octagons

Very much off topic from the article, but I've always found modern South Korean culture to be very interesting. Is there a resource or book that lends more insight into today's mentality/zeitgeist of South Korea?

I don't have the most optimistic outlook for this having any impact, but I really hope this sets a precedent for limiting the use of dark patterns with which companies try to tie your identity to a phone number. I think the total sum for this fine is rather myopic: it ignores the long tail of possible future data leaks and the impact it might have on the people behind the affected accounts.

I created my current Twitter account a few years ago and it remained dormant for a while. It was flagged as "in violation of our policies" despite having not made any tweets or using a handle or nickname that would cause offense to anyone. In order to resolve this, I had to enter my phone number to "secure" my account. I don't know what process triggered this review, but I'll be damned if it didn't smell like an easy way to associate an existing marketing profile with my Twitter account. Of course, it's vitally important to profile a service I used to keep up with industry news and post about Goban puzzles.

I've also run into similar patterns on Discord and similar platforms; "Oops! Something suspicious is happening with the account [you literally just created]. Please add a phone number to your profile to proceed."

Although I follow a reasonable set of practices around identity/password management, I usually architect my risk profile with a "I don't care if I lose this account" approach. If that statement isn't true, then I will happily apply all of the security measures available. However, it seems like the idea of creating "I don't care" accounts is becoming increasingly difficult as we continue to invest in user marketing analytics and lower the barrier of entry to these types of technologies that do not have the consumer's best interests in mind.

I just use one of these: https://www.rosewill.com/rosewill-rcus-17003-2-x-usb-type-b-...

Is the registration broken? I am getting errors to "Please complete this required field" on two fields that I cannot see (or fish out of the div soup that is this signup page.)

I'm aware of i3 and I think I've tested it out in the past but had some silly nit to pick about it. Thanks for the reminder - I'll give it another try!

The woman who develops Dashy is incredibly talented, and is extremely responsive to issues and pull requests for this project. Take a look at the pipelines she has added to the GitHub repository- it’s almost ridiculous the amount of automation that can be accomplished with them.

Fancy Zones makes my day-to-day so much more convenient. I wish there was an equivalent in Linux that worked as well - I’ve tried a few gnome plugins but always been disappointed.

I’ve used scapy for years and found it especially useful when performing internal penetration tests. It has useful patterns for tasks like quickly putting together a custom DNS server, UDP source spoofing, walking all ICMP codes (or a quick and dirty ICMP redirect tool), or couple it with matplotlib and to estimate how many active hosts are communicating with a remote server based on TCP sequence numbers (I believe this is part of the scapy examples.)

Coupled with interfaces to import and export PCAP files, it’s also a great way to learn about or explore/tamper with network protocols.

The fact that it’s implemented in Python might scare some off, but I personally feel that this only adds to its usefulness since it can benefit from all of the external tooling and flexibility that comes with the language.

I believe the OLED version has a glossy, glass screen. I ended up going with the matte 1080p screen for both of my X1 generations. It works quite well in bright daylight from my experience, but will still have some glare.

Absolutely love the X1 series. I use it as a daily driver running Linux and can vouch for some of the points made in this thread about them.

You're absolutely correct about the Windows ACL system. The discretionary access control system in Windows can easily be subverted by a poorly configured dynamic access control policy.

Windows is not a single-user OS. Even a standard "desktop" installation can support multiple sessions through terminal services, but usually it is not configured to allow multiple concurrent interactive sessions.

The vulnerability in hh.exe is already well known and documented by the LOLBAS project [0]. My team and I (Adversary Simulation at IBM X-Force Red) conduct stealth-oriented red team security assessments and we use vulnerabilities like this to do our jobs every day - just as any red team worth its salt would. Capabilities like this are built into all kinds of tools that are installed by default on Windows. They are often essential to obtaining code or command execution on hosts through social engineering or post-exploitation when moving laterally between hosts.

This is just speculation, but the privesc vulnerability might be related to memory allocation in the DLL used to integrate with the system shell context menu - i.e. right clicking on a file. Just a guess based on the mention of a heap overflow.

[0] https://lolbas-project.github.io/lolbas/Binaries/Hh/

I’ve been a huge JetPens fan for years. Something about the over-engineering makes it almost hobby-like to collect these pens and pencils.

On the downside, I probably own 500 or so pens and pencils of all variety, plus a requisite number of over-engineered pencil cases.

The habit extends beyond JetPens into somewhat exotic materials, like the pens from Tactile Turn out of Texas. It’s easy to spend $400+ on a pen there. It makes a fun conversation piece but very few understand the “cool pen” impulse some have.

I just experienced this scenario today with aurutils [0]. Perhaps I needed to reboot after building it, but it only gave me any insight into its syntax when I typed “aur” with no other flags.

[0] https://github.com/AladW/aurutils

Tangential to the rest of the conversation, but I often use/write binary templates [0] for 010 Editor [1]. The GUI-driven approach to navigating structures (such as PE headers) can be very useful.

I wish there was a similar tool that allowed me to simply highlight and bookmark blocks of binary data when I'm dealing with an unknown file format, such as a firmware dump for something exotic and/or proprietary.

[0] https://www.sweetscape.com/010editor/templates.html [1] https://www.sweetscape.com/010editor/

Yes! This is a great podcast if you are a fan of William Osman, NileRed, Michael Reeves, Peter Sripol, and the like.

Yes, I agree it was many factors. This video seemed to be the breaking point, but it was certainly a long time coming. I recall several videos over the past 2 or so years where he drew attention to the invective he receives. I don’t really participate beyond watching the videos, so perhaps there are others who are more informed about the factors behind his decision.

Regardless, I wish him all the best and hope he’ll find a way to showcase his talent or at least find fulfillment elsewhere.

It’s worth noting that William Osman stopped producing videos on his YouTube channel due to the fallout of this video.

It was a long time coming because he comes off as very aloof and has received criticism about the safety of many other projects, but this one appears to have triggered a lot of outrage.

FWIW, I think we need more young, brilliant minds sharing this kind of content. It has the entertainment value needed to capture the interest of young viewers who may not be otherwise interested in engineering disciplines. There are many, many other channels out there (backyard scientist, action lab, Cody’s lab, stuff made here, etc.) who are very successful on YouTube, but they tend to cater to viewers who are deliberately choosing to watch their videos.

I have been running Linux on Thinkpad X1 Carbon laptops for several generations now: Gentoo on Gen 1, Debian on Gen 5, and now Arch on Gen 9. I can’t recommend them enough for a Linux daily driver and development workstation!

I spent 5 years at Mandiant on the “proactive” team that performed penetration testing and similar services. The divestiture of the FireEye product was the best thing to happen to Mandiant since the acquisition by FireEye. The two business units were constantly at odds.

I’m genuinely surprised by this acquisition, however. Mandiant’s business model (consulting services) was successful despite the pressures and operational dissonance from the product side. When I left, they were well-poised for natural growth and to capture a larger market share of managed security services. I’m sure there is a model for success under Google, but I doubt many of the employees below the C-level wanted to go this direction.

Perhaps something like this: https://favicon.allesedv.com/

I’m just looking out for my fellow geometry nerds.

Some might feel apprehensive about visiting US government websites. I have been in this position before, so I often think like that. I figured I’d offer an easy to find alternative source.

Check out the Field Expedient SDR series. They offer a decent introduction for beginners.

My work is only tangential to the software engineering industry. Therefore, my view may not be as applicable as others.

I think it’s inappropriate for this senior manager to have given any feedback about the status or requirements of this project directly to you. As a recent graduate, I would hardly consider you to be responsible for any project management duties. It’s up to the project manager to set expectations and make decisions regarding things like meeting a deadline. In this case, I would assume the project manager is your direct manager.

There is a direct correlation between the output of a project and its inputs: the deadline, any specific requirements, and resources provided to the individual contributors assigned to the project (e.g. a senior resource providing code review). The project manager’s duty is to be the “neck to wring” when there are issues with the project. That is why they are responsible for communicating and setting expectations.

Perhaps your manager did not handle these duties well in this instance. In fact, it sounds to me like this is the case based on your story. Because your manager was not present in this meeting, the senior manager apparently chose to wring YOUR neck instead, which is inappropriate, especially given your tenure.

This is going to happen to you a lot in your career. You can protect yourself or prevent it by keeping good records of your actions. For example, your commit messages could contain a copy of whatever specifications you received, or you can make a habit of confirming your assumptions via email with the appropriate contacts in copy.

Either way, don’t take this too hard. You are unfortunately bearing the brunt of unprofessional behavior that is happening well above your head. The fact that you completed the project and feel proud of the output is what you should remember from this experience.

I don’t use any Alexa devices so this might just be an unknown to me, but this seems oddly staged. Is it common for children to “ask Alexa for a challenge” like that? What other “challenges” could Alexa offer? Obviously the suggestion to play with an electrical outlet is concerning if this is real, but the context seems very unlikely to me.

I’m genuinely interested in advocating for the elderly in tech. Do you have any insights on the challenges Honor faces or has overcome? Especially in regards to respecting the real-world/digital privacy (let alone HIPAA!) while engineering a solution with technology.

This correlates with some of the other reports I’ve read and I appreciate your skepticism. A “ban” is certainly not outside the realm of possibilities in China, especially given some of the new social policies, but we cannot afford to react like this whenever the word “China” makes its way into a headline if we want to draw attention to the real “bad” things.

> Which I increasingly feel confident in the idea that there’s no meaningful distinction and ADHD should/likely eventually will be considered part of the spectrum I’ve recently been pondering this point myself as I come across more acquaintances, friends, or colleagues who have been clinically diagnosed with ADHD after my own diagnosis. It’s certainly nice to be able to commiserate on some of the more common symptoms, but each of us has had to compensate (or not compensate) in a unique way throughout our lives. I’m always interested in how this manifests differently and affects one’s career or other major components of modern life. I agree that a lot of what’s suggested by this article are very ubiquitous, (sometimes) easier-said-than-done tools and strategies for those that struggle with ADHD. I wasn’t personally surprised by anything here. I am equally frustrated by the lack of availability of an app or planner that lets me “manage my meetings and tasks” that truly meets my needs as someone struggling with executive function disorder and depression caused by the lack of this executive function. I’d love to hear any examples. I have been playing around with pomodoro/task apps (Focus and Focus Keeper) but they have some very odd shortcomings, and Focus wants $40 USD/year to continue use past the free trial.