Skip to content

The end of Windows 10 is approaching, so it's time to consider Linux and LibreOffice

Technology
193 115 0
  • Tough, Tiny, and Totally Repairable: Inside the Framework 12

    Technology technology
    14
    1
    116 Stimmen
    14 Beiträge
    0 Aufrufe
    zib@lemmy.worldZ
    I got a Framework 16 a few months ago and I've been loving it. Super happy these guys managed to make this concept of a repairable laptop work. Though, one thing I wish is for them to make a storage case for the expansion cards. I've built up a little collection of them and obviously filled up all 6 slots pretty quickly. I'd like a better place to put the unused cards than in a random drawer.
  • 16 Stimmen
    3 Beiträge
    0 Aufrufe
    P
    I've jumped to Qobuz, but it's weirdly selective in what countries it's available.
  • XMPP vs everything else

    Technology technology
    10
    1
    42 Stimmen
    10 Beiträge
    0 Aufrufe
    M
    Conversely, I have seen this opinion expressed a few times. I can’t judge the accuracy but there seem to be more than a few people sharing it.
  • Is Google about to destroy the web?

    Technology technology
    65
    1
    191 Stimmen
    65 Beiträge
    1 Aufrufe
    S
    Or validating source, making sure it isn't AI content which usually regurgitates the same talking points. Homogenizing the entire query and removing actual information variance of personal experience.
  • 11 Stimmen
    1 Beiträge
    1 Aufrufe
    Niemand hat geantwortet
  • Palantir’s Idea of Peace

    Technology technology
    12
    22 Stimmen
    12 Beiträge
    4 Aufrufe
    A
    "Totally not a narc, inc."
  • 1 Stimmen
    8 Beiträge
    5 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.
  • 44 Stimmen
    4 Beiträge
    5 Aufrufe
    G
    It varies based on local legislation, so in some places paying ransoms is banned but it's by no means universal. It's totally valid to be against paying ransoms wherever possible, but it's not entirely black and white in some situations. For example, what if a hospital gets ransomed? Say they serve an area not served by other facilities, and if they can't get back online quickly people will die? Sounds dramatic, but critical public services get ransomed all the time and there are undeniable real world consequences. Recovery from ransomware can cost significantly more than a ransom payment if you're not prepared. It can also take months to years to recover, especially if you're simultaneously fighting to evict a persistent (annoyed, unpaid) threat actor from your environment. For the record I don't think ransoms should be paid in most scenarios, but I do think there is some nuance to consider here.