• 0 Posts
  • 212 Comments
Joined 3 years ago
cake
Cake day: June 19th, 2023

help-circle
  • I’ve been running my own eMail server for almost a quarter century, and I have no clue what all the fuss is about.

    Sure, providers are getting very picky about what domains that they will receive eMails from. But that’s why I have gMail, Yahoo, and Microsoft webmail accounts - so I can train their systems by exchanging emails once a quarter.

    And yes, you do have to be running whitelists and blacklists and tarpits and have a good Fail2Ban in place. And good geoIP system if you want to cut out regions that you are unlikely to ever have legitimate mail originate from. But that’s just common sense security.





    1. Actually text me the one-time passcode, rather than saying you sent it to me while instead texting it to the molten core of the earth.

    Uhhh… how about NO??

    In fact, as a casual security professional (it’s not a core part of my job, but I know a lot more than most ppl), I openly advocate making SMS and eMail illegal for transmitting one-time passcodes.

    Why? Because both are critically insecure, cannot be adequately secured outside of laboratory or highly restrictive environments, and can be trivially hijacked.

    The only one-time passcode that should be used are one-time password generators (TOTP) such as Google Authenticator or any other such method.

    Yes, this requires a little more effort on the part of the site owner, but it’s worlds better than SMS or eMail, and far more user-friendly than forcing the user to open the company’s app just to receive the code (looking at you, Canadian banks and other businesses like Telus).


  • I am in IT, and personally speaking, with my own machines, I have never had these power settings not be obeyed.

    And the only time when I have seen these settings “not be obeyed” in other systems is because either,

    1. Someone or some other non-Microsoft software had dicked with power settings through the registry/GPO, or
    2. I’ve been able to trace things down to hardware malfunctions or hardware discrepancies.













  • If betting on Polymarket, you would actually have to stump up that money first, and the other person would have to do the same with whatever bid they wanted to use. Then, in order to get any kind of reasonable payback, you would need thousands of other people to make a bet for or against, using their own money.

    The payout isn’t on someone making a bet on themselves, no-one else would bet for or against that as the stakes are so small. The payout is on large-scale events that are - ostensibly - out of the control of the bettor or bettee.

    Polymarket is no different than betting on the outcomes of horse races or sports games, it just opens up the thing being betted on to anything and everything. People will still bet. The key is how “un-rigged” it appears to be.