The Infosec Thread: Yes, time to move off Entrust

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off Entrust

«‹›509 »

mllaneza: Apr 28, 2007; Veteran, Bermuda Triangle Expeditionary Force, 1993-1952

Volmarias posted:

The idea is that you're not putting out garbage that you wouldn't use yourself.

What baffles me is, Microsoft's internal system administrators have physical access to the developers who wrote this poo poo. How are there not constant stories about screaming matches in the cafeteria between the people who have to run Windows, and the people who wrote it ?

# ? Mar 13, 2020 01:56

Adbot: ADBOT LOVES YOU

# ? Jun 9, 2024 09:41

Mustache Ride: Sep 11, 2001

CommieGIR posted:

Give a better saying then.

Do the stuff I'm preaching

# ? Mar 13, 2020 02:14

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

Mustache Ride posted:

Do the stuff I'm preaching

Cool Ill use it. But you still understood what I meant.

# ? Mar 13, 2020 03:01

Last Chance: Dec 31, 2004

can we also stop using the term "bug" for a glitch? i don't like bugs

# ? Mar 13, 2020 04:09

astral: Apr 26, 2004

Last Chance posted:

can we also stop using the term "bug" for a glitch? i don't like bugs

What if it's a glitch caused by a bug?

# ? Mar 13, 2020 04:35

beuges: Jul 4, 2005; fluffy bunny butterfly broomstick

astral posted:

What if it's a glitch caused by a bug?

Undocumented behaviour

# ? Mar 13, 2020 10:22

BlankSystemDaemon: Mar 13, 2009

beuges posted:

Undocumented behaviour

Also known as: users.

# ? Mar 13, 2020 11:07

CatHorse: Jan 5, 2008

mllaneza posted:

What baffles me is, Microsoft's internal system administrators have physical access to the developers who wrote this poo poo. How are there not constant stories about screaming matches in the cafeteria between the people who have to run Windows, and the people who wrote it ?

Because the only people at Microsoft that use Windows are the couple of people on Insiders team that do webcasts.

# ? Mar 13, 2020 17:03

some kinda jackal: Feb 25, 2003; �
�

In my mind, I'm imagining the internal network at MSFT to be some sort of Dante's Inferno levels of hell of Windows vulnerabilities.

# ? Mar 13, 2020 18:35

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

mllaneza posted:

What baffles me is, Microsoft's internal system administrators have physical access to the developers who wrote this poo poo. How are there not constant stories about screaming matches in the cafeteria between the people who have to run Windows, and the people who wrote it ?

When you're the ones writing the software, you're probably also able to deploy and configure it in very useful ways and lean on said developers to ensure that things you in particular need, get attention. There's also unlikely to be any "well we're still using Vista in 2017, let's look at upgrading to windows 7" nonsense. Working at a certain large company that produces its own productivity software, I'm also able to complain loudly and at least hear a reason why my particular issue is not trivial to solve, or is already on the roadmap, so I'm more forgiving here.

What's wild to me is hearing about how people back in the early 90s liked DOS and Windows because it let them hack on their own machines and tinker with things.

Volmarias fucked around with this message at 14:43 on Mar 15, 2020

# ? Mar 15, 2020 14:41

RFC2324: Jun 7, 2012; http 418

Volmarias posted:

When you're the ones writing the software, you're probably also able to deploy and configure it in very useful ways and lean on said developers to ensure that things you in particular need, get attention. There's also unlikely to be any "well we're still using Vista in 2017, let's look at upgrading to windows 7" nonsense. Working at a certain large company that produces its own productivity software, I'm also able to complain loudly and at least hear a reason why my particular issue is not trivial to solve, or is already on the roadmap, so I'm more forgiving here.

What's wild to me is hearing about how people back in the early 90s liked DOS and Windows because it let them hack on their own machines and tinker with things.

I remember hex editing command.com.

I always ran Mega Hard Dick Operating System on my computer

# ? Mar 16, 2020 09:20

ynohtna: Feb 16, 2007; backwoods compatible; Illegal Hen

Yeah. Back then, home computer owner demographics were strongly skewed towards �computer enthusiasts� who had already learnt and expected that these were messy systems that required lots of guts POKEing just to get games running, sound working, etc.

# ? Mar 16, 2020 09:36

Proteus Jones: Feb 28, 2013

poo poo I remember using a chip puller and inserter to upgrade the family IBM XT from 512K to 640K. Given I was 14 at the time, it was pretty nerve wracking since I went ahead and did it without telling my dad.

# ? Mar 16, 2020 15:47

wolrah: May 8, 2006; what?

Proteus Jones posted:

poo poo I remember using a chip puller and inserter to upgrade the family IBM XT from 512K to 640K. Given I was 14 at the time, it was pretty nerve wracking since I went ahead and did it without telling my dad.

I remember my dad and I both carefully triple checking the process and orientation when adding additional SIMMs to our first PC. Grounding ourselves religiously, not taking the cards out of the bag until the absolute last second, etc. It was such a relief watching the POST RAM counter keep going after 2048KB.

A few years later we accidentally hot-swapped a PCI modem on an MMX-era Pentium system when we were switching back and forth trying to solve a problem and forgot to shut the computer down first. It's amazing how quickly that sense of fragility goes away (though we still both had a "oh gently caress.....wait....it's still running.....wow...." moment).

# ? Mar 16, 2020 17:15

RFC2324: Jun 7, 2012; http 418

Proteus Jones posted:

poo poo I remember using a chip puller and inserter to upgrade the family IBM XT from 512K to 640K. Given I was 14 at the time, it was pretty nerve wracking since I went ahead and did it without telling my dad.

never did it with system RAM, but I had an expansion board that added a whole 2M when you filled all the banks with chips. that poo poo was cool as hell to kid me building it.

they need to make more computers like that

# ? Mar 17, 2020 00:18

Darchangel: Feb 12, 2009; Tell him about the blower!

mllaneza posted:

What baffles me is, Microsoft's internal system administrators have physical access to the developers who wrote this poo poo. How are there not constant stories about screaming matches in the cafeteria between the people who have to run Windows, and the people who wrote it ?

Lots of Kool-Aid

Last Chance posted:

can we also stop using the term "bug" for a glitch? i don't like bugs

You're not supposed to like bugs, you're supposed to eradicate them.
Also, it's called a bug because the first one was a literal bug in a relay.

beuges posted:

Undocumented behaviour

D. Ebdrup posted:

Also known as: users.

wolrah posted:

I remember my dad and I both carefully triple checking the process and orientation when adding additional SIMMs to our first PC. Grounding ourselves religiously, not taking the cards out of the bag until the absolute last second, etc. It was such a relief watching the POST RAM counter keep going after 2048KB.

A few years later we accidentally hot-swapped a PCI modem on an MMX-era Pentium system when we were switching back and forth trying to solve a problem and forgot to shut the computer down first. It's amazing how quickly that sense of fragility goes away (though we still both had a "oh gently caress.....wait....it's still running.....wow...." moment).

I gave up on all the static precautions and poo poo decades ago.
Now whenever a user questions me about it while I'm working with RAM or their SSD, I make sure to rub my fingers along the contacts a few times. And threaten to lick it. I have to assert dominance.

# ? Mar 18, 2020 20:38

RFC2324: Jun 7, 2012; http 418

Darchangel posted:

I gave up on all the static precautions and poo poo decades ago.
Now whenever a user questions me about it while I'm working with RAM or their SSD, I make sure to rub my fingers along the contacts a few times. And threaten to lick it. I have to assert dominance.

if you are touching a plugged in case, you are grounded and safe :colbert:

# ? Mar 18, 2020 22:16

wolrah: May 8, 2006; what?

Darchangel posted:

I gave up on all the static precautions and poo poo decades ago.
Now whenever a user questions me about it while I'm working with RAM or their SSD, I make sure to rub my fingers along the contacts a few times. And threaten to lick it. I have to assert dominance.

By the time I had a PC of my own I was over the extreme paranoia about static. I just touch the case and call it a day, no strap. At one point I had a TV that constantly generated static that I literally placed an old motherboard over and ran my hand around zapping all over the board. My little brother then used that motherboard as his PC for two years, with it just laying on his desk being started with a screwdriver.

RFC2324 posted:

if you are touching a plugged in case, you are grounded and safe

And even if it's not plugged in, the case defines the neutral voltage for all the electronics so even if you aren't entirely discharged you should be at least equally charged to the case and thus the electronics in it.

# ? Mar 18, 2020 23:26

F4rt5: May 20, 2006

Darchangel posted:

You're not supposed to like bugs, you're supposed to eradicate them.
Also, it's called a bug because the first one was a literal bug in a relay.

A common misconception. The incident you are thinking of was the first LITERAL bug found in a computer. The expression was in use before that.

Thomas Edison, 1878 posted:

It has been just so in all of my inventions. The first step is an intuition, and comes with a burst, then difficulties arise—this thing gives out and [it is] then that "Bugs"—as such little faults and difficulties are called—show themselves and months of intense watching, study and labor are requisite before commercial success or failure is certainly reached.

e: I guess because bugs are annoying, like the ants during a picnic trope? Seems logical.

F4rt5 fucked around with this message at 14:15 on Mar 19, 2020

# ? Mar 19, 2020 12:23

Darchangel: Feb 12, 2009; Tell him about the blower!

RFC2324 posted:

if you are touching a plugged in case, you are grounded and safe

Exactly.

F4rt5 posted:

A common misconception. The incident you are thinking of was the first LITERAL bug found in a computer. The expression was in use before that.

e: I guess because bugs are annoying, like the ants during a picnic trope? Seems logical.

Huh. I read that it was a literal bug in a relay in, I believe it was, UNIVAC that gave them the name.

# ? Mar 19, 2020 20:49

Proteus Jones: Feb 28, 2013

Darchangel posted:

Huh. I read that it was a literal bug in a relay in, I believe it was, UNIVAC that gave them the name.

https://www.bbvaopenmind.com/en/technology/innovation/when-computer-bugs-where-real-insects/

quote:

The story is so popular that, like any story often told, it has become distorted over the years. Contrary to the version circulating today, that episode was not the one that coined the term �bug� for computer errors, nor the verb �debugging� for their correction. The truth is that, well before this incident, these words were often used to refer to the malfunctions of machines, as evidenced by the notes of the inventor Thomas Edison in the 1870s. In fact, sources from the Institute of Electrical and Electronics Engineers (IEEE) have attributed the coining of these terms to Edison himself, and in the era of the Mark II, the computer engineers at Harvard used them regularly.

# ? Mar 19, 2020 21:25

Powered Descent: Jul 13, 2008; We haven't had that spirit here since 1969.

F4rt5 posted:

A common misconception. The incident you are thinking of was the first LITERAL bug found in a computer. The expression was in use before that.

e: I guess because bugs are annoying, like the ants during a picnic trope? Seems logical.

Huh. I guess I've learned something today. Neat.

# ? Mar 19, 2020 21:45

King Keltair: Jul 16, 2001

CLAM DOWN posted:

Do not buy or use third party AV products. Please. Thank you.

I've been using ESET NOD 32 since forever ago - both for antivirus and firewall. Is the microsoft windows defender now the way to go? Finally getting ready to build a new computer and trying to play catch up.

# ? Mar 25, 2020 14:04

Cup Runneth Over: Aug 8, 2009; She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate

King Keltair posted:

I've been using ESET NOD 32 since forever ago - both for antivirus and firewall. Is the microsoft windows defender now the way to go? Finally getting ready to build a new computer and trying to play catch up.

Yes, use Windows Defender.

# ? Mar 25, 2020 14:14

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

King Keltair posted:

I've been using ESET NOD 32 since forever ago - both for antivirus and firewall. Is the microsoft windows defender now the way to go? Finally getting ready to build a new computer and trying to play catch up.

Defender is kicking rear end.

# ? Mar 25, 2020 14:50

King Keltair: Jul 16, 2001

Thanks guys!

# ? Mar 26, 2020 05:57

Diva Cupcake: Aug 15, 2005

Those of you who manage BitLocker within an organization, do you also prevent access to manage-bde? Curious about compensating controls.

# ? Mar 26, 2020 19:16

The Fool: Oct 16, 2003

Doesn't doing anything with manage-bde require elevation?

# ? Mar 26, 2020 19:19

Billa: Jul 12, 2005; The Emperor protects.

Diva Cupcake posted:

Those of you who manage BitLocker within an organization, do you also prevent access to manage-bde? Curious about compensating controls.

whats bde? I've never heard of it.

# ? Mar 26, 2020 20:01

Cup Runneth Over: Aug 8, 2009; She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate

bdez nutz

# ? Mar 26, 2020 20:03

The Fool: Oct 16, 2003

Billa posted:

whats bde? I've never heard of it.

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde

# ? Mar 26, 2020 20:06

Diva Cupcake: Aug 15, 2005

The Fool posted:

Doesn't doing anything with manage-bde require elevation?

Probably. We also do Splunk-based alerting of encrypted devices so if someone gets out of line we should at least know.

Only 3 more years until the Intune rollout and we can get rid of MBAM.

# ? Mar 26, 2020 20:19

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Diva Cupcake posted:

Those of you who manage BitLocker within an organization, do you also prevent access to manage-bde? Curious about compensating controls.

One of the old tricks is deter people is to modified the default acls to the executable so the standard admins/users groups can't execute and you need to be in a domain admins group or similar.

# ? Mar 26, 2020 21:39

droll: Jan 9, 2020; by Azathoth

Has anyone got a link to a good, consolidated technical deep dive on the current Zoom vulnerabilities? The UNC path one sounds interesting.

# ? Apr 2, 2020 17:30

Potato Salad: Oct 23, 2014; nobody cares

Zoom: oh hey you got a link for meeting

Link: \\420.69.13.13\C$

Your system: *attempts to log in*

# ? Apr 2, 2020 17:52

droll: Jan 9, 2020; by Azathoth

So if they're WFH on an enterprise Win 10 machine, the attacker that owns/listens on 420.69.13.13 now has your password? This attack would work if someone clicked the link on a website though, not just from a Zoom chat?

# ? Apr 2, 2020 18:05