i code. i am cranky. i am cat.
cat cavern
Joined August 2016
- Tweets15.2K
- Following1.5K
- Followers409
- Likes268K
Pinned Tweet
A: Good to see you here again!
B: It's my first time
A: You were here yesterday
B: You should have forgotten that
-> EU privacy regulation
This is a story.
Years ago, I took physics and there was this nut who they only let loose on the grad students. But, of course, a prof got sick and he was assigned to teach us a class. It was basically a train wreck, but there was a phrase I remember from over 40 years ago. /1
I'm not asking for the answer to be perfect, although I understand why you think it needs to be (FU, tort bar) but I'd like some reasoning going on beyond "well the RCT says" thinking. I'm fully in favor of RCT as the gold standard.
/4
Decades ago a friend and I were drinking beer in my living room and listening to "Israelites" on a loop. My wife gets home and it takes her about 10 minutes to ask what on earth we're doing.
> TLS traffic over DHE ciphers have a 1-byte secret, "04"
presented without comment
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
crankycatcoder retweeted
yes; also plausible IMO is “Cloudflare will run your AI defense swarm and you just pay a small monthly fee and don't really have to think about it”
This is hilarious and very common.
(It's the kind of thing that makes me unsympathetic to the Google employees who complain about 'excessive' process.)
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
crankycatcoder retweeted
One thing about being an Oilers fan is if you see a drop pass in the neutral zone into empty space, you know Connor McDavid is about to enter the frame doing One Billion Miles Per Hour
#LETSGOOILERS
crankycatcoder retweeted
It is appalling how bad the driving is in Seattle.
95% of residents should just buy a Tesla and put it in self driving mode.
crankycatcoder retweeted
Imagine climbing El Capitan and discovering the biggest obstacle was a Karen at the bottom.
I think there's something to this. I also think the four color problem has to have simpler proofs than those that now exist, fwiw.
People are surprised that AI is finding weird unelegant maths results like this. I think there is a plausible explanation.
Maths (and adjacent disciplines like physics and comp sci) had elegant results so far because humans are biased towards elegant solutions. I think this bias is due to how human minds work. We have a pretty small context window, and we are only able to find solutions that are relatively elegant.
This gave us the impression that maths and the universe are elegant. Maybe they are not, and we are now finding out because we have intelligences that can work with much more complex solutions.
crankycatcoder retweeted
Canada is just flat out murdering people when they don't want to pay for their health care
ALT Kranendonk made sure she was in the room for the second MAiD assessment, and it was there where she noticed the doctor speak in 'really loose terms, never using the words death or dying. 'She explains MAiD to my grandmother by saying: "We're going to give you medicine, you're going to feel at peace. And I just want you to know that you won't have a bowel movement." 'She's saying it in these strange terms, that aren't literal,' Kranendonk says, adding: 'My Oma's just kind of nodding. Her first language is not English, she is 83-years old and severely hearing-impaired.' Kranendonk looked at the doctor, and said: 'She doesn't understand what you're saying.'