The DMZ

Journeyman Geek

12:04 AM

@nobody dirty little secret is... it dosen't matter

Sometimes you can do a one line sh*t post and get a few thousand rep

or spend a few days on a masterpiece someone downvotes

As a two site 100K user, if you're chasing rep, its going to be harder.

focus on consistency and quality (and fun) and the rep rolls in

John Zhau

7:55 AM

How often do you pentest the pentesters?

nobody

@JourneymanGeek That's what I thought :)

@JohnZhau My guess is never :)

MechMK1

9:45 AM

@JohnZhau Occasionally.

MechMK1

10:48 AM

1

Q: What's the best way to prevent my Mac from updating macOS?

I'd like to keep my Mac on Catalina forever. Other than disabling "Automatically keep my Mac up to date", is there anything else I can do to prevent my Mac from upgrading to newer macOS versions? I'm still interested in receiving Catalina updates and Safari updates, but they don't need to be auto...

And on this episode of "Holy shit what the fuck is going on on Ask Different!?", I present to you...

nobody

Damn. Ask Different really is crazy.

MechMK1

"What's the best way to make my Mac insecure?"

Also, fun fact: The recent MacOS update actually improved their product!

It fixed a bug I was affected by. And now it's working as intended!

A. Hersean

> being the mildly paranoid techie I choose to leave [install system data files and security updates] off

Dafuck?

Is that a common behavior among people asking differently?

HNQ: networkengineering.stackexchange.com/questions/72755/…

nobody

@MechMK1 That might have actually broken OPs work flow. hence why they don't want to update

A. Hersean

Is it just me or the HNQ selection algorithm is tuned to fetch dumb question?

MechMK1

10:57 AM

@A.Hersean So that is why I hit HNQ more than anyone else here.

nobody

Dumb questions have answers everyone can understand. Hence more people answer and the answers receive more upvotes

Which the HNQ algorithm considers popularity

MechMK1

@nobody I can hardly imagine how OPs workflow can include the bluetooth module breaking after leaving a PC turned on for 48 hours

nobody

@MechMK1 No your HNQs fall off the list very quickly. So they're not dumb, just technically interesting for us

@MechMK1 Well, I couldn't imagine how someone's workflow included CPU overheating, until Randall told me how. ;)

Journeyman Geek

@A.Hersean there's an XKCD about this...

There are probably children out there holding down spacebar to stay warm in the winter! YOUR UPDATE MURDERS CHILDREN.

MechMK1

I am convinced that users are awful and we should never have made programs for them.

Journeyman Geek

11:03 AM

someone beat me to it

MechMK1

@JourneymanGeek This one was linked to above :D

Journeyman Geek

More seriously

some software is validated to specific versions of an OS

updating might render it unsupported

nobody

@MechMK1 Yes, as you say computers were a mistake

MechMK1

@JourneymanGeek Then you need to airgap that machine

Journeyman Geek

I wouldn't go with 'forever' but there's actually valid reasons to stay with specific builds or versions

MechMK1

11:04 AM

Not keep it online

Journeyman Geek

@MechMK1 Not everyone is going to work from a security first perspective

nobody

Specially not disable security updates

Journeyman Geek

I invoke avid's first law, possibly incorrectly

MechMK1

@JourneymanGeek And those are the people who then come to us and ask how to remove ransomware

Journeyman Geek

> "Security at the expense of usability, comes at the expense of security."

MechMK1

11:06 AM

@JourneymanGeek I'm not sure if it applies here. Security updates by themselves are not "reducing usability"

Journeyman Geek

So the correct response isn't to get mad at him for not wanting to swap out his OS for the new hotness

Its to figure out what he's afraid will break

nobody

Yeah you're right

But the only answer he received is just crazy

MechMK1

Yeah but that would require me to engage with someone in a meaningful discussion

I want to make a funny one-line comment that gets upvotes

Journeyman Geek

@MechMK1 an extremely underrated skill in tech

MechMK1

Unfortunately, yes

MechMK1

1:17 PM

♦6♦ 東方Touhou [Violin/Piano] Capital City of Flowers in the Sky

►

I feel like I'm not posting enough music

I completely fail to comprehend people who say they "don't like music"

Anonymous

^

MechMK1

Music is the language of the heart

And I don't want to talk to people who don't speak it

It doesn't even matter what kind of music. Any music is a reflection of oneself.

Anonymous

Speaking of music, I don't usually like rap but I can't stop listening to this song: youtube.com/watch?v=1KlNDZpCkHc probably because it is "emo" rap is why.

Anonymous

1

Q: How hackers hide their identity while hacking?

I was wondering how hackers hide their identities while hacking? For instance, consider an attacker who wants to hack a website that has a SQL injection vulnerability. If the attacker uses automated tools to send malicious payloads, the admin of the website can check the payload sender's IP and r...

attacks anonymity

Anonymous

the top answer on this question

Anonymous

1:26 PM

is absolutely terrible.

Anonymous

I mean, it isn't terrible.

Anonymous

But the whole thing is ruined by him saying to use a VPN to commit crime.

Anonymous

What an awful idea.

Anonymous

Also, buying a VPS in BTC is absolutely not safe lmfao

MechMK1

"I told her call me Rocky, she say she not gonna call me that"

I fucking lost it at this line

Anonymous

1:27 PM

Hahahhahahahaha :D

MechMK1

Zelda Wind Waker: Dragon Roost Island - Metal Cover || RichaadEB

►

Anonymous

Yeah rappers do say some weird shit lmfao

MechMK1

Also 100% nostalgia fuel.

Wind Waker was peak Zelda for me

Anonymous

I guess this song reminds me of Juicewlrd and I love Juice so

Anonymous

I'll listen in a sec.

MechMK1

1:28 PM

I feel really glad for people who fell in love with Breath of the Wild

Even though it wasn't for me

Anonymous

@MechMK1 this is fucking cool

Anonymous

Gonna add this to my playlist, actually.

Anonymous

Might as well, I'm already 10,000 songs plus.

Anonymous

Whats one more.

MechMK1

My playlist is pretty small, let me check

Anonymous

1:32 PM

I wish I could play an instrument but I tried before and I just can't learn that type of thing

MechMK1

800 songs

I play a little bit of guitar

That's almost an overstatement already

"I have begun to learn how to play guitar"

Anonymous

I have been collecting this playlist since I pretty much started listening to music. It is fairly well organised. I always think about actually organising it as much as I would like but then I sit down to do it and I just think "fuck it"

Anonymous

@MechMK1 Heh, that's cool though!

Anonymous

I wish I could even learn, I just can;t.

Anonymous

I tried many times, it is just not a skill I will ever develop.

Anonymous

1:35 PM

But whatever, I can still enjoy music :D

MechMK1

That's what matters

Anonymous

Absolutely :D

Anonymous

I am now doing at least 100 chess puzzles a day to get better at this damn game.

Anonymous

I'm so bad but it is so addictive.

MechMK1

that reminds me I haven't solved a sudoku today :D

Anonymous

1:42 PM

See, I can solve 1000 elo puzzles.

Anonymous

But when I play, I am playing at like 600 elo.

Anonymous

It is so frustrating. I just get so flustered when someone counters my strategy.

MechMK1

I play really horribly

You could beat me easily, 100% sure of that

My training in chess is "I know how the pieces move"

But if you want a good training in chess, I can highly recommend Really Bad Chess

Anonymous

Non-HTTPS site... monkaS

Anonymous

I actually started playing chess because I quit playing other games.

Anonymous

1:52 PM

Like, I have been playing counter-strike since I was super, super young.

Anonymous

But I quit all other games a while ago and really wanted something to play. So I started playing chess.

MechMK1

reallybadchess.com/cgi-sys/defaultwebpage.cgi

Lel

Conor Mancone

This probably sounds lame, but I'd love to play the piano at some point in time

MechMK1

> Our Core Values
> People
> People are at the center of everything we do. This includes our employees, our customers, and our communities. It’s that simple.

Conor Mancone

Mainly because I have absolutely no musical talent whatsoever

MechMK1

1:57 PM

This literally means nothing

@ConorMancone Go for it

Honestly, just do it

Conor Mancone

and absolutely no ability to distinguish pitch or anything else

MechMK1

@ConorMancone Extremely few people have perfect pitch

Conor Mancone

Put I can hit keys on a keyboard, and have some limited amount of rhythm.

Anonymous

@MechMK1 I have seen a billion companies use this same empty, lifeless, soulless, cover story-esque mantra

Conor Mancone

So I figure that a piano is probably the only instrument that I might have any success with...

MechMK1

1:58 PM

@ConorMancone If you press two different keys on a piano, can you hear they are distinct tones?

Conor Mancone

@MechMK1 Yeah... my issue isn't a lack of perfect pitch, but a lack of any at all.

If they are far enough apart :)

MechMK1

@J-- 's/People/Money/g' and I would believe it

Conor Mancone

lol!

(oops, off to a meeting - apologies for the smash-and-grab operation)

MechMK1

> Money is at the center of everything we do. This includes our employees', or customers' and our communities'. It's that simple.

@ConorMancone Same, talk to you later

Anonymous

@MechMK1 lmfao :D

MechMK1

2:01 PM

100% more believable

I probably should not have eaten 10 grams of psilocybe cubensis for lunch

I completely forgot I had this meeting

Anonymous

Meetings spits

MechMK1

2:18 PM

I survived, and I think nobody suspected a thing

Meanwhile everyone else: "Was that dude on shrooms?"

Anonymous

Hahahahahhahahaha :D

Anonymous

I just remembered that today is the day I need to start pre-studying for my course, oof.

Anonymous

So excited but... Not excited.

ThoriumBR

and I just had a meeting with a 4 yo sharing the same desk as me for remote school

remote school for a 4 yo is not productive...

I imagine @ConorMancone teaching his twenty kids... it must be tough...

MechMK1

This reminds me of a video about UX design for little kids

And how different and difficult it is to make UX for someone who can't be expected to be able to read

ThoriumBR

2:34 PM

I saw a doctor writing the prescription for an illiterate old lady here... as she only could read the numbers

he put colorful stickers on the prescription and the same sticker on the box of the medicine

MechMK1

That's really neat

Anonymous

Here I am, a week later still relying on others to help me finish a task which is my responsibility which I cannot finish without these incompetent fucks.

Anonymous

I am about to lose my shit with this.

Anonymous

This is the kinda' thing that makes me look for a new job, I'll be honest.

ThoriumBR

report it... there's someone upper in the task chain that is waiting for you to submit the task, mail him telling that the task cannot be finished because someone downstream is not working

Anonymous

2:44 PM

I have.

Anonymous

There's nothing anyone can do.

Anonymous

We have to rely on this 3rd party, I won't get control to do this myself.

ThoriumBR

I got anxious about it when I was younger... now I don't care... As soon as I report, the problem turns into a "not my problem" kind of issue

Anonymous

It just makes me feel incompetent.

Anonymous

I know I am not, but that's how my brain views it.

ThoriumBR

2:46 PM

makes you feel incompetent to you

Anonymous

Which in turn makes me think I failed, which makes me think that I look a clown.

Anonymous

Which makes me want to get a new job to avoid the situation entirely.

ThoriumBR

and if it's you thinking about yourself, you can redirect the blame

Anonymous

I hate failing as it is. But failing because of others.

Anonymous

That makes me even more unhappy.

Anonymous

2:48 PM

I mean. the rational side of my brain knows it isn't my fault.

Anonymous

But my feelings don't feel that way and no matter how many times I tell them to they just won't.

ThoriumBR

I know how it feels... I spent a week inside a cold noisy datacenter sitting on a stair because the guys tasked with plugging ONE fiber cable didn't cared to work, and had to fly there another week... it's terrible

Anonymous

One of the things that tipped me over the edge in my last place was people not doing their job properly and my brain couldn't handle the pressure of blaming myself for their incompetence.

ThoriumBR

but flying back to the customer the next week I realized that it wasn't something I had to think about, so I wrote on my report that I was available, waiting, and couldn't work because the fiber wasn't there and I wasn't allowed to plug it myself, even if I knew exact what fiber had to be put on which port

Anonymous

The same thing is going to happen here if this continues.

Anonymous

2:49 PM

@ThoriumBR You had to fly there? Jesus Christ.

Anonymous

See, I would not fly there. I would flat out refuse.

Anonymous

At that point, that's when I'd have had enough and called it quits.

ThoriumBR

yes, I had to fly 400km, spend another week on a cold datacenter, and get home

Anonymous

I have a very short fuse for this shit.

ThoriumBR

so a job that would take a day took 2 weeks

Anonymous

2:50 PM

Jesus...

Anonymous

I remember in my last place.

Anonymous

A colleague forgot to take a serial cable to a client site.

Anonymous

I had to travel 130 miles to give him one. That pretty much tipped me over the edge.

Anonymous

I left a short while after that.

Anonymous

I don't think I've ever been as mad as I was then, I was swearing the whole way.

ThoriumBR

2:51 PM

On the outside, was a nice week: I spent a week in Rio de Janeiro, on a nice hotel close to the beach, food paid for, it was good... but internally I spent a week on a datacenter, freezing, without internet and with nothing to do for 40h every week

Anonymous

Yeah, that is miserable...

ThoriumBR

when I reported it to the manager's manager, they showed up and plugged the fiber in 15 minutes

Anonymous

Datacenters in general are miserable.

Anonymous

I hated going to datacenters.

Conor Mancone

@ThoriumBR Remote school for a 4 year old is definitely pointless

ThoriumBR

2:53 PM

I don't mind working on a datacenter if I am working. but I had a couple experiences spending the week inside with very limited cellphone coverage, no internet, and waiting for someone to do its job

my last time on a datacenter was bad too: a week waiting for the security guys to open a port on the firewall so I could access the console... they opened the port when I was on the boarding gate... I connected to the VPN inside the plane and said: "yes, now I can access. No, I cannot work on this anymore because I am on the plane"

Anonymous

I started editing this..

Anonymous

-1

Q: vulnerability management 101 for a dummy

So looking at a typical vulnerability scan report from Nessus, Qualys most people are terrified, lost and basically with more question then answers, for example, how on earth am I going to deal with all this findings? From what I was thought, a vulnerability management process can be broken down ...

vulnerability vulnerability-management

Anonymous

Then I got like 15% through and was like: "okay fuck this"

Anonymous

That question is a total mess.

ThoriumBR

better wait for the author to clean up a little...

it's a question written by a non-English speaker... may be difficult sometimes

Conor Mancone

6:44 PM

This is one of the worst exchanges I've seen from a security researcher yet. This is an actual exchange one of my teammates had. I've modified it slightly to protect the names of the innocent and shorten the responses from my teammate:

[Researcher]
[Report for clickjacking vulnerability]

[Team Member]
Thank you! We have a bugcrowd program that you can join. Can you provide your username so I can invite you?

[Researcher]
Please give me program link

[Researcher] (5 minutes later)
Give me bounty for my bug

[Team Member]
Hello again!

Currently we are not giving any rewards for bugs. Sorry

[Researcher] (5 minutes later)
Please give me bounty for my bug

[Team Member]
Hello [Researcher]!

Sorry we are not giving bounties for the findings at the moment

[Researcher] (10 minutes later)
Please give me bounty for my bug

[Researcher] (1 week later)
Your domain clickjacking misconfiguration bug fix now please

Give me bounty for my bug

Anonymous

Yeah, we often get similar situations at my place...

Anonymous

Although, some of the situations I've been told about before are... Well. Just extraordinary.

Anonymous

People's entitlement never fails to amaze me..

Conor Mancone

I've seen people be less pushy when they identify P1s and P2s. Clickjacking? This person has apparently been told that they can run this little scanner thingy, file off some emails, and just rake in the money. It doesn't work like that...

Or at least, if it was that easy, I would be doing that for a living :)

Anonymous

Yeah, that's just... Absurd. These people are just greedy.

Anonymous

6:52 PM

That is my view of them.

Anonymous

I refuse to accept another position, either. They are greedy and entitled.

Anonymous

They want a shortcut to money they're just using bug bounty as the vehicle.

Fire Quacker

@ConorMancone Well, you didn't pay, but if the researcher finds enough websites and is persistent, they could make a bit

At least it's more productive than scam calls

Conor Mancone

7:11 PM

@FireQuacker lol, that's fair!

MechMK1

8:01 PM

23

Q: How can I run newer Unity games on OS X 10.9 "Mavericks"?

Most games built with Unity 2018 and Unity 2019 do not work on Mac OS X 10.9. They will launch initially, and occasionally even get as far as the main menu, but invariably crash before entering gameplay. Dyld Error Message: Symbol not found: _getattrlistbulk Referenced from: /Users/USER/Deskt...

macos crash games

Ask Different is on a roll now

First one actual dumpster fire of a question, now a really good answer

@ConorMancone This is why I hate bug bounties

Because it gives a direct incentive to be dishonest

Conor Mancone

@MechMK1 Just wow (in a good way)

ThoriumBR

8:52 PM

understand.. understand... understand... not undestand... there's a "r" there man... understand...

"understand" and "throughput" are two words I almost NEVER write correctly on the first try...

now back to the report

MechMK1

@ThoriumBR To be fair, some dialects make it sound like it's "un-de-stand"

ThoriumBR

"undestandable"...

MechMK1

I have my fair share of words I regularly write wrong, such as "truly"

Since truly comes from "true", I always write "truely"

ThoriumBR

I usually swap y and i on some words, like "saying"... sometimes I write saiyng and the spell check saves me

now I need to send a performance report to someone with 25 years of experience on the field

gaazkam

10:34 PM

> This is needed to avoid attacks from the less privileged accounts toward more privileged (e.g. process hijacking, file races, etc.). Unfortunately, this point is a bit confusing without a proper explanation that may take several blog posts to be fully covered, but in a nutshell it means that root should not touch anything writable by the less privileged account. Some examples of the bad and insecure behaviour include:

* changing directory to a directory writable by non-root,

(above quotation from dmitry.khlebnikov.net/2015/07/18/… )

(linked by @forest in this answer security.stackexchange.com/questions/196664/… and forest is an authority)

...umm if we stick to this policy...

Anonymous

What are you asking?

Anonymous

I don't get it. Stick to what policy?

gaazkam

How to set permissions for other accounts?

The policy that root shall not make a directory writable by non root as quoted above

afaik one of the tasks of root is to set up permissions for other accounts

to do this root must sometimes decide that such-and-such directory is to be writeable by such and such non root account

Anonymous

I'm sorry. I don't know enough about Linux hardening to understand all of this. You're best off just pinging forest and asking him.

Anonymous

Especially since he gave an answer on the question.

Anonymous

10:42 PM

He comes here often so I am sure he will be happy to talk it over.

Transcript for