SCHiM

The code runs on your machine. You do not own the game, the idea behind the game or the logic, but you do own the copy of the game on your machine.

You can read and change your copy, regardless of what the ToS says. The owner of the game can retaliate, this is not law after all.

I can confirm MSVC. Not sure about clang. Although you can disable this. The default release builds, with optimization, leaks: paths, names and symbol names.

Indeed that is the strangest thing. By _any_ metric coal is far worse. Even the metric "amount of radioactive material that ended up in the atmosphere per watt of energy." (Coal contains trace amounts of radioactive material, that gets spread when burned).

The fact of the matter is, that we can dump all our waste on a couple of football fields worth of space. Or even better: store it in a cave somewhere deep and dark and away from rivers.

Too right. It's just evolution really, survival of the fittest.

Software that can afford to have 100 developers work on it will, on average, out-compete software that is sustained by 50 developers.

Software (note: not necessarily _good_ software, this could also be the shittiest software with a nice lock-in) that is good at making money, can afford more developers, lawyers and lobbyists.

It's nothing new under the sun, but it does suck in a major way.

Grew up reading Phrack too. Work as pentester these days. I understand code deeply, and have tried my hand at everything from memory corruption exploits to javascript SPA apps.

I hate technology more and more. It's moving in the wrong direction. Almost everything technological seems to be used to increase control over individuals, extract money, track or predict.

No company can seem to withstand the lure and the power that comes from controlling, analyzing and aggressively tracking users.

Every traditional device that works just fine, now only has 'smart' alternatives available. The only value-add for the consumer appears to be that I can use my smartphone as the thermostat remote. The value for the energy company seems to be to better predict when to raise prices and bill & track me.

That update that was supposed to be off (a known problem.) Bricked my VPN config in a time of quarantine away from home.

That was a fun thing to explain. My respect for this company was stellar, but is now around rock bottom.

For me that was the "one job" problem.

If we manage to increase the sensitivity a few more orders of magnitude, and put an array of these devices in a sphere, we can make gravitic sensors!

Strange, my experience is also the exact opposite. I really wonder why that is?

I'm running about 10 windows 10 machines, various builds, auto updates enabled. Some in a domain, some in a workgroup. The last time an update bricked a system, or even broke a feature, must be over a year ago.

Now on Ubuntu, I have the same experience as some other posters. I'm reasonably confident that I can update if I do it semi regularly. But the number of times I've experienced breakage that lead to hours of bugfixing during $DAYJOB, is way too high. Now everything is in its own tightly controller docker, no more random breakage (unless docker breaks, or a key expires...).

A debian 9 apt upgrade actually managed to render my install inoperable once. But that might be semi-unfair as it had to do with graphics drivers.

Are you running windows systems on semi-recent hardware? Or is it all decades old thinkpad laptops with shitty thirdparty drivers?

You are, as a saas I think.

I mean, this gives you all the control, you can charge for all sorts of services and "value adds". There's no reason you, as the maker of this software, would want this available as a block chain.

Unless you also create a token and start having people speculate on your anti-counterfeiting blockchain?

That's what it looks like to me anyway.

The answer is piracy again.

For a moment in time, piracy of movies and series was at a low point. Recently, with the fragmentation of all the different streaming services it's rising again.

What is wrong was the immediate jump from "Fat in organs is the fat we eat from food". It seemed a natural and simple explanation at the time.

Now it appears it's not that clear. It's the excess of sugar in everything that overloads your bodies temporary stores of glycogen in the muscles and liver, which is then stored as fat, since your body can easily transform sugars into fats.

To see how that looks you can track the obesity numbers in US, the more "0%!" fat products are propped up with suger over the years, the larger the obesity crowd.

I don't think the final word is out yet, but the _cause_ of fat in your body, is not necessarily the fat that you eat.

I like Network Attacks and Exploitation: A Framework by Matthew Monte. It makes a clear and comprehensible case about the various asymmetries in cybersecurity and gives a detailed overview of failed past strategies, and strategies currently being tried.

I recognize the fact that the argument is exactly the same as for not opening up the appstore in the first place. But the importance and scope of it is less if the store is open.

Now you can chose to buy en expensive device (or you did in the past and can't de-apple due to lock-in) or not. In the future you could chose not to buy photoshop because of their insistence on their app store dependency.

I think having a more granular choice is good. Like I said, that UX hit, imo, is less important than the monopolistic behavior displayed now:

The apple "tax" (including the rules around links to donation pages and similar nonsense). Curation that cannot be overridden by end-users. Unpredictable policy changes for developers. 1st party appropriation of successful independent applications. Unfair competing (think browser javascript engines).

I think bad UX is less important than those things listed above, that's the argument.

You install those yourself you know. I'd rather have a choice than not.

I feel your pain in the sense that that I think user UX will take a hit, but I think that's less important than breaking the monopoly of the current app store.

For example, I can't find apps with pornography or other types of things the high overlords at apple or Google have deemed inappropriate for me to have. That's bad. Apparently apps like Matrix fall under that category. It'd be nice if I can choose what I want to see.

Funny how that works. An algorithm, a computer, can ban your entire virtual presence at a whim, with no recourse. (talking about Google obviously).

But the opinions of incensed humans aren't worth the rollback it takes to "correct" the problem.

The entirety of google is a money making machine intelligence serving it's few wealthy owners, and absolutely disrupting and destroying everything else.

We need to take the torch to our big tech overlords.

I know how that goes I guess. Slowly "rules" and "procedures" from the behemoth come into play. Before he knows it, his successful methods are "against the rules", and doors slowly close.

I love that dynamic /s

Right but that's just it. I've always toyed with the idea of honeypots in my mind. But I'm not sure what type to incorporate into existing security measures.

I primarily deal with big financials and fintechs. The problems they have are very difficult to solve. They are slow, have big legacy processes and tech and combine that with large targets on their backs. The signal to noise ration is very bad, given the amount of users and old weird tech in the network. They need something better than 1000s of "Suspicious file on machine" warnings EDR generates for them. Or "beaconing detected" every time a youtube endpoint changes or something.

They can only tackle one single security measure at a time, because any change is a Big Project given the existing infrastructure, red tape and ways of working.

I always come to the the conclusion that honeypots would not work. The security is good enough to ensure that the threats that do slip past will not make the mistake of scanning the network once inside. They'd probably not even notice there were any honeypots in the network.

To catch them when they're moving in the network you'd need to give them credentials that appear to give them the keys to the kingdom. Perhaps a user present on each machine that appears to be admin on a domain controller that does not exist? That'd be a honeypot server + credential...

So say you're in charge at a financial organization, and you're sprinkling fake alliance servers here and there in your network. How is that going to catch an actor like lazerus?

They're not going to scan your service, or attempt to attack it without observing actual workflows of their target's employees. If the employees are not using the honeypots, they won't either.

What strategy do you employ to catch attackers at that level? I'm not critical of honeypots in general. But I would like to know some success stories, since I have not witnessed their success myself, and have a hard time believing they'd help against attackers that have the skills to penetrate otherwise well defended organizations.

I'm wondering, given how threat actors normally behave when intruding into networks, do you also have honey user credentials in the network?

I don't imagine you're catching many serious attackers just by exposing fake servers vulnerable to MS17 for example.

Could you explain more about your strategies and which types of attackers you can say you'd catch with surety?

There's an example of how this looks in this teardown:

https://gru.gq/2019/12/07/baltic-counter-disinformation-2/

This explains more background:

https://gru.gq/2018/11/08/russian-propaganda-isnt-even-good/

This project grew into an insanely powerful tool. It's called DynamoRIO and is still under active development and use today. It's one of the coolest technologies I've ever worked with.

It's used by the winafl fuzzer to provide basic block coverage for black box binaries.

https://dynamorio.org

What's criminal about selling to Zerodium though? I guess a case could be made that selling on the darknet is 'not in good faith'. That is an important criteria for determining if you're aiding and abetting where I'm from.

But this problem is not there with all avenues for grey market transactions.

It seems like many people disagree. But it's true.

Microsoft used to pay 20k for exploit primitives that could potentially lead privilege escalation. These days the bounty program seem to require a demonstration (read: working exploit).

Zerodium offers up to 80k for a working local privilege escalation exploit. Depending on the workings, if that exploit can be used to break out of a browser sandbox you might earn a bonus.

The whitehat bounties are not market rate, if you only look at the monetary rewards.

I think the op referring to monero (XMR).

I mean, GDPR is a step in the direction. Many websites, and by extension, people seem to think that you comply by 'gdpr' by putting up a stupid cookie banner.

But the real compliance is not storing PII, then you don't even need a cookie bar!

Not all of them. msimg32.dll has no certificate and many system processes attempt to load that. There are more dlls in system32 if you look. Neither does Wldap32.dll, which gets loaded into lsass and is part of the knowndlls...

Over time security measures always cause friction. You'll always be the annoying presence, the naysayer, the 'needlessly' difficult person. Effective security imposes restrictions, hurts egos and interferes in natural social responses.

It's funny you say that my way of working literally makes people want to do the opposite of trust me, when I send them a phishing e-mail that's exactly what I'm aiming for ;P

It was pretty much this scenario years back, as a result of that exact same scenario being used by bad actors.

The real thing happened, was detected and shut down. Then they did some trainings over the course of a year, and had us test the same thing again next year. Results were not particularly good, and people got upset that they did not receive the promised Christmas gifts.

Afaict, these trainings stop being effective at around 10%. That is, 10% of all people being phished like this will do everything you tell them to. Up to and including sending your their password and installing malware on their machines following your e-mail instructions.

I can attest that I have ran tests in a very similar vein at least three times. One of which also caused an uproar.

I also prefer my security measures procedural, technical and layered. Like I said before, phishing simulations don't really work for me at all... Currently many places where I do some work the security department have a large say in what happens, regardless of goodwill. Security measures always suck, are less efficient and cause no end of headaches, you mostly have 0 goodwill anyway.

I don't agree with you, but with the other posters in this thread. You can't just pull your punches, phishing and ransomware crime is currently skyrocketing. This is exactly the type of scenario that will entice many people to infect themselves with malware. This is also a scenario I've seen multiple _real_ e-mails of in recent weeks. It's not like your employees are not likely to receive something just as nasty as this over the course of their employ.

That said, I do agree with you that money is better spent elsewhere. A company with > 1000 employees should just assume there's an infected machine in their network 24/7. Defense in depth stipulates that this should not matter for their security.