laurencei

I use `s3:PutObject` with versioning - yes.

Although I've not tested if only having `s3:PutObject` even allows overwriting in the first place? You might not need versioning.

Also - they dont have `list` or `read` access, so they cant even see what files are there to overwrite in the first place. They might be able to guess depending on your code, but adding some random numbers and you'd be pretty safe.

Any AWS IWS experts able to confirm if `s3:PutObject` allows overwrite?

> Fixing the vulnerability not only requires the keys to be changed on the server, but also a software patch to be rolled out on each affected device.

Is this correct?

Couldnt they just change the existing keys in AWS to be "write only" - and therefore allow a one way stream of data "in"?

That way, even with the keys, you cant actually get any existing videos, and only place new ones there?

I do this for my web application backups - my AWS keys on the server are "write only" (with no overwrite) to S3. Then, if my server was every compromised, my backups are NOT and are protected because the attackers cant get to them (to either overwrite or read the existing backup).

As someone who works for Government and Enterprise - all I care about sometimes is how a company behaves when everything goes wrong.

The issue with outages for the Government organizations I have dealt with is rarely the outage itself - but strong communication about what is occurring and realistic approximate ETAs, or options around mitigation.

Being able to tell the Directors/Senior managers that issues have been "escalated" and providing regular updates are critical.

If all I could say was a "support ticket" was logged, and we are waiting on a reply (hours later) - I guarantee the conversation after the outage is going to be about moving to another solution provider with strong SLAs.

Yeah - it was a ?blog about how hard it is to do payments for porn sites.

I wonder why it's not Elon himself? He can obviously afford it, and it is clearly his passion, so why not take a once in a lifetime opportunity and head into space?

"“The owner was even afraid of handling it,” Mr. Lyons said. “He asked me to come and get it. I said, ‘Put it in a FedEx envelope and send it to me.’ He said, ‘I’m not doing that.’”"

I cant believe he even asked him to do this. Placing a stamp worth anywhere from $300,000 to $1,300,000 into a FexEx envelope? The risk of loss, damage or theft would have been too high.

...sounds like a "SaaS for Malware"? Turn key hosted malware?

Yes - personally I like it.

But I'm trying to be objective and note the lack of correlation between a shows percevied quality and how that does/not translate into ratings.

If you check out the show on Rotten Tomatos it has a tomato rating of 90% with an average audience score of 95%.

That seems really high to then cancel the show?

I'm guessing the problem is it is highly loved by a small group of individuals? But given Sci-Fi in general is a wide enough demographic for many other shows - it seems strange this is not drawing in the ratings?

[1] https://www.rottentomatoes.com/tv/the_expanse/

I always wish I could just plugin a Google spelling check API into things like Microsoft Word instead of using the inbuilt ones.

i.e. the amount of times I cant spell a word, and MS Word has no idea what I'm trying to say, so I "copy and paste" the wrong word into Google and it instantly knows what I meant and shows me the correct spelling.

I appreciate part of that is probably related to my previous searches on Google and it guesses based upon my history - but I'd be ok with using this for "good" like my spell checking.

The strange thing is the article is a year old? Why would it suddently be exploited now? I find it difficult to believe no one's tried until today?

The thing is I've used Gmail for nearly 10 years (give or take) - and I've never once had a spoofed email reach my inbox. Ever.

Something must have changed, most likely in the past 24 hours (give or take) to allow this to suddenly occur? Or someone's worked out a way passed the gmail spam filters or something.

Either way - this is clearly "new".

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com":

    Delivered-To: my.email.fake@gmail.com
    Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal;
            Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
    X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH
    X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.1524376459326;
            Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
    ARC-Seal: i=1; a=rsa-sha256; t=1524376459; cv=none;
            d=google.com; s=arc-20160816;
            b=yNz7pv3/Uh4jUBqrFSpnrhROAQ6bdU0eiolhXCpHXodEBCygkRTsVIZiSPxU1e66PU
             +y1dJAT4q911YZE9Qb8jUKZ0yYuamvXY4NHGbN7hQzYR36ocZP4cuqrYZoLzrWzqWMjQ
             0PcYbDK5dgKO4yhJj4ymhDMW05YZATsYqmaianc6O4KmG0i1dPCvHu0Rjl4lWFfX1UEX
             jQK3/rA4Kqji/dHCqj6mHqiit2yzdj7XJTdoIiTdcBhWGoGOov1oCvpdzwQYRPCGe5qN
             A3l5e0qgqYY/aWmEWJ5Ia8vwvbWWQvbe+nH2AxQf0KArHXQ/ktQb8oBackZTljwQivgI
             ziIw==
    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
            h=date:message-id:subject:to:from:arc-authentication-results;
            bh=e9D0rlZHq51n3B4mRj4EfKnNKsv8i1UrXVRpskBltKg=;
            b=QVTaX2wLGCYZzWS7YGqc7Ck1ZiLTbKEVNYjhOJqiJkqKqeR6r7dEhGMUFNpOGAQOYB
             Y5X/r0uktROpPceC8EzBnhLXtuVUJP2Q3Uje4QvTYLPrdMx8V1UvqJ4Wx6sxsHZR1tJB
             69rtTABGlOC2ZW3dE7uqiVtsIukJmb/HQDOItX5g+ifsyBy4A9KZbKWpU9agqaD1NOpG
             Rm7PnBzMAPbD0s02QBCeErZp+Irax0Gk7WzkGsJfO+GWjPMZN6DpWLvgS/vBRN0/Tz+B
             xLb3VO+EPN6bG2ZvGqRJZ4LlbQIVFpBQGRFAAqMQLDEZGKTFJxrA4uO3NMMRqbQno5IM
             cc6Q==
    ARC-Authentication-Results: i=1; mx.google.com;
           spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com;
           dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
    Return-Path: <Reply@telus.com>
    Received: from rine.play-wto.com ([91.203.70.10])
            by mx.google.com with ESMTP id b69-v6si4041238lfe.13.2018.04.21.22.54.19
            for <my.email.fake@gmail.com>;
            Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
    Received-SPF: pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) client-ip=91.203.70.10;
    Authentication-Results: mx.google.com;
           spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com;
           dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
    Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
            by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
            for <my.email.fake@gmail.com>;
            Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
    Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 91.203.70.10 as permitted sender) client-ip=13.58.85.245;
    from: Bitcoin Loophole <my.email.fake@gmail.com>
    To: <senderus@justvaluerate.com>,<senderse@justvaluerate.com>,<monsl@50-233-80-21-static.hfc.comcastbusiness.net>,<mz@traveldailymedia.com>,<gego@nih.gov>,<iscontact@rei.com>,<mz@wp.com>,<info@chadog.fr>,<info@autotrader.com>
    Subject: Are you still alone?
    Message-ID: <NkhPw@google.com=Mx.google.com>
    Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status
    X-EMMAIL: <@googlemail.fr my.email.fake@gmail.com>
    Date: Sun, 22 Apr 2018 01:54:19 -0400

Exact same thing for me.

Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder.

But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my account etc. Still did a password reset "just in case".

However one interesting part is after about 4 hours the emails automatically became marked as "spam" - and they disappeared from my "sent" folder simulatenously.

So it would seem the likely issue is someone worked out a way around the "Spam" setting for Gmail - and a by-product of not flagging spoofed emails as spam is Gmail marks them as "Sent" by you in the labels.

Seems this was flagged as a security risk over a year ago - and Google declined to fix? https://www.zdnet.com/article/spammers-delight-gmail-weirdly...

> But learning from the past is not a weakness.

What's the lesson you are learning from?

The lesson I see is that any language, even PHP, will give you success if you "build something people want".

I read lots of startup "shutdown" stories - and I've not read one that mentioned the choice of "PHP" (or any language) as the reason for shutting down.

So if your comfortable with PHP - punch out what you need to get started...

The queue is given the command. The command has the functions I want to run, including the context and what I want done with the result. It can be a closure right up to a full class.

Using a framework like Laravel I can even "chain" queued commands - so CommandA will queued, then call CommandB when it is done etc.

I've never run into a situation that wasnt easily solved by this.

Like Facebook or Uber? Both started with PHP.

I am an experienced PHP developer - and I also ask the question "why asynchronous PHP" all the time - except in a different context.

Every time I start thinking about doing some strange magic "asynchronous" function - I realise I can just use the standard queue systems built into most frameworks today. i.e. get the task - push it onto a queue - then do something else without waiting for the queue itself.

The thought of dealing with "forked" processes, memory leaks, strange race conditions etc and all the stuff that comes with async PHP does not seem worth it. It is very easy to "reason" logic behind a queue system. I can test it extremely well, and essentially break the process up into sub sections and not have to worry.

Note - I'm not saying there is no place for true asynchronous functions - but I think people reach for them in PHP when other easier solutions might suffice in the first place.

The problem is the codebases are still not "completely independent".

If the backend dev needs to change a field in the database, or add a new one, then can might affect the front end dev.

Also - simple things like validation rules - i.e. what can the front end dev allow users to store into the DB vs what can the back end dev use/need.

IMO (as someone with 45k rep on StackOverflow, largely in PHP) - the best way is to modify the "flag" option on answers - and have an extra option called "out of date". If someone flags an answer as out of date, then anyone with a gold badge in that tag (i.e. PHP) - can review and accept or decline the flag.

If 5 gold people accept it - then the answer is formally highlighted as out of date, or even deleted.

You could raise this on Meta Stackoverflow as one possible way to start: https://meta.stackoverflow.com/

edit: There probably should be another flag option - called "security" - where even if an answer "works" and is "in date" - people can flag it as insecure due to a better option. Think of all the stupid SQL injection answers. You can downvote it to hell - but sometimes they should just be flagged/deleted.

Can you get StackOverflow to "sponser" this idea? Not just for crypto (which you've done) - but for all PHP related answers?

Because the problem is there are many "old" accepted answers, with high upvotes, that will always come up as number 1 or 2 in google searches.

Given PHP has changed so much, many of those answers are outdated, use incorrect and insecure methods, and some are now just wrong. This is not just security - but a whole host of answers.

The "meta" StackOverflow rules will tell you to downvote the old answer and post a new one - but that is not practical - and will take years to take effect. Plus, many people simply read the first large upvoted answer, copy + paste the code, and move on.

edit: I guess it would be nice to be able to "flag" an accepted answer (not a question) as outdated, get 5x people with gold badges for that tag to accept it - and then the answer is highlighed as wrong/out of date (or even deleted). Something like that.

...but if it is "so obvious" - why has it taken ~20 years to discover it (publically)?

The problem is if your computer is compromised - they might get a few sites that you visit after the compromise (and before you realise/format etc).

But with a password manager - they get 100% of usernames + passwords to every site you've ever used, even if you dont visit it after the compromise...

cool - thanks.

Any chance of a ELI5 of this?

So if you "thought" that Bitcoin will go over $50k - why not buy the Bitcoin itself now at $20k (or whatever it is today)? i.e. what is gained with the call option here?

What happens if the value of BTC goes up or down though during that time though? What will he be entitled to?

Just tried it with some of my own details. Found a domain I forgot I owned on an old reseller I havent used in a while - lol.

On a more serious note - I'm very curious how you get such a long history of domains. i.e. I can see every DNS change and ownership for any domain - I didnt realise that was always available?

Is there a way I can triple check my S3 bucket is secure?

I know I've not enabled public access that I know of - but given the recent focus on this; what are the exact steps that I need to follow so I can sleep at night and show a level of diligence on the issue?

But it can also be:

1.) get "illegal" money from somewhere/anywhere. Create bank accounts under fake names with the "illegal" cash.

2.) host receives payment minus AirBnB fees 2 days later

3.) host transfers amount minus his own cut to criminals

4.) AirBnB never gets notified of anything - it's just another happy customer.

So the problem with this scenario is AirBnB never knows about the problem - so all the "bad" hosts can go on for long times, and you dont need as many accounts; thats where the "scalability" comes in.