Captain Foo posted:

0day poastin'

quote:

The story noted that vDOS earned its proprietors more than $600,000 and was being run by two 18-year-old Israeli men who went by the hacker aliases “applej4ck” and “p1st0”. Hours after that piece ran, Israeli authorities arrested both men, and vDOS — which had been in operation for four years — was shuttered for good.

spankmeister posted:

We already have "cyber reservists" here.

Cocoa Crispies posted:

that's insipid

NSA already installs stuff at telecom facilities

and the reason to use residental/small business internet connections for attacks is to make attribution difficult, hard to do when parties are going right out and saying "install this poo poo that lets us run attacks from your connection"

hackbunny posted:

[*]IsBuildOlderThan20150211: false. what a weird check! it compares two static dates: the build timestamp encoded in the version number, and february 11th, 2015 (the next day). always evaluates to false, regardless of when, where and how the code is executed. very confusing

infernal machines posted:

the point is that previous ruling was the only reason patriated data centers mattered. if you have a legal requirement to store data domestically, you had the option of using local data centers even if they were being managed by an american company, because at least legally speaking the us couldn't just subpoena all your data across national boundaries.

ms specifically built a bunch of canadian DCs so that they could bid on a shared services contract for the federal government. whoops, that's out the window now.

geonetix posted:

Best advice? Got big German clients? Make sure you're doing what you've said you were doing ;-).

power botton posted:

the weakest part of AD is all the servers and desktops storing kerberos tickets and hashes in memory to get retrieved with mimikatz et al, but MS keeps adding new features to minimize that. the chance of your average Fortune 500/1000 enabling them is nonexistent but hey.

the adsecurity.org guy cares way too much about AD security and has easy to read and well cited articles if you want to read more.

Shaggar posted:

theres no reason to wait until it compiles to commit if you have a reason to commit. the CI system will only spit out compiled artifacts so it doesn't matter if a build breaks cause you should be using the last successfully built artifact instead of the source for the artifact.

Shaggar posted:

if a dev is running their own feature branch who cares if they break the build? they're the only ones working in it.

Shaggar posted:

iu guess I don't really see the problem w/ broken builds getting into the CI system since either
A) The non-compiling code is critical for moving forward in which case it has to be fixed and building the code before it was checked in is pointless
B) The non-compiling code is not critical for moving forward in which case we use the last compiled build

idk maybe none of my projects are hugely monolithic like that.

Shaggar posted:

If your builds are so large that minor changes in one branch break productivity for everyone your design is probably pretty heinous. also its infinitely more likely that the junior dev will horde his code because the CI keeps rejecting him and then he puts in a slew of changes that have hardcoded garbage to pass tests but that breaks everything in runtime. now you've been building your own stuff against his broken code for weeks cause you've trusted the CI server to gate things for you.

Shaggar posted:

sure but one real great way to trigger an out of band code review is a check in that doesn't build. lots of jr devs aren't gonna ask for help cause they're just out of college and they dont understand that they didn't learn anything there. now you're creating a build environment that's hostile to them and they're gonna fall back on the bad habits their profs taught them. A jr dev dodging tests in order to get code to compile is to be expected of a jr dev because they don't understand why tests are important yet.

I like failing builds as a mechanism to detect struggling devs who aren't asking for help. Also I want code in the repo even if its not finished. The last thing I want is code sitting on a laptop that hasn't been checked in in days because its not "perfect".

Truga posted:

the s in iot stands for security

apseudonym posted:

Judging by the Android section this is pretty old stuff

ate all the Oreos posted:

the real trick is to only do it to moderate to poor people, obvs

anthonypants posted:

"his wife" immediately jumped on twitter after the gif was sent to tell the person who sent the gif that he was having a seizure

here's an article with more background on this guy

OSI bean dip posted:

oh boy i cannot wait for the recommendations for a vpn service coming down the pipe

Progressive JPEG posted:

I'll be the city limits reaching out to all the reservoirs:

anthonypants posted:

today, huh

cheese-cube posted:

i do all my hacking from the most weird domains, ones that would be extremely awkward for a prosecutor to read out

Wiggly Wayne DDS posted:

i am shocked, truly, that the developers aren't completely in a vacuum from researchers

e: it is very telling that even in a worm of this magnitude the most effective research is being done in public and unpaid

Phone posted:

BangersInMyKnickers posted:

They claim it was an "unprecedented database corruption event" but how the hell it sat for so long and why they weren't able to restore within a day of the failure is a mystery to me