« first day (3778 days earlier)      last day (25 days later) » 

9:01 AM
Hey, how's everyone?
 
Mostly fine. You?
 
Same. Just had a meeting, which went well.
Now I'm mostly just managing projects instead of actually pentesting.
 
I refused promotions to management position. I did it for 1 year on a project, and that was enough for me to know that I do not like it.
 
I'm not in a management position
Nobody in their right mind would put me in management.
But I do have a customer I am assigned to, and I have to manage those projects
And I fucking hate it
Not the customer themselves, they're nice people. I hate the act of managing. Calling here, calling there, oh this guy is on vacation, better delay everything then...
 
So, you are effectively in a (part-time) management position, without the monetary compensation.
 
9:15 AM
20
Q: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

Michael KarcherI installed Windows NT 3.1 on a Compaq ProSignia 3080 system, because of several reasons: I know that this machine was running Windows NT 3.1 when it was in productive use. And I think this machine was one of the machines Microsoft explicitly targeted with Windows NT. For improved performance, I ...

@A.Hersean Yeah
 
Quit?
 
@A.Hersean No, it's a chill job to be honest
 
So, that's not so bad.
 
I start at 10 or 11, then quit at 16 or such
There are days where I basically just watch YouTube videos
 
Don't you have some technical tasks in parallel?
 
9:17 AM
It depends if I have a project
If not, well, tough shit
YouTube it is
 
^_^
 
I'm definitely not going to go out of my way to find work to do
So I volunteered to be the SPOC for this customer, because a.) then I can say I'm SPOC for a customer, and b.) people won't believe I'm not doing anything productive
And sometimes, I actually am productive
 
Right now, we have too much work to do, without enough people. We are so understaffed (and hirering).
 
Not my fault if I am planned for 2PD for a recheck and then I check all vulns in 10 minutes
@A.Hersean I'd imagine a lot of people are looking for a job now anyways
 
@MechMK1 That's the curse to be too competent ^^
@MechMK1 Yeah, but we refuse most applicants.
 
9:21 AM
@A.Hersean I'm not particularly competent - that specific customer just happens to be very incompetent and actually didn't fix any vulns
I can't go into details due to NDA, but...
 
And since we are a priori understaffed only for the next 6 month, the direction does not want to hire too much because then we could become overstaffed.
I know that kind of clients.
 
Who on earth design a system this fucking shitty, has a pentest, two years to fix, and doesn't manage to fix ANYTHING?!
@A.Hersean I hope you can manage the next few months. Just refuse to perform, because management could see that as a sign that you don't need more people anyways
We had that at the local gov't after a "reform"
Departments were systematically bled out to "make the departments leaner" and then people dropped like flies from burnout
 
Management understands the situation, and we risk being late in delivering and having to pay penalties. But it's a risk they are willing to pay. They do not force us to work overtime either, like in lots of startups, so they are pretty cool on this matter compared to other work places.
 
Good, good. Because usually this shit goes like this: "We're temporarily understaffed, but it's just temporary, so give your best and push through" - "Oh, looks like we weren't understaffed at all and we can manage with 30% less people. Perfect."
 
The motto remains "quality of quantity", so we must take the time need to perform the tasks. But we still feel the pressure, because we like our work and would like to finish it in time.
 
9:28 AM
Then I wish you the best
 
@MechMK1 Management knows that a lot of people would quit if they put stuff like this in place. The turnover is still quite high because in my city there's a lot of jobs in cybersecurity so it's easy to find another job.
 
Also just saw a weird deleted question. Guy says he "scanned his internal network"; then claims he scanned his public IP. Says he didn't set up any port forwarding, then is suprised that no ports are open.
@A.Hersean Why do people go for other jobs then instead of this one?
 
@MechMK1 More technical/specialized tasks, better pay, "the grass is greener on the other side of the fence", less pressure (with lesser pay), etc.
 
@A.Hersean Seems like your company needs to up their game then
I know I could earn more money with other companies, but the fact that I have so little pressure to perform my tasks is worth its weight in gold
 
Not really. It's just that not everybody seeks the same thing in thair job.
 
9:34 AM
That is true
Things used to be way worse here
 
I know ex-colleagues that went to other companies that offered dream jobs (for them), but did not deliver. One of them quit after 6 months. The other is still there, but ended up doing exactly the same job as back in our company.
 
You see, there is a bit of an imbalance
My company offered me an incredible bonus system, which would have lead to me receiving ~300€ more per month
That system was "cut" 1 month after I started
I didn't consent to this, and essentially, was hired with a bait-and-switch tactic.
So I don't feel bad at all if I am tasked to do a pentest for 5 PD and only work 1.5 PD on it realistically.
After all, if they can unilaterally change the compensation they give me for my work, then it's only fair for me to unilaterally change the amount of work I put in.
 
That's (for them) the taste of karma when it comes back.
 
Exactly. So honestly, I don't feel bad about it.
 
We rarely have more time than enough to perform our tasks. We could almost always do more if we had more time. And since we like to produce quality work (related to why we refuse lots of applicants, and also to the good cooperative work atmosphere in the workplace), we rarely do the minimum (we can do it when the client is a real ass).
 
9:48 AM
Well, the quality of pentests I have ranges from "Oh my God, this is amazing" to "Please kill me now"
Also, completely unrelated: I love answers.microsoft.com.
I love how the answers provided by "experts" have no correlation with the questions whatsoever.
Q: "Why does Resource Monitor show P:4 instead of F:? What is this weird format?"
A: "Make a backup of your Windows installation."
 
The arse client usually get few vulnerabilities (we can avoid exploring some for when the clients come back) with harsh reports detailing even minor stuff. We usually emphasize the nice things when we find some, but not for those those clients.
 
@A.Hersean I have this one sentence in my report, which is just basically "You're a complete fucking idiot and everything you touch will end up in failure"
Although worded more professionally
 
@MechMK1 They pollute my searches to resolve the absurdities of MS stuff.
 
@A.Hersean I absolutely love how fucking stupid they are.
Q: "I want to use the Japanese IME with a QWERTZ keyboard. How can I set it up to be QWERTZ instead of QWERTY?"
A: "Update your Anti-Virus."
 
Do you remember the Blackhat talk on "Time AI"? We had a similar client that wanted a certification...
 
9:52 AM
@A.Hersean Oh god
 
We are not sure that this client will come back with a fixed version.
 
@A.Hersean Better that way
 
But they need a certification to extort money to their investors.
 
Q: "When running the Windows Media Creation Tool, I get error 0xE0007BA2. What should I do?"
A: "Run the Windows Media Creation Tool."
@A.Hersean That's why we don't certify
And I say in every kickoff meeting: "The goal of a penetration test is not to prove the absence of vulnerabilities. It is impossible to do that. The goal of a penetration test is to discover vulnerabilities, so that they can be fixed and make the product more secure.
I'm 100% certain if I fed a chatbot with all questions and answers from Super User tagged "windows" and then let it write automated answers to questions, it would do a better job that Microsoft's "Experts"
 
We don't technically certify. We are a contractor for a national agency that can deliver certifications. We write evaluation reports (the evaluations usually are of 20 to 30 work days), and based on our findings the agency delivers (or not) the certification.
 
9:56 AM
@A.Hersean Ah, i see
 
We also do pentests of a few days, but that's by other people.
 
Pentests are so fun, because I can basically tell people they're idiots without having to do better
But I can't disclose any funny vulns I had
 
The bullshit "Time AI"-like company came for an evaluation however.
 
Anyways, time to make lunch
 
See ya
 
9:59 AM
See ya
 
10:17 AM
0
Q: Security technologies that implements security through "organic-like" obscurity?

S ToAre there any advanced security technologies, for example, establishing a secured connection, which first require authentication based on security through organic-like changing obscurity of secrecy? I'm not a fan of "regular" security through obscurity, because hackers will eventually discover an...

That question was insane. It's like reinventing the wheel, but making it square
 
10:31 AM
@reed Uh, no not square, its trying to make it a shape that I can't even imagine
 
10:43 AM
non eculidian?
the very sight of it drives men to slobbering madness?
@MechMK1 ._.
 
11:11 AM
@JourneymanGeek Trust me, I've had this exact problem.
Would you like to know what fixed it?
 
@MechMK1 more the answer
I consider the MCT fickle and generally use other tools :D
 
@JourneymanGeek I am 100% convinced this is a situation like in xkcd
Especially the tooltip
 
I believe that's what you get when you want to provide tech support to people who don't even know what they are doing.
Like, okay, imagine you open up a GitHub issue for a project. You provide detailed steps to reproduce the issue, provide a stacktrace, perhaps even a debugable memory dump. And the answers you will get are going to be amazing.
Now imagine doing the exact same thing on answers.microsoft.com. You will be asked "did you try restarting the application?" or "Did you try updating Windows?" or "Did you try disabling Anti-Virus?"
 
ah yeah
 
11:21 AM
And because they expect that the "input" for questions is going to be nearly unusable, the answers they provide and are expected to provide are going to be nearly unusable.
And to be honest, "Did you try rebooting your computer?" or "Did you try restarting the application?" will probably resolve a good chunk of all issues.
For example, I once had OpenVPN problems, where my connection was continuously reset every couple of seconds. I resolved it by rebooting my machine. Why was it an issue in the first place? I'd love to know, but I probably never will
 
12:02 PM
sure
that's often the first thing I try
 
The problem is that more often than not, their support doesn't exceed that level of generic error handling
 
Well they're probably poorly paid and/or will get in trouble if they go off script
 
Yeah, and that's the thing
If someone labels themselves as a "Microsoft Certified Professional", I INSTANTLY assume they will not be able to help me.
 
12:18 PM
but is answers.microsoft.com a place for "official" support? I never understand if such communities (also on Google, etc.) are by enthusiasts for enthusiasts, or if they are something more official
sometimes I suspect (or rather, I'm pretty sure) lots of products rely on support by volunteers, hoping they will help clients use their products, instead of investing in real official support
 
@MechMK1 It's like the CEH certification. You do it if your boss asks it. But you do not put it on your CV if you want to be credible.
 
@A.Hersean Yeah, literally. Though sadly, I have to put it on my internal CV
@reed I believe that the "Microsoft MVPs" are being paid, but that's just a gut feeling
Otherwise I'd see no reason why someone would spend their time giving shitty answers to shitty questions
You don't even gain updoots like on SE
 
@reed It's both. That's half the problem. The other half is that the professionals usually are not that much better than enthusiasts.
(The 1st half implying that the few good answers are drowned under poor ones.)
 
I might be wrong, but I suspect there's something wrong with the way technology works. If a product has a problem, the problem should be fixed by whoever created (and sold) that product. Right now, in the world, millions of poor guys are fixing Microsoft's problems, while not being paid by Microsoft
 
That's the historical way it works with MS.
 
12:25 PM
but Microsoft is just an example, the same would apply to most tech, I guess
 
Now that more and more of their products are on github, one can open issues.
@reed Depends. Most games end up with patches fixing most of their issues.
But for crappy IOT stuff, obviously not.
I think the culprit is this:
> THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
YES! I told you "AS IS" is one of my favorite jokes
the joke is that "as is" is literally everywhere under the hood
 
1:01 PM
I found the best tweet of all time
3
Q: Cyber Security vs. Digital Security

Makan TayebiWhat is the difference between Cyber Security and Digital Security? They sound very similar (same) to me, But I have read that current techniques of Machine Learning can provide Digital Security, But not Cyber Security. So what is the difference?

Digital Security is when you secure your digits, and Cyber Security is when you secure your cyber. — MechMK1 47 secs ago
 
J--
my life has resorted to this
 
In French, "digital" still retains its original meaning of "with digits" (AKA fingers). "Digital" gets translated to "numeric". So, "Digital security" would be gloves.
 
@A.Hersean Digital security is when you wear protective gloves.
@J-- my life has resorted to telling they/them kids that their 17 different self-diagnosed mental illnesses aren't real
Already have two of them a complete mental breakdown over it
 
J--
lol
 
"No, we swear, we have ADHD, ADD, BPD, DID, BFG, HGD, HFS+, etc...."
 
1:14 PM
...... HFS+ ? Oh my, I don't know anyone who got that and lived.
 
Yeah, I heard it's Terminal
I should have said ZSH instead
Then that joke would have made sense
 
I hope you have insurance so your next of kin could... csh... out
 
I heard CSH is worse: it's terminal in is early stage.
 
1:40 PM
Jesus these puns are so bad, they make me wanna kill -9 myself
:D
 
 
6 hours later…
7:51 PM
okay so looks like nobody noticed, but Steffen Ullrich surpassed the Little Bear
This is probably the first time in almost a decade that anyone has had more rep than the bears
 
 
2 hours later…
9:27 PM
Based
 
9:47 PM
checking in... and checking out...
 

« first day (3778 days earlier)      last day (25 days later) »