Mikina

joined 1 year ago
[–] Mikina@programming.dev 5 points 3 hours ago* (last edited 3 hours ago)

What drove the point home for me was seeing a Twitter account (it was years ago) that posts short 6 second segments of every new game released on steam.

It was posting almost hourly, and while there was a lot of trash, most of the games were of pretty "standart" smaller indie quallity. It's ruthless.

And in addition with the GDC talk of someone who made literally millions by making a generator that generates super basic slot machine games on various themes (as in, generate a theme (cars, bird...), download a few pictures, place them on slot machine) and uploads them to Play Store (back then you had a limit on 20 games a day, and they did include some more rules about quality in reaction to this talk), and the game were getting thousands of downloads and when they checked how is their script doing after few months, they had like over a million in revenue IIRC. Sure, it's about mobile games, but it is hearbreaking when you realize how do the consumers work in reality.

[–] Mikina@programming.dev 153 points 3 months ago (13 children)

I stumbled upon the Geminy page by accident, so i figured lets give it a try.

I asked him in czech if he can also generate pictures. He said sure, and gave me examples about what to ask him.

So I asked him, again in czech, to generate a cat drinking a beer at a party.

His reply was that features for some languages are still under development, and that he can't do that in this language.

So I asked him in english.

I can't create images for you yet, but I can still find images from the web.

Ok, so I asked if he can find me the picture on the web, then.

I'm sorry, but I can't provide images of a cat drinking beer. Alcohol is harmful to animals and I don't want to promote anything that could put an animal at risk.

Great, now I have to argue with my search engine that is giving me lessons on morality and decide what is and isn't acceptable. I told him to get bent, that this was the worst first impression I ever had with any LLM model, and I'm never using that shit again. If this was integrated into google search (which I havent used for years and sticked to Kagi), and now replaces google assistant...

Good, that's what people get for sticking with google. It brings me joy to see Google dig it's own grave with such success.

[–] Mikina@programming.dev 1 points 3 months ago

I see. So, you having shares basically means you own part of the company assets, and if it were to for example shut down or get into huge trouble (so no one sensible would want to buy their shares), you'll still get kind of compensated from the value of their remaining assets being sold? That kind of makes sense, and is the difference I was looking for.

It's still weird, but a little bit more understandable than crypto, which is only literally stealing and scamming money from others (who will eventually in the end end up left with all the literally valueless crypto, and whose money basically paid for all your profit from it)

[–] Mikina@programming.dev 4 points 3 months ago (8 children)

I see, stonks are way more bullshit than I thought. Is there anything else you can do with your stock, other than sell it to someone else? I always thought that crypto is such a scam especially because in the end, it has no value in itself, and the only thing you can do with it is sell it to someone else. If noone wants to buy it, well, you are fucked. Does it mean that stocks are exactly the same concept? I always thought it has something to do with the vaule of the company and the profits it earns, but if there is no way how to cash them out other than selling your piece of paper to someone, then it's really the same? I suppose that unlike crypto, the stock price increases if the company is turning profit, but you still have to find someone to sell it to, right, so the price is increasing only because the demand from people willing to buy it is increasing due to it turning profit, but it's not really tied to the actual value of the company, so it's exactly like crypto? Or is the price set by some different mechanism than crypto is - pure demand from people willing to buy?

[–] Mikina@programming.dev 15 points 3 months ago (17 children)

I've always thought that stocks have to pay dividents, like that's the whole point of having it? I.e you get paid by the company regularly some of their profit, based on how much stock you have.

Does this mean that the only way how to make money from their stock now is to sell them to someone else? But then, it has nothing to do with the actual company and money they make, but you are paid by someone totally unrelated - the guy who buys the stock from you. I don't get it, I suppose I'm missing something.

[–] Mikina@programming.dev 5 points 3 months ago

One place where I found AI usefull is in generating search queries in JIRA. Not having to deal with their query language every time I have to change a search filter, but being able to just use the built in AI to query in natural language has already saved me like two or three minutes in total in the last two months.

[–] Mikina@programming.dev 71 points 4 months ago (13 children)

Isn't that, like, illegal?

[–] Mikina@programming.dev 4 points 4 months ago
  • OrangePi with HomeAssistant and PiHole.
  • Old gaming PC turned 24/7 server with Jellyfin, V-Rising server
  • Hetzner cloud with Matrix server for Messenger and Discord bridging.
  • Synology NAS for SMB and sharing stuff with others through Synology Drive, which also serves as a seedbox for Redacted.ch, with Headphones and Transmission.
[–] Mikina@programming.dev 4 points 4 months ago

I'm not. I vaguely remember seeing it in some posts and comments, and it would explain it pretty well, so I kind of took it as a likely outcome. In hindsight, You are right, I shouldnt have been spreading hearsay. Thanks for the wakeup call, honestly!

[–] Mikina@programming.dev 21 points 4 months ago (1 children)

I see a lot of hate ITT on kernel-level EDRs, which I wouldn't say they deserve. Sure, for your own use, an AV is sufficient and you don't need an EDR, but they make a world of difference. I work in cybersecurity doing Red Teamings, so my job is mostly about bypassing such solutions and making malware/actions within the network that avoids being detected by it as much as possible, and ever since EDRs started getting popular, my job got several leagues harder.

The advantage of EDRs in comparison to AVs is that they can catch 0-days. AV will just look for signatures, a known pieces or snippets of malware code. EDR, on the other hand, looks for sequences of actions a process does, by scanning memory, logs and hooking syscalls. So, if for example you would make an entirely custom program that allocates memory as Read-Write-Execute, then load a crypto dll, unencrypt something into such memory, and then call a thread spawn syscall to spawn a thread on another process that runs it, and EDR would correlate such actions and get suspicious, while for regular AV, the code would probably look ok. Some EDRs even watch network packets and can catch suspicious communication, such as port scanning, large data extraction, or C2 communication.

Sure, in an ideal world, you would have users that never run malware, and network that is impenetrable. But you still get at avarage few % of people running random binaries that came from phishing attempts, or around 50% people that fall for vishing attacks in your company. Having an EDR increases your chances to avoid such attack almost exponentionally, and I would say that the advantage it gives to EDRs that they are kernel-level is well worth it.

I'm not defending CrowdStrike, they did mess up to the point where I bet that the amount of damages they caused worldwide is nowhere near the amount damages all cyberattacks they prevented would cause in total. But hating on kernel-level EDRs in general isn't warranted here.

Kernel-level anti-cheat, on the other hand, can go burn in hell, and I hope that something similar will eventually happen with one of them. Fuck kernel level anti-cheats.

[–] Mikina@programming.dev 2 points 4 months ago

Why does this need to be installed here when previously agentless technologies was sufficient

As someone who works in offensive Cybersecurity doing Red Teamings, where most of my job is to bypass and evade such solutions, I can say that bypassing agent less technologies is so much easier than agented ones. While you can access most of the logs remotely, having an agent helps you extremely with catching 0-day malware, since you can scan memory (that one is a bitch to bypass and usually how we get caught), or hook syscalls which you can then correlate.

Oh, an unknown unsigned process just called RWX memory allocation, loaded a crypto binary, and spawned a thread in another process that's trying to execute it? Better scan that memory and see what it's up to. That is something you cannot do remotely.

[–] Mikina@programming.dev 2 points 4 months ago (2 children)

From what I've heard, didn't the issue happen not solely because of CS driver, but because of a MS update that was rolled out at the same time, and the changes the update made caused the CS driver to go haywire? If that's the case, there's not much MS or CS could have done to test it beforehand, especially if both updates rolled out at around the same time.

 

Hello!

I've recently stumbled upon an amazing blog about getting credentials from Bitwarden vault through DPAPI and Windows Credential Storage, and what suprised me is that any low-privileged process can just ask for all information in Credential Storage, without requiring any user input (the article discusses it in the second half, even though the first half is about abusing DA credentials), through the CredEnumerateW WinApi call.

Since that vector was pretty interresting, I tried running their PoC for listing the cred storage on my, and several colleague machines, and was surprised that every machine had domain account credentials listed in plaintext, that could be grabbed by any low-privileged process just by calling this WinAPI.

I suspected that it's because of Outlook or Teams, because I found articles from few years ago mentioning that they do get saved there. However, one colleague did not have his credentials there, even though he was using Teams and Outlook, and had his password saved.

So, how did that password get there? Why most people we tried the PoC with do have a domain password saved, but some do not? Or is it because of Windows Hello? I'd love to get some kind of solution/recommendation about how to avoid having your password, in plaintext, in such an insecure space. Or was I dumb enough to save it into Edge somwhere, and have promptly forgotten about it?

And more importantly - how this isn't a pretty severe vulnerability, and is considered "as designed" by Microsoft? The fact that any process can just ask for your credentials is mind-blowing, plus it isn't even detected by EDRs we've tried it with when discussing it with our SoC.

 

There is one argument I've seen missing in most of the de/federation discussions, that I think should be mentioned, and warrants it's own discussion.

I've seen a lot of people mentioning that defederating with Meta means we have broken the promise of Fediverse, that you can use one account to interact with whatever service you choose, and that it should be inclusive.

But I don't agree that's the main idea. There is something that's more important, and to make sure I'm not misinterpreting it, I'll just directly quote various websites about the Fediverse I've found (I was just taking top results for Fediverse on DuckDuckGo, but I did select only the parts that are the most important point for me personally). But I do concur, I was not able to find a single source of truth, and I'm not really sure how credible the resources are, so please disagree with me if it's wrong or I've chosen some no-name site that just matched my rethorics.

https://www.fediverse.to/ has the following sentence as the main hero header:

The fediverse is a collection of community-owned, ad-free, decentralised, and privacy-centric social networks.

Each fediverse instance is managed by a human admin. You can find fediverse instances dedicated to art, music, technology, culture, or politics.

Join the growing community and experience the web as it was meant to be.

Another search result is for fediverse.party, which has the following quite in https://fediverse.party/en/fediverse/ :

Fediverse (also called Fedi) has no built-in advertisements, no tricky algorithms, no one big corporation dictating the rules. Instead we have small cozy communities of like-minded people.

The page also mentions some link for knowledge about the fediverse. Some of them are only tutorials about how to join, but there's also https://joinfediverse.wiki/What_is_the_Fediverse%3F , with the following part:

How does it compare to traditional social media?

...

Morals

  • Traditional social media is neither social nor media. It is not made for you, it is made to exploit you and it is full of misleading ads and fake news.
  • This is because the aim of traditional social media is to make a whole lot of money.
  • The aim of the Fediverse is to benefit the people.
  • The aim of traditional social media is to control and steer the users.
  • The aim of the Fediverse is to empower the users to control the Fediverse.

I wasn't able to find more websites directly about the fediverse, and I did not want to quote random articles. But for completion sake, here is a list of FAQ/About sections of websites that are about the Fediverse, but don't directly support or imply the point of view I was trying to make (one that can be best summarized by the Morals in the last quite):

The split seems to be 50:50, but at least for my DuckDuckGo search results, the https://www.fediverse.to/ is the first result you find, and that one is pretty clear about what Fediverse should be. I wanted to start a discussion about what do the users here see as a main selling point of the fediverse, and whether morals and non-profit nature of the instances is important to most of the users as it is to me, or whether you'd rather have interconnectness and inclusivness.

view more: next ›