@m4rc0v0nh4g3n @buzz_chronicles I hadn't even thought of making it a public list. That's not a bad idea either.

Would it be unethical to collect the crappy tweets from tech and infosec dudes directed at women and other under-represented groups for purpose of reference when their resumes show up for a job posting?

Asking for a me.

Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies

👇Check the thread after reading for a few bonus

Scope:

Other than the mentioned .NET bug, only one other team said the finding was out of scope, using this as a reason to reduce the bounty from P1 to P2.

We've also purposely avoided reporting to at least one program that had "internal or development services" listed as OOS

Pytosquatting:

In Python, the 'install' name of a package can be different from the 'import' name. This allows for an unique type of typosquatting attack by uploading under unclaimed import names on PyPI, where it can be downloaded by developers, or even automated tools.

I tried this out against some Google open source projects and it actually got me inside two *.corp.google.com machines.

However, just like typosquatting, this mostly relies on one-off mistakes. Google did not accept it as a valid vuln, and I fully agree with their assessment.

Fun fact: those packages are long gone from PyPI but for some reason they are still up on some sort of Chinese mirror, and I still get various callbacks from China to this day.

Use Google like a pro.

🧵

1. Use quotes to force an exact-match search:

"what is javascript"

2. AND operator will return only results related to both terms:

html AND css

3. You can use the OR operator to get the results related to one of the search terms

(javascript OR python) free course

4. - operator will exclude results that contain a term or phrase:

javascript -css

Many people are stressed by social media, especially Twitter.

Here is what I do to keep my sanity:

1. Be selective who you follow. Choose uplifting people and people you enjoy talking to.

2. Mute and block liberally. “But freedom of speech”. Nonsense. You choose your friends and parties in real life. Same applies to social media. It’s not immoral to ignore people who dunk on you. This also includes the annoying “devil’s advocate” personalities.

3. Choose your online persona. I mostly use Twitter for work and for engagement with the .NET community. But I’m still a human. Don’t let others dictate what you can and cannot talk about.

4. Choose wether you use your real name or a pseudonym. Social media is about authentic and real human encounters. Your name isn’t as important has how honest you can be in your conversations. Being anonymous is totally cool if that lets you be who you are.

So many folks (esp. the media) are missing the complete backstory on $GME and how we got here.

This has been simmering for over a year and the story behind it is great. I’ve been tracking this since September and devoured all of the details from the origin through today.

So back in September 2019 (!) some guy named DeepFuckingValue posted this on r/wallstreetbets:

It was just a post about his LEAPS (aka,
Long-Term Equity Anticipation Securities — tl;dr long-dated calls) on GME.

At the time, nobody understood his position at all. The top comment on that post?

"Bid-ask spread on these are ridiculous, good luck getting rid of them" lol.

For the next year, every month about once a month, he posted his "YOLO GME" position. Every month for a year he got made fun of.

I caught wind of this trade back in September 2020, a FULL YEAR after this guy was already holding. I also thought it was weird—the dying retailer?

So I dug into the public quarterly reports of GameStop. Every quarter, public companies are required to release what's called a "10-Q" which is a quarterly report of their financials. You can find them here:

Daily Crunch: GameStop becomes a meme stock https://t.co/A2cotQNiC4 by @anthonyha

Part of the GameStop absurdity and chaotic revelry is seeing news outlets publish Reddit usernames with a straight face

2024 Treasury Secretary nominee: Thicc Dads Club

@GaryMcAllister @shanselman

Tomorrow morning a subreddit is going to successfully drive a $13 billion hedge fund into insolvency.

A few folks are correctly pointing out that this may take until Friday to go fully nuclear (that’s when a lot of contracts come due). Either way, tomorrow morning’s opening bell will be pure chaos.

Have you ever had an app that authenticated users, and then thought wouldn't it be great if it could act as that user for the services it has to call later?

This has historically been called Impersonation, Delegation, Act As, or On Behalf Of depending on protocols in play.

Fundamentally the idea is simple. The user projects their identity to some remote application (i.e. authenticate). The app can't do anything with that projection other than accept it. Delegation is the act of granting that app the right to project the identity further downstream.

There's a fundamental requirement with this though. The method of projecting (authing) the user has to rely on a trusted third party. In other words using something like federation or protocols like Kerberos. This is in contrast to just passing around creds. You might wonder why.

It's because if the app in the middle has your password it can just use your password for downstream stuff, ad infinitum. Trusted third party auth protocols by their nature like having 1:1 relationships with all parties. Unfettered projection complicates things.

I keep saying projecting when I technically mean authenticating. You might wonder why. Authentication is the act of verifying a credential, where that credential could be a password, or a token, or a ticket. Most people associate it with just the first step: the user password.

Speaking of algorithm competitions, here are a few you should checkout if you are interested.

Topcoder Open:

Facebook Hacker Cup:

Google Code Jam:

Microsoft Imagine Cup:

Hallo ihr da draussen. Ich bin Lexa, 12 Jahre alt und besuche ein #Gymnasium in #Sachsen. Und das hier ist ein #rant über #Homeschooling 🤬. Meine Mum gibt mir dafür ihren Account, damit ich das mal loswerden kann was mich bewegt.
#BildungAberSicher

Womit soll ich anfangen? #Lernsax ist unzuverlässig. Die ersten paar Tage kam ich nur unregelmäßig rein, es nervte einfach nur, immer und immer wieder stürzt das System ab oder ist überlastet. Die Lehrer kennen sich damit scheinbar noch weniger aus als wir Schüler.

Nach dem ersten Lockdown hätte man das im Computerkabinett der Schule gemeinsam üben können, denn jeder wusste, dass eine zweite Welle kommt und damit auch ein neuer Lockdown (auch wir Kinder wussten das!) Aber nein, stattdessen haben wir irgendwelchen Schnulli in PC gemacht.

Offenbar sind unsere Lehrer auch nicht geschult, sich mit den neuen Medien auseinanderzusetzen, teilweise sind sie sogar richtig technikfeindlich und weigern sich, online irgendwie präsent zu sein. Deshalb haben wir auch keine Zoom-Meetings oder ähnliches.

Begründung der Lehrer: das würde ja ihre Privatsphäre verletzen, wenn sie von zuhause aus Unterricht machen würden. Und sonst müssten sie ja jeden Tag in die Schule fahren. 🤬 Wir hatten während der gesamten Zeit nicht ein einziges Online-Meeting oder einen Chat. 😭

Unsere Systeme sind derzeit leider nicht erreichbar. Wir arbeiten unter Hochdruck an einer Lösung und halten Sie hier auf dem Laufenden.

Liebe Nutzer, wir haben Verständnis für eure Unzufriedenheit. Auch wir sind mit der aktuellen Situation nicht zufrieden und arbeiten daran, den Dienst kurzfristig wieder verfügbar zu machen. (1/2)

Dear @Etsy,

Please for the love of God stop writing copy for me on my mobile device. All I want is the URL. I assure you most of your customers delete this text. Stop writing on my behalf when all I want is the link. 😑 I sometimes do not share links from you because of this.

Also, why are you not giving me an option for JUST the link? What is even going on over there @Etsy? JUST GIVE ME THE LINK. This makes for a terrible user experience 😳

I'm almost positive this is the effort of someone in marketing thinking "this way we'll make sure @Etsy gets tagged in posts!" 😑😐

But c'mon- think about how much of a pain this is for folks who don't like to send messages that sound like I work on your marketing street team 🙄

LMAO WHY DO I HAVE THE OPTION TO TRANSLATE BUT NOT TO JUST GET THE FUCKING LINK OMG ⚰️ @Etsy I'm calling the app police 🤣😭 so wild

WHY WOULD I EVER WRITE THIS ON MY OWN @trello CARD???? ⚰️💀

So there's a lot of confusion about what Parler being kicked off of Amazon Web Services (@awscloud) means. Let me do a quick thread to explain it to folks who aren't deep in the technical weeds...

You use an app (in this case, Parler). There's a web site you can use, and apps you can download onto your phone via Apple and Google. Those three versions of the app all talk to servers (big computers) behind the scenes.

In the Olden Days, getting those servers took months. Then you had to sign deals with companies to host those servers--they take massive amounts of power, they run hot so air conditioning is a big deal, and they need a *lot* of bandwidth.

About 15 years ago or so, Amazon (the online bookstore) had a revelation and started AWS. The idea being that instead of needing tens of thousands of dollars to get those servers built up, and spending months on it, that they would rent you these servers by the hour.

"A credit card and a few clicks of a mouse later" you were basically able to spin up huge numbers of these servers.