« first day (3986 days earlier)      last day (903 days later) » 

1:22 AM
krebsonsecurity.com/2021/11/… Kinda bold. And sure to get the US government pissed off....
@forest It was IRC I think, very early on.
@MechMK1 If you were local (and I'm not shipping it), eh, I would offer to front you a free shitty AMD card or sell you my 980TI at a fair offer :D
@forest w3m is awesome, especially for low effort/skill web scraping :D
@forest >_>
@forest only... I don't EVER mix work with personal stuff
My laptop stays at work
As much as possible I seperate work from home, though less for security and more for "I am not touching this steaming pile of doo if I can avoid it"
AMUSINGLY, I started doing that cause I didn't trust my work PC at a previous job + I was a little paranoid about employers after job -3 or 4 suddenly shut down
 
1:52 AM
@JourneymanGeek Thus far, my GTX 1080 is still going strong
 
@JourneymanGeek You aren't a high-profile target of course (since not all government work is classified), but it's very easy to accidentally mix work and personal stuff without realizing it. A simple example would be a waterhole attack which could potentially be possible even by simply knowing what sort of things you do on your work computer (e.g. what kind of websites you load).
@MechMK1 Do you play games that require a particularly strong graphics card?
 
@forest Nothing not work related 😅
 
@JourneymanGeek Well you said you worked in your country's equivalent of ICE and although I don't know anything about it, I could imagine that there are likely websites you frequent which are work related and, given that you've revealed enough information that one could potentially guess which websites, place a waterhole attack on them.
Of course it's unlikely that anyone would do that for such a government agency, but still.
 
@forest Well - If I suddenly got fired, I'd need to sanitize my machine, and its harder when you have personal stuff all over it
And 3 years on, I'm still paranoid about that :D
Even if its a much more 'secure' (in terms of job security) job than old ones
 
Why not just sanitize with ATA Secure Erase?
 
2:06 AM
Not sure if current employer is ok with that.
 
I'm sure almost any government agency would find that sufficient, unless you work in one of those which require degaussing or literal melting.
 
+++ They could be monitoring your use.
Can't trust any computer I don't manage myself.
 
Ah.
 
Can't trust any I do, probably, but if stuff goes wrong, at least its my fault.
 
So for you it's more of a "I don't want my employer to screw with my personal life" and not so much "I don't want someone in my personal life from screwing with my employer".
 
2:07 AM
Yup
I suspect the one job, if it happened, where It would be inevitable would be if I worked for SE, and even then, I'd think about compartmentalisation
 
Most people who would want to screw with SE will have an easier time breaking into them via their horrible backend security than trying to get in through an employee. :P
Not that I know anything in particular about their backend, myself. I'm a Linux person.
 
As a bonus, I can 'switch off' from my job at any time
 
Switch off?
 
Not care :D
 
Ah
You work in tech support, right?
Or was that your last job?
 
2:13 AM
in a manner of speaking
Well, all my jobs have been tech support. From a certain point of view
 
Something like support for users of some internal database or product, I assume.
(As opposed to "have you tried turning it off and on again?" phone work)
 
@forest I have done that recently :D
But yeah, something like that
 
The funny thing is just how effective turning it off and on again really is.
 
My resume would say "Monitoring Engineer"
@forest eh, kinda
It fixes transient issues, and stuff that piles up over time
Its less than helpful with fixing underlying issues
 
I find that it's helpful in probably 50% of serious issues. Of course, most of the stuff I do involves the Linux kernel, and often experimental and customized ones at that, so there are more bugs.
 
2:16 AM
"I need to get back to work now"
useful
"Hm, curious, what is wrong" .... maybe less so
 
Sadly lots of the underlying issues are so difficult to debug that you can't really find them without a deterministic fuzzer, and afaik, only Microsoft uses those regularly.
Do you work with a specific program/library/etc or a system/network?
(i.e. do your jobs tend to involve using a literal debugger finding memory corruption bugs and undefined behavior and the like, or working with networks/interactions between system components?)
 
@forest lol... I think you should have picked up I'm not "poke around the code" technical
or debugger technical
 
Well, poking around complex network configs is pretty technical but isn't "typical" debugging.
 
Mostly "DUDE, YOUR STUFF IS BROKEN"
 
Ah
 
2:26 AM
I mean, if I was an attacker, I know exactly how I'd tackle this, but :D
I ain't sayin :D
 
Tackle what? The way in which the "stuff is broken"?
 
Well, that I tackle all the time.
Or better yet, stuff breaks when I'm not around
that's best :D
 
Better than being on-call 24/7.
 
2:48 AM
lol
I'd explicitly want to get paid for that, and more.
 
Being on-call is all fun and games until you're desperately needed right when you get in the bath.
 
snort
I think the most 'fun' is when you thought you solved the problem, at the taxi stand waiting for a ride to get home, and something else goes boom at 2 am
happened to someone at work
 
Thankfully I've never been on-call for anything that needed me to be somewhere physically.
But even having to get to a computer dripping wet with a towel around you and not know if you'll need to work for 5 minutes or the rest of the night is a truly awful way to end the day.
I've heard horror stories about people who had to jump up despite having the flu.
Probably not legal in the US at least to make someone work in that condition, even if remotely, but sometimes a job really is too important to wait.
 
I'd love to see an employer try that in the time of covid
 
Oh they do.
Larger companies or legitimate companies are less likely to, of course.
 
3:58 AM
@forest You keep talking about SE's backend security. Makes me wonder how much access you have to it by now :)
 
:P
 
4:25 AM
@forest Escape from Tarkov
 
I don't know that one.
 
 
1 hour later…
5:55 AM
@forest though - I prefer primary/secondary and placeholder cause its more precise...
 
@JourneymanGeek It depends on context.
 
Agreed
 
Primary/secondary really does not work when you're referring to hubs or peripheral devices.
Maybe it works with databases.
 
@forest also means you have more than 2 levels in theory
 
Or my favourite: Whitelist and Blacklist
 
5:56 AM
@MechMK1 People using weird neo-pronouns really aren't very common.
 
Colours are entirely arbitrary :D
 
@forest Luckily so
 
"Allowlist" "Blocklist" tell you what they do
 
@MechMK1 Yeah but at least many people aren't bowing to pressure and changing them. I mean, some are for sure, but it's not as big as it could be.
 
Yeah
 
5:57 AM
@JourneymanGeek You know, there was a serious security bug in Linux because of that.
 
@forest eh, depends on the space. I've been in spaces where people use em routinely...
 
Could be a "Redlist" and "Bluelist" as well
 
Because of changing names, resulting in a security backport not being used.
 
@MechMK1 why blue over green?
 
And had it been called that since 100 years, I'd defend those terms as well
 
5:57 AM
@MechMK1 Actually blacklist comes from "blackbook" which was a literal book that a king would have containing a list of allowed citizens. And white is the opposite of black, so it was used as the opposite.
 
@JourneymanGeek Because I'm a bigot and colorblind
I have a hard time distinguishing certain shades of red and green
 
@JourneymanGeek It was a change from "master" to "main" or something in kernel code. Literally resulted in millions of vulnerable devices just so someone's feelings weren't hurt.
 
@forest No, not that
So someone could feel powerful
 
Oh, what was it then?
ah
 
Because that's the real reaaon
 
5:59 AM
It's the creation of a permanent victim class.
Which is a problem.
 
"I can dictate others how they're allowed to write code"
 
@MechMK1 On the other hand... that's exactly why these terms exist
 
Whenever someone in QA changes blacklist to denylist, I swap it right back
 
But thankfully terms like master/slave are not unique to programming, and in virtually every other subject, they're still used ubiquitously. Hell, even in the 24th century, Commander Riker uses those terms to confuse a Ferengi.
@JourneymanGeek No, they exist because of etymology.
Blackbook -> blacklist, not black person -> blacklist.
It was referring to the literal color of a book's binding. Had nothing to do with power.
 
@forest and the etymology is from english... and as I said, impresise...
 
6:01 AM
I want to be pragmatic here
I wanr to interview 10,000 randomly chosen black people from all over the world
 
@MechMK1 Pragmatic ... is "Maybe the way we've done things all along couldn be done better"
and use descriptive language
 
And ask them the top 10 issues relating to racism
And I guarantee you, not ONE SINGLE PERSON will mention the word "blacklist"
 
I'm not even talking about racism here. I'm talking about "A term that's based off obsolete linguistic skeomorphism" vs "It says what it does on the tin"
 
@MechMK1 "My friend was killed by a cop for the crime of walking while black" or "waaaah someone refers to a seccomp array containing disallowed syscall numbers as a blacklist!"
2
 
@JourneymanGeek We've always called it that - decades worth of literature
It isn't a genuine problem anyone is facing
 
6:03 AM
@JourneymanGeek That's appropriate when coming up with new words, but these words are so deeply ingrained in tech terminology that changing it all actually causes serious confusion.
 
@MechMK1 "A blind adherence to tradition is a sign one has nothing better to do" :D
 
I've had to spend hours - literally hours - trying to grep for something in source code just to find that they merely changed the words.
 
It's a vanity project for a tiny minority so they can feel good
 
@JourneymanGeek It's not tradition. It's useful terminology.
 
@JourneymanGeek I could say "Change for the sake of change is pointless"
@forest Agreed
Changing it now will just make everything less readable
 
6:05 AM
If someone wants to change slave to minion for master/minion, that wouldn't be nearly as bad as primary to secondary. Whereas master/slave works in most situations, now you don't know if you have to look for primary/secondary, main/second, first/last, leader/follower, client/server, or what.
 
So to me a pragmatic solution would be "Change it on new things" and "if we're going to change it, do so with a bunch of planning and clear documentation"
 
Because now we have two different terms referring to the same thing
 
@JourneymanGeek Or "spend our time fixing bugs and not adhering to the latest etymological fad"
 
@JourneymanGeek Or: Don't change things because it's not an issue.
Yeah, actually being productive for a change would be nice
 
The amount of time I personally have wasted because of the change due to ambiguity has been considerable, especially considering that I work with sandboxes a lot so "whitelist" is a common term in code I use. And given that it's resulted in actual security vulnerabilities means that it's already caused real damage in addition to wasted time.
 
6:06 AM
But as long as such codebase discussions are being held for the sake of stroking someone's ego, we won"t be productive
 
@MechMK1 As a mod, I get that so much for things that are issues. Sometimes people get annoyed at me for saying so too (Hackintosh questions on SU)
 
Given enough thought, any term can be interpreted in a way that is offensive to someone.
Sandbox => Infantilizing language
Controller => Referring to abusive relationships, possibly triggering PTSD
 
@MechMK1 The other thing is the Americentrism here. Many of these terms are specifically offensive in our culture, and we ignore terms which are offensive in other cultures.
 
Trigger => Referring to a firearm
 
At least *nix sysadmins don't get triggered when someone talks about a child killing its parent and then aborting itself. But oh man, paracide!
 
6:09 AM
@forest American universities these days are like a breeding ground for problems, I feel.
 
Some of them.
 
@forest Petition to rename "killall" to "genocide"
 
Except killall doesn't actually kill all (except on Solaris, which has lead to many ignorant sysadmins crashing their systems).
 
sudo genocide -USR1 dd
 
If that ever happens, I swear I'll submit a patch to add a SIGGAS signal.
 
6:11 AM
As far as I know, killall is called killall because it kills all processes of the specified name
 
Ah good point. I guess it would be genocide if you had a process called jews or something.
But why focus on killall? Many-a-sysadmin have had an immature giggle at finger.
 
At this point, if you had a legitimate command like genocide -gas jews I would ar least understand why someone may be offended by that
 
Yeah, since that could only exist for the purpose of being offensive.
 
Back on the C64, you had PEEK, which was certainly a voyeuristic thibg
Just like me
 
abort() -> terminate_pregnancy()
@MechMK1 Almost every system with a BASIC shell back then had a POKE and PEEK.
 
6:14 AM
ALL OF THEM PERVERTS!!!
 
And resulted in many giggles from many 12 year olds as they entered cheats.
 
I recall endless hours of fun with a text2speech program, making the computer say cursewords
I was like 26 at the time
 
lmao
 
Not my fault that my IQ is like 74
I'm entertained by my own farts :D
God alone knows how I managed to get a BSc and a job
 
Uh oh. I think you might be a diversity hire.
 
6:18 AM
Fuck yeah
Literally zero performance expected from me
 
You know, diversity hires are actually a real problem because it causes people to assume that minorities don't deserve their jobs, which causes actual discrimination.
 
I know
 
Whereas when meritocracy is employed, no one thinks that a minority is anything other than another qualified, intelligent person when they're there.
Thankfully even with the backlash against it, most tech companies still primarily utilize meritocratic governance in one way or another.
 
Whenever I see a sign like "Applications only from non-whites" I immediately know what kind of position it'll be
 
Wtf, do you actually see signs like that?
 
6:21 AM
In the UK there are some
 
"Whites need not apply"
 
Here, luckily not (yet)
@forest Exactly
I have quite a lot of non-white co-workers
 
In the US, there are certainly minority-only scholarships, but it's illegal to discriminate against anyone based on the color of their skin.
Which protects both Irish from "Irish need not apply" and whites from "whites need not apply".
 
None of which I could complain about
 
@MechMK1 Which means they're skilled and deserving of their positions.
The way it should be.
 
6:22 AM
The minority-only scholarships are just as much BS
And the reason so many whites claim to be 1/16th cherokee or such
 
I personally believe it should be based on income (class), not race.
 
In theory, yes
 
I see no reason why a wealthy Asian should qualify for a scholarship intended to equal the playing field that a poor white person shouldn't.
 
In practice, and from experience, it's total BS
 
@MechMK1 It's not done that way in practice though. It's done based on minority status only.
Not privilege. It's just assumed that anyone who is a minority is under-privileged.
Rather than understanding that it's far more nuanced than that.
 
6:24 AM
My parents are divorced and my father did not pay us a cent, yet his income was added to ours, leading to us not getting support
 
That's just a broken system.
 
The reasoning: "We can't believe that a parent would abandon their offspring like that"
Well guess what motherfucker? He did just that
 
I'm thinking more about the concept of affirmative action in general.
Not so much social benefits from the government.
 
Fuck affirmitive action - Git gud or stay broke
I got gud as well, and the deck was stacked against me too
 
I have to (only partially) disagree there. There are many people who are truly put in a position where it's nearly impossible to pull themselves up and git gud.
 
6:26 AM
Wanna know something fun about academic success?
 
Although I do think that the current implementation of affirmative action is total bs.
 
@forest Okay, perhaps if there was a working alternative, I could be convinced"
What I wanted to say before
 
But someone living in a ghetto who has the choice to either starve or commit crimes to feed their family is not going to be able to spend the hours and hours out of their day studying programming to git gud so they can get enough money to move to a better city and get a good high-paying job.
@MechMK1 And that's the problem: No one cares about a working alternative unless it makes them feel like they're "doing something about -ism".
 
None of politics is about doing something
It's all about power and money
 
For the politicians, at least. For the people voting them in, it's about their "feelings".
 
6:29 AM
Every action performed by a politician was done so because they expect and increase of either one of these
 
Well, there are the rare honest politicians, but they never get into a position of real power.
 
@forest >im_doing_my_part.mp4
 
They remain low-level and unable to make any positive change.
In other words, you need to be a lying scumbag to move up in politics.
 
@forest Guess why that is ;^)
 
Because of lying scumbags who confuse cronyism with democracy.
 
6:30 AM
Democracy is an inherently broken system
And the people who benefit from how broken it is are the ones telling us that we need to protect it at all cost
 
Democracy is broken when everyone is allowed to be ignorant and have the same say.
 
Indeed
But amyways
I gotta sleep now
It"s 7:30
 
Either you're going to bed really early, or really, really late.
 
guess :^)
 
Yeah I thought so. :P
Then I'll let you go before the sun makes it too hard to fall asleep. Later. :P
 
 
2 hours later…

« first day (3986 days earlier)      last day (903 days later) »