SCHiM

14 ms·

91.
by SCHiM 6y ago
Indeed that is the strangest thing. By _any_ metric coal is far worse. Even the metric "amount of radioactive material that ended up in the atmosphere per watt of energy." (Coal contains trace amounts of radioactive material, that
92.
by SCHiM 6y ago
Too right. It's just evolution really, survival of the fittest. Software that can afford to have 100 developers work on it will, on average, out-compete software that is sustained by 50 developers. Software (note: not necessarily _good
93.
by SCHiM 6y ago
Grew up reading Phrack too. Work as pentester these days. I understand code deeply, and have tried my hand at everything from memory corruption exploits to javascript SPA apps. I hate technology more and more. It's moving in the wrong
94.
by SCHiM 6y ago
That update that was supposed to be off (a known problem.) Bricked my VPN config in a time of quarantine away from home. That was a fun thing to explain. My respect for this company was stellar, but is now around rock bottom. For me that wa
95.
by SCHiM 6y ago
If we manage to increase the sensitivity a few more orders of magnitude, and put an array of these devices in a sphere, we can make gravitic sensors!
96.
by SCHiM 6y ago
Strange, my experience is also the exact opposite. I really wonder why that is? I'm running about 10 windows 10 machines, various builds, auto updates enabled. Some in a domain, some in a workgroup. The last time an update bricked a sy
97.
by SCHiM 6y ago
You are, as a saas I think. I mean, this gives you all the control, you can charge for all sorts of services and "value adds". There's no reason you, as the maker of this software, would want this available as a block chain.
98.
by SCHiM 6y ago
The answer is piracy again. For a moment in time, piracy of movies and series was at a low point. Recently, with the fragmentation of all the different streaming services it's rising again.
99.
by SCHiM 6y ago
What is wrong was the immediate jump from "Fat in organs is the fat we eat from food". It seemed a natural and simple explanation at the time. Now it appears it's not that clear. It's the excess of sugar in everything th
100.
by SCHiM 6y ago
I like Network Attacks and Exploitation: A Framework by Matthew Monte. It makes a clear and comprehensible case about the various asymmetries in cybersecurity and gives a detailed overview of failed past strategies, and strategies currently
101.
by SCHiM 6y ago
I recognize the fact that the argument is exactly the same as for not opening up the appstore in the first place. But the importance and scope of it is less if the store is open. Now you can chose to buy en expensive device (or you did in t
102.
by SCHiM 6y ago
You install those yourself you know. I'd rather have a choice than not. I feel your pain in the sense that that I think user UX will take a hit, but I think that's less important than breaking the monopoly of the current app store
103.
by SCHiM 6y ago
Funny how that works. An algorithm, a computer, can ban your entire virtual presence at a whim, with no recourse. (talking about Google obviously). But the opinions of incensed humans aren't worth the rollback it takes to "correct
104.
by SCHiM 6y ago
I know how that goes I guess. Slowly "rules" and "procedures" from the behemoth come into play. Before he knows it, his successful methods are "against the rules", and doors slowly close. I love that dynamic &#
105.
by SCHiM 6y ago
Right but that's just it. I've always toyed with the idea of honeypots in my mind. But I'm not sure what type to incorporate into existing security measures. I primarily deal with big financials and fintechs. The problems the
106.
by SCHiM 6y ago
So say you're in charge at a financial organization, and you're sprinkling fake alliance servers here and there in your network. How is that going to catch an actor like lazerus? They're not going to scan your service, or att
107.
by SCHiM 6y ago
I'm wondering, given how threat actors normally behave when intruding into networks, do you also have honey user credentials in the network? I don't imagine you're catching many serious attackers just by exposing fake servers
108.
by SCHiM 6y ago
There's an example of how this looks in this teardown: https://gru.gq/2019/12/07/baltic-counter-disinformation-2/ This explains more background: https://gru.gq/2018/11/08&#
109.
by SCHiM 6y ago
This project grew into an insanely powerful tool. It's called DynamoRIO and is still under active development and use today. It's one of the coolest technologies I've ever worked with. It's used by the winafl fuzzer to p
110.
by SCHiM 6y ago
What's criminal about selling to Zerodium though? I guess a case could be made that selling on the darknet is 'not in good faith'. That is an important criteria for determining if you're aiding and abetting where I'
111.
by SCHiM 6y ago
It seems like many people disagree. But it's true. Microsoft used to pay 20k for exploit primitives that could potentially lead privilege escalation. These days the bounty program seem to require a demonstration (read: working exploit)
112.
by SCHiM 6y ago
I think the op referring to monero (XMR).
113.
by SCHiM 6y ago
I mean, GDPR is a step in the direction. Many websites, and by extension, people seem to think that you comply by 'gdpr' by putting up a stupid cookie banner. But the real compliance is not storing PII, then you don't even ne
114.
by SCHiM 6y ago
Not all of them. msimg32.dll has no certificate and many system processes attempt to load that. There are more dlls in system32 if you look. Neither does Wldap32.dll, which gets loaded into lsass and is part of the knowndlls...
115.
by SCHiM 6y ago
Over time security measures always cause friction. You'll always be the annoying presence, the naysayer, the 'needlessly' difficult person. Effective security imposes restrictions, hurts egos and interferes in natural social
116.
by SCHiM 6y ago
It was pretty much this scenario years back, as a result of that exact same scenario being used by bad actors. The real thing happened, was detected and shut down. Then they did some trainings over the course of a year, and had us test the
117.
by SCHiM 6y ago
I can attest that I have ran tests in a very similar vein at least three times. One of which also caused an uproar. I also prefer my security measures procedural, technical and layered. Like I said before, phishing simulations don't re
118.
by SCHiM 6y ago
I don't agree with you, but with the other posters in this thread. You can't just pull your punches, phishing and ransomware crime is currently skyrocketing. This is exactly the type of scenario that will entice many people to inf
119.
by SCHiM 6y ago
The reason they don't is because they don't want to find out things like this. There's no reason a company as rich as apple _can't_ do such interviews...
120.
by SCHiM 6y ago
Not sure on the Linux situation. But this is an established technique on Windows, where stack canaries can be bypassed by overwriting SEH chains (trap handlers) on 32bit windows processes. Which are, strangely enough, recorded as function p

More ›