• 0 Posts
  • 102 Comments
Joined 2 years ago
cake
Cake day: June 7th, 2023

help-circle






  • Stopping Windows from running, probably not. MS could stop sending updates and could deactivate it, but it would mostly keep running. And, if any EU/Russian systems were not connected to the internet (yes, this sort of thing still happens in 2025), nothing MS did would matter. Office/Azure and other cloud based services are more vulnerable. Yes, Microsoft could geo-fence those services such that they did nor work if you were coming from an IP address in EU/Russia. Though, the simple workaround for this is to install a VPN. And given US sanctions on Russia, this is probably happening right now anyway.

    As much as the tin-foil hat crowd likes to think about MS having some master control switch, it’s incredibly unlikely. The problem with backdoors is that hackers are constantly looking for ways to attack systems, especially Windows. If there was some sort of master “off switch” baked into the code, it’s likely some one would have stumbled upon it by now. Even if it’s that well hidden, it’s a “one use” item with high reputational damage attached. Stop and consider for a moment, what happens when that kill switch gets used? It’s going to be picked up on. People record internet traffic for fun. As soon as that kill command went out, security researchers, the world over, would be dissecting logs to find the command, and then it would be reversed engineered. That MS had such a kill switch in their codebase would cause massive distrust in MS software going forward. No one would want to take the risk of having that kill switch running in their environment, certainly not on anything critical. Also, given how bad people are at updating Windows, we’d probably see a lot of systems killed by hackers just doing hacker things. Since the versions with the kill code would be know, you’d get bored teenagers searching Shodan for vulnerable systems and sending the kill command for fun. And all of this would be “Microsoft’s fault” for having the backdoor. It would be a PR nightmare. And since everyone would now know what the kill command looked like, anyone who mattered would install filters to block it at the firewall. So, it got used once, caused some damage with a lot of damage to MS’s reputation but is now neutralized. Was it worth it? Probably not to Microsoft.


  • This is exactly the problem, they have no accountability for bad updates causing hardware to become unusable. So, Q&A just becomes a needless expense and untested firmware is dropped on users. Sure, you could try and sue, or more likely get fucked by a binding arbitration clause. But, the cost would be far beyond what the device costs. So, it never makes sense. There need to be fines when this shit happens, which are significant percentages of worldwide revenue, to scare companies into actually testing updates before they are released.

    In the end, all we can do is shake our heads and remind folks to never buy HP. They put out great products 30 years ago, but those days are long gone. Now, they just put out crap.


  • Why do you expect to receive someone else’s work for free? Part of the reason the web has become so enshitified is that no one is willing to pay for anything anymore. We all expect everything to be “ad supported”, and then we act shocked when everything is covered in ads.

    That said, there are usually open source alternatives for most software packages out there. They may not have complete feature parity or have quite the same slick UI as the commercial products. But, they do tend to be both free in terms of cost and ads. E.g for image editing, there is Gimp. It’s not going to replace Adobe Photoshop in professional spaces anytime soon. But, for a home user who isn’t willing to shell out the Adobe Tax, it’s a reasonable choice.

    But, the reason so much is paywalled is because everything takes time and money to create. Someone has to pay that cost. Maybe it’s advertisers, maybe it’s a dedicated team of volunteers. But increasingly, creators are asking users to pay directly.


  • Decades ago, my father would have some fun with the receipt checkers at Costco. After a shopping trip, we’d commonly have lunch at the cafe in Costco. When leaving the store, he’d hand the receipt checker the receipt for lunch rather than the receipt for the items bought. More than half the time, the checker would just swipe the receipt with a highlighter (their way of marking it “checked”) without noticing that it was the wrong receipt. So ya, it’s complete security theater. Anyone with a modicum of thought can figure ways around it, and it only accomplishes inconveniencing the people who aren’t trying to get away with anything.




  • At least on Android (I’d assume iOS does it as well), you can set Do Not Disturb (DND) to turn on and off automatically, based on the time. You can also designate certain contacts to be allowed to bypass DND, so the phone will ring normally. I setup DND a long time ago, because I don’t want to be bothered by random shit while I am trying to sleep. However, my job is such that I might reasonably be called at 03:00 and need to roll my arse out of bed and start working. So, the number they call from is set to bypass DND. My elderly mother and brother are both similarly set to bypass. It all works out quite well and if some random marketer figures out my number and calls in the middle of the night, I don’t get woken up to talk about my car’s warranty.


  • It makes little sense why it works on an offsite WiFi, but not mobile data.

    I’d agree with unbuckled above, it’s a DNS issue. If your mobile device is capable, use nslookup or dig to see what responses you are getting in different scenarios. It’s possible that your VPN software is leaking DNS queries out to the mobile data provider’s DNS servers while you are on mobile data and only using the correct DNS settings when you are on wifi. Possibly look for split tunnel settings in the VPN software, as this can create this type of situation.

    You can also confirm this from the pihole side. Connect to the VPN via mobile data and browse to some website you don’t use often, but is not your own internal stuff. Then open the query log on your pihole and see if that domain shows up. I’d put money on that query not showing in the pihole query log.



  • Along with the things others have said (Backups, Linux, Docker, Networking) I’d also recommend getting comfortable with server and network security. A lot of this is wrapped up in the simple mantra “install your goddamn updates!” But, there is more to it than that. For example, if you go with Nextcloud, read through their hardening guide and seriously consider implementing all of the recommendation. Also think through how you intend to manage both the server and instance. If this is all local, then it is easier as you can keep SSH access to the server firewalled off from the internet. If you host part of your stuff “in the cloud”, you’ll want to start looking at limiting down access and using keys to login (which is good practice for all situations). Also, never use default credentials. You may also want to familiarize yourself with the logs provided by the applications and maybe setup some monitoring around them. I personally run Nextcloud and I feed all my logs into Splunk (you can run a free instance in a docker container). I have a number of dashboards I look at every morning to keep an eye on things. E.g. Failed/successful logins, traffic sources, URI requests, file access, etc. If your server is attached to the internet it will be under attack constantly. Fail2Ban on my wireguard container banned 112 IP addresses over the last 24 hours, for 3 failed attempts to login via SSH. Less commonly, attackers try to log in to my Nextcloud instance. And my WordPress site is under constant attack. If you choose to run Wordpress, be very careful about the plugins you choose to install, and then keep them up to date. Wordpress itself is reasonably secure, the plugins are a shit-show and worse when they aren’t kept up to date.


  • I join at exactly the designated time. If you wanted me there five minutes earlier, then schedule the meeting five minutes earlier. Don’t jerk me around with some expectation that I’m going to do anything other than what you asked for. Also, most of the folks I work with tend to be booked with lots of back to back meetings; so, no one is showing up early anyway. We all show up at the designated time and anyone late can catch up when they show up.

    The “early is on time” mentality makes some sense for physical meetings and appointments. For virtual meetings, it just demonstrates that the person has no understanding of how technology works.



  • First off: time you enjoy is not time wasted. So, while gaming and watching TV (not just sports) may not be activities which provide some sort of self-improvement, they can be useful activities in providing for relaxation and stress relief. Humans generally don’t do well when forced to be “on” every waking minute of the day. We need downtime to decompress and allow our brains to relax. “Play time” is a useful thing. Don’t just abandon your enjoyed activities because they are looked down upon by some segments of society. Like all things though, they can be taken to an extreme. If you find that those activities were interfering with work, socializing or getting things done, which need to be done (e.g. home maintenance, self-care, etc.) that’s when you should start worrying about addiction.

    That said, if you are looking for other “play time” activities you can take up in the comfort of your own home, there are quite a few:

    • Reading - find books you enjoy and read them.
    • Model building - hit a hobby store and find models you find interesting, buy and build one.
    • Model rocketry - Similar to model building, but you get to shoot them into the sky.
    • Home brewing - It’s like chemistry, but you get to drink the end products. Check your local laws before starting.
    • Home distilling - As brewing, except the results are even more fun. Again, check you local laws.
    • Painting/Drawing/Art - Why not make something you like to look at?
    • 3d Printing - Learn to hate first layers. Maybe make something cool.
    • Wood working - Build stuff, enjoy the smell of sawdust.
    • Metal working - Whether blacksmithing or welding.

    If you are willing to get out and “touch grass”, instead of watching sports, you could do some. Though, this often costs money and means dealing with people. On the upshot, you might meet some nice people and improve your health.

    In short, find something you enjoy doing and don’t be ashamed of doing it. Just don’t let it interfere with the things in life you need to get done.