elnerd

I once got a wildly inaccurate billing estimate shortly after I created my AWS account. I could not find a out which resources that would cost me so dearly, and saw no other option to delete the entire account.

A few hours later, I got a mail saying the estimate was wrong.

Now, I cannot create an AWS account using my email address because you cannot create a new account using the same email address…

I’m using Postgres for my DNS log service. I only store data for 90 days. To delete data, my strategy is to use partitions based on month. At the start of every month, I drop one partition.

I am not sure of this is the best way to do this, but it works for me.

I changed from Gmail to proton many years ago.

The only pain point I have is the search. Understandable, the emails are encrypted and search has to be done on the client. That works when using the web hi as you have the option to index all emails.

I do not find this option in the iOS app :(

Same goes for logistics, which is an extension to your point:

https://walton.uark.edu/clc/posts/when-supply-chain-is-the-b...

Yesterday, I took a web application, downloaded the trial and asked AI to be a security researcher and find me high and critical severity bugs.

Even vanilla models spew out POC for three RCE’s in less than an hour

I have a fully populated server with 2x7K62 and 16x64GB (3200 mhz) for my home lab. Do you know how to check if I am affected by this?

«Document future incidents to build a case for AI contributor rights»

Is it too late to pull the plug on this menace?

I just read gnutella page on Wikipedia, no mention of bad actors

I have the impression this is not the same. In the linked video, they talked about unauthenticated functions in BLE if I recall correctly…

In related news, 10% of Meta ads are malicious, and they have Meta seems to have little incentive to stop it.

https://www.reuters.com/investigations/meta-is-earning-fortu...

Would it be be trivial to have a init container to do CA injection? Maybe though mutating admission controller? Then some CNI magic to redirect outbound traffic to do transparent proxying?

One domain parking actor is responsible for nearly 10% of all issued ssl certificates. 185.53.178.99. This is just one of many bad actors.

We soon will have to implement paradoxes in our infrastructure.

I unsubscribed from Spotify for this very reason.

Just because you cannot see how a vulnerability can be exploited does not mean that others can. As you describe, people seem to assume that the only way the config file ends up on the server is «physically» editing it.

An anecdote: I have been struggling with exploiting a product that relies on MongoDb, I can replace the configuration file, but gaining RCE is not supported «functionality» in the embedded version as the __exec option came in a newer version.

A parser bug would be most welcome here.

What’s the emulator he used when designing the firmware?

It is strange how EVs are measured by how far they can go full charge when this is a metric I never have seen for fossile cars. It tells a story how inconvenient EVs or the charging network really is

You are actually more likely to buy a car just after you have bought a car than the 10 years you did not need to buy a car. Maybe not cars, but I’ve heard this argument for kitchen appliances. If you for some reason return the item you just bought, you may buy what you get ads for. Maybe you regret you did not get the premium one, especially when they shove it in your face afterwards…

Getting the rug pulled under you does not qualify as an experience you need. It happens, but should not be in the curriculum for kids.

I am sure that being forced to spend time on this steals time from more interesting projects.

After thinking of it for a while, I do not think it is such a big issue. The threat actor was probably an adversary to existing huntress customers and the EDR probably reacted to his tooling and mistakes.

When doing red team engagements, we do the same, install same security solutions as the customer and work around it. It could be what happened here?

That the analysts spotted him and were able to connect it to existing cases is just good craftsmanship.

I no longer feel that it’s relevant to discuss a red line here. Huntress just did their job.

Unrelated story; how politician gave us a look into their financial adventures.

I am curious where the red line is.

Any criminal activity or just behavior that the analysts find interesting?