• 3 Posts
  • 397 Comments
Joined 3 years ago
cake
Cake day: June 7th, 2023

help-circle
  • I’m in, though I’m curious what “turns you into a reptile” means. Does it just mean I become cold blooded. I’m fine with that, it just means I’m moving somewhere tropical. Do I grow scales and a tail? Certainly not ideal, but I could probably live with it, especially if the tail is prehensile and if I get claws in the mix. Do I get a really long, controllable tongue? Can’t think of any uses for that. Nope, none at all…

    Attraction, sex and reproduction would be interesting questions as well. Do I still find human women attractive, or is my brain rewired to want a lusty argonian maid? What does my new plumbing look like? Are there others of my new species around for me to do the monster mash with?

    But overall, yes I’d probably go for it. I don’t delude myself into thinking that I will somehow continue to exist after death; so, not dying seems like the better alternative. Sure, if the downsides are really bad, I can accept that death is a better outcome (e.g. you live forever, but have locked-in syndrome forever). But, living as a lizard person doesn’t seem too horrible.



  • You could try using Autopsy to look for files on the drive. Autopsy is a forensic analysis toolkit, which is normally used to extract evidence from disk images or the like. But, you can add local drives as data sources and that should let you browse the slack space of the filesystem for lost files. This video (not mine, just a good enough reference) should help you get started. It’s certainly not as simple as the photorec method, but it tends to be more comprehensive.


  • Most of those US services (YouTube, Twitter, etc.) arose to fill a niche which was opened by expanding access and bandwidth. Take YouTube as an example, the idea of sharing a video on a dial-up connection was simply silly. Just downloading the contents of a 1.44MB floppy on a 14.4kbps modem took forever. Even when we got to a 56kbps modem, pictures could still be slow and GIFs were painful to download. It wasn’t until home DSL or cable connections became common that sharing a video was even close to reasonable. In that environment, we saw the start of media sharing services rushing to fill a previously unknown “need”. The most well known was Napster for music sharing, but we also saw the start of bittorrent clients. While not exactly legal, early music sharing and torrent sites showed that people wanted to be able to download media. And with sites like MySpace or GeoCities cropping up, it was apparent that people wanted to also create and share media. YouTube simply married up those two desires at a time where the technology could reasonably support it. And they have massively capitalized on the first mover advantage. With them also having Google money to scale the service, they now sit in a fairly privileged position in their niche.

    I bring this up to say that, were US based services snapped out of existence, new services would arise to fill the gap. If you look at somewhere like China, where access to US services is highly regulated, they aren’t simply doing without, they are creating their own alternatives. TikTok is a good example, while it lacks the longer form videos of YouTube, it did provide media sharing in China. Were YouTube to be blocked at the Great Firewall, TikTok is in a good position to expand into the longer form videos. China also already has WeChat which fills much of the Twitter and FaceBook nice. Russia has VKontakte for those spaces as well. Basically, any place which isn’t well served by US based media giants has their own solutions to fill those gaps.

    Western Europe (using EU as shorthand, though yes I know the EU isn’t all of Western Europe) has the issue of being closely linked with the US economically and culturally. US based services can operate in most EU countries with little friction. Sure, they have to figure out GDPR and Data Privacy issues, but that’s not a major barrier, despite US companies’ whining. So, given the size, first mover advantage and money behind the US based solutions, there hasn’t been space for reasonable EU based replacements. Why use some second rate EU based system, when the US system works so well, and the EU and US are such good allies and closely linked?

    Of course, that last bit is changing (which is part of why you’re asking the question, no doubt). With the US Government going quickly off the rails, and US tech giants doing their damnedest to enshitify everything, the deep cultural links between the US and EU are starting to slip. There might now be space for EU based services to try to step in and replace services like YouTube or Twitter. And that’s the answer to your question. If those services go away, they will be replaced by something else. In time, they are probably bound to be replaced anyway. At one time everyone though MySpace was here to stay, these days I suspect some folks had to google it to figure out what the hell I was going on about. It may be a long time to come, but I’d bet on YouTube eventually being replaced. I have no idea what will replace it, but nothing lasts forever.




  • I can think of a couple of reasons off the top of my head.

    You don’t say, but I assume you are working on-site with your work system. So, the first consideration would be a firewall at your work’s network perimeter. A common security practice is to block outbound connections on unusual ports. This usually means anything not 80/tcp or 443/tcp. Other ports will be allowed on an exception basis. For example, developers may be allowed to access 22/tcp outbound, though that may also be limited to only specific remote IP addresses.

    You may also have some sort of proxy and/or Cloud Access Security Broker (CASB) software running on your work system. This setup would be used to inspect the network connections your work system is making and allow/block based on various policy settings. For example, a CASB might be configured to look at a domain reputation service and block connections to any domain whose reputation is consider suspect or malicious. Domains may also be blocked based on things like age, or category. For this type of block, the port used won’t matter. It will just be “domain something.tld looks sketchy, so block all the things”. With “sketchy” being defined by the company in it’s various access policies.

    A last reason could be application control. If the services you are trying to connect to rely on a local program running on your work system, it’s possible that the system is set to prevent unknown applications from running. This setup is less common, but it growing in popularity (it just sucks big old donkey balls to get setup and maintain). The idea being that only known and trusted applications are allowed to run on the system, and everything else is blocked by default. This looks like an application just crashing to the end user (you), but it provides a pretty nice layer of protection for the network defenders.

    Messing with the local pc is of course forbidden.

    Ya, that’s pretty normal. If you have something you really need to use, talk with your network security team. Most of us network defenders are pretty reasonable people who just want to keep the network safe, without impacting the business. That said, I suspect you’re going to run into issues with what you are trying to run. Something like SyncThing or some cloud based storage is really useful for businesses. But, businesses aren’t going to be so keen to have you backing their data up to your home server. Sure, that might not be your intention, but this is now another possible path for data to leave the network which they need to keep an eye on. All because you want to store your personal data on your work system. That’s not going to go over well. Even worse, you’re probably going to be somewhat resistant when they ask you to start feeding your server’s logs into the businesses log repository. Since this is what they would need to prove that you aren’t sending business data to it. It’s just a bad idea all around.

    I’d suspect Paperless is going to run into similar issues. It’s a pretty obvious way for you to steal company data. Sure, this is probably not your intention, but the network defenders have to consider that possibility. Again, they are likely to outright deny it. Though if you and enough folks at your company want to use something like this, talk with your IT teams, it might be possible to get an instance hosted by the business for business use. There is no guarantee, but if it’s a useful productivity package, maybe you will have a really positive project under your belt to talk about.

    FreshRSS you might be able to get going. Instead of segregating services by port, stand up something like NGinx on port 443 and configure it as a reverse proxy. Use host headers to separate services such that you have sync.yourdomain.tld mapped to your SyncThing instance, office.yourdomain.tld mapped to your paperless instance and rss.yourdomain.tld mapped to FreshRSS. This gets you around issues with port blocking and makes managing TLS certificates easier. You can have a single cert sitting in front of all your services, rather than needing to configure TLS for each service individually.




  • So a couple possibilities come to mind:

    1. Someone else has your password. Do you have kids and do they have access to devices which may have your Google account linked? You may want to change your password (use something long, hard to guess and unique).
    2. Your local system is compromised in some way. This would be a really odd way for someone to use that access, but it’s always possible. Take a look at the apps and any browser extensions you have installed and make sure there isn’t anything you don’t recognize.
    3. There is some sort of Cross Site Scripting (XSS) vulnerability which is being leveraged to subscribe you to stuff. I would expect Google to be better than to have an XSS on YouTube (they bought Mandiant a while ago, FFS). But, big companies doing stupid things is common enough. When you got the pop-up, was it in the YouTube app or a web browser. Did you have other tabs open? Other background processes from sketchy apps?
    4. It is Google, them doing shitty things to their product (that’s you) for their customers (the advertisers paying for your eyeballs) is basically their business model. Don’t like it, de-google your life (warning: this is actually really hard).



  • I deal with this sort of thing pretty regularly for the company I work for. We get threat intelligence from several vendors when they see our users show up in “dumps”. Basically, threat actors will package up stolen credentials in a large zip file and make that available (usually via bittorrent) for anyone to download. Security vendors (e.g. Mandiant, which Google bought) download those dumps and search for accounts associated with their customers and send out these warnings when they find one. On the customer side, if the breach was recent we’ll force a password reset and warn the user about the breached password, with a recommendation to change their password on the affected site and also change any passwords which might be similar elsewhere.

    Why do we force the password reset, even when it wasn’t the account for our business which was breached?
    There’s a couple reasons for this. First off, people still reuse passwords all the fucking time. Maybe this victim didn’t, but we have no good way validate that. Second, even without direct reuse, folks like to have one main password that they apply slight variations to. They might use “Hunter 42!” at one site and then “Hunter 69*” at another. This isn’t smart, attackers know you do this and they have scripts to check for this. Lastly, if an organization is following the latest NIST guidance, you’re not changing your password on a regular cadence anymore. With that is the expectation that passwords will be rotated when there is a reason to suspect the credentials are compromised. Ya it’s annoying, but that’s part of the trade-off for not having to rotate passwords every six months, we pull the trigger faster on forced rotations now.

    If you get one of these, consider it a good time to think about how you come up with and store passwords. If you are re-using passwords, please turn off your computer/device and don’t come back to the internet until you have thought about what you have done. If you aren’t already using one, please consider a password vault (BitWarden or KeePassXC make great, free choices). These will both help you create strong passwords and also alleviate the need to memorize them. Just create a strong master passphrase for the vault, let it generate the rest of your passwords as unique, long (12+ character) random junk, and stop trying to memorize them (with the exception of your primary email account, that gets a memorized passphrase).





  • This sort of thing is just awesome. I really wish there was more information on repairing these sorts of electronics out there and accessible to non-electricians. I do get that sometimes it really does take someone with a lot of specialized knowledge and training to troubleshoot and fix things like this. But, even basic, “look for X and try Y” type stuff for us plebes to make the attempt. Sure, we’ll fail as often as we succeed, but even that would save a lot of electronics from the scrapheap.