eswat

Seems these animations are not really in the sign up process, rather at certain completion milestones. From the article:

> [We improved the Sign-up flow by] Removing anything extra like images, so you could move faster without distractions.

Find a site the target visits frequently that lets you inject something that will make a request to your server (“poisoning the well”). Use the gathered IP address, User-Agent and Language headers to start building a persona to look for.

> It's a little bit like scyscrapers in Dubai, which look like someone in the 90s read sci-fi from the 60s, rather than futuristic it looks retro and nostalgic, missing the entire point.

Keep in mind this game is loosely based on a 90s role playing game. Sure they probably have a lot of leeway in art direction but there’s probably some faithfulness to the original setting they want to keep (which is a little bit like skyscrapers in Dubai[0]).

https://cdn.shopify.com/s/files/1/0274/0781/products/NightCi...

There’s a difference between certificates and certifications. Certificates are just a document showing you completed a course. Certifications are for those that have proven to a certifying body that they know the requisite skills and knowledge of a specific role.

ie: there’s a difference between having a certificate showing you’ve finished some Certified Ethical Hacker course, and actually having the Certified Ethical Hacker certification. The former is not worth much, even for govevernment or their vendors.

If your goal is to learn something deeply and not just get something out the door, I don’t believe “just build something” is not the prevailing wisdom.

Building something is a part of how you reinforce what you've learned from actual material like books, documentation and others research. You still need to know some of the basic building blocks to get started.

Most gig work is done through middlemen/platforms where only some contract work like that exists and typically for longer engagements (ie: through agencies and temp staffing).

Contractors also have more flexibility to develop a relationship with the “client” for better opportunties down the road without the middleman/platform interfering.

Developing software that fulfills functionial or gameplay requirements is going to require a very different skillset compared to fulfilling security requirements (user stories become abuser stories, and they aren't always easy to wrap your head around).

Corporate Japan has also lagged behind western companies in this area. The book Business Management and Cybersecurity by Shinichi Yokohama dives into this.

SpyCloud did an interesting writeup on at least one credential stuffing tool used months ago in this attack: https://spycloud.com/technical-analysis-nintendo-account-che...

This attack affected regular Nintendo accounts that are free, not just those using Nintendo Online (the paid service).

Did you have a Nintendo Network ID linked to your Nintendo account though? Was that NNID password secure?

Source (Japanese) https://www.nintendo.co.jp/support/information/2020/0424.htm...

> article said possible downloaded "booby-trapped files"

They gave that as a general example, not for this attack specifically. The article doesn't rule out an attack originating from outside the network (ie: phishing).

Past how robust the tech scene is in your desired location, you also have to ask how the pandemic will affect your time outside of work. ie: Montréal will be just as boring as Ottawa in terms of the nightlife scene for a while.

> However, if your version of getting ahead is to have a loving family, or to spend time on the hobbies you like or traveling or <insert other non-monetary thing here> then you can (and sometimes even have to) spend less effort on the game.

Money – and thus at least understanding the game enough – is often a precursor to getting enjoyment out of those things though, to various degrees. Probably less so with family, if the dynmaics are healthy, but definitely more needed for certain hobbies and travel.

Yup. It's "digital by default" not "digital at all costs".

Seems they'll keep their current offices but reformated as spaces for people that really want to work amongst each other physically, instead of expecting the majority of workers to come in every day.

Notice of cyber security incident: https://otp.investis.com/clients/uk/easyjet1/rns/regulatory-...

The economy ≠ the stock market

Investors are expecting things to get better in the future and pricing stocks based on that.

These are the big hindsight takeways I’ve seen as I’ve pivoted from web design/development towards information security.

1. For me it's hard to stay motivated learning a new technical topic if I can't connect it to some plausible future where my life would benefit from the knowledge. If I’m not addressing any pain points then the drive to study just won't be there.

2. Realize that there’s going to be an overwhelming amount of resources and tactics you can use to learn the topic. But they’re all not created equal and some may get you to your desired destination faster than others. This is highly personal; not every method of learning works for everyone (ie: I dislike learning theory through videos and lectures, highly prefering technical books instead).

3. Find a group of people that's at least slightly above your knowledge level in the topic and learn through osmosis. While I was able to pick up the foundations of infosec on my own it wasn’t until I was learning with others, especially while preparing for certification exams, that I got to learn more of the intricacies of the topic. Learn with others that have a similar drive as you.

4. Set weekly goals and dates in the future that you really need to test your knowledge to see if you understand the material. Security certifications, while I was a bit rebelious against at first, served this purpose for me perfectly. I’d set weekly goals to learn material based on a courses' syllabus and every few months there was the ultimate test to show I actually grokked the topic, which huge burst of hedons along with it (if I passed, which has been a 3-exam streak for me so far).

There are a few RCE disclosures for Valve games related to this previously

- https://hackerone.com/reports/542180

- https://nvd.nist.gov/vuln/detail/CVE-2020-9005

- https://nvd.nist.gov/vuln/detail/CVE-2020-7952

- https://nvd.nist.gov/vuln/detail/CVE-2020-7951

- https://nvd.nist.gov/vuln/detail/CVE-2020-7950

- https://nvd.nist.gov/vuln/detail/CVE-2020-7949

Isn’t this something you should be asking your manager or leadership? How are we supposed to know what metrics are important for your company for you to hit?

Or by individual do you mean personal growth?

Likely would. The `validMAC` function doesn’t just fail silently if the regex fails, which would get past naive signature detections. Oh and feeding user input directly into `exec`…

Mostly continuing certifications in InfoSec. Got OSCP recently, will be getting GWAPT in a few months. Looking to earn OSWE before the end of the year.

A bit. A gaming channel that I've been hanging around in since 2003 made the bittersweet move of migrating to Discord as more and more people stopped using IRC.

Given that a lot of InfoSec teams I'm in also use Discord I didn't mind the shift. But my paranoia makes me think that maybe our new home may have a higher chance of imploding due to factors out of our control than when we just stuck on GameSurge.

I just completed a difficult cybersecurity certification exam (OSCP) and if I had to summarize my learning path for that:

- Figure out a time where you want to become proficient in the skill by – something that balances between setting a fire under you while not being impossible to meet – then develop a weekly learning plan roughly based on that

- Learn a lot of things from many resources, instead of learning everything from a single resource. Cross-pollinate the ideas of several authors. I like to combine text books, audio books, hands-of practice with things like labs or side projects and just talking to others about what I'm learning

- Don't burn out and take a couple days off the learning path every once in a while

This may be sound for someone with a moral compass. But you could also say wealth is the value you take from others (scams or well-meaning offers to others with highly questionable value).

Have you looked into cybersecurity in a non-engineering role? I’ve transitioned from a web development background towards penetration testing specializing in web applications. While I don’t get to code as much as before I still get to retain some of that knowledge through coding small proof-of-concepts every now and then.

Canadian version: https://i.imgur.com/zlGnuDO.png

I wonder if this can have a detrimental effect for compulsive buyers: “Oh I shouldn’t buy this widget but a chunk of it will go towards my retirement anyway!”

To add context to the other reply, it’s not uncommon for penetration testers to have Postman in their toolbelt, in addition to traditional security tools like Burp, Metasploit, sqlmap, etc.

True. Clear markings are like a deterrent control in security. They can mitigate damage but something that prevents wrongful use needs to be used in the end.