• 0 Posts
  • 67 Comments
Joined 2 years ago
cake
Cake day: June 7th, 2023

help-circle





  • Not a specific word or phrase, but Google Dorking is useful for limiting down search results. Just the basics of putting things in double quotes (e.g. “Find this exact text”) and negating words/phrases (e.g. -NotThis) can go a long way in refining search results. The “filetype:” modifier is much less useful than it was a decade or two ago, as SEO assholes have gotten wise to it and so include tags to show up on results using it. The “site:” keyword can be really handy, when you are pretty sure what you want is on a specific site/domain. Or, if you are trawling a website for specific information. You can also negate the “site:” keyword. So, you can add something like “-site:expertsexchange.com” to a search and get rid of useless advertising sites.



  • While I’m all for fresh ideas, one of the advantages to sticking with well known naming is that folks will often look for those things and might end up missing the community, if the name isn’t obvious and easily searchable. While “LFG” does imply that one is looking for a group, rather than maybe just a single other person, it also has a very long history in gaming and is a well known acronym. I suspect a lot of folks are going to specifically look for that acronym when starting their search. So, I’d argue with sticking with that classic.

    That said, it is your community and you should build the identity you want to build. So, don’t let some old curmudgeon like me push you away from doing something that interests you.


  • do any of you hate how self-hosting services like photo- or document-management systems, or even a simple rss tool, forces you to sort your stuff out, and put your decades old files in order?!

    What is this “sort” thing you speak of? I don’t sort anything, I have NextCloud syncing my entire photos, videos and documents folders and they are just as messy as ever. Granted, I do go through my photos and videos once a year and dump them in a folder named for the year they were taken. Occasionally, I’ll go hog wild and try to sort some of a year’s photos/videos into folders named after events. Though, that hasn’t happened in a number of years. I setup NextCloud so I could have everything synced to my own server and just forget, not have to deal with labeling my data.

    As for bookmarks. I already keep those in folders; but, I don’t sync those. I use my desktop far more than I use my phone for web browsing. And the types of things I use my phone for (mostly recipes), I just keep bookmarked there.


  • The first issue with running a coin miner is using company resources for your own profit. Your own system, using your own electricity, go for it. Running it on a company owned laptop, while at a company building, burning electricity the company is paying for. Ya, that starts to get uncomfortably close to fraud or theft. There is also that whole, “running unauthorized software on a company system, doing who knows what else in the background.” There is a very real possibility that the coin miner has unknown vulnerabilities which could allow remote code execution; or, just outright be malicious and contain a remote access trojan. Maybe he was smart enough to audit all the code it was using and be very sure that’s not the case. More likely, he just grabbed a random implementation of XMRIG, put his wallet in the config file and ran it. Either way, he also made a point of refusing to remove it, so we escalated up to management. With the recent ransomware outbreak having been in the multi-million dollar (possibly low tens of millions) damage range, refusing to remove unauthorized software went over about as well as a lead balloon. There may have been other factors at play; but, the unauthorized software and being a dick about removing it was what got him out the door.


  • If you spin it up, fucking own it. When you’re done with it, shut it down. I have long lost count of the number of times I’ve reached out to a team to ask about the coin miner they are running on some random EC2 instance only to find out that some jackass spun it up for a test, gave it a public IP, set the VPC to allow any inbound traffic, installed all kinds of random crap and then never updated it. Nor did it get shutdown when the test ended. So, a year and a half later, when the software was woefully out of date, someone hacked it and spun up a coin miner. Oh, and the jackass who set it up didn’t bother to enable logging or security monitoring. But, they sure as hell needed the ability to spin stuff up on their own. Because working with IT to get it done right would be too hard for their fragile little ego.


  • You joke, but I’ve actually been responsible for a coder getting shown the door for running a coin miner on his work laptop.

    In his defense, cyber security at that company was crap for a long time. After a ransomware outbreak, they started paying attention and brought some folks like myself in to start digging out. This guy missed the easy out of, “hey that’s not mine!” The logs we had were spotty enough that we would have just nuked the laptop and moved on. But no, he had to fight us and insist that he should be allowed to run a coin miner on his work laptop. Management was not amused.





  • Companies taking advantage of Linux to create locked down, proprietary systems is pretty common. For example, Android is Linux. Many smart TVs run some flavor of Linux. E.g. Tizen from Samsung is Linux based. If a company can short cut the software development process and licensing costs by using Linux, that’s often a first choice. So, my bet would be on Wall-E running on a version of Linux.

    The dystopian part would be that the company locked it’s drivers behind a closed source model, and only included highly obscured binaries on Wall-E’s OS. Motors and controllers would be non-standard, requiring closed source firmware and the hardware would refuse to work with any software which isn’t signed by an original manufacturer’s digital certificate. Using an unsigned binary would blow a fuse in Wall-E’s CPU, killing him.




  • Never mind recent motherboards, I’m still salty about the era of boards from 2004-2010 or so which had USB ports but the BIOS would refuse to accept inputs from them until after POST so you’d have to dredge up a separate PS/2 keyboard and jack it in to be able to configure the damn thing or use the boot menu.

    Had one of these in a server rack. Which was all kinds of fun because the rack KVM was USB. We ultimately just left the PS/2 keyboard plugged in and sitting on top of the server in the rack. Given the shitshow which was cable management in those racks (we shared them with several departments), that keyboard was hardly the worst sin.