Posts by o p

Re: thief

My point was that the technical details of how he could get the files do not matter. The legal "details" is a different thing.

All these commentards trying to justify the theft because he could install Dropbox are wrong, IMO.

And Tesla's security is not inept, they caught the guy spot on.

And Elon Musk's recruiting strategy does not look reckless when you look what his teams do

Re: Credit card? What credit card?

> So how do you prevent the site remembering your card?

Easy. You use a virtual credit card. Each card number generated has a fix amount that can be charged. You generate a new number for each payment. They can keep track of all the numbers, they can be used only once. So you don't care.

Re: Outsourcing

Crappy cloud practices does not imply best on prem practice. S3 is perfectly secure when used correctly, certainly more secure than many on prem solutions.

Re: absence of proof or proof of absence?

>If something is not labelled, then it doesn't form part of >the training

Wrong. It is part of it. The training says: look: There is no pedestrian here. There is nothing.

what is to stop?

15 years in jail for removing it should do.

The issue is not technical, do not believe you are smart because you can launch regedit.

Re: What advantage does AWS have

They know how to run a cloud 365 or 366 days a year. US military will certainly enjoy a lot waiting 2 or 3 days for their mfa to be fixed.

This is not cloud in general, this is Microsoft. I have never had an MFA failure with Google or AWS in the last 5 years, and it's enforced on all our accounts. And everytime I read this kind of article I know Azure and 358 are not even worth considering.

Re: Every company after a data leak

And YES, if professional pentesters reveal only a fraction of issues at a time, so that they are certain to find and bill new ones for the next audit, it does not help to establish trust and respect with the profession, and it certainly discourages business.

Re: Oops

Right. This is a strong hint that Microsoft is Fed up with un-listing them.

Basically this proves they do not control the emails sent from their ip adresses. So they spam the world with mailing lists with a huge number of invalid adresses, and they are the victim ??

Come on.

Re: Let's Encrypt used by shenigans... what a surprise

If you don't want let's encrypt to issue certificate for your domain, you can block them ( via dns !). The issue issue here is dns hijacking. It seems fairly easy to understand that once you do not control name resolution for your domain it's complicated to discuss privacy, security etc, whatever the protocol or tools.

There is also an infinite number of even numbers.

Prime is in P. I do not find it intuitive. Maybe you do?

Re: For those who happen to know where a cash machine running a 15-year-old C3 might be found

Sonicwall 2040. Still running.

new programming

This is a new way of programming. Developpers of sendmail did not bother about anything but relaying emails.

Re: Easy to mitigate

Not0etya used afmin logins. Not vulnerabilities.

It was installed by sysadmins. It did not use internet access.

None of your procedures would help. Not a bit.

Re: Lucky!!

1/ lvextend , resize2fs

2/ vg is full

2a/ physical server: replace first raid1 disk with a bigger one. Wait for sync. Replace 2nd drive. Create new array. Pvcreate vgextend go To 1/

2b/ virtual server: virsh attach. . Pvcreate.vgextend.go To 1/. Or shutdown ,take snapshot. Create bigger volume. Swap disk in vm. Boot. Fdisk. Pvresize. Go To 1/

3/ fix the crap and/or provision more storage.

4/ by the way: check backups are still working

The median for example

Re: A simpler solution?

Won't protect you from key longer, camera + microphone hijacked, unencrypted memory access, graphic card, unencrypted network communications, USB storage access... no, running a vm on a compromised hypervisor is not a good idea.

Re: So how will this work?

Yes but we don't have the details of how it will work.

They say : "enabling HTTPS for your site will be as easy as installing a small piece of certificate management software on the server" .

If this means that a daemon runs on your server, generates private key + csr and send it to a CA, it is very likely that the "management software" will be exploited, sooner or later.

Let's assume it updates itself automatically - a "best practice" nowadays - it will be out of the control of the admin of the server.

You can argue this is already the case with many components on the client and server side, so maybe one more will not make a huge difference. But from the paranoid point of view you can't accept it as really secure solution.

Re: ...or what it might look like.

I have one. I like it, even with win8, the weird keyboard and the impossibility to replace the battery.

Unlike an android tablet it's a real pc and it's lighter than most laptops, with a great screen and a good battery life.

The main issues are the price and the locked container. no drive / memory / battery swap. Maybe they will fix it on the 4th generation.