I don't have the capability to verify at the moment. But I suspect that a case I worked recently was related. A YouTube video was pointing people at a supposed plugin to make Claude free forever. The plugin was actually a Remote Access Trojan (RAT) and credential stealer. The initial loader was hosted on GitHub. The profile was fairly new and only had a couple updates, mostly adding the Trojan and README files.
- Posts
- 1
- Comments
- 270
- Joined
- 3 yr. ago
- Posts
- 1
- Comments
- 270
- Joined
- 3 yr. ago
Sadly, a reluctance to install patches isn't unique to Windows administration. I worked at a site with a well functioning Satellite infrastructure and support contracts with Red Hat. And we (InfoSec) were still chasing down admins to get their shit patched. Thankfully, we had NAC and authorization to disconnect systems that feel out of compliance. Most departments got with the program pretty quick when they ignored the "please patch all critical vulnerabilities in three days' email and ended up with a "you are out of compliance and have been disconnected" email.
And Docker had made the whole Linux situation even worse. So many devs love to spin up containers, basically disable any sort of firewall, don't bother with IP filtering. Oh and let's just use passwords for ssh. Also, who needs logs? It's a container, right. So, let's disable all logging and not forward those anywhere. Then they promptly forget about the container until we run a vuln scan and find it's got half a dozen RCE vulns and have to run them down and ask why the fuck it's still running.
Linux is a much better base to build on. But bad security hygiene is still rife and still really bad for security.
Then they transfered a file to /tmp/exp which was linux kernel CVE-2026-43500, nicknamed ‘Dirty Frag’, an RxRPC local privilege escalation. I had not patched these internal servers that nobody should have access to against this.
Lessons Learned #1:Install your patches."But I have a firewall!"That is not a sufficient control.Install.Your.Fucking.Patches!
LLMs are a tool. Like all tools, we are going to go though a learning curve as we adapt to safe usage of that tool. LLMs cratering companies would be a really tame way to learn those lessons. Usually, we don't start writing regulations around tools until we have buckets of blood to write those regulations with.
I still break out the old Sierra games (specifically the Quest for Glory series) from time to time. Those are still a lot of fun and ScummVM makes them run damn near perfectly.
Most non-indie stuff is complete and utter trash.
Ya, it's telling that some of my favorite games these days all started as indie games. I do worry about them as they get in bed with larger producers, but I also understand the draw. E.g. I still love Valheim, but they were Embracer'd by private equity. And I'm waiting for that relationship to push them to shit all over their players. Though I understand that publisher backing lets them focus more on development and less on the marketing and distribution of the game.
So now I expect it will be just a patronising nostalgia IP reboot fest designed to extract as much cash as possible.
Ya, this is one of the big turn-offs for me. For example, I really liked Prince of Persia: Sands of Time back in the day. I've got exactly zero interest in the remake. Ubisoft's logo now looking like a neat pile of dogshit, viewed from above, is pretty apt.
I think it's pretty telling that so many of the people they talk to and a lot of the focus of the article isn't really about older gamers, it's about their money.
The opportunity is substantial. The 40+ segment in the US is on track to grow from $19 billion in 2022 to $43 billion by 2030, a 132% expansion at a moment when the rest of the industry is shrinking. These are players with the most disposable income, the longest gaming literacy, and the highest brand loyalty.
I'm in that "40+ segment" and I suspect part of the "problem" these companies face is that older gamers have seen the enshitification of so many of the brands we love. Our tolerance for bullshit is basically gone at this point. Micro transactions, season passes, fucking ads in games, all of that bullshit is a quick way to not get our money.
I also suspect "brand loyalty" is basically gone for the same reason. As a kid, I looked for the Electronic Arts logo. If I saw this logo on a game package, I knew I was looking at a good game. I haven't bought an EA game in years. I don't expect to buy an EA game any time soon and I basically ignore everything they do. Sure, if a trailer for Starflight 3 dropped, I'd sit up and take notice. I'd also expect it to be an enshitified mess wearing the skin of a beloved series to sucker me in, before pouncing on my wallet.
So ya, maybe just make good games and older gamers will inevitably buy them. I mean, Larian can pretty much say, "hi we're making..." and I'll have my wallet out and be pulling bills before they get any further. And maybe that's your "brand loyalty". Game companies who make good games and aren't private equity firms wearing the dead skin suits of brands we used to love.
You can buy resin molds for the AR-15 lower, which is the regulated part. Then just buy all of the non-regulated parts retail and assemble a "ghost gun". There's also things like the FGC-9 which is mostly printed parts. And the Luty SMG if you're skilled enough.
This genie is so far out of the bottle, it's lapped the regulators and is going around again.
Soldiers give up a lot of rights when they sign their enlistment contract.
He might be right. He's a complete ass for pointing it out. And the fact that he would think he might need to point it out should be cause for some serious self reflection. But ya, disparaging someone above you in the chain of command is going to run afoul of the UCMJ. I'm just not sure of the VP is considered in the chain of command.
We walked to school in the snow. Uphill. Both ways!Now get off my lawn!
Jokes aside, I think one thing we had pretty good was not having to live in constant fear of every stupid thing we did likely being put online immediately. And there not being an "online" where your mistakes would haunt you forever. I did a lot of stupid stuff in my late teens and early 20's. And there is thankfully very little evidence of any of it. Kids these days don't often have that luxury. We're all young and stupid at some point. As you get older, that stupid stuff should be something you and your friends laugh about over beers, not something you fear a current employer is going to find at the top of the results when they google your name.
That said, the easy access to media and information is insanely cool. If I want to learn about the mating habits of marmosets, there is likely an in-depth Wikipedia article with way, way too much information. And it's likely up to date and well edited. Compare that to whatever blurb might be in the encyclopedias at your local or school library, plus anything you could dig out of the periodicals and microfiche, and it's not even in the same universe of information availability. Sure, there's a lot more to sift through online. And it's getting easier and easier to get lost in a sea of misinformation. But, you still stand a much better chance today of finding more, faster, than what we had back then. It's funny to think back about instructors making a big deal about not using Wikipedia when it first came out. Now, it's likely recommended as the first stop in researching something.
Also, I have a fucking computer in my pocket with more processing power than the entire world had available when we sent men to the moon. And I can use that computer to communicate with nearly anyone in the world instantaneously. And that computer can access that insane wealth of knowledge I just mentioned above. Again, almost instantly, from most places I am likely to be. I can be taking a shit in the woods and reading up on marmosets fucking while chatting with someone shitting on Twitter. It's the goddamn future over here.
My company has let us get Enterprise Copilot and has been pushing us all to "use AI". So, I now use it as a a semi-functional search for SharePoint/Outlook/Files on an almost daily basis. I also ask it questions about Microsoft documentation on a regular basis. I wonder how long it's going to be until they yank my license.
- JumpDeleted
Permanently Deleted
Anything SharePoint.So many companies end up using SharePoint for "knowledge management" not realizing they are dooming their knowledge to be lost in some byzantine hole of information where no one will ever be able to find or use it ever again. Worse, as more knowledge is yeeted into the pile, the search becomes better and better at presenting outdated, or irrelevant information. So, you will have new employees who find a process which is 5-10 years out of date, completely wrong, but it looks official and the links still work for some gods forsake reason. Of course, the right information is in SharePoint somewhere, but it's probably locked behind a site with broken permissions, in a document library in a Word document which isn't properly indexed and there's 4 different versions of the same document with names like "New procedure_v3_DRAFT_bob's edits.docx", because no one understands how file versioning works.
- JumpDeleted
Permanently Deleted
The base is taking about Iran and not the Epstein files. I'd say Trump's done a fine job fooling his base.
how would it put more dollars on the market than there was always going to be anyway?
Specifically printing money (as you proposed, or more realistically, the Fed giving more money to the US Treasury) means increasing the Dollar supply. Something kinda like that happens all the time and, in a much more controlled fashion, and is probably a net good. But, the Fed could just add $39 Trillion to the US Treasury's bank account, it's just a database update command anyway, and that would increase the Dollar supply by $39 Trillion. Sure, no actual bills would be created, that isn't really important. At the scale those investments operate at, no one is handling cash, it's just numbers in a database. But, it's numbers in a database which are very carefully tracked and those numbers mean something to people. If I move $100 from the database at my bank to the database at your bank, you will have the ability to obtain more goods and services based on those database transactions. The whole thing is absolutely a house of cards, but it's a house of cards that most people trust because if anyone fucks with that house of cards the US Government will show up and start shooting them. People also trust it because the US Government (US Fed, really. But that's a whole different can of worms) is very careful about how it grows the money supply.
If the US Fed started just adding large amounts of money to the US Treasury's account, people would notice and people would freak out.
The total Federal debt is $39 trillion, but there’s only something like $20 trillion actually in existence, if I’m not mistaken. Even if we collected every single existing dollar out there through taxes, we’d still have a shortfall of almost $20 trillion.
Wikipedia puts the number in actual bills and coins around $2T. But ya, the number of physical Dollars is dwarfed by the US debt. And no one cares. Most money exists as numbers in databases. But, those digital Dollars are every bit as real as the physical ones in the sense that they can be used to obtain goods and services.
Trump, is that you?Jokes aside, this is a bad idea.
We could try printing our way out of it, but people will swear up and down that would cause runaway inflation
That's exactly what would happen. With more dollars on the market chasing the same amount of goods (e.g. oil) the price of everything denominated in dollars would shoot through the roof. As a simplified example, imagine I have a barrel of oil and someone offers me $50 for it. That's pretty good and I might be inclined to accept. But, with the money printer going BRRR, someone else has a lot of cash to splash around and offers me $100 for that barrel. Well great, that $50 bid can go get fucked. But they really want my barrel, and the money printer go BRRR so now they have $150 to offer me. And this cycle keeps going, so long as the money printer is BRRing along. Eventually though, I get smart and realize that, no matter how many dollars I get for my barrel of oil, the value of those dollars is going to collapse faster than I can spend them. So I finally get smart and tell both bidders to put their dollars somewhere else and demand that I get paid in a more stable store of wealth (e.g. gold or a more stable currency).
And, in theory, wouldn’t that cause bond yields to go down?
Maybe for a very short period, but it would reverse very, very quickly. If investors want to make money (wealth really). If they start to realize that US Treasury yields either not making as much money or losing money due to the devaluation of the US Dollar, they are going to demand higher yields. This is why countries which are suffering crises have to pay much higher borrowing costs. The US has been a special snowflake here, specifically because the US Dollar is seen as exceptionally stable and the US economy is seen as a safe place to put money. If we go stupid and start heading the hyperinflation route, that will all collapse. Read up on the Turkish Economic Crisis for something.
If treasuries were essentially guaranteed investments (and weren’t they kind of seen that way for a very long time, up until recently?), yields would drop and the cost of borrowing for the Federal government would go down.
That is why US borrowing costs are currently so low and one of the reasons the US can run these sorts of deficits and not have investors fleeing for other countries. Despite Trump's flailing about, the US Dollar is still seen as a safe investment. It's relatively stable, easily convertible and easily transferable. Plus, it's used to buy oil. Inflating the fuck out of it would not help any of these perceptions and may make some nations with lots of oil consider requiring other forms of currency. You want to see a major economic catastrophe in the US? Convince the world to stop trading oil in US Dollars. Granted, as the largest single producer of oil and natural gas, the US has a lot of pull against that. So maybe, the US Dollar would survive the Middle East de-Dollarizing. But, it's not a gamble I would want to make for anything other than really, really, really good reasons.
Answer #1: Someone gutted CISA's budget. We're not naming names here, but perhaps a branch of government with the "Power of the Purse" could figure out how to fund the organization properly.Answer #2: Maybe don't fire the people who actually make the organization work, just because they aren't political hacks.Answer #3: Cyber security is hard and it takes skilled people. Laying off large swaths of the staff isn't conducive to good cyber security and leads to the remaining people taking short cuts which they shouldn't. And a robust cybersecurity program has a batter chance to catch and correct these shortcuts before someone else finds them.
Of course, this would require the MAGAts in Congress to unwrap their collective mouths from Trump's cock long enough to tell him to stop gutting critical government operations. Something we know isn't going to happen. And given recent Primary results, is only going to get worse.
Edge is just Chrome with a Microslop skin. They went from crushing Netscape so hard it got open sourced (mostly via monopoly shenanigans) to copying Google's homework. And their attempts at mobile anything has been failure (Windows CE) after failure (Windows Phone) after failure (Windows for ARM).
If it weren't for Office and companies' undying love of Active Directory and Exchange, Microslop would be a memory and little more.