The single domain here is a ccTLD, and DNS's heirarchical nature means your personal domain's redundant DNS can't mitigate an outage at the ccTLD level.
Sorry, no. I was responding to "I am reminded of the warning that zonemaster gives about putting your domain name servers on a single AS, as is common practice for many larger providers."
That is not the ccTLD, that is an individual domain and its name servers. I recall being given that warning for early domain registrations.
There are a lot of NPP users out there, and probably the most important thing, given that they use it to edit all their files, is that they can trust the software. Some rando out of nowhere saying they've written "NPP for Mac" is red flag central.
When a military achieves something and there's intense speculation on how they did it, they will want to obfuscate how they did it. One of the best ways to do that is to give a range of different explanations, some fanciful, some plausible, none of which are completely accurate, leaked to a range of credible and non-credible people. A disinformation campaign.
I think you're conflating two things: fictional characters/personas, and attributing "music" to them.
People go wild for characters all the time, whether they be Batman, Pikachu, Colombo, Dora the Explorer, whatever -- have you ever seen Nyango Star drumming? https://www.youtube.com/watch?v=-UYgORr5Qhg -- not to mention the entire VTuber scene, where people build the same weird parasocial relationships as other YouTubers do, but hiding behing an animated avatar and voice changer.
Hatsune is an odd one in that she's a character whose "voice" is a set of parameters for a vocal VST (Vocaloid) that you can plug into your DAW and have a synthesized singer along with your synthesized piano, drums, guitar, etc. But for whatever reason, the Japanese loved the character, so they rolled with it and you can now make 3D videos with the character as well as having her singing.
More to the point, the Gorillaz are a full touring band of VTubers, even though the people behind the animated masks are themselves pretty famous already. They have fans, including deranged ones that can't seem to separate the fictional cartoon characters from real people and imagine themselves as Murdoc's wife.
This goes back a long way, I was thinking Josie and the Pussycats, but Wikipedia reminds me that Alvin and the Chipmunks is probably the first.
It also makes me think of ABBA and their "ABBA experience", where they've "digitized" themselves. What it really is is wish-fulfilment and nostalgia; their fans, themselves in their 60s/70s, are thinking of their youth 50 years ago, and the actual members of ABBA also look 70 and not 20 anymore. So they've made a virtual replica of themselves from when they were in their prime, and you can go and dance to them if you want, while the real ABBA members water their garden and feed their cats at home.
Consider the possibility that the general public enjoy neologisms regardless of their source, and will take and adapt them just for fun, without ascribing to the ideologies of the coiners.
Also consider that people are laughing at the cant and its speakers, rather than with them.
If you need evidence of this, try saying this without laughing: "Clavicular was mid jestergooning when a group of Foids came and spiked his Cortisol levels. Is Ignoring the Foids while munting and mogging moids more useful than SMV chadfishing in the club?"
"owning" generally requires doing something to the other person, such as defeating them in an online shooter
Whereas you "mog" simply by being within range of the other person, you don't even have to interact, but a third party can see your natural advantages over that other person, thus "mogging" them.
You can expect the spicy autocomplete to feed you flattering bullshit. It may cite Wikipedia (it shouldn't), but you should go check out those citations, and validate the claims yourself. It's the least you can do.
And if the cited source is Wikipedia... check Wikipedia's sources too. Wikipedians try their best to provide you with reliable sources for the claims in their articles (oh who am I trying to kid? They pick their favourite sources that affirm their beliefs, and contending editors remove them for no good reason, and eventually the only thing that accrues is things that the factions agree on, or at least what ArbCom has demanded they stop fighting over).
I guess what I'm trying to say is: don't rely on that authoritative-sounding tone that Wikipedia uses (or that AI bots use, or that I'm using right now). It's a rhetorical trick that short-circuits your reasoning. Verify claims with care.
Also check the Talk page, you often find all kinds of shenanigans called out there.
Perhaps my favorite example of a citogenesis-like process is the legendary arcade game Polybius, which originated as an entry on some German guy's web compendium of arcade games (coinop.org), perhaps as a "paper town", or fake entry that acts as a copyright canary when duplicated elsewhere. Gamer news and special-interest blogs and sites, and even print publications like GamePro picked it up, and I think it was even listed on Wikipedia as an urban legend whose actual existence was unknown. Then the retrogaming YouTuber Ahoy did an in-depth documentary (https://m.youtube.com/watch?v=_7X6Yeydgyg) which concluded that Polybius didn't exist and was never even mentioned before the aforementioned coinop.org reference and, for me anyway, that settled it. Polybius, in its urban legend form, never existed.
(Norm Macdonald voice) Or so the Germans would have us believe...!
> ... eventually the only thing that accrues is things that the factions agree on, or at least what ArbCom has demanded they stop fighting over
Or what the faction with the most favored access to ArbCom manages to make stick by getting the other faction banned.
A state actor could absolutely cause immense damage to Wikipedia at scale, because most admins aren't experts in the subjects whose articles they police. I'm just surprised that nobody has done so already.
Vehicle emission and fuel efficiency standards are a great idea. The stupidity was allowing a "light truck" exception at all. It made the manufacturers turn to manufacturing and promoting what should be work vehicles to rich idiots who need nothing larger than a regular car (but can easily be upsold on something they don't need)
America is already fucked, given how awful its urban sprawl is. Trucks used for commuting and not haulage just makes it double fucked.
Put your meagre and limited resources on keeping them outside the hatch.
If they get through the hatch, that is where you fucked up, not that you didn't remove every conceiveable command from yourself should they get through. If they can remotely get some program to execute a shell, they can quite conceivably get the same program to just read them the files directly by writing different shellcode. Running a shell is just a convenience for them.
The number of setups that are insecure enough to allow remote shells by arbitrary attackers, but are secure because you disabled /bin/cat once they get in, is zero.
Security is done in layers. Yes, we do our best to keep the adversaries outside the proverbial hatch. But even inside the hatch, the principal of least privilege is important in reducing the damage of attacks.
Typically you do things like this to either work in restricted envs (distroless) or to evade detection logic. It's not about bypassing a boundary, it's about getting things done in the env you have available.
But you wouldn't, or shouldn't, take a patchwork approach to it.
If the software you're trying to secure actually depends on a full, working, intertwined unix system... you leave that as it is. You can certainly try reducing a process's access to the system it's running on (whether that be by containers, jail(8), SELinux, AppArmor, etc.), but you don't go around deleting 7-zip or your scripting languages or compilers, on the off-chance that'll thwart a hacker.
Sure, you can say, "defense in depth", but if you have one layer that's actually holding up the security guarantees, and a second layer that is largely ineffectual (haha! I removed /bin/cat, now they can't read files! oh and base64 too... and yyencode... and... and... and...), I wouldn't waste much time on the second layer.
I think you have the wrong end of the stick. The OP link is a resource for when you do get access to the processes environment which has already been reduced via containers, jails, or what have you.
If the environment is already restricted, but the process has, for example, access to the base64 tool, here's how you can use that to do something you otherwise aren't able to.
I can't read the original article because Github is having a very bad day, but I don't really understand the attack model here.
If a process has access to any tool that isn't statically linked, the process already has access to ld-linux.so and can therefore execute any binary it has read access to. "restricting access" by enumerating the binary paths a program can execute is not a very useful restriction by any means.
The original article is a list of ways to achieve certain features (ie, reading a file) when you don't have it natively (ie, no cat, but for some reason, base64).
> execute any binary it has read access to
Maybe I'm missing something, but in these restricted environments, why would the system have read access to binaries it doesn't need or use?
reply