Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Shaggar posted:

the government should not be allowed near computers
or at least the cops who self-select for below-average intelligence

Adbot
ADBOT LOVES YOU

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Midjack posted:

the usb interface appears similar to the ones i've pulled up so I guess it's an industry standard

he said he'd used that atm before so either he got skimmed already or there was a real shield at first. not sure there's a new skimmer at the end of the story though, likely the skimmer replaced a legit shield and the bank put a new shield back on
I never understood this from an aesthetic perspective; you could easily make atms that are just flat plexiglass with a slot that fits a CC exactly. Why don't they design the atms to both look futuristic and remove the ability to attach skimmers to it without people noticing? Instead they're going in the other direction, attaching increasingly large and ridiculous multi-colored shields which are indistinguishable from skimmers themselves

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Cocoa Crispies posted:

cost, durability, accessibility, repairability, etc
it smells to me more like bandaids rather than a concern incorporated into the base design, you can use the same materials, you just need to make everything flush

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

ErIog posted:

How is the user supposed to know the slot is supposed to be flush? There's lots of different ATM designs all around the world, and I bet there are cases where even a bank of multiple ATM's at a bank have slightly different form factors.
true, but I mean trying to integrate it into an overall design such that adding anything to it would look weird. It may not be possible but it might be something to try. Imagine trying to put a skimmer onto what amounts to an ipad with a slot; if it doesn't fit inside the slot people would notice it immediately

well, they would if we weren't already accustomed to weirdly shaped shields. which was my point

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Parallel Paraplegic posted:

I always yank at the card slot vigorously before any transaction
please sir, stop accosting our CC machine or we're going to have to ask to you leave target

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
I wonder if mrtg and other visualization tools still have imagemagik bundled deps

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
now i want a lima churro, they were the best

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
fishmech has been very near me according to one of those red dots :hfive:

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Captain Foo posted:

rape accusations at Tor :(
buh bye ioerror

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

BattleMaster posted:

lol looks like hijacking updates is the in thing right now
that's because everything you install these days checks in more often than a teenage daughter's dad with a boy over

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

spankmeister posted:

Use CentOS 7.
this. most supported, comes otb with selinux enabled and supported on all base rpms, fastest to get patches, just works.

the effort RH put into selinux configs for all rpms puts it far ahead of any other distro atm unless you really like janitoring OSes more than you have to

Bhodi fucked around with this message at 16:47 on Jun 9, 2016

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

jony ive aces posted:

oh goddammit

i've long complained itt both about the site lacking https, and about them still unironically using sourceforge (though apparently the latter may not be an issue any more as they're no longer owned by DICE? though when I first noticed it was, and DICE were using a https cert for the single purpose of redirecting to http, lol). and yet i'm still dumb enough to keep using it

but yeah, finding out that a literal security product is not only avoiding https but doing so for the purpose of serving "ads" (malware) is a pretty big deal
yet another reason to stick with 1.x keepass for life

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
vegas is fun when you get out of vegas. lots of hiking and rock climbing nearby at red rock, just be more active

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Tiny Bug Child posted:

so i asked our CTO if they'd send me to def con and for some reason i got a super enthusiastic yes so see you guys there
you should present

something like "incognito mode doesn't save you. we know exactly who you are, you sick filth"

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

thehustler posted:

if I have an old 1.x version of keepass am I affected by whatever that ad bullshit was about?
nope. 1.x has worked for years and will continue to work.

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug


without any chance of fraud? hmm.

https://twitter.com/WeldPond/status/743755637000024065

https://twitter.com/matthew_d_green/status/743756987695955970

uh oh

https://blog.ethereum.org/2016/06/17/critical-update-re-dao-vulnerability/

quote:

An attack has been found and exploited in the DAO, and the attacker is currently in the process of draining the ether contained in the DAO into a child DAO. The attack is a recursive calling vulnerability, where an attacker called the “split” function, and then calls the split function recursively inside of the split, thereby collecting ether many times over in a single transaction.

The leaked ether is in a child DAO at https://etherchain.org/account/0x304a554a310c7e546dfe434669c62820b7d83490; even if no action is taken, the attacker will not be able to withdraw any ether at least for another ~27 days (the creation window for the child DAO). This is an issue that affects the DAO specifically
the DAO is a giant slush fund account i think? i dunno but

ayyy lmao

Bhodi fucked around with this message at 14:03 on Jun 17, 2016

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Parallel Paraplegic posted:

think of how much time and money we could save if our drivers never buckled their seatbelts and we remove those pesky airbags!
fortunately, no one commenting is working on anything that could be life threatening and the greater world won't care when your "uber for ___" app shits itself when it's backend servers get cryptolockered

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
the most depressing thing about the symantec vulnerability besides leaving millions of servers open to an easily-exploitable worm is that their stock didn't even loving budge when the news broke

the fact they enabled viruses to millions of servers and destroyed confidence in their product didn't even budge their bottom line, ftge

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

geonetix posted:

How would you call somebody in an organisation that does code review and educates their colleagues?

Just poking around, but I'm having so much trouble coming up with a proper function name for such a person. "Idiot" does not suffice :(
dreamsmasher

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Parallel Paraplegic posted:

so what is all y'all's opinion on storing credentials in environment variables? i'm specifically dealing with Docker but the question applies to any linux service, really. it's always made me super uncomfortable because they seem like something that were never designed to hold secrets and obviously a lot of things just blindly dump them for various reasons (like that thing earlier in this thread, or phpinfo(), etc)

is there a better way to store and retrieve service credentials? assume i can't use kerberos for reasons.
environment variables are bad but it's the best of a sometimes necessary solution; there are no good universal credential stores like there are on windows. All stock solutions are compromised the same way, if you have access to that user, you have access to that user's process memory and storage; you can read files and obscure poo poo via 0400 perms but at the end of the day it's all the same security context and since the code is being read and probably stored you can sniff any decryption keys/salts as-needed, the best you can do is obscure and isolate with unique passwords, at least env variables aren't passed into process lists

dehumanize yourself, etc

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
if you want to use keepass 2 across non windows OS you have to go the mono route, 1 has native clients for osx and linux and android

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
afiak 2.x provides nothing that 1.x doesn't already do better, literally all i want is a password manager with autotype that works on all my devices and 2.x fails at that

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
trigger warning this poo poo, jesus christ

byte compiled perl dependency hell, it's the closest i ever came to literally walking out the door to work on a farm and raise goats

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

cheese-cube posted:

yeah this is 100% true except i'd call it more of a cancer than diabetes, especially if SAP is involved. it always starts off innocently with ERP plus maybe a couple other products which are stongholded by being integrated with HR and payroll. then 3 years later there are an additional 15 diff SAP products deployed all of which have their own independent environments with multiple app/web/DB servers multiplied by 4-8 environments (prototype, dev, qa0, qa1, qa2, uat, bau, prod) giving you a surface area of almost 300 VMs. oh and they are all interconnected with each other in some way so performing any kind of maintenance is next to impossible. oh yeah and they also bought two SAP cloud products so there's that boondoggle on top.
lol if u use monsoon, that thing is a half-assed aws ripoff with a quarter of the performance and features

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

cheese-cube posted:

oh no i was reffering to T&E which they acquired from concur and successfactors. SaaS stuff really but still dumbbbbb
I used to work on LMS & bizx, lmao

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
I've always had a grudge against MS for that. "It's not a security boundary" it only halts whatever you were doing and demands permission to make changes, that's nothing like a boundary, how silly that people could become confused since it's very similar to virtually every privilege escalation prompt ever

"it's for notification", well it doesn't give you information on what's going to be changed so that's worth a wet fart

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Smythe posted:

Oddly, the no message history is the more important criteria for me. Kind of like Hangouts "Off the record" mode. I guess that's better for me. My use case is I just would prefer some chats be ephemeral instead of logged forever
they're logged forever on hangouts, you just can't see them

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Volmarias posted:

Would love to see any sort of information on this, since
have a shitily written article and a slightly better one but the tl;dr is that google doesn't say they don't keep a record, they only say you can't see it. you can't confirm recipients aren't logging it themselves, the design and code is a black box and and there's no fingerprinting

all you can rely on is that it turns off local history with accounts that aren't actively being monitored / seopena'd, between parties who aren't actively trying to subvert it, and logs might or might not exist on google servers which may or may not be being slurped by state actors due to their "end-to-end" encryption ending at google's servers rather than the other person's phone

basically, there's a poo poo ton of uncertainty all over the place

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
regex matching is fine; capturing is where you've hosed up

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
there are two regexes that always give me a chuckle, the first is a html regex parser attempt, the second is email addresses

it's like trying to hammer in a nail with vice-grip pliers

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

flakeloaf posted:

vms that should be separated for security reasons ought not to have their resources combined for security reasons
look at this special snowflake who lives in a land made of money

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
the english proficiency is so stilted in the announcement that it feels deliberate

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Captain Foo posted:

snowden talkin on tweetz0r that the equation group hack is likely russians demonstrating CCNE in order to show that they can prove U.S. responsibility of any attacks sourcing from that server, which he speculates is now being made more public in order to halt escalation of attribution in the DNC hack
yea this is worth reading, here's the text

quote:

The hack of an NSA malware staging server is not unprecedented, but the publication of the take is. Here's what you need to know: (1/x)
1) NSA traces and targets malware C2 servers in a practice called Counter Computer Network Exploitation, or CCNE. So do our rivals.
2) NSA is often lurking undetected for years on the C2 and ORBs (proxy hops) of state hackers. This is how we follow their operations.
3) This is how we steal their rivals' hacking tools and reverse-engineer them to create "fingerprints" to help us detect them in the future.
4) Here's where it gets interesting: the NSA is not made of magic. Our rivals do the same thing to us -- and occasionally succeed.
5) Knowing this, NSA's hackers (TAO) are told not to leave their hack tools ("binaries") on the server after an op. But people get lazy.
6) What's new? NSA malware staging servers getting hacked by a rival is not new. A rival publicly demonstrating they have done so is.
7) Why did they do it? No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack.
8) Circumstantial evidence and conventional wisdom indicates Russian responsibility. Here's why that is significant:
9) This leak is likely a warning that someone can prove US responsibility for any attacks that originated from this malware server.
10) That could have significant foreign policy consequences. Particularly if any of those operations targeted US allies.
11) Particularly if any of those operations targeted elections.
12) Accordingly, this may be an effort to influence the calculus of decision-makers wondering how sharply to respond to the DNC hacks.
13) TL;DR: This leak looks like a somebody sending a message that an escalation in the attribution game could get messy fast.
Bonus: When I came forward, NSA would have migrated offensive operations to new servers as a precaution - it's cheap and easy. So? So...
The undetected hacker squatting on this NSA server lost access in June 2013. Rare public data point on the positive results of the leak.
You're welcome, @NSAGov. Lots of love.

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
NSA: ‘Can Somebody Good At Computers Help Us?’

quote:

FORT MEADE, MD—Explaining that things weren’t working right and he didn’t know why, visibly frustrated National Security Agency director Michael S. Rogers called a press conference Thursday afternoon to ask if somebody good at computers could help out the intelligence organization. “We must have done something wrong and now everything’s all screwed up—is there anybody who knows computers that can fix it for us?” said Rogers, adding that he doesn’t know whether he hit a wrong key at some point or if he got “the virus,” but would just like somebody to make the agency’s computers work like they did before all this. “I’m no good with this type of stuff, and all I want to do is check my emails. Can someone just come by my office and make the problem go away? I don’t think it should take too long.” Following the press event, Rogers reportedly returned to his desk to sit and patiently wait.

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

18 Character Limit posted:

So you're saying you're a pex editor.

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
Anyone else read the OPM report? It's dry but you should check out chapter 5

jeff (IT director and all around scumbag) is told he has malware by cylance, goes "poo poo this could be bad, let's get a second opinion and also make it a blind test and not tell them we know anything", then brings in cytech who goes "Uh so we found malware on what you said was a quarantined network but it kind of looks like a non-quarantined active production network and our CEO says to give you some free services because these are literally the systems his clearance information sit on" then jeff decided to try and cover it up, misled a select committee about cytech's role in discovery and instructed staff to wipe all the cytech servers that had logs and forensic images and ship them back even while an investigation was in progress spawned from the NYT leak story and the committee hearing

Bhodi fucked around with this message at 17:37 on Sep 7, 2016

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

Midjack posted:

federal it, checks out
yep, 100℅ shitshow and of course jeff is still there and in fact got promoted twice since the start of it

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

YO MAMA HEAD posted:

did you use a "care of" symbol instead of a percent sign? how does that even happen
phone postin', blame the android and my terrible eyesight

didn't even notice until you pointed it out, lmao

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

ultramiraculous posted:

i'm still not sure how this answers the "how did this happen?" question
well you see i hit one button instead of the other button

Adbot
ADBOT LOVES YOU

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug
I'd like that for work emails, thanks to linked in i now get massive spam at whatever my current work is due to them correctly guessing a standard first.last@company.com format. I suspect they've automated it on the backhand for sales assholes and i don't see any way of opting out

  • Locked thread