Seems people have to relearn this lesson every few years:
If you don’t want something to be public, don’t put it on the internet. “Privacy” controls from these companies fail regularly, sometimes by design. If you put something on the internet, it will be public eventually.
Or two decades fighting an asymmetric war which President Bone Spurs personally managed to avoid.
By “de-shitify” they meant removing all the shit which isn’t owned and controlled by Microsoft.
nasa is about to remote into the computer
I’ve dealt with slow RDP sessions while fixing servers in the past, but the lag on this connection must really suck.
Yup. Being young and stupid, a group of us were lighting those rose fireworks (the kind which spin and light up on the ground), putting them in a water balloon launcher and flinging them into the sky. While we were aiming for a river, this also meant we were aiming for some brush. Unsurprisingly, we eventually had one land short while still burning and started a bush on fire. We ran down and started trying to put it out with dirt. This wasn’t going well until we remembered we had a small container and a ready source of water (the river) and managed to douse the fire.
It’s the return of the Glasshole.
Also, what idiot decided that only one settings window is allowed open at one time?
Microsoft engineers were worried that people missed the joys of MS-DOS and having only one application running at once. Next up, will be the return of base memory versus expanded memory versus extended memory. This ends when they devolve Windows to prove Bill Gates right that 640kB should be enough memory for anyone.
Simple, NoPilot can just erase all your files. Binaries can’t take up memory of they can’t be loaded.
It certainly makes sense. AWS hosts infrastructure specifically for the US FedGov. That infrastructure includes systems for the US DoD. So, that makes it a valid military target. And while cyber attacks can do a lot to degrade command and control, nothing DoS’s a server farm like a few hundred kilos of high explosives.
This one is a mixed bag. KYC regulations are very useful in detecting and prosecuting money laundering and crimes like human trafficking. But ya, if this data needs to be kept, the regulations around secure storage need to be just as tight. This sort of thing should be required to be kept to cybersecurity standards like CMMC Level 3, audited by outside auditors and violations treated as company and executive disqualifying events (you ran a company so poorly you failed to secure data, you’re not allowed to run such a company for the next 10 years). The sort of negligence of leaving a database exposed to the web should already result in business crippling fines (think GDPR style fines listed in percentages of global annual revenue). A database which is exposed to the web and has default credentials or no access control at all should result in c-level exec seeing the inside of a jail cell. There is zero excuse for that happening in a company tasked with protecting data. And I refuse to believe it’s the result of whatever scape-goat techs they try to pin this on. This sort of failure always comes from the top. It’s caused by executives who want everything done fast and cheap and don’t care about it being done right.
It’s certainly one of those hard trade-offs to make. One of the methods for reducing crime is increasing the perceived likelihood of getting caught. Cameras can do that, if there is regular follow-though by government authorities to investigate, arrest and prosecute crimes. Though, there is probably more value in reducing poverty and corruption, which is known to reduce crime. And which has the added benefit of not creating a surveillance network when corruption does creep into government. Of course, that is expensive and might just help the poors, and that is antithetical to authoritarians of every stripe.
The best way to protect a dataset from falling into the “wrong hands” (for however the “wrong hands” is defined for that dataset) is to not keep that dataset in the first place. While I get that tracking the movement of citizens can make solving some crimes easier, the risks to privacy and of authoritarian abuse are far too great to accept.
I remember working in environments where management had decreed that we would not install updates ever. . .That’s…definitely a decision that puts a lot of trust in Microsoft’s security. Lol
It was a very different time. Security was still something that happened mostly at the network perimeter, and even then not much. Routers without firewalls were very common and things like SQLSlammer were much more possible.
Ya, I’m sure the AI code isn’t helping, but is it materially any different? I spent way too many long nights trying to unfuck Windows servers after updates failed to install correctly. And that was well before the AI Slop Boom. Even more fun is when the update reported installing correctly but the Nessus scans came back showing the old version of DLLs still in the System32 folder. There is a reason no one installs Windows patches on day 1. At minimum, you give them a week to let the foolhardy and fanboys get their disks slapped by Microsoft, again.
Going back to my days supporting Window 2000/2003, I remember working in environments where management had decreed that we would not install updates ever, because of too much downtime due to bad updates. Even today, updating in OT environments can be very difficult due to shitty software running on really old versions of Windows. At least that stuff can usually be kicked off the network and left to rot in isolation.
While I don’t know the specific post you are referring to, Malware exists for Linux. Here’s a great overview from last year. If someone wants to argue, “oh it’s from a security company trying to sell a product” then let me point you at the Malware Bazaar and specifically the malware tagged elf. Those are real samples of real malware in the Linux specific ELF executable binary format (warning: yes it’s real malware, don’t run anything from this site). On the upshot, most seem to be Linux variants of the Mirai botnet. Not something you want running, but not quite as bad as ransomware. But, dig a bit and there are other threats. Linux malware exists, it has for a long time and it’s getting more prevalent as more stuff (especially servers) run on Linux.
While Linux is far more secure than Windows by design, it’s not malware proof. It is harder for malware to move from user space into root (usually), but that’s often not needed for the activities malware gets up to today. Ransomware, crypto miners and info stealers will all happily execute in user-land. And for most people, this is where their important stuff lives. Linux’s days of living in “security through obscurity” are over. Attackers are looking at Linux now and starting to go after it.
All that said, is it worth having a bloated A/V engine doing full on-access scanning? That depends on how you view the risk. Many of the drive-by type attacks (e.g. ClickFix, fake tech-support scams) all heavily target Windows and would fail on a Linux system. The malware and backdoors that come bundled with pirated software are likely to fail on a Linux system, though I’ll admit to not having tested that sort of thing with Wine/Proton installed. For those use cases, I’d suggest not downloading pirated software. Or, if you absolutely are going to, run those file through ClamAV at minimum.
Personally, I don’t feel the need to run anything as heavy as on-access file scanning or anything to keep trawling memory for signatures on my home systems. Keeping software up to date and limiting what I download, install and run is enough to manage my risk. I do have ClamAV installed to let me do a quick, manual scan of anything I do download. But, I wouldn’t go so far as to buy A/V product. Most of the engines out there for Linux are crap anyway.
Professionally, I am one of the voices who pushed for A/V (really EDR) on the Linux systems in my work environment. My organization has a notable Linux footprint and we’ve seen attackers move to Linux based systems specifically because they are less likely to be well monitored. In a work environment, we have less control over how the systems get (ab)used and have a higher need for telemetry and investigation.
That of ServiceNow, whose tools help businesses automate various tasks, dropped by 13%
If AI can kill ServiceNow, I’ll happily praise our new AI Overlords. I’m sure ServiceNow can be really good. I’ve just never seen it in practice. Perhaps we just never paid for the “interface which doesn’t suck” module.
I’m in, though I’m curious what “turns you into a reptile” means. Does it just mean I become cold blooded. I’m fine with that, it just means I’m moving somewhere tropical. Do I grow scales and a tail? Certainly not ideal, but I could probably live with it, especially if the tail is prehensile and if I get claws in the mix. Do I get a really long, controllable tongue? Can’t think of any uses for that. Nope, none at all…
Attraction, sex and reproduction would be interesting questions as well. Do I still find human women attractive, or is my brain rewired to want a lusty argonian maid? What does my new plumbing look like? Are there others of my new species around for me to do the monster mash with?
But overall, yes I’d probably go for it. I don’t delude myself into thinking that I will somehow continue to exist after death; so, not dying seems like the better alternative. Sure, if the downsides are really bad, I can accept that death is a better outcome (e.g. you live forever, but have locked-in syndrome forever). But, living as a lizard person doesn’t seem too horrible.
You could try using Autopsy to look for files on the drive. Autopsy is a forensic analysis toolkit, which is normally used to extract evidence from disk images or the like. But, you can add local drives as data sources and that should let you browse the slack space of the filesystem for lost files. This video (not mine, just a good enough reference) should help you get started. It’s certainly not as simple as the photorec method, but it tends to be more comprehensive.
My money is on Microsoft’s AI based detections causing false positives again. I spend way too much time chasing ghosts from Defender. Their machine learning based signatures are especially egregious. You get an alert with a name like “Win32/Wacatac.b!ml”. That last “ml” bit denotes that it’s machine learning based. And then you get fuck all to help you determine why the alert fired. Sure, it might actually be a trojan. More likely, it’s a false positive. But who knows, because Microsoft won’t provide enough information to perform a reasonable analysis of the binary.
And MS has been pushing CoPilot hard. It’s in everything and it’s happy to slop up answers for you. The accuracy of those answers though can be a bit spotty. I’d certainly never turn it loose on tools which can have business impact. But, I doubt Microsoft has any such reservations about letting CoPilot slop all over third party devs.