• 0 Posts
  • 53 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle
  • Sandford Fleming (the guy who invented time zones) actually made it easier.

    Before timezones, every town had their own clock that defined the time for their town and was loosely set such that “noon is when the sun is at its highest point in the sky.” Which couldn’t be measured all that accurately.

    If it wasn’t for Fleming, we’d be dealing with every city or town having a separate time zone.




  • Most large corporations’ tech leaders don’t actually have any idea how tech works. They are being told that if they don’t have an AI plan their company will be obsoleted by their competitors that do; often by AI “experts” that also don’t have the slightest understanding of how LLMs actually work. And without that understanding companies are rushing to use AI to solve problems that AI can’t solve.

    AI is not smart, it’s not magic, it can’t “think”, it can’t “reason” (despite what Open AI marketing claims) it’s just math that measures how well something fits the pattern of the examples it was trained on. Generative AIs like ChatGPT work by simply considering every possible word that could come next and ranking them by which one best matches the pattern.

    If the input doesn’t resemble a pattern it was trained on, the best ranked response might be complete nonsense. ChatGPT was trained on enough examples that for anything you ask it there was probably something similar in its training dataset so it seems smarter than it is, but at the end of the day, it’s still just pattern matching.

    If a company’s AI strategy is based on the assumption that AI can do what its marketing claims. We’re going to keep seeing these kinds of humorous failures.

    AI (for now at least) can’t replace a human in any role that requires any degree of cognitive thinking skills… Of course we might be surprised at how few jobs actually require cognitive thinking skills. Given the current AI hypewagon, apparently CTO is one of those jobs that doesn’t require cognitive thinking skills.






  • You wouldn’t be able to MITM a plaintext connection inside a corporate network with this attack by itself. You could only MITM something that the attacker can access without your VPN.

    Any corporate network that has an unsecure, publicly accessible endpoint that prompts for credentials is begging to be hacked with or without this attack.

    Now you could spoof an login screen with this attack if you had detailed info on the corporate network you’re targeting. But it would need to be a login page that doesn’t use HTTPS (any corporations, dumb enough to do that this day and age are begging to be hacked), or you’d need the user to ignore the browser warning about it not being secure, which that is possible.


  • I can’t see routing traffic to some kind of local presence and then routing back to the target machine to route out through the tunnel adapter without a successful compromise of at least one other vulnerability.

    That’s not to say there’s nothing you could do… I could see some kind of social engineering attack maybe… leaked traffic redirects to a local web server that presents a fake authentication screen that phishes credentials , or something like that. I could only see that working in a very targeted situation… would have to be something more than just a some rouge public wi-fi. They’d have to have some prior knowledge of the private network the target was connecting to.



  • Not all VPN traffic. Only traffic that would be routable without a VPN.

    This works by tricking the computer into routing traffic to the attacker’s gateway instead of the VPN’s gateway. It doesn’t give the attacker access to the VPN gateway.

    So traffic intended for a private network that is only accessible via VPN (like if you were connecting to a corporate network for example) wouldn’t be compromised. You simply wouldn’t be able to connect through the attacker’s gateway to the private network, and there wouldn’t be traffic to intercept.

    This attack doesn’t break TLS encryption either. Anything you access over https (which is the vast majority of the internet these days) would still be just as encrypted as if you weren’t using a VPN.

    For most people, in most scenarios, this amount to a small invasion of privacy. Our hypothetical malicious coffee shop could tell the ip addresses of websites you’re visiting, but probably not what you’re doing on those websites, unless it was an insecure website to begin with. Which is the case with or with VPN.

    For some people or some situations that is a MASSIVE concern. People who use VPNs to hide what they’re doing from state level actors come to mind.

    But for the average person who’s just using a VPN because they’re privacy conscious, or because they’re location spoofing. This is not going to represent a significant risk.


  • So for this attack to work, the attacker needs to be able to run a malicious DHCP server on the target machine’s network.

    Meaning they need to have already compromised your local network either physically in person or by compromising a device on that network. If you’ve gotten that far you can already do a lot of damage without this attack.

    For the average person this is yet another non-issue. But if you regularly use a VPN over untrusted networks like a hotel or coffee shop wifi then, in theory, an attacker could get your traffic to route outside the VPN tunnel.


  • I think I have you slightly beat… mine was an Apple II+, circa late 1981, with a disk drive, and a monochrome green screen monitor.

    First cell phone was around 1997. Though I honestly don’t remember what it was. I recall having a Nokia model from before they made that indestructible model in all the memes, as well as a Kyocera one that I could connect to a laptop and have wireless dial up internet at some abysmal speed like 20 kbps. (0.02 mbps). I had at least two more phones, including a Treo 650 “smartphone” before getting my first iPhone, a 3G. I’m on my sixth iPhone now.



  • The pro-lifers that think there should just be an exceptions when mother’s life is at risk need to also hear that the Texas law already has an exemption for when a doctor uses their “reasonable medical judgment” that the life of the mother is at risk or the pregnancy poses “a serious risk of substantial impairment of a major bodily function.”

    All pregnancies are a risk to the mother’s life, anytime a doctor performs an abortion in Texas they risk losing their license, and possibly even prison time. Which is why we have these case of mothers with unviable pregnancies that aren’t terminated until they’re almost dead.

    If you care about life, why on earth would you support a law that takes informed medical decisions away from doctors and their patients to put it in the hands of lawyers and lawmakers?


  • Who cares? Because I assure you, Microsoft doesn’t.

    20-25% of those webservers are running on Microsoft Azure hardware. Microsoft is the #2 cloud provider and has been slowly but closing their gap behind AWS in recent years. All of that is in large part due to them embracing Linux and open source support on their platform.

    Software isn’t the battleground, and hasn’t been for a decade. The people behind Apache and Nginx aren’t making bank on their web server dominance. Microsoft and AWS still rake in money hand over fist regardless of what software runs on their servers.

    The author of this article’s apparent attitude that this is some kind of indicator of Microsoft’s market failure is one of the most ridiculous conclusions I’ve heard in a while.