& the expectation, in many, of powerpointy interfaces. Structure? Markup? Longevity? → Academic meh.
(No news in that, for 25 years. Why do I still try to care…)
Meeting in academialand yesterday, discussing archiving/upgrading some old stuff, suggesting static site generation. Some PHPerson invited too (not sure if for previous work for the natives or as an interpreter for anything I would be saying). The look from the PHPperson when I replied "no" when he asked if we haven't been using Drupal/Joomla/Wordpress.
A "this guy isn't normal" look.
[prev meeting, someone else pointing out the LAMP nature of the native web culture]
Instagram: My life is a party.
Snapchat: My life is a quirky TV show.
Facebook: My life turned out great!
Twitter: We're all going to die.
Mastodon: Don't worry, while we are on a quirky, meandering path towards an inevitable apocalypse, we might as well enjoy the ride and show eachother some love in an unorthodox, yet irresistible manner, not in any way hindered by considerations of style, identity or consistency.
I just went around and did some basic nmap-ing on the most popular Mastodon instances, and there's some seriously sketchy stuff in there. Publicly reachable Postgres servers, tons of open internal HTTP ports, SSH with password login, multiple Mastodon instances that seem to be running on mail server VMs, …
I guess if you're just running a single-user instance for yourself, sure, but those are all 2000+ user instances.
You can, however, make programmers work 60-80 h/week, during short time intervals of a few hours (or even a few days).
If you succeed in making some of them work 168 h/week for a full day, occasionally challenge them into achieving a bit more. A few may succeed in working a full day at more than 336 h/week, and you will then have a dream team literally able to get things done yesterday — le Saint Graal of programmer management.
Okay, now that a few friends-of have been notified, please help boost so folks who weren't able to get on maly.io and other free speech Masto instances before they hit capacity know that the awesome https://freehold.earth is now open. :D
@donb cool, please share with me earlier if you can.
Other off the top of the head tricks (some need a different sig):
Password: quarantine pw files that aren't encrypted
username: utmp/wtmp
syslog to local/remote: zorch certain logs based on log level etc.
Browser strings: logs
DNS additional records: local lookup caches
SMTP X-headers: mail files/spools
Anything across the net to bork IDSes running AV.
This is a gift that keeps on giving!
Other ideas?
Have fun planting virus signatures in strange places that touch remote disks somehow/somewhere.
Example:
Change your mail sig to:
X5O!P%@ap[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Or send it in a browser var, as a password (quickly find the sites that don't encrypt passwords), send to open syslogs, etc.
The some AV actually delete/quarantine the file (weblogs, mailspool, {u,w}tmp etc.)!
What are your ideas?
Inspired by: https://www.sec.cs.tu-bs.de/pubs/2017-asiaccs.pdf
Brilliant <thing on other network we don't talk about> by @Mudge:
https://twitter.com/dotmudge/status/850385568148140033
"This is a brilliant tactic. There are so many others like this because the AV community keeps thinking this is a one-move game... Kudos!"
That definition of the strategy of the AV community is absolutely perfect. Depth: zero.
> People often don't realize how important it was to OSS that it was preceded by decades of easy access to programming tools and resources meant for absolute beginners.
> OSS needs FPGAs, and FPGAs need what programming had back in the 1980s: an on-ramp.
Man this looks really cool. Am excite. https://www.blinklight.io/blog/2017-03-31/
If you own a Tizen powered hardware (Samsung), consider removing it from the Internet and your network. It’s incredibly insecure: https://motherboard.vice.com/en_us/article/samsung-tizen-operating-system-bugs-vulnerabilities #security #infosec
https://arxiv.org/abs/1704.00792
George Kadianakis, Claudia V. Roberts, Laura M. Roberts, Philipp Winter,
"Anonymous Keys in Tor relays"
[...]Our experiments revealed that ten relays shared moduli, and 3,557 relays -- almost all part of a research project -- shared prime factors, allowing adversaries to reconstruct private keys. We further discovered 122 relays that used non-standard RSA exponents, presumably in an attempt to attack onion services.[...]
@maiyannah I immediately left mastodon.social when I became aware of their censorship/defederation practice.
However, their ability to do so protects the network and protocol from pressure to silence users/groups for the protection of those who desperately want to live in that kind of bubble. We got Twitter/FB censorship because these people had to globally censor in order to have an environment they felt safe in.
Freedom to associate works both ways.
free speech fundamentalist・crypto absolutist・privacy reactionary・prestige blasphemer・Indirection director・branching brancher・transparency troll・exiled within