rishabhd

In India, they ramped up salaries after years of delayed pay commissions. Now cyber security guys in Government (even on contractual terms) are paid better than their private counterparts on average. For instance a malware reverse engineer might be paid around INR 600,000 (just starting out) - INR 40,00,000 (technical managers) on average in private sector. In Government, they vary between INR 10,00,000 - INR 50,00,000 per year along with a lot of extra perks. The downside is that positions are few, the hiring process is painfully slow and involves a lot of bureaucracy.

There is a woeful lack of cyber security acumen in government to actually amp up their hiring practices and strategy.

Probably an unpopular opinion, but doesn't it exposes workers to OPSEC issues? I mean, if it is a strike, there must be a way to identify how is it being organized/ co-ordinated via some social media/ messaging apps leaving them wide open for other nation state actors to identify who-n-who of CSE. That is assuming CSE employees are not profiled actively before this.

Try reporting something to Indian CERT, its a bureaucratic chore. I tried reporting multiple, still open issues but nothing happened. One exposed PII data at scale, the other one exposed credentials at a critical sector organization. Now I am not reporting it anymore because no one listens.

The key problem is that cyber in government is still very nascent, and security is an afterthought even in policy.

This is how much the complete insurance covered hospitalisation & surgery costed for my late father (RF tumour ablation) including tests and medicines. Key thing here in India is that there is no objection in use of generics - in one case, I was looking for a medicine which would cost me around 10 USD for a blister pack, the chemist looked at me and gave a generic one which costed around 2 USD. Hospitals tend to consider tests done at outside labs which may be done at lower cost (case to case basis). Surgeries conducted/ consultations provided on daily basis per doctor vastly outnumber as compared to US. Price breakups are clearly provided (and can be compared easily) and you pay for exact tests or consumables as prescribed. From where I live currently, thanks to the government capping, COVID-19 test costs between 10 USD to 35 USD, you are free to pick where you want it to be conducted and get the same results.

edit : added more details

Hate to say this, but having worked in similar industries, RFPs are sometimes deliberately skewed/ created in a manner that make it hard (or downright impossible) for others to participate.

Compliance at higher level, yes. Better than any ops guy at the same level. Atleast in India. Since I have been on the both sides, can comfortably say that it is the case.

Can relate. I am in cyber security and typically everything is on fire almost all the time. Haven’t had a proper vacation in aeons. A job in internal compliance is considered low stress in our field since it is mostly focused on creating risk plans and ensuring things are enforced by Ops, you are typically the driving force behind it. The pay is nicer as well.

edit : added more details

Too little, too late.

I thought zyxel was taiwan based. Also, big customer base in soho/ government (atleast in India, thanks to vendors who design their networks for them).

This reminds me of an old beautiful long read on the decline of Nokia. Warning, 10k word+ read.

https://communities-dominate.blogs.com/brands/2012/07/the-su...

Before the dawn of the DLC/ patching, a release like this wouldn’t even be possible no matter how hyped it was. Games would be delayed, but releasing a broken mess would be a cardinal sin since nothing could patch it once it was on disc.

Absolutely, a well made film with an amazing score. My annual christmas watch along with Michael Clayton. I hope someday they will make a sequel for this gem.

Hope this does not gets warped into something to the likes of Soylent Green/ Snowpiercer or Cloud Atlas in future.

That apart, since this requires FBS/ chicken cells, not sure if it is going to attract vegans. Pricing is going to be another interesting avenue. Do we have double blind studies if it really tastes like meat or is it just another experiment?

Just did a search on site for "facebook" (ignored community forums), all the results are very carefully worded and scrubbed as of now.

touché.

With our luck in 2020, it just might be Cthulhu's heartbeat.

Still very localized to cause real damages, difficult to reproduce (and get volunteers for). Then we have these report from China and Russia as well.

Isn't this an old one? I remember reading a report by guardian some time back.

https://www.theguardian.com/world/2017/sep/14/mystery-of-son...

That's why I opt for "non smart" TV's and then connect them with either a PS3/ PS4 to make them smart my own way. I get all the goodness of netflix and am not bothered by ads. Not to mention pihole is also configured as a local ad blocker in my network to keep those pesky ads out.

In our community (garhwalis), we are taught to cook from a very young age informally. Identifying spices, combinations, tempering, different ways of cooking, different curry preparations and how to optimize/ prepare with different ingredients is a common theme of growing up. To be honest I am quite glad it is still being taught and probably I will pass it on to my kids as well. Absolutely indispensable and important.

We maintain a sensor network which consists of multiple nodes which emulate network fingerprint and characteristics of popular services. We did multiple experiments over a period of 3 years as part of tuning our sensors one of which was changing the SSH port of one honeypot to 38651. Less than 10 hits were observed on it over a period of 6 months and 7 out of 10 were legitimate (or misguided, depends on how you look at it).

During our experiments, we learnt a lot of lessons -

   1) Attackers operate on a budget and are often time-bound (they have bosses as well). They have less incentive to target esoteric ports unless they have specific intel about it.
  
   2) It is always a better strategy to ensure you waste their resources. No one is going to do full port scans of internet. The last I heard, adding an extra port to ZMap takes around 500 MB of extra memory.
  
   3) The advent of intel sharing models typically highlight nasty scanners like a beacon.
  
   4) Very few ISPs provide high bandwidth pipes to their retail (or even privileged) customers do full port scans. Its always a fight between scanning via low bandwidth pipes via multiple nodes over a long period of time and have less updated data or having to pay a lot more to get a 10GB+ pipe to do it which is bad for OPSEC.
  
   5) Corollary to previous point, even if you control a large botnet that may do it for you, you will get reported or will have scanning, co-relation or computation issues. Or all of them.
  
   6) Pareto's principle is everywhere, 20% of security/ sanity measures will solve 80% of your problems. Simply changing network ports, running your infra over a closed VPN environment, reducing your public internet exposure, configuring dual factor authentication et al - it seriously reduced our infra monitoring/ management upkeep.
   
   7) The internet is full of spam (and water is wet), expect mass spam all the time on your mail sensors/ email IDs. Interacting with these will eventually get elevated to targeted attempts. Even simple browsing will sometime give you a high value malware payload served via AD networks that was previously unknown.

In other news, water is wet.

Jokes apart, if this is true then what is the legitimate use case for Facebook for getting access to router? This may be potentially used for ad fraud, DDoS, surveillance etc all of which have potential penalties. I wonder if they have added another clause in their ToS that they may use auxiliary mediums/ channels/ network devices to collect data so that they can improve customer ad delivery experience.

Read everything ever written by thegrugq and apply it.

Actually, I am a big fan of the work you do for CVEs, I have had the privilege of having technical discussions on security vulnerabilities and you guys seemed to know almost every trick in the book.

Now that you mentioned it, I believe you guys have been imbibed with years of valuable experience, it is an absolute pleasure to interact with your team.

Reminds me of this classic haiku -

It's not DNS. There's no way it's DNS. It was DNS.

Well, I had to leave for my hometown (post COVID19 lockdown in India) which is a Tier 2 city where I don't any copper/ fiber connectivity in my area apart from government backed BSNL which is a pain to get. To compensate, I have 2 provider plans which I shuffle for doing my work.

1) Vodafone : I pay around INR 588 (~USD 8) for an unlimited calling plan with 200 GB data per month, unused data is credited to next month. Speed varies around 4 Mbps - 32 Mbps, throttles some websites such as BBC/ NYTimes and torrents (no idea why). Streaming services work flawlessly.

2) JIO : I paid around INR 599 (~USD 8) for 84 days with unlimited calling + 168 GB high speed data (downgrades to 64Kbps post exhaustion). Speed varies around 3 Mbps - 24 Mbps. Also throttles some websites as per Department of Telecom (DOT) guidance.

I manage my servers, download abandonware games (which were cool in circa 2000s), code and use streaming services - so far so good. Other providers provide similar offerings as well. The only challenge so far has been to keep my cellphones constantly charged.

Edit : added country details.

I wish they were available natively (they are via PS Now). I now play MGS2 on my PC by leveraging this (https://github.com/VFansss/mgs2-v-s-fix/wiki) and MGS3 via PCSX2 emulation.

I kind of stopped playing after MGS3 - tried MGS4 but it deviated too much from its roots. MGS5 is just okay but since there is no David Hayter so not a true MGS for me.

My mind has been blown to smithereens by literally playing his games during the course of my life - playing MGS trilogy annually is kind of a Christmas tradition for me. It is simply my favorite videogame trilogy of all time.

The first time I fought against Psycho Mantis, I simply marveled the genius behind the fight. MGS2 was way ahead of the curve in almost of all of the aspects - smart texturing work, AI squad tactics, pinpoint pointer shooting accuracy, the still amazing weather effects, cue to the future of information warfare and fake news, VR missions, realtime cutscenes which I can't believe were possible on PS2 during its early stages, the score by Tappy/Harry Gregson Williams/ Hibino, superb VR missions, crisply written dialog and narrative - I still discover something new during my annual playthrough. MGS3 broke grounds by pushing PS2 to its limits, details such as the way the bullets rustle leaves during enemy skirmishes, realtime cutscenes that still hold very well today, probably the best boss fights in the series, great story, score, tight controls and that Hideo Kojima touch. I still remember the fight with The Sorrow, I had no idea on what to do and then I realized - these are characters that I have killed over the course of the game.

Kojima, is an auteur and a master of his craft.

Bonus edit: I recently discovered by accident (epsxe mis-configuration) that MGS1 detects if the player has a monoaural TV set during the fight with Hind D. Video here (not uploaded by me) https://www.youtube.com/watch?v=TzG8Sty9veI

I came back to my hometown due to this lockdown and had the pleasure of having homemade butter again. Good heavens, it was peak gourmet if there is anything like it. The best part : I learnt how to make it.

and I am re-playing Metal Gear Solid 2 for the nth time, a postmodern gem. Never ceases to amaze me.