61–70 of 108 posts
Aha I love those little messages at the end telling users to update their software to the latest version. It's a cry to the void.
On one hand, the average user will never update his software unless you literally force them to. On the other hand, your free upgrade to Windows 10 is ready. Would you like to install it right now or later tonight?
Earlier quoted context omitted.
These days I'd be worried about CFAA or otherwise getting V& for this. In the "good old days", it was possible to get away with and laugh about this type of vigilante justice. These days though, you're more likely to wind up in prison. No longer worth it for lulz. Sad times now, but good memories.
What they did at the time would still have definitely been illegal. Probably not any more illegal than it is now. I doubt they'd be prosecuted, but breaking into any system is illegal.
Earlier quoted context omitted.
broadly speaking, how would you design things? All I can think of doing is putting explicit permission grants on everything, requiring everyone to click a million times as was done with the first version of Vista's UAC, IIRC, which is no solution IMO.
ever heard of code signing ? Maybe MSFT could use some of its 23 BILLION dollars of yearly profit to test some of the programs and conditionally approve them if they pass muster, also based on the historical reputation of the signer (like ebay feedback). Then if they contain sleeper code or other exploits, the keys are pulled, updates are pushed to ALL users of the program that revokes the key, thereby preventing mas…
Even if you assume they would add a UEFI "enable developer mode" setting, this would get them so much bad press (and, also, it would actually make developing and distributing software on Windows a lot harder for smaller and open-source developers, and deploying custom software harder for enterprise costumers).
Website that we were running was under DDOS couple of years ago, what we did is we took ips of servers that made ddos. Then we scanned the ports, found vulnerability in the application that was running on it then get into the server using this vulnerability. We checked open connections and found one used for command and control server (irc server) then we listened to irc channel. DDOSers were talking private things o…
I’ve had a very similar experience – I’m surprised I’m not the only one who did that. I’d have expected the DDoSers to have better security
Earlier quoted context omitted.
ever heard of code signing ? Maybe MSFT could use some of its 23 BILLION dollars of yearly profit to test some of the programs and conditionally approve them if they pass muster, also based on the historical reputation of the signer (like ebay feedback). Then if they contain sleeper code or other exploits, the keys are pulled, updates are pushed to ALL users of the program that revokes the key, thereby preventing mas…
Sure, because it is not like anyone would accuse them of abusive business practices and of trying to kill open source if they made it impossible to run software not signed by them... /s Even if you assume they would add a UEFI "enable developer mode" setting, this would get them so much bad press (and, also, it would actually make developing and distributing software on Windows a lot harder for smaller and open-sourc…
See, the signing system doesn't have to be mandated. It could pop up a UAC-like screen but with an actually useful message: this code is known to have malware, we recommend you dont run it. If you absolutely want to, press OK at your own risk.
Another message could say it's completely unsigned, so devs could still write and distribute their own code. But make it free to submit to the "app store" and get reviewed by MS. That would work wonders to improve security across their whole ecosystem, and not force anything down the users' throats.
Earlier quoted context omitted.
or had no authentication at all, just authorization. imagine having only a openid password to memorize... one can dream right
Wouldn't that just consolidate the attackable footprint? What if openid, or your openid account, got hacked?
Is the header sticky for anyone else? It seems to take up ~30% of my screen (Windows 7, Chrome Stable) [0]. [0] http://puu.sh/pNYUH/d42d8395fc.jpg
This bookmarklet was well received last time I mentioned it, so I'll link it again: https://alisdair.mcdiarmid.org/kill-sticky-headers/ Finds anything with position:fixed and deletes it. Reload the page to get the elements back if needed.
Earlier quoted context omitted.
What they did at the time would still have definitely been illegal. Probably not any more illegal than it is now. I doubt they'd be prosecuted, but breaking into any system is illegal.
I'd just be afraid I'd have rotten luck and wind up on the wrong person's computer (government, big business, etc) because they happened to be part of a bot net. (I'm not ready to move to Moscow quite yet)
Me neither, it's damn expensive