Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)X

xylogx

@ xylogx @lemmy.world

Posts
42
Comments
314
Joined
3 yr. ago

  • Democratic lawmakers call for constitutional right to privacy in Wisconsin

    Jump

  • 110% agree.

    We need national privacy legislation with teeth. Companies will collect our data whether we like it or not, they need to be held accountable and pay the price when they violate the trust and privacy of their users.

  • Can a reasonable person genuinely believe in ghosts?

    Jump

  • It is disturbing when people take this kind of mysticism seriously. I could say a lot about this but it may be best just to refer to the words of Carl Sagan:

    “I have a foreboding of an America in my children's or grandchildren's time -- when the United States is a service and information economy; when nearly all the manufacturing industries have slipped away to other countries; when awesome technological powers are in the hands of a very few, and no one representing the public interest can even grasp the issues; when the people have lost the ability to set their own agendas or knowledgeably question those in authority; when, clutching our crystals and nervously consulting our horoscopes, our critical faculties in decline, unable to distinguish between what feels good and what's true, we slide, almost without noticing, back into superstition and darkness...

    The dumbing down of American is most evident in the slow decay of substantive content in the enormously influential media, the 30 second sound bites (now down to 10 seconds or less), lowest common denominator programming, credulous presentations on pseudoscience and superstition, but especially a kind of celebration of ignorance”― Carl Sagan, The Demon-Haunted World: Science as a Candle in the Dark

  • Under the most ideal circumstances, how 'clean' is drinkable tap water by the time it reaches our taps?

    Jump

  • What old person thing do you do now that you wouldn't have guessed you'd do when you were younger?

    Jump

  • How excited I am about buying a new frying pan.

  • True

    Jump

  • Did they find it?

    Modern technology can render the phrase "like finding a needle in a haystack" obsolete. | Partly busted | While it is possible to find a needle in a haystack, even using specialized machines to do so takes a considerable amount of time, particularly since bone needles cannot be picked up by magnets. The task is difficult enough to still make the saying viable.

  • True

    Jump

  • What happened?

    Modern technology can render the phrase "like finding a needle in a haystack" obsolete. | Partly busted | While it is possible to find a needle in a haystack, even using specialized machines to do so takes a considerable amount of time, particularly since bone needles cannot be picked up by magnets. The task is difficult enough to still make the saying viable.

  • If there is a doctor that only saves killers, and a killer only kills other killers, I wonder who would save/kill more people?

    Jump

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • Take a look at Shai Hulud. All the attacker had was the key.

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • I would feel more comfortable running curl bash from a trusted provider than doing apt get from an unknown software repo. What you are trying to do is establish trust in your supply chain, the delivery vehicle is less important.

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • What you said is the key infra needs to get compromise. I do not need to own the PKI that issued the certs, I just need the private key of the signer. And again, this is something that happens. A lot. A software publisher gets owned, then their account is used to distribute malware.

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • Not sure how else to explain this. Look at the CISA bulletin on Shai-Hulud the attacker published valid and signed binaries that were installed by hundreds of users.

    "CISA is releasing this Alert to provide guidance in response to a widespread software supply chain compromise involving the world’s largest JavaScript registry, npmjs.com. A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages.[i]

    After gaining initial access, the malicious cyber actor deployed malware that scanned the environment for sensitive credentials. The cyber actor then targeted GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for cloud services, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.[ii]

    The malware then:

    • Exfiltrated the harvested credentials to an endpoint controlled by the actor.
    • Uploaded the credentials to a public repository named Shai-Hulud via the GitHub/user/repos API.
    • Leveraged an automated process to rapidly spread by authenticating to the npm registry as the compromised developer, injecting code into other packages, and publishing compromised versions to the registry.[iii]"

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • If I can control your infra I can alter what is a valid signature. It has happened. It will happen again. Digital signatures are not sufficient by themselves to prevent supply chain risks. Depending on your threat model, you need to assume advanced adversaries will seek to gain a foothold in your environment by attacking your software supplier. in these types of attacks threat actors can and will take control over the distribution mechanisms deploying trojaned backdoors as part of legitimately signed updates. It is a complex problem and I highly encourage you to read the NIST guidance to understand just how deep the rabbit hole goes.

    Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • Signatures do not help if your distribution infra gets compromised. See Solarwinds and the more recent node.js incidents.

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • Yes this has risks. At the same time anytime you run any piece of software you are facing the same risks, especially if that software is updated from the internet. Take a look at the NIST docs in software supply chain risks.

  • Vibe Coding Has a Security Problem Nobody Wants to Talk About

    Jump

  • As a security professional it amuses me that you think non-AI generated code is manually reviewed for security. Either you are committed to code quality or you are not. If you are you have automated testing, standard architectural patterns and vulnerability scanning. Peer reviews are great but do not scale and are far from comprehensive.

  • Why Chains are Still Better for Bicycles than Belts

    Jump

  • I have 10,000 miles on my belt, no chain I have ever owned has lasted anywhere close to that. The efficiency difference is real, but less important for ebikes.

  • How do you know youre getting burnt out at work?

    Jump

  • One red flag for me us too much multitasking. If I have too many things I am working on and none of them are getting completed eventually switching between tasks becomes so disruptive I cease to make any progress on anything. I fight this with focus and prioritization: find the things that are most important and focus on them until closure.

  • Cold and expensive vs hot, cheap and eco-friendly: the contrasting histories of home heating in the UK and Sweden

    Jump

  • “Without the option of “clean” natural gas, Sweden turned to district heating – an idea which had originated in New York in the 19th century. But Sweden committed to it in a big way during the 1960s and ‘70s, deciding it was the best way to meet the heating needs of the 1 million homes now being built. This decision shaped the way homes in Sweden are heated: today, some 90% of its multi-family apartment blocks are connected to district heating systems – with heat distributed from power plants (usually on the edge of cities) as hot water via a network of pipes.”

  • Chip-processing method could assist cryptography schemes to keep data secure

    Jump

  • This seems like a bad idea. How do you protect against spoofing? Seems inferior to traditional smart cards and private key crypto.

  • pics @lemmy.world
    xylogx @lemmy.world

    War on Christmas 2: Rudolph Strikes Back

  • wildlife photography @lemmy.world
    xylogx @lemmy.world

    Deer in the snow

  • pics @lemmy.world
    xylogx @lemmy.world

    Did we learn nothing from Terminator? Skynet? Hello?

  • Mildly Interesting @lemmy.world
    xylogx @lemmy.world

    Bonus Bun

  • wildlife photography @lemmy.world
    xylogx @lemmy.world

    Red Fox

  • pics @lemmy.world
    xylogx @lemmy.world

    Twelve Coffee Day

  • Life Pro Tips @lemmy.world
    xylogx @lemmy.world

    LPT: Easy way to convert Celsius to Fahrenheit

  • pics @lemmy.world
    xylogx @lemmy.world

    Fall colors this way

  • pics @lemmy.world
    xylogx @lemmy.world

    The Moon on a crisp, clear autumn evening

  • pics @lemmy.world
    xylogx @lemmy.world

    Nice dusk trail ride

  • Linux @lemmy.ml
    xylogx @lemmy.world

    Need text editor advice

  • pics @lemmy.world
    xylogx @lemmy.world

    Weeping Willow

  • pics @lemmy.world
    xylogx @lemmy.world

    Orb Weaver

  • pics @lemmy.world
    xylogx @lemmy.world

    The Nashville Parthenon

  • pics @lemmy.world
    xylogx @lemmy.world

    Red Fox

  • pics @lemmy.world
    xylogx @lemmy.world

    Whats up doc?

  • pics @lemmy.world
    xylogx @lemmy.world

    Cool sky

  • Showerthoughts @lemmy.world
    xylogx @lemmy.world

    The horns emoji is the hearts emoji for boys