secfuck v18.509 issuance of thread title with short validity period. update: we will not be revoking

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.509 issuance of thread title with short validity period. update: we will not be revoking

«‹›10 »

The Fool: Oct 16, 2003

Lightbulb Out posted:

hirens boot disk was a thing

there�s a bunch of those utilities though

# ¿ Jul 18, 2023 18:47

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 02:06

The Fool: Oct 16, 2003

There were also professionally made ones like ERD and the Best Buy Geek Squad one.

ERD was based on WinPE, and there were a handful of others like that

Towards the end of my tenure there I built a WinPE usb disk for the shop that I worked at.

# ¿ Jul 18, 2023 18:56

The Fool: Oct 16, 2003

I'm not saying it's a good idea, I'm just saying that's what those folders are for

# ¿ Jul 18, 2023 19:02

The Fool: Oct 16, 2003

BlankSystemDaemon posted:

nlite allowed you to slipstream updates (and custom software) onto retail installs, which made it very easy to reinstall windows

of course this was also back when you had to reinstall windows every 6 months for it to not just start deteriorating on its own

The shop I worked at did a "$99 Reload" and with tools like nlite, some homebuilt scripts and a couple 4 port kvms a tech could do 8 of them in an hour.

# ¿ Jul 18, 2023 22:51

The Fool: Oct 16, 2003

there was a couple months where my personal azure sub got up to $0.12 a month and my bank kept flagging that as fraudulent

# ¿ Jul 18, 2023 23:18

The Fool: Oct 16, 2003

p sure naomi has/ had a beard for a long time so that may explain some confusion

# ¿ Aug 19, 2023 14:41

The Fool: Oct 16, 2003

has been for a while

# ¿ Aug 26, 2023 01:57

The Fool: Oct 16, 2003

its just so gauche

# ¿ Sep 14, 2023 14:22

The Fool: Oct 16, 2003

Shame Boy posted:

the collective joke, on all of us

# ¿ Sep 14, 2023 15:31

The Fool: Oct 16, 2003

Armitag3 posted:

congrats here are you standard issue cat ears and programming socks

I thought the cat ears were for rust devs

# ¿ Sep 21, 2023 14:55

The Fool: Oct 16, 2003

Hed posted:

She says she always uses that card at Target through Apple Pay... does the whole process present target with a virtual card number?

yes

# ¿ Sep 29, 2023 18:18

The Fool: Oct 16, 2003

https://www.apple.com/legal/privacy/data/en/apple-pay/

quote:

The card number from your credit, debit, or prepaid card is not provided when you use Apple Pay.

# ¿ Sep 29, 2023 18:21

The Fool: Oct 16, 2003

Also, you can see the last 4 of the virtual number if you look at your card details in the wallet apps.

# ¿ Sep 29, 2023 18:23

The Fool: Oct 16, 2003

that's par for the course for any online proctored exam

# ¿ Oct 15, 2023 03:45

The Fool: Oct 16, 2003

how does reviewing a release cause downtime

with cicd you should be releasing to prod early and often, but you do blue/green deployments and you roll back when there's a problem

many smaller releases mean that when there is an issue it's a lot easier to resolve than if there's one big release to untangle

and while there is no way for your tests and reviews to actually simulate prod, in no way should this strategy be considered endorsement to not test and review

# ¿ Nov 6, 2023 15:20

The Fool: Oct 16, 2003

Snuff Melange posted:

Sure its fine if you're iterating in very small, modest changes and if you have robust code tests built in

I mean, this is the whole thing.

# ¿ Nov 6, 2023 17:10

The Fool: Oct 16, 2003

Subjunctive posted:

lol a bit at �five figure cost�

ikr

# ¿ Nov 6, 2023 17:37

The Fool: Oct 16, 2003

based some napkin math I figure any P1 outage at my org has a base cost starting at 5 figures

like, by the time a bridge is spun up and an IC is engaged, we're already there

# ¿ Nov 6, 2023 17:39

The Fool: Oct 16, 2003

posting is work

# ¿ Nov 23, 2023 20:08

The Fool: Oct 16, 2003

Cold on a Cob posted:

I don�t read legit email, so I�m not gonna go back to reading phishing test emails either. I filter basically everything that isn�t from a known sender.

I filter out everything that isn't actually addressed directly to me.

# ¿ Dec 5, 2023 23:02

The Fool: Oct 16, 2003

I love it when a website doesn't load at all because my pihole blocked some tracking bullshit

# ¿ Dec 19, 2023 20:58

The Fool: Oct 16, 2003

just do what facebook did and ignore capital letters

# ¿ Dec 21, 2023 19:00

The Fool: Oct 16, 2003

Powerful Two-Hander posted:

I just noticed that their password manager is online, just lol if you trust Norton to manage that.

good take

quote:

lol if you even store passwords online anyway and don't use synched keepass db files

bad take

# ¿ Jan 17, 2024 14:56

The Fool: Oct 16, 2003

Cybernetic Vermin posted:

for most people convenient password management makes them way more likely to use good passwords (and generally manage them). some online sync is an important part of convenience for most people.

i'd guess that's the reasoning at least.

yeah, it's this

bitwarden, 1password, or apple keychain for most use cases is just fine and have a 1000x better ux than keepass

# ¿ Jan 17, 2024 15:49

The Fool: Oct 16, 2003

don't shame people for their password manager choices unless its norton or lastpass

# ¿ Jan 17, 2024 15:49

The Fool: Oct 16, 2003

yeah, I can't bring myself to defend that

# ¿ Jan 17, 2024 17:31

The Fool: Oct 16, 2003

would someone repost the study showing reliance on llms causing less secure code?

in a meeting now where it is relevant

# ¿ Jan 17, 2024 18:38

The Fool: Oct 16, 2003

post hole digger posted:

https://arxiv.org/abs/2211.03622

> We conduct the first large-scale user study examining how users interact with an AI Code assistant to solve a variety of security related tasks across different programming languages. Overall, we find that participants who had access to an AI assistant based on OpenAI's codex-davinci-002 model wrote significantly less secure code than those without access. Additionally, participants with access to an AI assistant were more likely to believe they wrote secure code than those without access to the AI assistant. Furthermore, we find that participants who trusted the AI less and engaged more with the language and format of their prompts (e.g. re-phrasing, adjusting temperature) provided code with fewer security vulnerabilities. Finally, in order to better inform the design of future AI-based Code assistants, we provide an in-depth analysis of participants' language and interaction behavior, as well as release our user interface as an instrument to conduct similar studies in the future.

bless

# ¿ Jan 17, 2024 18:46

The Fool: Oct 16, 2003

Varkk posted:

Just a quick question. What is the go to for a password manager for a team? We currently have a Keepass DB on a shared drive but obviously lacks important features like audit trails, different accounts for access etc. What is everyone else using in this space?

we're using azure keyvault, and while it works great for automation and app secrets it is poo poo for user secrets

if it was my decision would just use 1pass or bitwarden for team/user secrets

# ¿ Mar 15, 2024 13:38

The Fool: Oct 16, 2003

just lmao that aws secrets bills per secret and per api call

azure keyvault at least is only transaction billing

just use vault though

# ¿ Mar 15, 2024 15:10

The Fool: Oct 16, 2003

Related, in powershell I run a thing called PS-ReadLine which does a predictive preview of commands from your history:

https://devblogs.microsoft.com/powershell/announcing-psreadline-2-1-with-predictive-intellisense/?WT.mc_id=-blog-scottha

Is there anything like this for bash?

# ¿ Mar 15, 2024 20:40

The Fool: Oct 16, 2003

ctrl-r behaves considerably differently

# ¿ Mar 15, 2024 20:46

The Fool: Oct 16, 2003

Achmed Jones posted:

if yall dont set up fzf with ctrl-r instead of the bash/zsh built-in i dont even know what to tell you

The Fool, you probably want fzf

yeah, that's exactly what I was looking for thanks

# ¿ Mar 15, 2024 22:46

The Fool: Oct 16, 2003

Is there a good writeup of the entrust issue somewhere that's easy to share?

# ¿ Mar 18, 2024 17:35

The Fool: Oct 16, 2003

all of my orgs public facing certs are issued by entrust

none of them are EV, but if this drama resulted in them getting dropped from the roots then I would have a very bad day

# ¿ Mar 20, 2024 18:18

The Fool: Oct 16, 2003

Raymond T. Racing posted:

that�s why you use certbot, right

right

no, but we do use a combo of venafi and terraform to provide self service automation

But because it is self service it's going to require notifying and supporting ~70-ish teams

# ¿ Mar 20, 2024 18:24

The Fool: Oct 16, 2003

skimming the article the site may not actually be a scam or malicious (for now)(it's still an issue)

# ¿ Apr 8, 2024 14:24

The Fool: Oct 16, 2003

Raymond T. Racing posted:

the floodgates have been opened, Amir has mentioned �well maybe you shouldn�t be trusted�

# ¿ Apr 10, 2024 14:55

The Fool: Oct 16, 2003

all of my public certs are entrust issued, a little under 5k

# ¿ Apr 11, 2024 20:49

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 02:06

The Fool: Oct 16, 2003

we don't use EV certs at all, so all of them?

# ¿ Apr 11, 2024 20:56

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.509 issuance of thread title with short validity period. update: we will not be revoking

«‹›10 »