline and a mascot and promoted tweets

*the opposite

reminder that i still own fartbleed.com and am still waiting for someone to create an exploit worthy of the name

# ¿ Mar 23, 2023 20:27

Shame Boy: Mar 2, 2010

dpkg chopra posted:

changelog:

added prep.h to codebase to mitigate effects from fartbleed

lmao if i ever wind up doing anything with the domain i will work this in somehow

# ¿ Mar 24, 2023 03:02

Shame Boy: Mar 2, 2010

the lesson is in fact to just never open any company emails ever though

# ¿ Apr 4, 2023 23:35

Shame Boy: Mar 2, 2010

fins posted:

lmao, so many twitch streamers are gonna have a bad time

yeah occasionally i think about doing some kinda stream and then i think of all the fun and exciting ways you can leak information like this and crawl back in my little hole

# ¿ Apr 5, 2023 03:57

Shame Boy: Mar 2, 2010

another in the long line of "weird choices by banks", i'm making an account and

quote:

Username must be 8 to 32 characters and include at least 2 numbers. No special characters or spaces, please.

is that just them trying to make it harder to guess usernames maybe?

e: lol the security questions include a bunch of poo poo that you can just look up publicly or guess easily and the minimum acceptable length is two characters, great

# ¿ Apr 6, 2023 12:08

Shame Boy: Mar 2, 2010

Crime on a Dime posted:

https://www.forcepoint.com/blog/x-labs/zero-day-exfiltration-using-chatgpt-prompts

what part of this is a zero day, as far as i can tell he just got chatgpt to write a thing that loaded someone else's steganography library and put a document into a bunch of pngs

e: oh much further down in the page he has it wrap the exe in a windows screensaver, which... you then manually install. i guess that's... something...

Shame Boy fucked around with this message at 13:54 on Apr 6, 2023

# ¿ Apr 6, 2023 13:51

Shame Boy: Mar 2, 2010

intelligence dudes probably spend all their free time on /pol/ anyway, so why not

# ¿ Apr 7, 2023 06:16

Shame Boy: Mar 2, 2010

theflyingexecutive posted:

they told her that's how they found her

lol they found her via parallel construction and made up some bullshit

# ¿ Apr 17, 2023 19:58

Shame Boy: Mar 2, 2010

rjmccall posted:

parallel construction is the bullshit

you find someone via sketchy/illegal means and then build a case that retroactively justifies how you could have found them. the latter half is the parallel construction: it�s parallel to the real way you did it which you don�t want to disclose

a pair of constructions that are parallel are both parallel constructions to each other :colbert:

# ¿ Apr 17, 2023 21:27

Shame Boy: Mar 2, 2010

mystes posted:

Get a roomba and it will submit a nicely formatted physical map of your home too

yeah but not to amazon

# ¿ Apr 25, 2023 14:22

Shame Boy: Mar 2, 2010

ymgve posted:

the first sexbot will send a nicely formatted map of your physical body to the servers, to be sold to your health insurance company

now i'm imagining someone excitedly unpacking their first sexbot only to have to do a firmware update and then calibrate it by touching various glowing circles while it stares at them all dead-eyed

# ¿ Apr 25, 2023 14:24

Shame Boy: Mar 2, 2010

Cybernetic Vermin posted:

huh? is there some silo promise i'm unaware of, otherwise it seems real unlikely that amazon is just letting that data sit

did i miss amazon buying iRobot

# ¿ Apr 25, 2023 14:25

Shame Boy: Mar 2, 2010

Cybernetic Vermin posted:

yes, $1.7 billion. but the deal apparently has not closed just yet, so for the moment you are technically correct

oh that sucks, okay

# ¿ Apr 25, 2023 14:31

Shame Boy: Mar 2, 2010

love 2 Cymulate :heysexy:

# ¿ Apr 26, 2023 22:17

Shame Boy: Mar 2, 2010

the gunpoint blowjob one from swordfish

# ¿ Apr 27, 2023 15:29

Shame Boy: Mar 2, 2010

spankmeister posted:

I worked at a place that had something similar to "Spring2013!" as the default password.

in 2018

i worked at a place that had "company" set as the default password hint, but the default password wasn't the company name but was a basic fact about companies as a concept, which i think is so dumb it loops back around to being clever

# ¿ Apr 28, 2023 14:33

Shame Boy: Mar 2, 2010

theflyingexecutive posted:

Pr0fit=Rev3nue-C0$t$##

Guy Axlerod posted:

M0neyC@nBeExh@nged4G00ds&$ervice$

these are much too good, the actual password was letters only, all lower case, and an even simpler observation

it was more like "hasemployees"

# ¿ Apr 28, 2023 23:54

Shame Boy: Mar 2, 2010

tbf that guy's criteria is whether or not it costs a company money, and sure, the NSA reading all your information will probably not cost a company money

# ¿ Apr 29, 2023 06:17

Shame Boy: Mar 2, 2010

i haven't tried the original one in a while but i remember XC just working better and having an overall nicer UI :shrug:

# ¿ May 1, 2023 14:18

Shame Boy: Mar 2, 2010

sb hermit posted:

https://www.theregister.com/2023/04/27/microsoft_windows_rust/

https://arstechnica.com/information-technology/2023/05/two-core-unix-like-utilities-sudo-and-su-are-getting-rewrites-in-rust/

Rewriting everything in Rust to eliminate memory safety issues may finally be what migrates all these C based apps to something a little more safe.

is there a version of rust for people who like the idea but hate how the syntax looks

# ¿ May 1, 2023 19:13

Shame Boy: Mar 2, 2010

pseudorandom name posted:

Rust syntax looks like C syntax though.

sorta?

i mean every time i think "maybe i should try it" i go to the wiki page and see poo poo like

code:

#[derive(Debug)]
struct Config<'src> {
    hostname: &'src str,
    username: &'src str,
}

fn parse_config<'cfg>(config: &'cfg str) -> Config<'cfg> {

and my brain just kinda twitches uncomfortably. like someone took typescript and made it weirder

# ¿ May 1, 2023 20:11

Shame Boy: Mar 2, 2010

like i'm not gonna use it for work stuff or anything, this is just my personal bullshit hobby projects that are really of no real importance. if i had to use it every day I'm sure i could get over it (i've definitely gotten over weirder and much worse languages for work reasons) but i really don't wanna spend my free time using something that just makes me viscerally uncomfortable, and that's a shame cuz like I said I really like the idea.

i realize this is mostly just me being a huge baby but idk maybe there's some other language that works similarly but looks different that i just don't know about

rjmccall posted:

i�m a little biased here, but swift is trying real hard to grow into a language with the same basic guarantees as rust, with some philosophical differences about accepting copies in more situations by default while still maintaining the ability to opt in to a strict borrow-enforcement regime

like that, thanks

# ¿ May 1, 2023 20:19

Shame Boy: Mar 2, 2010

haveblue posted:

C family languages also have a million little tags you can add to declarations like const or nullable or strong or <template> or whatever, rust just has different ones

I read the rust wikipedia page for 30 seconds and I learned that '<keyword> is effectively an explicit declaration of scope which makes a lot of sense for a language trying to be very safe

i think i'm not being super clear here, i understand what's going on i just don't like how it looks. like what the hell kind of monster uses single quotes like that??

it's incredibly petty and stupid, i know.

# ¿ May 1, 2023 20:20

Adbot: ADBOT LOVES YOU

# ¿ Apr 26, 2024 01:03

Shame Boy: Mar 2, 2010

pseudorandom name posted:

as opposed to

code:

template<typename cfg> struct [[deprecated]] Config {
    std::basic_string_view<cfg> &hostname; 
    std::basic_string_view<cfg> &username;
};

template<typename cfg> auto parse_config(std::basic_string_view<cfg> &str) -> Config<cfg>;

yes, unironically.

i'm a degenerate weirdo, i know.

# ¿ May 1, 2023 20:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.509 issuance of thread title with short validity period. update: we will not be revoking

«‹›39 »