• 1 Post
  • 646 Comments
Joined 4 years ago
cake
Cake day: May 31st, 2020

help-circle
  • Man, during my apprenticeship, I spent a month in the offensive security department, so white-hat hackers. My most memorable experience there was us scrolling through a WireShark log of a server (which a user had conveniently placed into a web-hosted folder, so our automated scanners could pick up on it).

    Then we found an unencrypted FTP connection in there, which meant the password got logged in plain text and then we tried the same password for SSH. In roundabout 10 minutes, we had root access. On a real-world system.

    And yeah, watching him scroll through those Recall logs, that felt eerily similar. Like you just need the right Ctrl+F, the right screenshot or any clue that they’re using some insecure technology which you can exploit. If you can extract those logs, it’s likely just a matter of time until you find something.


  • Traditionally (as in 20+ years ago), software got developed according to the Waterfall model or V-model or similar. This required a documentation of all the requirements before a project could be started. (Certain software development fields do still work that way due to legal requirements.)

    This was often a failure, because the requirements did not actually match what was needed, not to mention that the real requirements often shifted throughout development.

    Agile, on the other hand, starts out development and figuring out the requirements pretty much in parallel. The customers get a more tangible picture of what the software actually looks like. The software developers also take over the role of requirements engineers, of domain experts, which helps them make more fitting software architecture decisions. And you can more easily cancel a project, if it turns out to not be needed anymore or whatever (which is also why a cancellation percentage is misleading).

    The trouble with Agile, on the other hand, is that projects can get started with really no idea what the goal even is, and often with not enough budget reserved to actually get them completed (obviously, that may also be a failure state; if the project is promising enough, customers will find the money for it somewhere).
    Also, you do spend a lot of time as a software dev in working out those requirements.

    But yeah, basically pick your poison, and even if people like to complain about Agile methology, it’s what most of the software development world considers more successful.


  • I feel like that’s the same underlying issue: The requirements are not understood upfront.

    If a customer cannot give you any specific information, you cannot cut any corners. You’re pretty much forced to build a general framework, so that as the requirements become clearer, you’re still equipped to handle them.

    I guess, the alternative is building a prototype, which you’re allowed to throw away afterwards. I’ve never been able to do that, because our management does not understand that concept.




  • Nothing matters, but neither does that fact.

    Growing up in a population with lots of spirituality, it felt like a requirement to have some higher meaning to your life. And me deciding one-by-one that I didn’t believe in the spiritual stuff, it felt like I was missing that higher meaning.

    What I didn’t realize for too long, is that if I don’t believe in the spiritual stuff, then I necessarily also don’t believe that the spiritual people have a higher meaning to their life. And that it’s not a requirement. A regular meaning or even no meaning is just as fine.


  • I’m not here to argue that Linux is flawless if you just do this one obvious trick, but rather to say, for you in particular, with the issues you described: You might enjoy openSUSE more.

    It comes with filesystem snapshots out-of-the-box. As in zero setup. And you can rollback to a previous snapshot from the bootloader, even if your system does not boot anymore.
    So, assuming neither your filesystem nor hardware broke (and you noticed the breakage right away), it takes 5 minutes to get back to a working state.

    It also comes with an extensive system settings GUI, called “YaST”. It certainly does not completely absolve you from touching config files. It also will not make you weap from how intuitive of a GUI it is. But it is a GUI and it covers lots of the common stuff that one might tweak on a computer.

    I do also find openSUSE to be less error-prone than Ubuntu in general (my workplace makes me use the latter).

    Main downside of openSUSE: It is more niche. The community is smaller. When you do run into an error, there’s fewer articles out there to help you. In particular, setting up specialty software like DAWs, VSTs etc., you may find less help for.

    But the small community is more tight-knit and consists of lots of folks with higher expertise, so if you ask in the forum or some other place where the community hangs out, you will usually still get rather excellent help (and perhaps better help than what search engines unearth these days).


  • Oh man, I obviously don’t want that, because there’s gonna be companies and organizations and whatnot handling my data with a non-hardened Windows 10, but I’d still grab some popcorn and watch all the security and data protection people explode.

    Windows 10 as is, was already a massive shitshow. The German Federal Office for Information Security started a guide for hardening Win10 and they very deliberately chose a name that would abbreviate to SySiPHuS, because I imagine, they never expected to see the end of it.

    Now, that end would be in order, at the very least, because the worse Win11 should be taking over. And to then have Microsoft chip in a new massive security hole, making them update their guides and all the hardened systems once more, that certainly has some incendiary potential. 🙃








  • I really don’t care to be the guy that’s like, oh, you criticized Linux, I’ll point out how wrong you are, but packages? If the software you want to install is packaged, then it’s easier to install than on Windows. You just open up the app store UI and click on “Install”. I also have no idea why you’d need to install packages every 5 minutes.

    I’d say the most prevalent issue people have with Linux, is that they need/want specific software that only runs on Windows.


  • I think, there’s just too few potential customers.

    Linux works excellently for techies, but those don’t need help.

    It works great for the many people that just browse the internet, but Windows or their phone/tablet is also fine for that.

    Well, and then there’s a chunk of people that aren’t techie enough to install an OS, which would still have an interest in an improved OS, but those will then also often use some specialty software which only runs on Windows.



  • I mean, that makes sense, but consider the other side. You find some document that very clearly says that you have a license to do whatever the hell you want with it.

    In this particular case, you probably heard the news, but in many other cases, you just couldn’t trust any license anymore, because there’s just no way to know whether something was intended to be licensed like that. It would pretty much defeat the purpose of licensing anything at all.


  • Not sure, if this is precisely the same in the US, but here in Germany, employees act on behalf of their company. So, if you write such a documentation, your copyright is assigned to the company, but just as much, you’re allowed to license this copyrighted work.

    In many cases, this is absolutely necessary to do for your daily work. Like, maybe your job is to work with external contractors that implement changes to these search ranking parameters.

    There is some things, like entering a contract, which require a signature to be legally valid. And signing things, that is something that not everyone can do. But yeah, you don’t need a signature for licensing.