Bot's enable discovery of information or exploits at a scale that we cannot imagine.
Recent example of a breach, they are now using AI to decomp APKs and iOS apps, mainly old builds of apps that nobody would bother spending the time on previously to look for secret keys or accidental information disclosure.
This would have been immensely time consuming with each app usually doing things a bit differently (e.g. encrypted + compiled settings, keys in database, settings in a settings.json).
Now you can automate the entire pipeline, this is actively being used to look for legacy API endpoints that may not be hardened or monitored, or if you don't rotate your keys and at one point disclosed them.
Dang, that’s tough. Recently having to deal with php2shell was a good wake-up call for anybody doing hosting of any kind. Next few years gonna be rough (but food on the table for cybersecurity experts I guess)
“The major problem—one of the major problems, for there are several—one of the many major problems with governing people is that of whom you get to do it; or rather of who manages to get people to let them do it to them.
To summarize: it is a well-known fact that those people who must want to rule people are, ipso facto, those least suited to do it.
To summarize the summary: anyone who is capable of getting themselves made President should on no account be allowed to do the job.” - Douglas Adams HHG2G
Agreed. This is all lazy chair hindsight talk, maybe by those not affected by it. In the moment you act on the imperfect information you have available and you use the safe than sorry rule. And to demand perfect information is also a fallacy, it doesn’t exist until after the fact.
I hear you, but also I'm not so sure. I remember Log4j, heartbleed, etc. and they were just as serious, but I don't recall people just going dark immediately. Scripts to validate whether or not you had exposure were built, people ran them, and if you did have exposure you started checking to see whether or not it was exploited. This timeline for this seems wildly different to me.
Because it’s not the same type. There was no actual info until the patch dropped, with some people in the know , which made it dangerous to leave your site up. The stopgaps were wild guesses. The multi-upload mitigation wouldn’t have worked.
There was no check that could be trusted to be the check to mitigate it. So that left the scenario that we went through.
My semi-outdoor cats are extremely anxious in cars. The vet is 150km away and they hurt themselves in the journey out of panic.
During one trip I decided to roll my cat in her usual blanket and then kept comforting her. I also played the usual music I play at house. This really helped calm her down. Putting her in a carrier was making her more anxious but being held in her own blanket made her feel safer.
I like that George seems to be in a better headspace. He was like that posh brit talking others down with a know it all attitude, but since the summerbreak he has been way more relaxed and less antagonistic.
The struggle is the blind opening of chrome, like most people probably just do without thinking. Unless you are really a hardcore frontend developer, you lose nothing by switching to Firefox (or non chrome/chromium browser). I operate both and for 95%, maybe even more, there is no difference. By switching you will put pressure on google to keep on the users good side.
I think the schism happened for several reasons, none of which I can personally account. If people really want to dig in, the subreddit r/academicbiblical is full of well, academics and people who know their stuff.
reply