Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›2 »

vOv: Feb 8, 2014

Lain Iwakura posted:

these forums are the least of my problems for name changes

are you implying what i think you're implying here b/c if so then good luck with everything and godspeed

(feel free to be brief or whatever if you don't want to clog up the thread)

# ¿ Jun 26, 2017 21:39

Adbot: ADBOT LOVES YOU

# ¿ May 2, 2024 01:10

vOv: Feb 8, 2014

cinci zoo sniper posted:

im not sure what effect that does but ive seen some of my coworkers smoking next to the intake of building-wide air ventillation system

it doesn't do anything per se but usually smelling almonds in a chemical plant means 'cyanide spill'

# ¿ Jun 30, 2017 23:11

vOv: Feb 8, 2014

systemd continues to be a garbage fire

# ¿ Jul 3, 2017 00:04

vOv: Feb 8, 2014

Lain Iwakura posted:

you used a public computer to connect to work resources?

# ¿ Jul 10, 2017 06:13

vOv: Feb 8, 2014

Computer Serf posted:

fresh hack on the cyberpogs

about $80m transferred out and some project got cleaned out entirely of their 44,000 digital trading pog bytes.

https://press.swarm.city/parity-multisig-wallet-exploit-hits-swarm-city-funds-statement-by-the-swarm-city-core-team-d1f3929b4e4e

https://twitter.com/bcrypt/status/887790274876891136

i don't really know much about ethereum but i think this is what happened:

ethereum is all about 'smart contracts' and code that executes on the blockchain, so the multisig wallets were implemented using contracts. they had an initializer method that would set up the owners and stuff, but they forgot to specify the visibility, and it defaults to public (lmao) so someone could just reinitialize it with themselves as the owner

# ¿ Jul 20, 2017 02:37

vOv: Feb 8, 2014

maskenfreiheit posted:

seriously how does a magnet lose its magnetness

any piece of iron will have a bunch of 'magnetic domains' (3d chunks where the magnetic field lines up) in it, it's just that generally they all point in random directions. in a magnet they point in the same direction. i guess that over time they slip out of alignment, and heat speeds up the process.

vOv fucked around with this message at 06:14 on Jul 24, 2017

# ¿ Jul 24, 2017 06:10

vOv: Feb 8, 2014

rjmccall posted:

they're saying you can't check them, not that you can't carry them on

yeah that's the weird thing. if it's checked they can just open up your bag so what's the problem

maybe it's supposed to be carryon but it got miscommunicated somehow

vOv fucked around with this message at 20:30 on Jul 24, 2017

# ¿ Jul 24, 2017 20:28

vOv: Feb 8, 2014

https://twitter.com/dalmoz_/status/889530871870390272

# ¿ Jul 25, 2017 03:54

vOv: Feb 8, 2014

iirc civilian GPS devices also have altitude/speed lockouts so you can't use em to build missiles

# ¿ Jul 26, 2017 06:41

vOv: Feb 8, 2014

Cocoa Crispies posted:

the factorio devs seem uncommonly professional, like they have a proper CI setup and everything

yeah their dev blog makes them seem like some of the most competent game devs ever, especially consider that it started off like a $20k kickstarter

# ¿ Jul 26, 2017 22:43

vOv: Feb 8, 2014

pseudorandom name posted:

https://github.com/xoreaxeaxeax/sandsifter

this is a super hackercore interface

# ¿ Jul 28, 2017 19:55

vOv: Feb 8, 2014

mdl posted:

tl;dr: mozilla wants to readd the Totally Not Eddy Nigg/Mossad SSL vendor to the trust rolls

https://bugzilla.mozilla.org/show_bug.cgi?id=1311832#c16

https://news.ycombinator.com/item?id=15055707 if the circlejerk ever shows it instead of a blank page, lol.

is that mozilla that wants to add it or is it some random gently caress

# ¿ Aug 19, 2017 22:58

vOv: Feb 8, 2014

maskenfreiheit posted:

it's my understanding you're not responsible for fraud, you should file a police report and threaten to contact CFPB.

that's almost definitely the case but given what i know about banks i can't imagine getting the money back will be an easy or painless process

# ¿ Aug 21, 2017 00:56

vOv: Feb 8, 2014

maskenfreiheit posted:

so i guess gchq is an apple shop

# ¿ Aug 25, 2017 19:51

vOv: Feb 8, 2014

FAT32 SHAMER posted:

it's speculated that he died of cyanide inhalation from his little gold plating thingo even tho the Apple was nearby but I would be willing to bet he huffed them on purpose

even if his death was 100% accidental the castration was still monstrous

# ¿ Aug 26, 2017 01:24

vOv: Feb 8, 2014

iirc you can't just wait 5 seconds, you have to wait a certain amount of time so that the information can propagate, but i don't know details

that being said i have no clue if this applies to a vuln you discover, or what the rules are if you get the information illegally

# ¿ Aug 31, 2017 03:47

vOv: Feb 8, 2014

i seem to remember hearing about some company or government agency requiring that even ethernet cables be destroyed

# ¿ Sep 1, 2017 06:39

vOv: Feb 8, 2014

wolrah posted:

How does the random person know who I am in the first place to look up my Facebook photo (assuming this is one of the rare times my Facebook photo is actually of me)?

I don't use the face unlock because it was never reliable when I tried it in the past and my current phone's front cam is totally hosed anyways, but I have no reason to expect that someone who knows who I am would be trying to break in to my phone. If it had worked well I'd probably use it.

If I were a public figure of any sort that'd obviously be an entirely different matter, but that was basically my point. Different people have different threats.

apple has a 'medical id' thing where you can put your name, and some people will include an e-mail address or something so someone who finds the phone can get in touch with them

# ¿ Sep 5, 2017 19:54

vOv: Feb 8, 2014

Zero One posted:

in ios11 you can turn fingerprints off for unlocking the phone but keep it for Apple pay or app store. so you can save your prints and re-enable the unlock whenever.

this isn't new in ios 11, it's what i have set up on my phone

# ¿ Sep 6, 2017 06:26

vOv: Feb 8, 2014

Babies Getting Rabies posted:

did we already talk about how comodo ignores caa and just issues certificates despite caa records for those domains not authorizing them to do so?

quote:

Yesterday morning (Monday 11th), when investigating the Problem Reports, the original developer discovered that as a result of that BIND upgrade all of our calls to `dig` were returning the following response:

`Invalid option: +sigchase
Usage: dig [@global-server] [domain] [q-type] [q-class] {q-opt}
{global-d-opt} host [@local-server] {local-d-opt}
[ host [@local-server] {local-d-opt} [...]]

Use "dig -h" (or "dig -h | more") for complete list of options`

Unfortunately, this `dig` response was being interpreted by our CAA checking code as a CAA response that contained: no "issue" property, no "issuewild" property, no unrecognized critical properties, etc.

# ¿ Sep 14, 2017 04:07

vOv: Feb 8, 2014

fishmech posted:

i'm just baffled by the whole decision as it's designed to like work when you're quite a few feet away by design. and probably can't handle something like "the user looks angry so we know we shouldn't unlock"

it's almost like it's designed so a hostile actor has plenty of ability to get you to unlock the phone unwillingly

supposedly it doesn't work if your eyes are closed

# ¿ Sep 15, 2017 23:21

vOv: Feb 8, 2014

flakeloaf posted:

some exploits from the lab work perfectly well in vevo

lmao

# ¿ Sep 19, 2017 07:11

vOv: Feb 8, 2014

flakeloaf posted:

oxaloacetate and acetyl coa

had to look this one up, glad i did

# ¿ Sep 22, 2017 05:02

vOv: Feb 8, 2014

https://twitter.com/malpedia/status/915261404919287809

# ¿ Oct 5, 2017 16:17

vOv: Feb 8, 2014

https://twitter.com/genderpickle/status/917065098904178691

# ¿ Oct 9, 2017 08:43

vOv: Feb 8, 2014

hobbesmaster posted:

that has to be a bizarre localization problem

somehow U+FE0F, which is variation selector 16, is getting appended for some reason

# ¿ Nov 5, 2017 01:31

vOv: Feb 8, 2014

maskenfreiheit posted:

# ¿ Nov 11, 2017 22:00

vOv: Feb 8, 2014

mrmcd posted:

Wait.

Is this basically showing they only bother redirecting to HTTPS if you're using a version of Chrome > 59?

code:

regulator@divine-apex ~> curl -D - [url]http://www.bing.com[/url] -s -o /dev/null
HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Content-Length: 128274
... more stuff

regulator@divine-apex ~> curl -D - [url]http://www.bing.com[/url] -s -o /dev/null -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3163.100 Safari/537.36"
HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Content-Length: 128640
... more stuff

regulator@divine-apex ~> curl -D - [url]http://www.bing.com[/url] -s -o /dev/null -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"
HTTP/1.1 302 Found
Content-Length: 195
Location: [url]https://www.bing.com:443/?toHttps=1&redig=95B1968FAE1A46E2B9BA66DA02B3B1ED[/url]

vOv fucked around with this message at 01:29 on Nov 12, 2017

# ¿ Nov 12, 2017 01:26

vOv: Feb 8, 2014

MrMoo posted:

So what changed? They should have started with v51 when HTTP/2 appeared.

originally i figured it was the 'not secure' warning but that started in 62 so i don't know

# ¿ Nov 12, 2017 02:01

vOv: Feb 8, 2014

distributed denial of service

# ¿ Nov 22, 2017 21:04

vOv: Feb 8, 2014

Hed posted:

Black Friday is a great time to stock up on parachute account names

DickleLick

# ¿ Nov 24, 2017 19:23

vOv: Feb 8, 2014

anthonypants posted:

the workaround for this is to not become aware of data leaks

it's like how at work they tell us to never ever ever look at patents because it's triple damages if the infringement is 'willful'

if we do need patent information we have the lawyers do that for us

# ¿ Nov 25, 2017 20:07

vOv: Feb 8, 2014

Avenging_Mikon posted:

It just seems like the fact recording happened should be more important than what was recorded. If I went and downloaded this on Friday and had a quiet weekend alone, then Monday morning find out it�s recorded me I�m less deserving of legal protection?

iirc some data breach related lawsuits have been thrown out because even though the plaintiff could easily show their information was exposed, they failed to show that they were harmed by it

e: yeah, here's an article, and here's one where scotus said that civil rights groups couldn't sue over a warrantless wiretapping act because they couldn't show any concrete harm

vOv fucked around with this message at 06:09 on Nov 28, 2017

# ¿ Nov 28, 2017 06:07

vOv: Feb 8, 2014

Wiggly Wayne DDS posted:

just another day in the uk partliament:

https://twitter.com/NadineDorries/status/937019367572803590

at least they're just using delegated access with audit trails:

https://twitter.com/NadineDorries/status/937034384976302080

oh:

https://twitter.com/NadineDorries/status/937043585454796801

the ratio on that first tweet lmao

# ¿ Dec 3, 2017 22:25

vOv: Feb 8, 2014

Meat Beat Agent posted:

ag | peanuts

idgi

# ¿ Dec 9, 2017 02:20

vOv: Feb 8, 2014

anthonypants posted:

here is a hint

# ¿ Dec 9, 2017 02:29

vOv: Feb 8, 2014

minato posted:

Firefox has a built-in similar (& simpler) feature called Quick Search where the user can bookmark a URL template + keyword, and entering the keyword + an arbitrary string will expand the template. e.g. "wiki Hackers movie" expands to "https://en.wikipedia.org/w/index.php?search=Hackers%20%movie".

i work for google and i do this with our internal codesearch tool, so like 'cs whatever' will do a codesearch for me. no extension needed, i just add it as a search engine in chrome.

occasionally i gently caress it up and accidentally wind up doing a google search for some highly internal tool, which makes me panic until i remember who i work for :v:

i would like to think that the people that work on search are above manually looking at search results from other companies' IPs (and that our internal tools would catch them)

vOv fucked around with this message at 07:47 on Dec 20, 2017

# ¿ Dec 20, 2017 07:40

vOv: Feb 8, 2014

spankmeister posted:

A DNS query does not contain the URN

i think they meant like http://cs/stuff+goes+here and then that resolves to http://cs.some.internal.domain.thing/stuff+goes+here, which the server interprets as a query

which works but is more fiddly to deal with and puts a constraint on how your server interprets URLs, unless you want to run a server just to forward it to the 'real' codesearch server

we do use that kind of DNS thing for other stuff tho

# ¿ Dec 20, 2017 08:02

vOv: Feb 8, 2014

Cocoa Crispies posted:

there's no generally cross-browser-compatible way

what they should probably be doing is anything other than crypto in js

it's a good thing that's not js then

# ¿ Dec 21, 2017 22:53

Adbot: ADBOT LOVES YOU

# ¿ May 2, 2024 01:10

vOv: Feb 8, 2014

mrmcd posted:

I don't understand what the scam here is, and why that thread is full of furrys.

i assume the full e-mail has a link to paypal.com.totallynotascam.com or something, but it is possible paypal hosed it up

# ¿ Dec 22, 2017 01:23

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›2 »