the rm -rf's will continue until morale improves

[scy@chaos.social]

@neurovagrant Morality. I think in this case the right word to use is morality.

[rubinjoni@mastodon.social]

@neurovagrant It's beautiful.

[paco@infosec.exchange]

@astraleureka At approximately the same time (same year, probably) we had a WAF vendor some in and give a presentation on their product. We had demo access to a live version of it. We were playing with the console of the WAF itself, not some app behind the WAF.

While the vendor is speaking my colleague starts testing stuff on the product console and within a couple minutes he’s pretty sure it’s vulnerable to SQL injection. He tries the classic “or 1=1” and he gets a well-formatted security error. Huh. It detected that and stopped it. He tried “or 2=2”. Bingo. It WAS vulnerable, but they were detecting and matching on the value “or 1=1” as some kind of literal.

I dont mean to derail the thread about careless people losing data to the automated , climate-destroying intern. It just triggers memories of hand made, non-automated failures in the past.

@jztusk @neurovagrant

[mmu_man@m.g3l.org]

@neurovagrant

[c_duv@piaille.fr]

@SomeVeganCheeseIsOk @jrdepriest @jztusk @paco @neurovagrant And also the non-isolation of permissions (the SQL user the application connects with should not be able to perform DDL queries, only DQL and DML).

[luap42@chaos.social]

@neurovagrant good

[taschenorakel@mastodon.green]

@neurovagrant Just waiting for the day, when Claude deletes my employer's company wide network shares.

[ciatmusings@raru.re]

@kirakira @neurovagrant all of em

[derherrfreitag@bonn.social]

@neurovagrant Part of the AI folkore, as long as your company is not big enough for "my agent/model is commiting crimes now".

Both still leave me puzzled, because in a professional context, this is a clear sign not to trust those people or even do business with them. But I might not be a professional... ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯

[joshg@mathstodon.xyz]

@aronowski
I vastly prefer the "don't use the stupid wasteful unethical thing" option, myself.
@neurovagrant

[derherrfreitag@bonn.social]

@neurovagrant Oh, CTO midnight foundation... "dedicated to growing the Midnight network — a fourth-generation blockchain built for secure, compliant, and private decentralised applications".

[darkathena@beige.party]

@patricksh @neurovagrant 100% YES

[thalassophobic@sunny.garden]

@neurovagrant Did he not know that rm -rf was? I honestly don't know what was supposed to do. And, if he closes most sandboxes, they tend to delete because they are temporary. I don't get it.

I don't get what this guy was trying to do and I don't think I will understand. I feel silly.

[dch@bsd.network]

@neurovagrant also, people still not doing backups/restore testing, no zfs, no jails / containers / other restrictions. Kids these days.

[neurovagrant@masto.deoan.org]

@dch right?

the fundamentals do not disappear regardless of the presence of spicy autocorrect

[aakl@infosec.exchange]

@neurovagrant .

[mercurial@booping.synth.download]

@paco@infosec.exchange @neurovagrant@masto.deoan.org I suppose he managed to prove his point...

[loathsome_dongeater@toots.matapacos.dog]

@neurovagrant To prove that this gun is not loaded I will shoot you in the face with it.

boom

I caused this. This is what happened:

[usbtypesteve@infosec.exchange]

@neurovagrant Use stupid software, win stupid prizes

[c0debabe@masto.hackers.town]

@neurovagrant there are guard rails for this and people keep removing them