MechMK1

@CaffeineAddiction Yeah, that's probably why I dislike it. It feels like I should be able to "solve" the task, so when failure is inevitable, I feel like I was not smart enough

ONI is just too big brain for me. I dislike when I have to copy things I don't understand

@ThoriumBR I suck at ONI. I keep trying and screwing up, and I never seem to learn what I'm doing wrong, since the time between me making a mistake and that mistake manifesting in negative consequences is too long

Man, sucks to be him stealing my identity of all people

Based af here

In Japan right now

Hey btw I'm still alive

I just played Baldur's Gate all day, because nothing was working

I am open for suggestions

Anyone got any idea for zip-based attacks? I alread tried zip slipping, file clobbering and even including symlinks? Only thing I have not and will not try is zip bombs

I also saw no indicators for exploitation attempts on my server

Yeah, I saw that too. I guess it's more interesting for big services like github

I did this morning, but it doesn't seem like I got exploited

Hope you already updated SSH

ubuntu.com/security/CVE-2024-6387

Also running the latest version of anything will lead to huge headaches when there is a major version bump and incompatibilities are introduced.

Every single company I ever worked with usually has the opposite problem - they ship ancient versions of stuff, because those ancient versions are tested and vetted.

@ThoriumBR In that case, I 100% blame website operators. If you run -latest, then you run unstable code by default.

jQuery officially doesn't even support that

Because that can just break regularly

Don't ever include jquery-latest.js

Either way, SRI wins.

If you don't trust your CDN, then SRI ensures your users won't get hacked.

If you trust that the CDN does not hack you, then SRI will not negatively affect your users.

Doubt it

It's better for users to get hacked?

Always!

If I include jQuery 3.6.1 I expect that to always be the same file

THAT'S TEH POINT

>it breaks the site if anything changes

They usually are!

SRI is just an attribute of the script tag

I'm saying if you use a CDN, use SRI

I'm not saying don't use a CDN

Calculate a hash of a known good version of the software, attach it to the script tag and instruct browsers "If the JS you receive from the CDN does not match this hash, it's not legit. Don't run it"

But no, one extra attribute would have been too much to handle.

SRI was designed specifically to prevent this exact issue.

The recent "Polykill" happening shows how little website owners actually care about security - even really big ones.

E.g. Server uses SHA-1, DH-1024 groups, etc...

If you ever need to test how a browser reacts to some kind of TLS-related problem, you can use BadSSL.com

By the way, quick tip

Not like I dislike PuTTY or anything, I just never bothered checking if there were better tools

Say, are there any alternatives to PuTTY?

oof, best of belated luck

Bernese Mountain Dogs are naturally playful. It's an extension of their shepherd's instinct

Essentially him sliding on his ass to decelerate

We were walking on the countryside when our dog spotted another dog far off in the distance. It was one he knew and often played with, so he was very excited. He immediately ran off. My dad shouted "Sit!" at him and almost reflexively his ass was put on the ground, while his front legs were still decelerating

There was a moment I recall vividly

I think the most important commands for any dog to follow are heel and stay, and they followed them perfectly