bsmartt

so official microsoft documentation vs infosec twitter.

that's not how you back up an argument with proof. there are no microsoft engineers in that video. i see a laptop. is that from tiktok? how are you taking this guy's word for shit without even thinking? its like 13 seconds taken out of context showing a folder click and authorization (what's even happening here, is this an admin account?)

i dont understand why everyone is so confused and outraged. first off, it doesnt affect you. even if you do buy a microsoft laptop that is being marketed as the "ai powered technology revolotion" (or whatever), its shipping from the start with almost all the tools i can think of to help you only recall what you want. application exclusion by ifn, pause the stored data / purge stored data / or opt out forever. if you use edge, you can have it ignore incognito tabs or certain websites. The feature needs to be opt in without these restrictions set up because the people who might actually benefit here are people who don't want to be bothered with those power user features. like my grandma.

anyone who is worried about screenshots leaking, do you guys remember photoshop?

we already have keyloggers, banking trojans, infostealers, and for someone to access your recall screenshots they'll be in a position to infect your laptop with all the usual suspects in commodity malware. so they could start logging your keystrokes, pilfer your chrome browsing data, or they could start downloading a 25 GB file that they can't even decrypt, and (lets just allow them to decrpyt somehow). now they get the pleasure of looking through 25 gb of cat pics and reddit hoping they might find a picture of you logging into your bank where you toggle the show password field button. or maybe you don't ever reveal the password so he gets really mad because his ISP only gives him 30GB down / month and he just burned nearly all of it. he decides to dox you and your data, but there isnt anything connecting your real identity to these screenshots (which again, couldve been photoshopped, or you could create your win11 username as Sam Altman). And none of this is even going to happen this would be the first time ive ever heard of a hands on keyboard commodity malware controller who is targeting whomever he can breach and rather than just sitting back while keyloggers and bots phone home and exfil sensitive data as text in an automated way, he's at home dealing with these massive encrpyted archive files and bajillions of screenshots.

everyone be triflin' over some bullshit here, you guys know why they did this right, not because its useful or a good use of AI. all the big guys are racing to cash in on the consumer AI market and they want to tell wall st on the quarterly earnings reports that theyve got a new go to market strategy with AI and its going to lead to N revenue, and instead of slightly faster hardware the next surface launch is gonna be huge marketing event and if you guys in nyc want to bet on ai for consumers, buy more microsoft stock.

isnt this obvious my friends?

where did you hear that?

> Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots.

You can delete your snapshots at any time by going to Settings > Privacy & security > Recall & snapshots on your PC.

source: https://support.microsoft.com/en-us/windows/privacy-and-cont...

Just want to point out that GitHub removing the asset after 15 minutes is actually worse than leaving it. The least appetizing aspect of this for adversaries is that your payload is now forever available to anyone with the logs. If it were adversary’s choice (submit the issue and it stays, only draft the issue and it gets wiped, good riddance, a phenomenal c2 stager indeed!)

> To be honest, it's far above my knowledge

Just means it's an even better opportunity to learn!

Sure, but the implied motive for spinning this up is that people care to know if their flight is on a 737max or <anything else>, and because Boeing put its name on this Russian roulette with wings, commenter is attempting to align perception with reality?

Also, first flight number I could find is a 737max according to google but this thing says it isn’t a 737max. AC565, January 9, 2024.

I'm not really sure what to think about this yet. I suppose comcast has the consumer customer base so when news like this breaks shade naturally gets thrown their way. But it's hard to fault comcast for having netscaler infra (which i guess was acquired by citrix at some point? dont quote me on that). 9 days to patch isn't really what I call blatant negligence (which is what i'd like to think would make me likely to terminate my contract). It's not always easy to just yank node balancers from your perimiter, especially if you have as large and probably ugly permimeter as comcast does. I'm sure that most people on this site had very little faith to lose in Citrix/Netscaler prior to this incident, so it's not a surprise there's little focus on them here, but as far as the consequences in any form, I really doubt Citrix / Netscaler will face enough punishment. It's also unclear to me exactly what the consequences of this data leaking are. last four of my social? Well, my full social is already out there, thanks to equifax (if no one else).

There's also the fact that a large number of companies were and still are being popped with citrixbleed, ransomware has gotten in line for this ride, and i bet it will take 6+ months for 80% of vuln systems to be patched/purged. Again, 9 days?

Ars technica's Dan Goodin has two articles about this (ive shortened them a bit): Comcast waits 9 days to patch critical vuln The latest high severity citrix vuln isn't easy to fix

come on...

That’s fascinating. But assuming you aren’t one of the top two or three search engines, wouldn’t it hurt you as much if not more to stop crawling a major site like Nike which visitors surely expect to be crawled? If you are one of the top two or three, I would like to think their crawlers are amazingly complex and robust but maybe I’m just naive.

why was this posted today? I bought Little Snitch 3 in January 2013. I was thinking maybe this was a new major version but it's not.

wouldn't this be easy to "rig"?

geez, privacy.com, I wonder how much that domain cost.

I'm using a card from getfinal.com, which appears to be the same idea. So far so good, though it's not 100% disposable, I still have a plastic card who's number is no easier to change than a chase card.

Does this site get updated on any regular basis? It doesn't feel like it it's ever changed.

I thought their stack was django?

I just wanted to say I reaped a ton of benefit from some of the comments here. Thanks bros.

If you're using django, there's a chapter in the Two-scoops of django 1.6 book that covers django security. Have you looked into framework specific resources? If you're using one of the big ones, this may be the most practical place to start.

Nikto, and other free web app vulnerability scanners can be good for both learning and practical use in the real world (albeit not much more useful than low-hanging fruit). http://sectools.org/tag/web-scanners/

I've never liked the ghost as an logo cause it looks like a KKK hood.

WAY overvalued. This app is fucking basic.

I like the document style, anyone know if/how this was generated?

Working with information about attacks all the way down the killchain. Everything from IDS sigs, english descriptions, attribution, ip/host reputation.

AlienVault is hiring security researchers.

edit: we have some limited data sets that we make public, incase you're interested, hence the name 'open threat exchange'.

No, but you do need OS X.

This looked really awesome, until I noticed the fees, which seem really high.

For my senior project, I was able to find a company with work in the open source space, and got a job out of it from making notable contributions to their OSS offerings. Github issues and explore are good places to start. Try and get in touch with the project leaders.

I can't even get pyobjc running on 10.9..

packing techniques change rapidly, however you gotta start somewhere I suppose.

I've always felt that software bugs are much like typos in nature (not necessarily complexity).

Take public speaking. And don't slide by, ace it.

Use your elective credits to soak up business, finance, marketing, etc. classes.

Start working with web frameworks (django, rails, node) before you graduate.

Hit up those conferences while you can, most offer student discounts. This is a good way to explore the different sectors of the software development world. You can walk around the vendors areas and talk to recruiters at most companies this way, and you can often find engineers who will be happy to kill a few minutes talking about their company culture, etc.

Google Summer of code.

Get involved in open source communities, who always need volunteers. This can be a good segway into getting your hands dirty and contributing.

Do you really think this is universally good advice?