Chinatown88
1 year 1 month 1 day and counting
I finally pre-ordered Unicorn Overload CE. I don't think there's any new stuff on the list this year for me. But I'm sure I'll stumble into something from my Twitter feed.
OT: 118th Obsequious Banter Thread: February is the month of food days
- Thread starter MiamiScreamingEagles
- Start date
- Status
Beef Invictus
Revolutionary Positivity
@Beef Invictus This is the worst API problem I’ve ever seen. Ever. I’ve never even heard of anything this bad at a bar during a conference.
How Spoutible’s Leaky API Spurted out a Deluge of Personal Data
Ever hear one of those stories where as it unravels, you lean in ever closer and mutter “No way! No way! NO WAY!” This one, as far as infosec stories go, had me leaning and muttering like never before. Here goes: Last week, someone reached out to me with whatwww.troyhunt.com
I loled early when he revealed it returned his email and phone number. These guys have 1998 "I made this site for a High School project" levels of security. It's been years since hiding that has become a basic thing.
Edit: AND A PARAGRAPH LATER THE PASSWORD HASH
Beef Invictus
Revolutionary Positivity
@JojoTheWhale This is incredible. It just keeps getting worse. Every time I think "well at least X probably isn't the case" I soon learn it is actually the case.
"Well, at least Spoutible is probably so small that it probably doesn't have any kind of federated access anywhere else."
Yes it does! Why wouldn't it, of course it does. The other sites granting those linkages did no digging apparently before tying their security to this. Someone has their account snagged here, their accounts at Bluesky and Mastodon will now spout whatever the snagger wants too. Good stuff. Both those sites should immediately disable crossposting from Spoutible.
And I don't think "What does F12" show is exactly the kind of digging that requires a security specialist.
"Well, at least Spoutible is probably so small that it probably doesn't have any kind of federated access anywhere else."
Yes it does! Why wouldn't it, of course it does. The other sites granting those linkages did no digging apparently before tying their security to this. Someone has their account snagged here, their accounts at Bluesky and Mastodon will now spout whatever the snagger wants too. Good stuff. Both those sites should immediately disable crossposting from Spoutible.
And I don't think "What does F12" show is exactly the kind of digging that requires a security specialist.
Magua
Entirely Palatable Product
Beef Invictus
Revolutionary Positivity
@JojoTheWhale my mind always ends up going to "whats the federated identity situation?" If there was something I'd cut off as step 1 if I were running security for a platform and were given draconian power, that would be it. If it isn't all in-house, it's out. FB/Twitter linkage? No way. Logging in using FB/Twitter/Google? Absolutely not. We would not be risking our users becoming compromised in any fashion thanks to a screwup at some other company. The convenience is nice and all, and I'll use it sometimes, but I sure do hate it.
And speaking of this, good timing on the whole security thing. I just got an email from a connection about checking on their server environment. They have no cash so "we pay in experience" is their favorite price. At this point I'm getting rusty on some stuff but I can refresh fast and dumber people than myself have faked it more severely.
And speaking of this, good timing on the whole security thing. I just got an email from a connection about checking on their server environment. They have no cash so "we pay in experience" is their favorite price. At this point I'm getting rusty on some stuff but I can refresh fast and dumber people than myself have faked it more severely.
Striiker
Former Flyers Fan
DancingPanther
Foundational Titan
- Jun 19, 2018
- 33,895
- 72,132
Ubisoft is next after what that fool said last week
She just won a bet
Embiid
Marcus Hayes "bitch" slapper
GIGO...
gizmodo.com
AI Deployed Nukes 'to Have Peace in the World' in Tense War Simulation
OpenAI’s GPT models sounded like a genocidal dictator in a test of war-time decision-making.
gizmodo.com
Flybynite
Registered User
- Feb 25, 2018
- 7,383
- 14,523
It's almost like the AI is potentially capable of acting the way warned of in tons of 'fiction' over the last half-century...GIGO...
AI Deployed Nukes 'to Have Peace in the World' in Tense War Simulation
OpenAI’s GPT models sounded like a genocidal dictator in a test of war-time decision-making.
If only there were warnings.
Chicken N Raffls
Here for the chaos and lolz
Back when people read magazines, I was reading one. The article was about new technology and this was late 90's/early 2000's. It described an interface where you could put a camera down on this flat screen, and it's contents would appear on the screen. You could drag them around with your finger, open up pictures and organize them. This was brand spanking new tech. Well before smartphones.
One of the first things I thought when I read that was, I will see kids at school with the "desk" from Ender's Game in my near future. Now every kid in school has a tablet. We live in a pretty crazy time of what's been imagined, and what's been realized.
Then again, this is all a simulation, soooo
ellja3
Registered User
As a European, this reference, of course, flew right past me, but let's just agree misery loves company.
It's better today. Slightly.
Do you have a smart watch that you can use as a phone?
Get Smart was more advanced than Star Trek. Capt Kirk had to use those flip open communicators.
Chicken N Raffls
Here for the chaos and lolz
Always cracked me up in Austin Powers how the video communication was great in the 60's, but grainy and choppy in the 90's.
I loved Get Smart
Lord Defect
Secretary of Blowtorching
- Nov 13, 2013
- 18,907
- 34,989
I’m tempted to buy the contra game they’re selling for the switch, but I’ve bought a few games lately and should take a little break in buying them, and it’s pretty much double the digital price.
JojoTheWhale
"You should keep it." -- Striiker
- May 22, 2008
- 35,879
- 110,904
Those are long sold out unless something weird happened. I think I bought mine in Spring 2022.
Great choice, though. Contra is one of my favorite series.
Lord Defect
Secretary of Blowtorching
- Nov 13, 2013
- 18,907
- 34,989
JojoTheWhale
"You should keep it." -- Striiker
- May 22, 2008
- 35,879
- 110,904
FLYguy3911
Sanheim Lover
- Oct 19, 2006
- 54,761
- 90,150
Danko
The Bearer of Bad Knees
- Jul 28, 2004
- 11,550
- 11,563
FlyerNutter
In the forest, a man learns what it means to live
DancingPanther
Foundational Titan
- Jun 19, 2018
- 33,895
- 72,132
Cody Webster
Registered User
- Jul 18, 2014
- 26,331
- 24,810
It's a really good interview, unfortunately, people won't give it a watch because, well, yeah.
DancingPanther
Foundational Titan
- Jun 19, 2018
- 33,895
- 72,132
- Status
