Linux nerd and consultant. Sci-fi, comedy, and podcast author. Former Katsucon president, former roller derby bouncer. http://punkwalrus.net/

  • 0 Posts
  • 42 Comments
Joined 2 years ago
cake
Cake day: June 22nd, 2023

help-circle

  • It’s pretty scary: I am seeing it in the IT sector as well. It’s not just knowledge; anyone can look up things, even Einstein did it. “I never memorize anything that I can look up,” he said once, about the why he never memorized cosine tables and such. But it’s basic logical flow of thought and problem solving. Like the skills behind the knowledge, that I see less and less of.





  • I have seen some rhetoric about this, like “a few bad apples,” but here’s the problem with this and a lot of enforcement jobs.

    • Polite and decent people, on average, dislike confrontation. Thus, are not particularly attracted to these types of jobs.
    • This leads to an uneven amount who are fine with confrontation or even like it. Some of these people are sociopaths and psychopaths.
    • People who are psychopaths are actually very attracted to position where they have power over people.
    • US Customs are not regulated under the same laws as police or military. They can do what they want, when they want, with little to no discretion.

    Are all US customs agents bad? No, of course not. But unchecked power is dangerous for anything. I can’t tell you what percentage is or is not, because you can’t measure a negative. But I see this in military, police, hired guards, and politics.

    Many years ago, they cavity searched an underage girl at my local airport (Dulles) as she returned with her family from a vacation in Jamaica. They separated her from her family, did not tell her family, and searched all her holes “for drugs.” They defended their actions by saying, “if we told people we didn’t cavity search babies, they’d hide drugs inside babies.” Essentially admitting, with no shame, they’d cavity search an infant. All in the name of “stopping drugs.” Oh and the girl? US citizen, but dark skinned. The mistake they made was her dad was a powerful attorney and went public.

    https://www.govinfo.gov/content/pkg/CHRG-106hhrg66023/html/CHRG-106hhrg66023.htm

    https://www.math.buffalo.edu/~sww/circle/raceprofiling/stories.racial.profiling.html



  • No. I have known a lot of attractive people get bullied by jealous bullies. Imagine you’re attractive, guys checking you out, and girls who work HARD to get noticed see you get noticed without much effort. You may even be, “no thank you,” like you have a choice. And they will seethe because they think it’s unfair you “have it so easy.” Logic and reason do not apply to bullies, they only know how to “preemptively retaliate” to keep the status quo in their head,



  • These are two types of cartoon sounds when a character snores.

    The “Inside you there are two wolves” is the name of a proverb which began being parodied towards the end of 2018 and through the beginning of 2019. In the original proverb, a grandfather says there are two wolves fighting inside him, an evil one and a good one. His grandson asks, “who will win?” The grandfather replies, “The one you feed.” In parodies, the story is often simplified to “There are two wolves inside you. One is X. The other is X. You are X.” The proverb’s actual origins are murky. It has been attributed to Christian pastor Billy Graham in 1978, as well as the Cherokee Native American tribe.


  • Basic setup for me is scripted on a new system. In regards to ssh, I make sure:

    • Root account is disabled, sudo only
    • ssh only by keys
    • sshd blocks all users but a few, via AllowUsers
    • All ‘default usernames’ are removed, like ec2-user or ubuntu for AWS ec2 systems
    • The default ssh port moved if ssh has to be exposed to the Internet. No, this doesn’t make it “more secure” but damn, it reduces the script denials in my system logs, fight me.
    • Services are only allowed connections by an allow list of IPs or subnets. Internal, when possible.

    My systems are not “unhackable” but not low-hanging fruit, either. I assume everything I have out there can be hacked by someone SUPER determined, and have a vector of protection to mitigate backwash in case they gain full access.






  • I have a kaleidoscope for the blind.

    One of only 150 or 250 made (I forget which). The artist (Reinhold Marxhausen) got Alzheimer’s in his final years, and is probably dead now. It looks like a metal blob, but the inside is hollow and it has are springs that vibrate and make tones to the slightest touch and heat change. Just shake it and hold it to your ear. It makes different and unique sounds depending on who is holding it, the weather, the air temperature, and so on.

    I got it from a kaleidoscope collector, who sold it to me because the small handmade box it came in was damaged in shipping, and it wasn’t worth as much without the box. I keep it in a handmade suede bag.

    Edit: I made an Imgur post about it: https://imgur.com/gallery/kaleidoscope-blind-Ab8Xz


  • Not mine, but from a post: First, you’re never going to win a head-on battle with an adversary that’s got you outgunned. That’s not the point of the Resistance. The point is to create friction, make it hard for your adversary to operate, to increase transaction costs.

    Second, resistance doesn’t have to be a dramatic act. It can be a small act, like losing a sheet of paper, taking your time processing something, not serving someone in a restaurant. Small acts taken by thousands have big effects.

    Third, use your privilege and access if you’ve got it. He and his buddies stole weapons from the Nazis by driving up with a truck to the weapons depot, speaking German, acting like it was a routine pick up, and driving away.

    Fourth, part of the third point really, sometimes the best way to do things is right out in the open. Because no one will believe something like what you’re doing would be happening so blatantly. All good Social Engineers know this.

    Five, bide your time. But be ready for opportunity when it strikes. Again, your action need not be dramatic. Just a little sand in the gears helps.

    Six, and this is a no-brainer, operate in cells to limit damage to the resistance should they take you out. Limit the circulation of info to your cell, avoid writing things down and…

    Seven, be very careful with whom you trust. Snitches and compromised individuals are everywhere. My dad was arrested because of a snitch. His friends weren’t so lucky, the Gestapo machine gunned the cabin they were in without bothering to try and arrest them.

    Eight, use the skills you have to contribute. Dad was an electrical engineer. When the Nazis imposed the death penalty for owning a radio (the British sent coded messages to the Resistance after BBC shows) he said he became the most popular guy in town.


  • I also wonder what the trade value of gold might have been in that universe? For all we know, it might be an either/or situation. Like “Well, I could have my favorite takeout every Friday for a year, OR the newest smartphone.” Both are tempting but for different reasons. Like, “I could buy a lot of turnips, potatoes, and beer with one golden smurf and not have to worry every month if I have enough food, but then they taste REALLY good on their own.” Gargamel struck me as someone who didn’t have a lot of money, so having been poor myself, I understand this weird conundrum. Also, having a golden smurf to trade might bring unwanted attention from locals would who assume he has LOTS of them, and rob his home looking for them.


  • Yes. Most of them were east-to-find solutions on the web, or someone else giving me access. “Can you reset my password on Blah?” “Try TempP@ass123.” “I’m in, changed password. Thanks.”

    A few times when I am really acting like a Senior Linux Administrator is figuring out a kludge or back door nobody had thought of. Recently, a client told me that the former admin had left and didn’t leave the password to over 300 systems (it turns out he did, the client was clueless, but I didn’t know that in the moment). I found every system the admin had access to, and looked for a dev box where he had access but I could take down during production hours. I took it down, booted into init with /bin/bash, changed root password, brought it back up. Then I checked his home directory to see what public keys he had. Based on that, I checked to see if there were any private keys on the bastion systems that matched as a pair (using ssh-keygen -l -f on each pair to see if the signatures matched). They checked which pair had no password. That was pretty quick because I quickly discovered a majority of these cloud systems also had an ec2-user that could escalate to root via private/public key pairs (it is supposed to be removed for security reasons, but wasn’t). Within a few hours, I had full access back to all their systems. Without taking down production.