« first day (3728 days earlier)      last day (53 days later) » 

12:04 AM
@nobody dirty little secret is... it dosen't matter
Sometimes you can do a one line sh*t post and get a few thousand rep
or spend a few days on a masterpiece someone downvotes
As a two site 100K user, if you're chasing rep, its going to be harder.
focus on consistency and quality (and fun) and the rep rolls in
8 hours later…
7:55 AM
How often do you pentest the pentesters?
@JourneymanGeek That's what I thought :)
@JohnZhau My guess is never :)
2 hours later…
9:45 AM
@JohnZhau Occasionally.
1 hour later…
10:48 AM
Q: What's the best way to prevent my Mac from updating macOS?

bitmakerI'd like to keep my Mac on Catalina forever. Other than disabling "Automatically keep my Mac up to date", is there anything else I can do to prevent my Mac from upgrading to newer macOS versions? I'm still interested in receiving Catalina updates and Safari updates, but they don't need to be auto...

And on this episode of "Holy shit what the fuck is going on on Ask Different!?", I present to you...
Damn. Ask Different really is crazy.
"What's the best way to make my Mac insecure?"
Also, fun fact: The recent MacOS update actually improved their product!
It fixed a bug I was affected by. And now it's working as intended!
> being the mildly paranoid techie I choose to leave [install system data files and security updates] off
Is that a common behavior among people asking differently?
@MechMK1 That might have actually broken OPs work flow. hence why they don't want to update
Is it just me or the HNQ selection algorithm is tuned to fetch dumb question?
10:57 AM
@A.Hersean So that is why I hit HNQ more than anyone else here.
Dumb questions have answers everyone can understand. Hence more people answer and the answers receive more upvotes
Which the HNQ algorithm considers popularity
@nobody I can hardly imagine how OPs workflow can include the bluetooth module breaking after leaving a PC turned on for 48 hours
@MechMK1 No your HNQs fall off the list very quickly. So they're not dumb, just technically interesting for us
@MechMK1 Well, I couldn't imagine how someone's workflow included CPU overheating, until Randall told me how. ;)
@A.Hersean there's an XKCD about this...
I am convinced that users are awful and we should never have made programs for them.
11:03 AM
someone beat me to it
@JourneymanGeek This one was linked to above :D
More seriously
some software is validated to specific versions of an OS
updating might render it unsupported
@MechMK1 Yes, as you say computers were a mistake
@JourneymanGeek Then you need to airgap that machine
I wouldn't go with 'forever' but there's actually valid reasons to stay with specific builds or versions
11:04 AM
Not keep it online
@MechMK1 Not everyone is going to work from a security first perspective
Specially not disable security updates
I invoke avid's first law, possibly incorrectly
@JourneymanGeek And those are the people who then come to us and ask how to remove ransomware
> "Security at the expense of usability, comes at the expense of security."
11:06 AM
@JourneymanGeek I'm not sure if it applies here. Security updates by themselves are not "reducing usability"
So the correct response isn't to get mad at him for not wanting to swap out his OS for the new hotness
Its to figure out what he's afraid will break
Yeah you're right
But the only answer he received is just crazy
Yeah but that would require me to engage with someone in a meaningful discussion
I want to make a funny one-line comment that gets upvotes
@MechMK1 an extremely underrated skill in tech
Unfortunately, yes
2 hours later…
1:17 PM
I feel like I'm not posting enough music
I completely fail to comprehend people who say they "don't like music"
Music is the language of the heart
And I don't want to talk to people who don't speak it
It doesn't even matter what kind of music. Any music is a reflection of oneself.
Speaking of music, I don't usually like rap but I can't stop listening to this song: youtube.com/watch?v=1KlNDZpCkHc probably because it is "emo" rap is why.
Q: How hackers hide their identity while hacking?

PatrisI was wondering how hackers hide their identities while hacking? For instance, consider an attacker who wants to hack a website that has a SQL injection vulnerability. If the attacker uses automated tools to send malicious payloads, the admin of the website can check the payload sender's IP and r...

the top answer on this question
is absolutely terrible.
I mean, it isn't terrible.
But the whole thing is ruined by him saying to use a VPN to commit crime.
What an awful idea.
Also, buying a VPS in BTC is absolutely not safe lmfao
"I told her call me Rocky, she say she not gonna call me that"
I fucking lost it at this line
Hahahhahahahaha :D
Yeah rappers do say some weird shit lmfao
Also 100% nostalgia fuel.
Wind Waker was peak Zelda for me
I guess this song reminds me of Juicewlrd and I love Juice so
I'll listen in a sec.
I feel really glad for people who fell in love with Breath of the Wild
Even though it wasn't for me
@MechMK1 this is fucking cool
Gonna add this to my playlist, actually.
Might as well, I'm already 10,000 songs plus.
Whats one more.
1:32 PM
My playlist is pretty small, let me check
I wish I could play an instrument but I tried before and I just can't learn that type of thing
800 songs
I play a little bit of guitar
That's almost an overstatement already
"I have begun to learn how to play guitar"
I have been collecting this playlist since I pretty much started listening to music. It is fairly well organised. I always think about actually organising it as much as I would like but then I sit down to do it and I just think "fuck it"
@MechMK1 Heh, that's cool though!
I wish I could even learn, I just can;t.
I tried many times, it is just not a skill I will ever develop.
But whatever, I can still enjoy music :D
That's what matters
Absolutely :D
I am now doing at least 100 chess puzzles a day to get better at this damn game.
I'm so bad but it is so addictive.
1:41 PM
that reminds me I haven't solved a sudoku today :D
See, I can solve 1000 elo puzzles.
But when I play, I am playing at like 600 elo.
It is so frustrating. I just get so flustered when someone counters my strategy.
I play really horribly
You could beat me easily, 100% sure of that
My training in chess is "I know how the pieces move"
But if you want a good training in chess, I can highly recommend Really Bad Chess
Non-HTTPS site... monkaS
I actually started playing chess because I quit playing other games.
Like, I have been playing counter-strike since I was super, super young.
But I quit all other games a while ago and really wanted something to play. So I started playing chess.
1:57 PM
This probably sounds lame, but I'd love to play the piano at some point in time
> Our Core Values
> People
> People are at the center of everything we do. This includes our employees, our customers, and our communities. It’s that simple.
Mainly because I have absolutely no musical talent whatsoever
This literally means nothing
@ConorMancone Go for it
Honestly, just do it
and absolutely no ability to distinguish pitch or anything else
@ConorMancone Extremely few people have perfect pitch
1:57 PM
Put I can hit keys on a keyboard, and have some limited amount of rhythm.
@MechMK1 I have seen a billion companies use this same empty, lifeless, soulless, cover story-esque mantra
So I figure that a piano is probably the only instrument that I might have any success with...
@ConorMancone If you press two different keys on a piano, can you hear they are distinct tones?
@MechMK1 Yeah... my issue isn't a lack of perfect pitch, but a lack of any at all.
If they are far enough apart :)
@J-- 's/People/Money/g' and I would believe it
1:59 PM
(oops, off to a meeting - apologies for the smash-and-grab operation)
> Money is at the center of everything we do. This includes our employees', or customers' and our communities'. It's that simple.
@ConorMancone Same, talk to you later
@MechMK1 lmfao :D
100% more believable
I probably should not have eaten 10 grams of psilocybe cubensis for lunch
I completely forgot I had this meeting
Meetings spits
2:18 PM
I survived, and I think nobody suspected a thing
Meanwhile everyone else: "Was that dude on shrooms?"
Hahahahahhahahaha :D
I just remembered that today is the day I need to start pre-studying for my course, oof.
So excited but... Not excited.
and I just had a meeting with a 4 yo sharing the same desk as me for remote school
remote school for a 4 yo is not productive...
I imagine @ConorMancone teaching his twenty kids... it must be tough...
This reminds me of a video about UX design for little kids
And how different and difficult it is to make UX for someone who can't be expected to be able to read
2:34 PM
I saw a doctor writing the prescription for an illiterate old lady here... as she only could read the numbers
he put colorful stickers on the prescription and the same sticker on the box of the medicine
That's really neat
Here I am, a week later still relying on others to help me finish a task which is my responsibility which I cannot finish without these incompetent fucks.
I am about to lose my shit with this.
This is the kinda' thing that makes me look for a new job, I'll be honest.
report it... there's someone upper in the task chain that is waiting for you to submit the task, mail him telling that the task cannot be finished because someone downstream is not working
I have.
There's nothing anyone can do.
We have to rely on this 3rd party, I won't get control to do this myself.
I got anxious about it when I was younger... now I don't care... As soon as I report, the problem turns into a "not my problem" kind of issue
2:46 PM
It just makes me feel incompetent.
I know I am not, but that's how my brain views it.
makes you feel incompetent to you
Which in turn makes me think I failed, which makes me think that I look a clown.
Which makes me want to get a new job to avoid the situation entirely.
and if it's you thinking about yourself, you can redirect the blame
I hate failing as it is. But failing because of others.
That makes me even more unhappy.
I mean. the rational side of my brain knows it isn't my fault.
But my feelings don't feel that way and no matter how many times I tell them to they just won't.
I know how it feels... I spent a week inside a cold noisy datacenter sitting on a stair because the guys tasked with plugging ONE fiber cable didn't cared to work, and had to fly there another week... it's terrible
2:49 PM
One of the things that tipped me over the edge in my last place was people not doing their job properly and my brain couldn't handle the pressure of blaming myself for their incompetence.
but flying back to the customer the next week I realized that it wasn't something I had to think about, so I wrote on my report that I was available, waiting, and couldn't work because the fiber wasn't there and I wasn't allowed to plug it myself, even if I knew exact what fiber had to be put on which port
The same thing is going to happen here if this continues.
@ThoriumBR You had to fly there? Jesus Christ.
See, I would not fly there. I would flat out refuse.
At that point, that's when I'd have had enough and called it quits.
yes, I had to fly 400km, spend another week on a cold datacenter, and get home
I have a very short fuse for this shit.
so a job that would take a day took 2 weeks
2:50 PM
I remember in my last place.
A colleague forgot to take a serial cable to a client site.
I had to travel 130 miles to give him one. That pretty much tipped me over the edge.
I left a short while after that.
I don't think I've ever been as mad as I was then, I was swearing the whole way.
On the outside, was a nice week: I spent a week in Rio de Janeiro, on a nice hotel close to the beach, food paid for, it was good... but internally I spent a week on a datacenter, freezing, without internet and with nothing to do for 40h every week
Yeah, that is miserable...
when I reported it to the manager's manager, they showed up and plugged the fiber in 15 minutes
Datacenters in general are miserable.
I hated going to datacenters.
@ThoriumBR Remote school for a 4 year old is definitely pointless
2:53 PM
I don't mind working on a datacenter if I am working. but I had a couple experiences spending the week inside with very limited cellphone coverage, no internet, and waiting for someone to do its job
my last time on a datacenter was bad too: a week waiting for the security guys to open a port on the firewall so I could access the console... they opened the port when I was on the boarding gate... I connected to the VPN inside the plane and said: "yes, now I can access. No, I cannot work on this anymore because I am on the plane"
I started editing this..
Q: vulnerability management 101 for a dummy

cyzczySo looking at a typical vulnerability scan report from Nessus, Qualys most people are terrified, lost and basically with more question then answers, for example, how on earth am I going to deal with all this findings? From what I was thought, a vulnerability management process can be broken down ...

Then I got like 15% through and was like: "okay fuck this"
That question is a total mess.
better wait for the author to clean up a little...
it's a question written by a non-English speaker... may be difficult sometimes
4 hours later…
6:44 PM
This is one of the worst exchanges I've seen from a security researcher yet. This is an actual exchange one of my teammates had. I've modified it slightly to protect the names of the innocent and shorten the responses from my teammate:
[Report for clickjacking vulnerability]
[Team Member]
Thank you! We have a bugcrowd program that you can join. Can you provide your username so I can invite you?
Please give me program link
[Researcher] (5 minutes later)
Give me bounty for my bug
[Team Member]
Hello again!

Currently we are not giving any rewards for bugs. Sorry
[Researcher] (5 minutes later)
Please give me bounty for my bug
[Team Member]
Hello [Researcher]!

Sorry we are not giving bounties for the findings at the moment
[Researcher] (10 minutes later)
Please give me bounty for my bug
[Researcher] (1 week later)
Your domain clickjacking misconfiguration bug fix now please

Give me bounty for my bug
Yeah, we often get similar situations at my place...
Although, some of the situations I've been told about before are... Well. Just extraordinary.
People's entitlement never fails to amaze me..
I've seen people be less pushy when they identify P1s and P2s. Clickjacking? This person has apparently been told that they can run this little scanner thingy, file off some emails, and just rake in the money. It doesn't work like that...
Or at least, if it was that easy, I would be doing that for a living :)
Yeah, that's just... Absurd. These people are just greedy.
That is my view of them.
I refuse to accept another position, either. They are greedy and entitled.
They want a shortcut to money they're just using bug bounty as the vehicle.
7:01 PM
@ConorMancone Well, you didn't pay, but if the researcher finds enough websites and is persistent, they could make a bit
At least it's more productive than scam calls
@FireQuacker lol, that's fair!
8:01 PM
Q: How can I run newer Unity games on OS X 10.9 "Mavericks"?

WowfunhappyMost games built with Unity 2018 and Unity 2019 do not work on Mac OS X 10.9. They will launch initially, and occasionally even get as far as the main menu, but invariably crash before entering gameplay. Dyld Error Message: Symbol not found: _getattrlistbulk Referenced from: /Users/USER/Deskt...

Ask Different is on a roll now
First one actual dumpster fire of a question, now a really good answer
@ConorMancone This is why I hate bug bounties
Because it gives a direct incentive to be dishonest
@MechMK1 Just wow (in a good way)
8:52 PM
understand.. understand... understand... not undestand... there's a "r" there man... understand...
"understand" and "throughput" are two words I almost NEVER write correctly on the first try...
now back to the report
@ThoriumBR To be fair, some dialects make it sound like it's "un-de-stand"
I have my fair share of words I regularly write wrong, such as "truly"
Since truly comes from "true", I always write "truely"
I usually swap y and i on some words, like "saying"... sometimes I write saiyng and the spell check saves me
now I need to send a performance report to someone with 25 years of experience on the field
2 hours later…
10:34 PM
> This is needed to avoid attacks from the less privileged accounts toward more privileged (e.g. process hijacking, file races, etc.). Unfortunately, this point is a bit confusing without a proper explanation that may take several blog posts to be fully covered, but in a nutshell it means that root should not touch anything writable by the less privileged account. Some examples of the bad and insecure behaviour include:

* changing directory to a directory writable by non-root,
(above quotation from dmitry.khlebnikov.net/2015/07/18/… )
(linked by @forest in this answer security.stackexchange.com/questions/196664/… and forest is an authority)
...umm if we stick to this policy...
What are you asking?
I don't get it. Stick to what policy?
How to set permissions for other accounts?
The policy that root shall not make a directory writable by non root as quoted above
afaik one of the tasks of root is to set up permissions for other accounts
to do this root must sometimes decide that such-and-such directory is to be writeable by such and such non root account
I'm sorry. I don't know enough about Linux hardening to understand all of this. You're best off just pinging forest and asking him.
Especially since he gave an answer on the question.
He comes here often so I am sure he will be happy to talk it over.

« first day (3728 days earlier)      last day (53 days later) »