technick

Easier to run tails or other live distros that don't store anything on disk and then run memtest afterwards.

I assume Kandula was a microsoft user and it's widely suspected there's a backdoor for law enforcement.

The level of incompetence on NCS's part is criminal, they absolutely deserved what they got. It could have been much worst, as in the malicious actor finding a way to insert code that makes it into production and then exfiltrating sensitive data to be sold on the dark web. Luckily Kandula wasn't smart enough to think like one of us.

NCS sounds like a clown show based on this article. The administrator credentials should have been changed as soon as Kandula was let go. Ideally, these credentials shouldn't have ever been used and everyone should be acting as themselves with a elevated privilege step.

As for the $678k in damages, why didn't NCS have snapshots that they could have quickly restored? Sounds like their BCDR plans need to be reviewed and updated.

Moral of the story is don't do business with NCS.

It's time to goto war with Roku and their penny grasping scumbag management.

I'm breaking up with google next year. Can't wait to be free of their crap.

I hate advocating for new laws but we need something to fix this imbalance that really screws over the worker more than anyone else. I recently left a company due to investors wanting to sell the company and a statement in the original RSU documents stating that I forfeit my shares upon leaving at the price the CEO sets really screwed me. The CEO decided my 4 years of shares were worth 2 cents a piece.

As someone else struggling to find a job, I understand. I would still have my last job if I was a little less transparent and made infosec a blackbox. I gave this company almost 5 years of my time, only to be told "Your services are no longer needed" and given 6 weeks of severance, then forced to sell my private RSU's for 2 cents a piece.

Most companies I've applied at don't respond, the < 5% that do respond with a rejection, they send the rejection email during the weekends which makes me wonder if they have people in other countries reviewing resumes.

I'm not a spring chicken either, I've been doing tech since 1999. Started as a linux / unix admin which became devops between then and 2016. I was doing security work but didn't have a security title until 2016. A lot of DevOps includes security, just it's never called out. I've been in dedicated security roles since 2016, making it all the way to lead security engineer and leading a team of 2 other people. Still I can barely get an interview and when I do get an interview, it ends with "We like you but we're going with another candidate or we don't feel your senior enough. Let me briefly highlight some of the gold nuggets I remember from my recent interviews.

* I did a 30 minute interview for a security architect position at a media company. It was me and another guy talking over a network diagram and the questions that need to be asked. I got all but one, which was about the hardware (Network DVR) becoming sentient and threatening physical damage.

* Did 5 hrs of interviewing for a Senior Security Engineer (detection) only to be put paired with a python developer in the end and asked to write code well beyond what the position called for. I can script and I never claimed to be a developer. But let me show you this thing called Copilot and ChatGPT, or if I need something advanced, I'll ask someone who knows more than me to help out.

* Another interview for a security architect at the local water company. They asked why I want to be a security architect, I respond with, "I'm into making sure security is baked into platforms as it's being designed, it's more optimal that way over shoeing in security as an after thought.". Hiring manager replies with "We've been around for over 100 years, we don't design anything new."

* I interviewed at a major password management company (the biggest) and was talking about their recent breach. In the aftermath they claimed to be encrypting all fields going forward, interview confirmed they lied and are not doing it now. I complained about vendors lying as they lied to me during a vendor review at my previous job. HR let me know later that they "liked me but decided to go with another candidate", probably one that doesn't care.

* I've had two jobs basically ghost me, say they wanted to create a new job position that fits all of my skills then go radio silent.

* A place that rhymes with dox had me interview with someone who thought a WAF can stop malware / ransomware from spreading on a internal network. I didn't know if this was a test to see if I corrected him or not, and if I corrected him will that blow my chances. The recruiter brushed me off and didn't respond for over a month after the interview.

* A few other interviews have turned into dick measuring contests on who knows the most irrelevant crap.

I've applied at jobs that I check every single box on their job posting and they don't even give me the time of day for a conversation before receiving a rejection. I'm getting tired and frustrated with the screwed up practices we've allowed to grow in our industry.

Absolutely, I'm already seeing some chatter from groups that want to get "even" with Caesars for displacing a 25 year tradition for strategy. I hope they have some good defenses installed now that you've pissed off no less than 10k infosec people.

Which is stupid because Caesars breach was directly tied to Okta's breach.

Caesars was hacked by the same attackers that pwned Okta, and used the stolen keys and tokens to get into Caesars. It was nothing carried out by Defcon in any way.

Anyone that takes this scene seriously knows Defcon is the place to be. Blackhat is a overpriced vendor circle jerk. The only way to make Blackhat relevant again is to kick out all of the vendors and if you can't do that, forbid them from collecting peoples information.

This is going to be my 11th year at Defcon this year. I snuck into a couple of blackhats and didn't get any value from them. I've been around the block a few times.

I will need to dig up the archives from DC 27 when the deal with Caesars forum was officially announced, but if memory serves me correctly DT said it was a 5 or 10 year contract. So unless there was some verbaige in the contract that allows Caesars to cancel for any reason, they're going to be cutting DEFCON a check.

I was forced to deal with an FBI agent last year. I authenticated him by calling the local FBI office and asking the person who answered to authenticate the agent. I got the number of the FBI office off way back machine.

I've been told by people who work at Delta, if they lose your bag, tell them the bag contained the cremated remains of a family member. They will go the extra mile to find that bag instead of compensating you for it.

I got my first taste of teams about a month ago. I had to install it on my personal laptop for a job interview. After installation, my laptop started displaying notifications encouraging me to renew my monthly subscriptions to Microsoft Office and Xbox Game Pass, things I haven't had a subscription for in over a year. It automatically set itself to start up with the computer which isn't unexpected. However I disabled the startup and it still launches when Windows restarts. Only solution was to remove it. I don't know why people waste their time using teams, it's such a trash app written by a trash company.

The only thing I've ever had issues with doing it remote is writing compliance policy, operational guidelines, and organizational standards. My boss wanted them re-written once every year into a different format and it destroyed my soul. What we had worked fine and didn't need to be re-written in my opinion.

I'm mostly on board with your proposal as I've seen a felony speeding conviction stop a friend from getting tech jobs over 5 years after it happened. His situation would have been totally different if he was caught 2 weeks before, it wouldn't have been a felony but the state arbitrarily changed the law. He didn't wreck, cause a wreck, or wasn't participating in street racing.

What if I told you my dogs are afraid of drones but don't flinch at fireworks blowing up 400 ft above them?

I'm going to be rather blunt here because I love fireworks and your argument is tired and has been played out on every local nextdoor, reddit, and facebook group. The problem with the world today is everyone is so worried about offending someone else that they give up their own freedoms and that's where I draw the line. I'm sorry you hate fireworks but at the same time, I'm not. I'll continue traveling across the Colorado state line to buy my boom booms, and setting off my "illegal" fireworks in a safe manner. If we banned everything that could be potentially dangerous, we wouldn't have cars, electricity, or many other facets of life.

You do you, if you hate fireworks, please move some place far away from where other people might celebrate with fireworks. Same goes if you have PTSD, living near other people can be noisy at times and you might find refuge living far out in the woods, away from any thing that might trigger your PTSD. Lastly, please desensitize your dogs to fireworks. Everytime a firework goes off, turn it into a party for your dog with their favorite treats. Eventually the dog will look forward to the next boom.

Lastly, it's well known the NFPA has been anti-fireworks for over 100 years now. They produce one sided propaganda to support their straw man argument.

It would be cool if there were laws or something requiring the acquiring company to keep all employees on the payroll at their pay rate when the acquisition occurred, for a minimum of a 18-24 months. Sadly the majority of our politicians are glorified fluffers for big corporations, so nothing like this would ever happen.

That's all I needed to see before making up my mind, Google needs to be broken up, or alphabet or whatever they're calling themselves these days. Advertising needs to become a separate company, not managed by anyone with controlling stakes in google and visa versa.

Bambu Labs is pretty darn awesome.

I make things for conferences with 3d printers. I started with Wanhao printers, then went to Aurora Jaguar's... and then Prusa Mk3s's... and now am looking at a mixed print farm of Prusa MK3s and Bambu Labs X1C's. I'm selling the rest of my Prusa printers in the coming months and replacing them with more Bambu's, their product are amazing and 3-4x faster than prusa printers.

I love Prusa but they were caught sleeping at the wheel, they stopped innovating until bambu labs woke them up.

The irony is my company is starting it's annual hackathon week. The company has gone out of its way to make Google AI available for us, met with Google employees who are rolling out the red carpet to give us access to unreleased tools, features and experimental apps. We were already tightly partnered with google before this, so it all makes sense google wants to see we very successful, meaning we can never leave them for AWS or Azure.

I feel like each team is looking for a way to optimize another teams work, making them more expendable after we fully adopt AI systems. Really feels like a race to the bottom, luckily only a handful of people know what I do and they don't have access to my systems to even start trying to figure out how I can be replaced. That's called job security my friends...

I believe anyone saying AI isn't going to reduce jobs is full of crap, it's going to happen.

Now they should do a article on parents who move in with their children.

I can't wait for that to happen

I think some of the things coming out of Russel Brand is lunacy, however I'm also 10000% against censorship. Youtube stepping against Russel Brand is virtue signalling at it's finest, when Russel Brand has not been convicted of any crimes. A small group of people can claim X did something evil against them, and Youtube will run with it blindly.

I never liked WebP, it didn't solve anything.

They've been saying this since Jurassic Park came out in the mid 90's, still nothing has ever materialized.

I'll believe that when pigs fly...

Anyone can become a PI in Colorado with just some business cards.

I have PTSD from listening to my friends complain about qmail back in the early 2000's.

SMS is the only way to get 2fa with a dumb phone and without a physical 2fa token.