Sysadministrivia

Apparently twitter does not let you include the word admin in your handle. Go figure. tweets by @brentsaner

[Sysadministrivia @SysAdm_Podcast]

you're welcome.

[Sysadministrivia @SysAdm_Podcast]

stop fucking writing shit in java

[Sysadministrivia @SysAdm_Podcast]

@evilsocket To be fair, you can do this with straight up telnet to a target SMTP server: https://t.co/uAmRPmv3mf

[Sysadministrivia @SysAdm_Podcast]

@GeorgeOhWell10 @erlichya LZ were plenty impressive on their own right; no need to steal thunder from other innovations.

[Sysadministrivia @SysAdm_Podcast]

@GeorgeOhWell10 @erlichya And ZIP (technically, DEFLATE) used only *parts* of LZ77 along with Huffman encoding. ZIP was entirely Katz and Conway, not LZ, and isn't itself spec'd to any compression whatsoever- just provides hooks/allowances for it.

[Sysadministrivia @SysAdm_Podcast]

@MrKevHunter @CompuConnexions @BrandonLive @robertgraham for a targeted account unless they've fixed that or implemented mandatory MFA in the meanwhile. This was a while back.

[Sysadministrivia @SysAdm_Podcast]

@MrKevHunter @CompuConnexions @BrandonLive @robertgraham Theoretically assuming the attack was silent enough, not even 1Password would know.

Pragmatically, last I looked into it they didn't limit or restrict failed login attempts so a bruteforce *may* be feasible (con't)

[Kelly Vaughn @kvlly]

Stop using LastPass as your password manager.

Move to any other one, and please change any passwords you have on there now.

[Sysadministrivia @SysAdm_Podcast]

@Paul__Walsh @evacide @kvakes Anything beyond is a fundamental misunderstanding of the right to privacy.

The consumer/user has no direct and enforceable guarantee that the privacy of their real-life identity is respected *except for never requiring it in the first place*.

[Sysadministrivia @SysAdm_Podcast]

@Paul__Walsh @evacide @kvakes My entire argument is this API call, in mention, is now pointless. There is no purpose to verifying "identity" (as you've taken upon yourself to claim context) unless it's something tied *to servicing* that identity.

[Sysadministrivia @SysAdm_Podcast]

@Paul__Walsh @evacide @kvakes well, no- there *is* PII. a specific *value* be ephemeral, but it's still required. further, tokenizing to a specific entity is, itself, still PII.

Personal - yep, entity is an individual, a person
Identity -ah, yep, there is indeed a set of data and history tied to this entity

[Sysadministrivia @SysAdm_Podcast]

@Paul__Walsh @evacide @kvakes i thought "I am always going to set fire to ... requir[ing] the use of real names online" was pretty clear

[Sysadministrivia @SysAdm_Podcast]

@bastianpurrer @Leomoss @PrivSecurity @evacide might want to rethink that for #2, becsuse the posturing for "hacking back" as part of nationstate cyberwarfare is literally what directly led to WannaCry.

[Dominic Alvieri @AlvieriD]

BREAKING

Microsoft allegedly breached.

@campuscodi @vxunderground
#cybersecurity #infosec @Microsoft

[Sysadministrivia @SysAdm_Podcast]

@washburn_stream @SlackHQ @brandonscript @cellularmitosis Checking in from 2022, still not here

[Sysadministrivia @SysAdm_Podcast]

@chakkerz @gamozolabs s/las6/last/

[Sysadministrivia @SysAdm_Podcast]

@chakkerz @gamozolabs Oh word; here's some recommended reaources to get you started when you have the time! (Hit the first link las6; the upstream docs are a bit dry)

https://t.co/tr3TyNy5BQ
https://t.co/f4lqtMvEQz
https://t.co/XTBvCEUvBy
https://t.co/aNt17qvj4y

[Sysadministrivia @SysAdm_Podcast]

@chakkerz @gamozolabs from an actual hardening/security perspective, though, they're both good. either one is better than neither. :)