elvith

@elvith@feddit.org

• ⁨Comment⁩ on ⁨Silent Hill decompilation just surpased 80%⁩ ⁨⁨1⁩ ⁨hour⁩ ago⁩:

  I don’t know.

  The gist is… When you write a program/game/… You write source code and then compile it - that means translating the source code into machine readable code. While certain things do usually get lost in this process (e.g. function names, variable names, etc.) you can see the resulting machine code and make a valid assumption about how the original code looked like. This is not a 1:1 reconstruction, but will yield code that should compile to the (basically) same result as the original game.

  If you hit a Jackpot, you find a version of the program/game that was used for testing. Those often contain many pieces of information that would otherwise be stripped from the end result (e.g. aforementioned variable names, function names and so on). If not, it’s a puzzle solved with guess work and experience.

  If you know some specifics about the game (which language was it written in, what compiler was used in which version,…) you can get some better results, as you can take patterns in the machine code and translate them back into what the original code was probably looking like based on the tools used.

  In the end it’s sadly almost everytime still a manual process in which you look at the resulting source code, make some educated guesses based on patterns that are usually used when programming and specific functions that are probably contained in a game and then check those assumptions by changing the code and see if your changes affect the part of the program you thought you were dealing with.

  Say you assume a specific variable/value is the maximum walking speed of the character. Then you change it and try to play the game and see if you can walk faster now. If so, label this value accordingly and go on to the next unknown piece of the puzzle.

• ⁨Comment⁩ on ⁨Setting up VPS (finally)⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:

  And don’t listen to the promises of big companies with billion-funds, they cook with water like the rest of us.

  Oh, yeah, I remember when one of our super important core systems was migrated to SaaS. My system was interfacing with it, so I got notified about the migration to make a plan. I basically told them: “We’re using $API to connect to your system. Tell me the new hostnames and IP ranges and ports and I will configure the firewall on our end. Also, our connector for your migrated system will be deployed in $IP-range so please allow these inbound connections in your firewall.”

  Half a year later I got a message: “Yeah, we just found out, that $SaaS-provider never configured the firewall after our tickets and everything is reachable from the public internet. We’re forcing them to lock down the system now. Can you please tell us again from where you connect to us?”

• ⁨Comment⁩ on ⁨Setting up VPS (finally)⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:

  If you put any data anywhere, assume it will be contained in a breach in the future. Blue teaming is hard. You have to be perfect every time. Red teaming is easy. You just have to wait till the blue team makes a simple mistake…

  Mails sent to a company? Their or your mail account will be breached one day.

  Account details on a webpage? Their user database will be leaked.

  Your cloud drive, ect.

  Even your data on your NAS at home or on your PC could get accessed in one way or another, you’re just a zero day and an unfortunate click away from disaster.

  On the upside, as long as you do not have a target on your back, patch your stuff in a timely manner and keep some hygiene in configs, secops … You should be fine, as most automated attacks aren’t that high level and target the low hanging fruits. But that doesn’t make you completely safe.

• ⁨Comment⁩ on ⁨big opportunity⁩ ⁨⁨6⁩ ⁨days⁩ ago⁩:

  Whips! Traps! Big round boulders rolling in your direction trying to crush you! Nazis you can punch!

• ⁨Comment⁩ on ⁨xkcd #3182: Telescope Types⁩ ⁨⁨6⁩ ⁨days⁩ ago⁩:

  Instructions unclear, drinking straw stuck in telescope.

• ⁨Comment⁩ on ⁨Never tried it but it sounds like fun⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

  There are 69 reasons why I don’t need a flexible spine.

• ⁨Comment⁩ on ⁨Streaming on mobile⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

  In the German Ubuntu Wiki there’s a list of many streaming URLs of (local) radio stations ordered by country: wiki.ubuntuusers.de/Internetradio/Stationen/

  Then they also have this list of online only radio stations, but those are heavily skewed towards German stations: wiki.ubuntuusers.de/…/Internetradio-Stationen/

  Just plug those URLs into VLC or any other app of your choice (heck, even the browser should work) and you’re good to go.

• ⁨Comment⁩ on ⁨Never tried it but it sounds like fun⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

  Yes

• ⁨Comment⁩ on ⁨It would be cool if after you died you could see the top 5 times you almost died⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  3 Not unconscious, but not far off from it (but heat in the summer plus also having not had a meal for a long time while being outdoors in a rarely frequented part of the woods)

• ⁨Comment⁩ on ⁨Cursed worm by Stitchywithliviee⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  No, never! Otherwise, we wouldn’t have such wonderful musical creations!

• ⁨Comment⁩ on ⁨Manufacturer issues remote kill command to disable smart vacuum after engineer blocks it from collecting data — user revives it with custom hardware and Python scripts to run offline⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  Having not read the article: “Let’s apply Hanlon’s Razor: Oh, probably it just collects the data locally and caches it until the vendor’s servers are reachable. After a while the data partition was full and it stopped working as this case was never deemed possible when this was developed.”

  Having read that the kill command was logged and he found it in the logs: “ok, there are no technical details, so there might still be a misunderstanding, but that’s not what I expected!”

• ⁨Comment⁩ on ⁨NEVER OBSOLETE⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  There aren’t many i386 distributions anymore, but you should still have some selection, I think

• ⁨Comment⁩ on ⁨Why?⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  This!

• ⁨Comment⁩ on ⁨Lawmakers Want to Ban VPNs—And They Have No Idea What They're Doing⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  That’s basically any modern network. There is no more trivial “inside our network” vs. “outside on the internet”. Networks are segmented on a need-to-know principle. You can access some information from the public internet. Some other things can be accessed from the internet, but only on corporate devices, if your user AND device is whitelisted. And then you have one or more VPNs on top of that for more sensitive stuff. Also those VPNs may be “dynamic” in the sense that it may also be dependent on the user, device and authentication method what is currently accessible over that VPN connection.

• ⁨Comment⁩ on ⁨In 1982, a physics joke gone wrong sparked the invention of the emoticon - Ars Technica⁩ ⁨⁨4⁩ ⁨weeks⁩ ago⁩:

  :-(

• ⁨Comment⁩ on ⁨We have one at home⁩ ⁨⁨4⁩ ⁨weeks⁩ ago⁩:

  I didn’t get mine to have less than about a second latency LOL

• ⁨Comment⁩ on ⁨🚣 🚣⁩ ⁨⁨4⁩ ⁨weeks⁩ ago⁩:

  There’s a boat emoji?

• ⁨Comment⁩ on ⁨If Valve creates an "entry point" for living room PCs, the console-beating Steam Machines will follow, argues Baldur's Gate 3's publishing director⁩ ⁨⁨5⁩ ⁨weeks⁩ ago⁩:

  You can disable UAC (thinking practical, not necessarily security minded - but for an auto login w/o password, what’s security?)

  Popups: yes. But then you’d need to actively use other software besides steam. Why would you do that, if using only a controller? Also that can happen in Linux, too. If you mean those desktop notifications - those should be silenced automagically when running games.

  For the logoff or shutdown: Set or createHKEY\_CURRENT\_USER\\Control Panel\\Desktop\\AutoEndTasks to 1 to auto kill hanging/not ending processes automagically. Also you can use WaitToKillAppTimeout there to define how long windows should wait before killing the processes (in milliseconds).

  And regarding bitlocker after a bios update: why would you use bitlocker on such a machine (auto login on boot which would allow access to all files anyways)? Anyways, set or create HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\PreventDeviceEncryption to 1 to prevent bitlocker from running after an upgrade. With Pro, you could also leverage GPOs for that.

  At least for the new Steam Gamepad they announced trackpads to be able to control the mouse with the gamepad, so clicking away a popup or sich shouldn’t be a problem.

• ⁨Comment⁩ on ⁨If Valve creates an "entry point" for living room PCs, the console-beating Steam Machines will follow, argues Baldur's Gate 3's publishing director⁩ ⁨⁨5⁩ ⁨weeks⁩ ago⁩:

  Any other Distribution and even Windows would work fine, as long as you set up passwordless autologon as a default user and then put Steam in Big Picture Mode as autostart.

• ⁨Comment⁩ on ⁨She strongly disagrees⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:

  370 to go

• ⁨Comment⁩ on ⁨Microsoft: Windows Task Manager won’t quit after KB5067036 update⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:

  It is. To close the Taskmanager, you simply start a new instance and kill the old ones…

  So, just don’t forget to select Taskmanager in the list and kill it instead of clicking X and closing the window. Otherwise you need to start a new instance and use that.

• ⁨Comment⁩ on ⁨Help? Caddy reverse proxy⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:

  No, that’s just another hypothetical app that you’re using a reverse proxy for. I just included it to show how you can also set settings for a single subdomain/reverse proxy entry that isn’t used globally on all domains that get served. I used a hypothetical REST API that needs a CORS Header that other apps don’t need (or maybe serve themselves).

  admin off disables Caddy’s admin interface (which shouldn’t be public and if you’re using config files this usually isn’t needed. So just a bit of gardening)

  servers sets some general server options.

  and then I just inserted several blocks that each define a reverse proxy to a different app / backend to show that you can just dump them all in a single Caddyfile. And the last example to show that you can set specific settings only for a specific subdomain instead of globally. As I set headers mostly used by REST APIs, I just called that api.example.com instead of app3.example.com.

• ⁨Comment⁩ on ⁨Help? Caddy reverse proxy⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:

  If you like, I can send you an example of the Caddyfiles, that I’m using (I used the import directive to split every service into its own Caddyfiles, you could just copy and paste everything in the same file). It will take a few hours until I get home, though.

  But basically you can just put every subdomain and it’s target in a separate block and the add some things globally (e.g. passing the original IP, switching off the admin API of Caddy,…)

  Something like this should work:

  
  admin off 
  
  servers {
  		client_ip_headers X-Forwarded-For X-Real-IP
  }
  
  app.example.com {
      reverse_proxy 127.0.0.1:8080
  }
  
  app2.example.com {
      reverse_proxy 127.0.0.1:8081
  }
  
  api.example.com {
      reverse_proxy 127.0.0.1:8080
      header {
          Access-Control-Allow-Methods "GET, OPTIONS"
          Access-Control-Allow-Origin "*"
      }
  }
  

• ⁨Comment⁩ on ⁨Microsoft Teams can record office presence from December⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:

  I mean… Is it really spying? Your company can detect which AP or Switch you’re connected to (or if you’re using a VPN from home), so they do have that data anyways.

• ⁨Comment⁩ on ⁨Internal domain and reverse proxy⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:

  Yeah, that’s exactly why I didn’t use my own CA. There’s a plethora of devices that you now need to import the CA to and then you need to hope, that every application uses the system cert store and doesn’t roll its own (IIRC e.g. Firefox uses its own cert store and doesn’t use the system cert store. Same for every java based application,…)

  It’s fiddly with Caddy, as you need a specific plugin to get it to work with anything else than the default challenge. That means using a custom build via caddy - and with docker, you’re SOL. BUT you can just use certbot and point caddy to the cert file in your file system.

• ⁨Comment⁩ on ⁨Internal domain and reverse proxy⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:

  I have this setup. I bought a domain (say homeserver.tld) from a registrar that allows zone edits with an API. Then I use certbot with a plugin that supports my registrar to get real Let’s Encrypt certificates. Usually Let’s encrypt connects to your server to ensure that it responds to the domain you’re requesting a certificate for, but this challenge can also be done by editing the DNS record of your domain to prove ownership. That is called DNS-01 challenge and is useful of your domain is not publicly reachable. Google for certbot DNS-01 <your registrar> to find some documentation.

  Some of the VMs/LXC now get certificates for a specific subdomain (“some-app.homeserver.tld”), other just get a wildcard certificate (“*.homeserver.tld”) - e.g. my docker host.

• ⁨Comment⁩ on ⁨If you want to be classy and impress people⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:

  Wouldeth youeth liketh toeth seeth myeth dicketh?

• ⁨Comment⁩ on ⁨The AWS Outage Bricked People’s $2,700 Smartbeds⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  Wasn’t it also some kind of DNS problem on top?

• ⁨Comment⁩ on ⁨do it cowards⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  For effective shitposting, right?

• ⁨Comment⁩ on ⁨English moment⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  A little bit:

  hose: ˈhōz

  dose: ˈdōs