Carl

I’ve joked about finding unopposed spots and running against them. Not because I want to win, but just because I want to force them to actually work for their spot.

It’s probably not the tech making the decision. It was probably the tech attempting to request one, (because they were out of/low on stock,) and being told by management to send it back as-is instead.

“Replacing that stick of RAM will cost more than the entire original purchase price of the laptop, so just say it’s faulty and let them figure it out. Never mind the fact that we sold them a laptop with faulty RAM.”

They make sprung flip-top covers specifically for this reason. It’s just a little adhesive square/circle that you stick over the power/reset button, and it has a flip-top that automatically springs closed again.

I mean, would you want it to serve clients outside of your subnet? I guess maybe if you had something like a guest network. But I tend to take the “fuck it, you get basic service and nothing else” approach to things like guest networks.

Isn’t it a potential security issue to have your pihole serve things on any subnet, because it allows an improperly configured firewall to stab at your pihole? I think you can specify any additional subnets it will serve in the settings somewhere. But IIRC, the default behavior is to intentionally drop traffic from unknown subnets. But that’s just off the top of my head.

The dude committed suicide two days after the cops raided him. So at most, it would be his estate suing people for libel/slander. But you usually need to prove damages (like losing your job, or being forced to move) to win a slander lawsuit, and it’s hard to claim that a dead guy was monetarily damaged by someone saying things about him.

Pretty much this. I’d copy anything I want to keep onto a temporary drive, (cloud storage, a USB drive, second SSD, etc), then use it as an excuse to refresh my install. Then just copy everything from that temporary storage after my new install is finished.

Nothing is mediocre about it. All of the “best” browsers are based on FF’s Gecko engine. Maybe they have complaints about Mozilla or the weird stuff they’ve been doing with FF recently. But the actual Gecko engine is solid, and it’s what all the best browsers are based on.

Exactly. There is zero way for those glasses to remain HIPAA-compliant, because everything you do is uploaded to Meta’s servers.

I’m somewhere in the middle, because comments like yours actually reinforce my concerns. A reverse proxy isn’t really doing anything to make you more secure, unless you’re using it for some sort of access control. It hides which ports you’re using, and allows you to encrypt your traffic with TLS… But it doesn’t add any additional security to the services you are exposing.

Maybe if you use it for access control, to add a secondary username/password to the services. But that breaks most legitimate things (apps, mostly) that try to reach the double-password-protected service. Because a user on a web browser may be able to type in two passwords, (one for the reverse proxy, and then one for the service itself) but an app will try to pass that info automatically using headers.

Any vulnerabilities in the services will still become potential attack vectors. Anyone who remembers the Huntarr debacle will know exactly what I’m talking about, because a single service being vulnerable can do a lot of damage. Yes, containerization does a lot to help mitigate damage by excluding access to everything except what you give it. But it won’t completely stop things from going wrong.

You should read the article. Linus simply said that LLMs have been useful for finding more bugs, which has led to larger patches (because each patch contains more fixes). They aren’t vibe coding the kernel.

Hey now, it isn’t only Nazis…
^{It’s also an overwhelmingly vast amount of CSAM…}

No, the cold wallets were using a predictable algorithm to generate key phrases. When you set up the wallet, you use the generated key phrase to pair it with your coins. So this wallet is supposed to live offline, keeping your coins safe because the key is kept offline. No way to hack it if it’s entirely offline. But a flaw caused the generated keys to be predictable, meaning hackers were able to brute force the keys and initiate coin transfers without even messing with the cold wallet.

Imagine you lock a million dollars behind a super secure vault door. This vault is impervious to all kinds of physical and digital attacks. The only way to open it is with the key. The vault is in a public area, but (again) there is no way to open it without the key. This vault only has one key, which you keep safely stored in a separate secure facility. Additionally, this key has like a thousand pins and tumblers, so it should be nearly impossible for a hacker to guess the correct key. The hackers essentially realized that due to a flaw in the lock’s design, there were only like three dozen potential key combinations. The thousand pins didn’t actually matter, because they were predictably arranged at the factory that built the lock. So the thieves just made like two dozen fake keys (until they got the correct one,) then took the money. All without touching (or even seeing) your key.

The issue is doing one at scale, with proper access controls. Also, let’s not skip past the whole “network isn’t air gapped anymore” side of things. Now you’re having to maintain firewalls, patch firmwares, manage users, enforce good password hygiene, etc… All without any additional IT support or hardware, because management is doing this as a cost cutting measure.

I can pretty much guarantee that the systems that get hacked aren’t the ones that do everything right. They’re the ones who have a single shared VPN password, haven’t updated their firewall since it was installed 8 years ago, and they haven’t even changed the default passwords for their control systems. Because they got tired of answering phone calls about what the password was, so they just made every username and password something stupid like admin/admin.

Literally this. It starts with “everything needs to be on an air gapped LAN so we can control it.” And then suddenly that air gapped LAN isn’t air gapped, because someone got tired of paying the call-out fee every time the on-call person had to drive to the site to push a few buttons on a keyboard. But figuring out a proper VPN (or at least a reverse proxy with access control) was too difficult or expensive, (management thinks the point is to save money on call out fees, not spend money on proper hardware) so they just poked a bunch of port-forwarded holes in the firewall and called it a day.