Is DefCon gonna be free for all on Discord?

I think i have made an enemy on this site

someone went on a downvote spree twice

the system reversed it

Now he is downvoting slowly.

In the span of few days,so as to not get reversed

Lol

I have a website with a CSRF token in the meta tags like <meta name="csrf_token" content="some_token" />. Zaproxy is giving it "No Anti-CSRF token" flags though. Is this likely a false positive or is it not good to put the token in the HTML content instead of a cookie or header?

@JohnZhau Putting it in HTML is perfectly fine, although I've never put it in a meta tag. Usually it goes in a hidden input in the form.

How does it get back up to the server from the meta tag?

@VipulNair That level of anger is such a waste of time.;. Not that you seem upset, but you can rest easy that "the other guy" is probably a miserable person in general :)

@JohnZhau csrf token in html is fine.But its usually like conor mentions in a hidden field thats gets submitted with post request

Ugh...my head

can I ask for some moral guidance?

I sent my ex the gaming PC that I built for her, and now she called me up and said when she tries to turn it on, nothing happens

I really don't want to help her with it, though

For 5 years, I always fixed her shit whenever she had a problem

I'm tired of it, and I feel she will just keep asking for favours

Does that make me an asshole?

I mean, I even told her to just go on Super User, describe her problem and just listen to comments when they ask something of her

It definitely doesn't make you an asshole. Debugging someone else's computer is a gigantic pain, especially when the person on the other end is not a tech person. If it boils down to hardware issues she won't be able to do it anyway, no matter how much you are willing to help.

I doubt it is

The PC was working fine when I sent it to her

And I packed it up in foam and everything

That's good. Hardware is just where I first go when I hear "turn it on and nothing happens". Maybe she forgot to plug it in :)

All she had to do was connect the PC to power, the monitor to the PC and the monitor to the power. Then add mouse and keyboard and that's it

Yeah but honestly, I don't want to be responsible for this PC anymore

Given the circumstances I think that either of those choices is perfectly fine

You guys broke up and finally (physically) separated. It's perfectly fine if you would like to continue in that direction and make this a clean break.

If that's what you wanted to do then I would explain it very simply and straight-forward. "I'm sorry, but I can't be your technical support. I hope you get it working, but I can't help you with this."

I told her she should help one of her 200 friends from Discord

If she argues maybe respond the same, but at some point in time it may be necessary to just start ignoring her

I mean, there is bound to be at least one person there who built a PC

And I told her in no uncertain terms that this is her PC, and her task is to learn how to maintain it

I mean, do they have computer repair shops in her area? (although I recognize that money may be a problem)

From my perspective, she has the following options:

Or just sell the PC and that's it

If she wants a gaming PC least she can do is learn how to debug issues on it,she can't call you all the time when something breaks up

Yeah, I think the same way

I believe "learn how to fix it" is not possible in a short time frame. ask or pay someone are the better options, as selling it would probably make her have less money than the computer is worth...

How do I evaluate the risk of giving people administrator access?

I've got a few users who work almost entirely at customer's sites. They often have to install different versions of software to work with old devices. Also have to manually set their laptop IP addresses. It's gotten very annoying for them to not have administrator access.

I kind of wonder if I'm morphing into Mordac the Preventer of Information Services

Admin access to what? Their own machines or servers at a customer site?

Own machines

I've never not been an admin on my own machine. What "risks" are you mitigating by not making them admins?

(I ask that as a serious question - not to suggest that you don't have a reason)

That's probably a better question than what I was asking in the first place...

Supposedly, if I had monitoring software to watch their internet activity and make sure they weren't doing certain illegal things with company resources, they could disable that monitoring software. But I don't have that in the first place.

It keeps them from downloading random programs from download-free-stuff.com and infecting themselves with viruses.

It might restrict what malware could do if they got phished. I say that, but there are probably still ways to elevate privileges on Windows.

(Phishing in this case being the email attachment kind, not the fake website login thing)

It keeps them from making big mistakes while trying to fix something on their computer.

These users are not very computer-savvy. Which I suppose can be good or bad. Bad because they may do things without realizing. Good because they may say, "I have no idea what all this stuff is, I'll just use the programs I'm familiar with."

If you have #2 then granting user access may be dangerous. If I was going to give admin access in your situation I may do so with caveats like, "Don't operate while logged in as an admin - switch to the admin user only when necessary, only install software you know to be safe, etc..." Of course if you think that your users will fail to abide by basic rules of computer hygiene then you definitely have a problem...

internet down for exact 2 minutes, back online for exact 2.5 minutes, repeat. 24h in this loop, and the ISP is troubleshooting and thinking about deleting my account and recreating.

@ThoriumBR Ouch...

unless they have a cron job messing with settings and restoring them, it won't work...

I asked them if they updated firmware on something, because this looks a lot like a hardware/firmware issue... the switch finds an error, reboots, gets back online, starts recreating the internal mac table, stumbled on the same error, reboots again...

Honestly, for an isolated machine (which, if they are at a client site, these probably are), the worst an admin can do is muck up their own machine. Unless they have lots of sensitive data stored on it, that "risk" may be relatively low, so it may be worth giving them more control so they can do their job more effectively

yep, I would not give them admin access on any server unless they absolutely had to. root on the hands of a untrusted person can be devastating...

But if you had a user who liked to download pirated movies on their work computer, if it was always connected to your VPN, if they had PII stored on the machine... then you're reaching an area where they need to suck it up and accept the fact that it is safer to not have admin access

How about if they're at a customer's site and they set off a ransomware worm? It won't affect my office, but...

@ThoriumBR If it's exactly 2 minutes and then exactly 2.5 minutes, there's probably a very specific reason (don't know it, just it seems really odd)

@ConorMancone that's different... if your employees walk around with PII on their laptops, you are doing it wrong...

@FireQuacker an error that reboots something, and as soon as the device gets online, it faces the same bug in 2.5 minutes, reboots, and takes exact 2 minutes getting back online

@ThoriumBR It's not always that simple. My mom worked in healthcare and specifically went to people's homes. Even if she didn't have the PII "on" her laptop it was still accessible from the laptop, because it had to be to work with her patients

@FireQuacker The problem is that lack of admin access won't necessarily stop a ransomware worm from getting in and causing problems. Many will operate quite happily with just user access, and can even spread like that (depending on how they propagate).

True, but it could theoretically stop some

Yes. The question is whether or not the some it could theoretically stop is worth the increased pain of having to make changes for your employees when they are at a customer site. Again, I'm not trying to argue the point one way or another: it's just a question of deciding which "cost" is higher.

Right

I'm probably going to draw up a big list of pros and cons and toss it on my boss's desk and let him decide

@FireQuacker That's always a great idea. At the end of the day it is the "business" who bears the risk one way or another, so they key is to make sure that someone sufficiently high up the chain understands the potential gains and potential risks, and is happy with the chosen balance.

@FireQuacker after 2 hours testing ping, traceroute, changing VLAN, changing PPPoE credentials, and running Windows on MY NETWORK, they changed the modem (that I asked 24h ago...), and voilá! stable connection...

online-offline-online-offline in a loop does not smell like settings... smells like hardware/firmware bug.

Good that it's fixed now, but ugh

You need some better tech support down there