CommitSyn

One thing I haven't seen mentioned..

The reason that I pay for all software I can afford, and run the REALLY expensive stuff in an isolated VM, is ransomware. If I were to search for the latest version of a program on torrent sites and forums, and I found it and installed it, and then +1 day + the next time I opened it, it "updated" with ransomware that the cracker included... well, I'd be real unhappy and make sure to warn people with negative reviews on the crack sites. There are ransomware as a service providers now that pay a large percentage of any payments... It's everywhere!

Now's a great time to learn how to read basic PHP and how to modify code to sanitize input. It's low-hanging knowledge that won't take much time. You're not going to prevent the OWASP top30, but you can stop SQLi and XSS and maybe get more into webappsec.

Input going into DB: https://wordpress.stackexchange.com/questions/114344/how-to-...

Input being displayed from DB: https://developer.wordpress.org/reference/functions/sanitize...

But also, steal his cookie. Allow the student to become the teacher and see if he takes it as a humble learning experience.

Ask him for a demo URL where he tests his plugin, send him a message to grab his admin cookie (don't make it complicated, just make it ping your server with with a 1px '/xss.jpg + document.cookie' and check your web logs), set your cookie as his to open his wp-admin and change something. Demonstrate why it's such a big deal since he is clearly a security novice.

And yes, if there's anything I've learned about WooCommerce plugins and WordPress plugins in general, it's to be very careful.

Care to share who that certain elite group is?

The typing style definitively seems like an American user applying the bare minimum red herring stylometrics to appear as someone with another mother tongue. Considering the timing I wouldn't be at all surprised to find out that this leak is from a recently departed employee. They likely have the full set but are only selling data from a certain point in time.

As a LastPass user (that hasn't logged in since ~2015 :-/ ) can you explain the difference please?

> This is why I prefer 1Password, as it requires the secret key to be compromised in addition to the Master Password, thus providing protection against a weak master password.

If we no longer operate on MAD and instead cower to every threat of use of nuclear force, then do we simply let Russia take whatever they want?

Welp, looks like they were able to copy vaults to crack and, worse yet, they have the unencrypted URLs to choose what to target.

> The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data. These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass. The encryption and decryption of data is performed only on the local LastPass client. For more information about our Zero Knowledge architecture and encryption algorithms, please see here.

What I've seen said about it is that we're getting the golden opportunity to cripple a top adversary by never even putting American boots on the ground. We're paying 5% of the already-designated military spending budget to do it, and we're giving that 5% to American companies to send arms to Ukraine to let Russia run itself into the ground.

Is that not the case? Seems like a win/win if it is.

Graham Hancock says that it hasn't been truly debunked, but that 'establishment archeologists' are programmed to dispute it, or something.

'Establishment archeologists' say it's a bunch of BS.

Mr. Hancock studied sociology for a while before switching gears to journalism.

It's fun to think about, but as far as him being the modern day Galileo, I'm not personally buying it.

Yes, and it's needed. Running relays or exits helps the network.

Ouch.

CVE-2022-41924 Severe 9.6

A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in cleartext with no Host header verification. This allowed an attacker-controlled website visited by the node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client, including changing the coordination server to an attacker-controlled coordination server. An attacker-controlled coordination server can send malicious URL responses to the client, including pushing executables or installing an SMB share. These allow the attacker to remotely execute code on the node. All Windows clients prior to version v.1.32.3 are affected. If you are running Tailscale on Windows, upgrade to v1.32.3 or later to remediate the issue.

Published November 23, 2022.

I was thinking about asking here if anyone could give a brief yet full overview of what exactly tailscale is and who/how it benefits. I've read about it, but I still don't get it.

Similarly, I use it to train my internal neural net to better answer Cloudflare CAPTCHAs.

It would certainly make sense from a marketing perspective to claim it's using tor, and then have a tor-proxy service (think onion.cab) use tor for hidden services and also attempt to use tor for clearnet traffic but fail back to regular proxy if it fails.

If it were directly using tor then I'd have to agree that most people wouldn't use it. Only those that are technical enough to understand what's going on and the security aspects. But they wouldn't be using Brave for the Tor functionality, they'd be using Tor Browser.

Gmail is saying that when you attempt to recover your account? If so, then I believe it's saying it sent the verification to the backup email on file, so check any other email addresses you have access to and might have used for backup recovery addresses.

It is a genuinely curious question. I haven't seen the abundance of "Why do they have so many employees" question as I'm new here, and that just seemed like a lot of employees to have if they can just lay off 1/3rd of their workforce overnight.

I'm curious what their 2016 boom numbers were. Is there any way to find that data?

Interesting, thanks!

Edit: are low quality replies like this appreciated on HN or no?

weird. it felt like your heart was pounding out of your chest as well? what about heart palpitations (feeling like your heart skipped a beat)?

my blood pressure is high but I never tested it with specifically caffeine + Adderall, I just know it was high with Adderall.

Helps with the minor amphetamine-induced.. not sure what to call them, OCD-type symptoms for me. Teeth grinding, messing with my beard, making weird throat noises, etc. It also helps a lot with sleep.

...except this brand new scientific paper from Stanford.

White people don't like that the language is gendered, so instead of Latina (female) and Latino (male) they told everyone they should be using Latinx and it stuck.

I've seen a number of Hispanic people get irritated that people are trying to take away from their culture and language, and others that say they don't care.

Taking caffeine with Adderall gives me horrendous anxiety and heart palpitations so I don't drink coffee anymore. When I take adderall + magnesium I'm almost as calm as I am unmedicated.

For anyone else taking them both that may not have made the connection yet.

> We’re reducing our global workforce by approximately 1,100 people, or 30 percent, in order to adapt to current market conditions.

Why does a crypto exchange need 4,000 employees?

I looked at a number of the pictures and I have no skin in this game but I'm not convinced. Many of the matches don't seem to actually be matches. One of the first for example - the lock of hair doesn't match any part of her hair and it's not crazy to think she may have brought some type of prop on a photo shoot.

Still, the wording 'anonymous' goes out the window with 100% of your users when credit cards are mandatory, even if you pinky promise not to connect it to the page.

I highly recommend BTCPayServer for handling (non-custodial) crypto payments.

Why do you search out pirated content when you can pay for it? Since I'm an adult with a decent paying job now, I pay for everything I can afford. I don't think I've pirated a program or movie in 5 years now.

It's a Signal fork that uses Oxen, a Tor fork. It also changes a lot under the hood with regards to encryption, and I'm not smart enough to know if the changes are good or bad.

There's not a truly solid secure anonymous implementation that I've found.