CyberSeeker @ CyberSeeker @discuss.tchncs.de

Posts

1

Comments

54

Joined

2 yr. ago

due to increased ozone and airborne particles from the wildfires and heat wave

This isn’t directly due to industrial air pollution, but rather is the much harder to solve downstream impact of climate change.

Sigh, clickbait at its finest, why else would we click

I would look at CISA’s Logging Made Easy project, which is based on Wazuh and Elastic with Kibana for visualization and dashboards.

https://github.com/cisagov/LME

Curious if this is so broadly true without bundled resources; obviously screens are higher DPI, so even buttons are now designed for at least 8K resolutions, even if most consumers are still on 1080p.

Orders of magnitude beyond 640x480 or pre Windows 3.1 resolutions.

Explain your thought process here, how did you arrive at the larger bottle being 90% more detergent? It’s EXPLICITLY clear that the concentration is higher in the smaller bottle.

You could complain about the form factor or lack of precision in dosing loads using the higher concentration, but “detergent” is mostly water, which they clearly said they reduced by 75% (same solute, with less water/solvent = higher concentration).

Quick search and going by what it says on the label, the cost per load has not significantly changed, a little more than half a penny’s difference:

Ultra Concentrated (left) $15/60 loads = $0.25/load https://mrsmeyers.com/collections/laundry/products/ultra-concentrated-laundry-detergent-rain-water?variant=50673207640338

Standard (right) $18/74 loads = $0.2432/load https://mrsmeyers.com/collections/laundry/products/ultra-concentrated-laundry-detergent-rain-water?variant=50673207640338

You definitely should bump it up the list, especially if you can handle ray tracing, though the raster lighting is also good.

BE WARNED. These extensions are a prime target for purchase and/or hijacking by malicious threat actors, who then use them to gain persistence on your browsers and steal data. There is no reason to increase your browser attack surface for this feature when better alternatives have been posted in this thread.

https://www.bleepingcomputer.com/news/security/chrome-extensions-with-14-million-installs-steal-browsing-data/

https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extensions-discovered-on-2-6-million-devices/

There are dozens of these articles dating back the last five years or so.

Shouldn’t be this hard to find out the attack vector.

Buried deep, deep in their writeup:

RocketMQ servers

• CVE-2021-4043 (Polkit)
• CVE-2023-33246

I’m sure if you’re running other insecure, public facing web servers with bad configs, the actor could exploit that too, but they didn’t provide any evidence of this happening in the wild (no threat group TTPs for initial access), so pure FUD to try to sell their security product.

Unfortunately, Ars mostly just restated verbatim what was provided by the security vendor Aqua Nautilus.

Only the cyber truck. Model S and 3 refreshes are still on the legacy platform, with a lithium ion 12V.

This server, maintained by Internet carrier Cogent Communications

Found the problem!

So the article repeats, several times, “waymo relies on remote operators”. I don’t think the author knows what “self-driving” means.

For encryption, the client and server need to share their private keys.

This is incorrect, for asymmetric (public-private) encryption. You never, ever share the private key, hence the name.

The private key is only used on your system for local decryption (someone sent a message encrypted with your public key) or for digital signature (you sign a document with your private key, which can be validated by anyone with your public key).

For the server, they are signing their handshake request with a certificate issued by a known certificate authority (aka, CA, a trusted third party). This prevents a man-in-the-middle attack, as long as you trust the CA.

The current gap is in inconsistent implementation of Organization Validation/Extended Validation (OV/EV), where an issuer will first validate that domains are legitimate for a registered business. This is to help prevent phishing domains, who will be operating with TLS, but on a near-name match domain (www.app1e.com or www.apple.zip instead of www.apple.com). Even this isn’t perfect, as business names are typically only unique within the country/province/state that issues the business license, or needed to be enforced by trademark, so at the end of the day, you still need to put some trust in the CA.

So if ISPs are once again Title II common carriers, how can they enforce the TikTok ban? 🤔

I believe this is already the case; domain reputation is weighted pretty heavily by Gmail and others, so it will take some months before you’ve established enough rep. Following SPF/DMARC/DKIM is crucial, followed with time your domain has been registered and typical outbound volume from your domain.

That’s the benefit of a custom domain, I suppose; you can always change he provider without changing your email.

For your last two questions, the counterpoint is, if even Microsoft can’t stop a dedicated nation state, how can any other major service provider say they haven’t been compromised?

The standard now is, assume breach. While unfortunate, the industry average for MTTD is in months. Microsoft was at least good enough to detect it within six.

Can Broadcom or Palo Alto say the same? Amazon, Google, Apple, Cisco?

Agreed, the echo chamber is real on Reddit/Lemmy. Easy to hate on Elon, but people are acting as if the old men leading most other Fortune 100 companies think any differently than he does. You can find the rare exception, but you’ll have a hard time living in modern society without your money filtering up to a bigot somewhere.

Elon just lacks the filter to keep himself from saying it.