Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
susan b buffering
Nov 14, 2016

Squinky v2.0 posted:

so that CBP hack was waaaay worse than initially reported

Hacked documents reveal sensitive details of expanding border surveillance


there’s more too. whoever got in seems to have made off with essentially everything the contractor had. seems bad.

Lol this rules

Adbot
ADBOT LOVES YOU

susan b buffering
Nov 14, 2016

rjmccall posted:

okay, so this appears to be the original, four-year-old bug. tl;dr: sqlite has a pair of bugs in its query and database-file parsers

in theory the query parser bug shouldn't be exploitable because nobody would ever be dumb enough to inject user input directly into an sql query string, right?

the file parser bug is only exploitable if you can corrupt the database file that sqlite is working with, but you probably can if there's literally any other bug in the program, because parts of the database file are probably just mmap'ed writably into the address space because that's how databases work. and corruption of the database file will generally persist across reboots, so potentially the exploit can persist, too

i don't know why ios was apparently using an ancient sqlite. probably because the whole clever point of sqlite is that you can just copy it into your project without worrying about adding a dependent project, so people do and then they don't worry about keeping up with security updates

the thing about passwords sounds like bullshit

ios definitely bundles a newer version of sqlite than that so maybe it's something else

susan b buffering
Nov 14, 2016

didn’t 2600 recently publish the location of a bunch of ICE detention facilities? that seems pretty good

susan b buffering
Nov 14, 2016

El Mero Mero posted:

I thought it would be funny to register something very similar to help@gmail.com when Gmail first launched.


Surprise, it was available and yes - it has been very funny.

lol

susan b buffering
Nov 14, 2016


lol

susan b buffering
Nov 14, 2016

Midjack posted:

rwx gonna give it to ya

susan b buffering
Nov 14, 2016

Jabor posted:

Looks like it's specifying a font you don't have and falling back to Times New Roman, lol

something like that has definitely happened to me at seemingly random times on some azure pages

susan b buffering
Nov 14, 2016

Shame Boy posted:

got another one of those "we saw all your secrets pay us a bitcoin and we'll go away" scare spam letters but i think this one wins for wording

finally, someone who appreciates my artform

lmao

susan b buffering
Nov 14, 2016

Jabor posted:

for safety, make sure you use a cloudflared base

:boom:

susan b buffering
Nov 14, 2016

spankmeister posted:

yeah or yospos could look outside the USA for once in their goddamn life and see that other countries have had chip + pin for decades and it doesn't come with this liability shift bogeyman that you keep harping on about. maybe in the us it does, but other places exist too

cue shaggar saying something inane and offensive like other countries not mattering

lol this whole discussion was sparked by something that happened outside the US

susan b buffering
Nov 14, 2016

Achmed Jones posted:

30-50 feral logs

susan b buffering
Nov 14, 2016

doesn't rm -rf / not even work by default these days?

susan b buffering
Nov 14, 2016

flakeloaf posted:

great another veeam escape

lol

susan b buffering
Nov 14, 2016

Shame Boy posted:

we've been asked (repeatedly) to TELL US MORE ABOUT YOURSELF!! in the new HR system by HR people, noting specifically that you can now fill out both your gender and gender identity!

:negative:

susan b buffering
Nov 14, 2016

Plorkyeran posted:

a c++ committee member was convicted for child porn, and is still on the committee and refusing to interact with them at in-person meetings is a coc violation

what on earth

susan b buffering
Nov 14, 2016

VSOKUL girl posted:

im too lazy to migrate all my poo poo off gmail especially since theres no way in hell anyone is offering OIDC logins with fastmail, even if they did have an OIDC provider. also im annoyed that their throwaway email integration is only with 1password and not bitwarden

other than that google's automatic classification of "poo poo that isn't 'spam' in the strictest sense but is definitely part of a never-ending stream of marketing email from some site you dared make a $3 purchase on once in 2004" was pretty useful. unfortunately i don't think theres an alternative service that runs on the principle of "anyone that slightly abuses a need to use transactional email as an excuse to send marketing garbage just goes to spam forever"

idk fastmail's spam filter seems similarly aggressive, maybe even moreso since i have to check it occasionally for false positives and i don't remember having to do that with gmail.

susan b buffering
Nov 14, 2016

if you think removing SMS 2FA improves security then that's because you like to gently caress and cum inside the computer

susan b buffering
Nov 14, 2016

Lain Iwakura posted:

impressive that this is worse than cryptocat

https://crnkovic.dev/testing-converso/

does this page jiggle up and down with increasing intensity as you scroll down for anyone else on iOS?

susan b buffering
Nov 14, 2016

~Coxy posted:

please don't call it that

was doing one of those security training things recently and got unreasonably mad at getting an answer wrong because i chose "phishing" instead of "smishing" or some poo poo

susan b buffering
Nov 14, 2016

Quackles posted:

thank you for saying it :kimchi:

susan b buffering
Nov 14, 2016

Powerful Two-Hander posted:

old job had a nuget proxy you were supposed to use but because of how poor nuget is there was no way to enforce using it because you had to make a conscious decision to install it and then actually select it as the source to use

the one time I tried to use it it blocked something like jQuery so I gave up

new job block vscode for allowing random add-in downloads which is probably a good thing, no idea how they handle visual studio seeing as I don't touch it anymore

but then they block local keepass installs so I'm 90% sure people are storing credentials in passwords.txt on their desktop

nuget finally added the ability to setup package source mapping rules a couple years ago, so you can just set those up in the solution's nuget.config and it'll use that to get packages from the right source. that and the new feature that lets you define package versions globally for a solution have made my interactions with nuget much less fraught.

susan b buffering
Nov 14, 2016

FungiCap posted:

crowdstrike super hates devs. ive seen this exact scenario multiple times. hopefully your security team put dev computers in a different group from all the other user computers and tune the policies better.

we have it on our dev machines and it seems fine. the only time I've been pinged by IT is because i ran a sketchy looking allen & heath firmware updater needed an intel cpu to run on, which seemed fair.

susan b buffering
Nov 14, 2016

i setup my passkey with 1password and have never had trouble logging into github with it op

Adbot
ADBOT LOVES YOU

susan b buffering
Nov 14, 2016

Shame Boy posted:

i mean this 100% sincerely: thank you for taking time out of your real actual important job to join us in our dumb lil' shitposting-about-security thread, this whole ride has been real fascinating

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply