Recent Posts

426

General Software Discussion / Re: TeamViewer hacked?

« Last post by Stoic Joker on June 06, 2016, 06:59 AM »

http://arstechnica.c...n-mass-account-hack/
After reading through the comments there.

Okay, this is getting ugly - where's the popcorn?

With the massive justificational back and forth, the thing that seems to be most consistently appearing is the ability of - the attackers - computer to guess X passwords per second ... which automagically makes most - if not arguably all - passwords less that 20 something characters "easily guessable. And then the "need" for 2FA get's brandished over, and over, and over... *Sigh*

Why does everybody keep glossing right past lockout limits?? I mean WTF - If a system like that is allowing 3+ login attempts per second - like anybody can actually type that fast... - without locking down the account. I don't care how many whoop-de-do factors they have in place, their system is fundamentally flawed...and the fault is theirs.

427

General Software Discussion / Re: TeamViewer hacked?

« Last post by Stoic Joker on June 04, 2016, 08:27 AM »

Man talk about sticking hard to the cover story...

As you have probably heard, there have been unprecedented large scale data thefts on popular social media platforms and other web service providers. Unfortunately, credentials stolen in these external breaches have been used to access TeamViewer accounts, as well as other services.

We are appalled by the behaviour of cyber criminals, and are disgusted by their actions towards TeamViewer users. They have taken advantage of common use of the same account information across multiple services to cause damage.

-TV Blog

Trying to hard much???

And how exactly do they explain (away) the part where it is mainly (read only) the TV v11 users that are getting "randomly" hit??

Then there's the we're not going to call it a (security) update...update. That they hung together in only days after - but not in response to - the not attack.


Saving face is one thing ... But this is just sad.


Given the issues we've been having with our current SSL Trusted Root signed VNC variant. I've been looking for something mainstream that our company can jump to for remote support, that won't constantly waste time talking end users through security warning.

Hay did I mention that this is a digitally signed by an SSL trusted root certificate provider that still constantly gets flagged by damn near everything??? (Signed binaries my ass)

Anyhow TV was on my list of -(mainstream)- replacement companies to investigate last week ... But they're not on that list anymore.

428

Living Room / Re: silly humor - post 'em here! [warning some NSFW and adult content]

« Last post by Stoic Joker on June 02, 2016, 07:01 AM »

Also, The Game:

You just lost

-http://www.urbandictionary.com/define.php?term=the%20game&defid=609015

-Edvard (June 01, 2016, 03:15 PM)

sort of like the opposite of zen:
promoting lack of awareness all over the world
:-)

-tomos (June 02, 2016, 03:46 AM)

But what if Zen's complete awareness is simply a total immersion in - and therefore a mastery of - the game??

429

General Software Discussion / Re: TeamViewer hacked?

« Last post by Stoic Joker on June 02, 2016, 06:53 AM »

The "careless use" disclaimer strikes me as a bit disingenuous when it's rather obvious someone is working their block quite hard. However that being said, I have long loathed the idiotic habit of 3rd party "Support" personnel installing remote access app X on everything from workstations to servers and then just orphaning it leaving people exposed by its then ongoing connection opportunity.

Any access hole poked into a network must be sealed the instant it is no longer absolutely necessary ...Period.

430

Living Room / Re: Show us the View Outside Your Window

« Last post by Stoic Joker on May 26, 2016, 11:17 AM »

Picture of an owl I shot with my Windows Phone in our backyard.

431

Post New Requests Here / Re: Idea : One Shot System Time Sync

« Last post by Stoic Joker on May 26, 2016, 06:52 AM »

For grins after running it I use the Time.is website to get a read sync and tell me how close my clock is to standard.

-MilesAhead (May 25, 2016, 03:55 PM)

Damn that is a handy site, never heard of it before. I just tried it cold on our system here and got:

The difference from Time.is was +0.023 seconds (±0.021 seconds).

I gotta go back and figure out what I did to the time service on our (VM) host machines...it's apparently working.

432

Living Room / Re: Interesting "stuff"

« Last post by Stoic Joker on May 25, 2016, 11:22 AM »

^ you have a PHD in the school of life !

I found it tiresome: I gave up at question #40 (no idea how long it goes on for).
Maybe it thinks if it tells everyone they have phd's, they might click on a few ads and buy stuff ;-)

-tomos (May 25, 2016, 10:26 AM)

There's a counter at the bottom that says x questions left. I didn't notice it until at the very end when I was about to step off on the damn thing (time...). I'm thinking it was 50 questions total.

433

Living Room / Re: Interesting "stuff"

« Last post by Stoic Joker on May 25, 2016, 06:43 AM »

I got a score of 93% and was considered a PHD. I got a BA, the test is too easy.

-Arizona Hot (May 23, 2016, 02:17 PM)

My 87% ranked as a PhD too. I think I got half of the literature questions wrong.

-x16wda (May 23, 2016, 06:58 PM)

I blazed through it in a rush, gut 67%, and it thinks I'm a PhD as well ... This thing is totally busted. I finished high school at 16 and joined the working class. I've never even set foot on a college campus outside of service work.

434

Living Room / Re: Goodbye to my father

« Last post by Stoic Joker on May 24, 2016, 11:32 AM »

My condolences.

I lost my dad a few years back, I don't think it truly hit me until sometime later when I picked up a new Harley...and then realized that I couldn't stop by to show it to him.

435

Developer's Corner / Re: Designing Personal Sites - Programming POV

« Last post by Stoic Joker on May 22, 2016, 12:21 PM »

What about static site generators? https://getnikola.com/ (python) or jekyll (ruby) - plenty more here https://www.staticgen.com/.

-Lintalist on Today at 09:22:42 AM

After handling my old job's static website for years, I am going to pass on any kind of static website, unless someone can prove to me they don't have to be a huge pain in the butt to update one line of code across all the files/pages

-Asudem (May 22, 2016, 11:44 AM)

I had a PHP static page site for years that wasn't an issue to manage, but the site pages consisted of:

<?PHP
InsertHeader("Page title"); // included beginning of body content container
?>

//// Body content went here

<?PHP
InsertFooter(); // included ending of body content container
?>

As a quick-N-dirty framework I thought it worked rather well.

436

General Software Discussion / Re: Registry Key Locator and Access tool

« Last post by Stoic Joker on May 17, 2016, 06:43 AM »

One tool that should probably also be mentioned in the context here is:RegScanner: A small utility (FREE from NirSoft) that allows you to scan the Registry, find the desired Registry values that match to the specified search criteria, and display them in one list.  After finding the Registry values, you can easily jump to the right value in RegEdit, simply by double-clicking the desired Registry item.  You can also export the found Registry values into a .reg file that can be used in RegEdit.

-IainB (May 17, 2016, 04:16 AM)

Search registry by string and/or value modification date/time ... Wow...I think I have a new favorite toy!

437

Living Room / Re: Freelance Programming/Upwork discussion thread

« Last post by Stoic Joker on May 16, 2016, 06:48 AM »

I'm going to have to investigate this further and fix it so I can get my.... *sigh* $20.

-Asudem (May 16, 2016, 02:24 AM)

Ouch man, that hurts.

I hate to ask ... But have you tried running sfc /scannow by chance?

I did a quick search and ran across this: http://www.winhelpon...og-empty-grayed-out/ The dialog view reset scripts look promising.

438

Living Room / Re: Good or bad password?

« Last post by Stoic Joker on May 12, 2016, 07:48 AM »

My REAL password actually involves part of a friend's car number plate, which she USED to own (how paranoid is that?)

-tsaint (May 12, 2016, 03:18 AM)

She should probably be very paranoid about the creepy old guy that keeps memorizing her license plate number...

But seriously the key to pass phrases is that the words should be completely non sequitur, but mnemonically associated with something by you.

So if your favorite movie scene involved a duck on a bicycle in the rain, the pass phrase for it might be.

Ride Cloudy Mallard!

439

General Software Discussion / Re: Looking for VPN recommendation

« Last post by Stoic Joker on May 12, 2016, 07:37 AM »

What will it be used for? G2G, C2G, C2C... Their may be other option depending on how they need to access what.

I've been playing with a Microsoft RemoteApp server which uses an accessible from anywhere SSL tunnel -(TLS version whatever you like )- that can make virtually any application available to pretty much anything. I even got our internal LOB application to run on my cellphone acceptably for quick stuff in a pinch. It leverages (desktopless) RDP for the delivery mechanism so iOS and Android devices can be used to access internal resources as well.

440

Post New Requests Here / Re: IDEA: Chaturbate[NSFW site] Game in Javascript

« Last post by Stoic Joker on May 12, 2016, 06:43 AM »

I thought it was a great project ...(requested purpose aside)... As it's really just an online card game that could be used anywhere depending on how you skin it (no pun intended). But I know nothing of game programming so I'd be useless for anything except maybe testing if that would help.


However TBH - I was a bit reluctant to click the link at work, and I keep forgetting to check into it when I get home.

441

Developer's Corner / Re: Designing Personal Sites - Programming POV

« Last post by Stoic Joker on May 11, 2016, 06:38 AM »

I have not even installed RocketCake yet.  But the description is intriguing.  It may be worth a look.

-MilesAhead (May 10, 2016, 04:57 PM)

Damn, that does look interesting. Especially since my site has been in limbo for the past year (or so...) because I took it down after deciding it was total shit...and can't for the life of me decide what to do with it.

442

Living Room / Re: silly humor - post 'em here! [warning some NSFW and adult content]

« Last post by Stoic Joker on May 10, 2016, 11:19 AM »

via the music thread:

... and please don't tell me that any DC'ers think a 'man bun' is a good idea 

-Edvard (May 09, 2016, 07:37 PM)

I ended up here:
Try Taking These World Leaders Seriously When They Have Man-Buns

[ Invalid Attachment ]

-tomos (May 10, 2016, 03:41 AM)

I've had long hair (since my rebellious teens) for over 30 years. I'll frequently tie it back (ponytail), but I will never tie it up. Buns are for uptight stereotypes, librarians, and etc. ... Not guys, ever...you just look stupid.

443

General Software Discussion / Re: advice on security setup for my elderly inlaws

« Last post by Stoic Joker on May 10, 2016, 06:47 AM »

Ransomware targets the user to get them to compromise their own files. Click here...boom! Your stuff is gone (/encrypted). Now what?

-Stoic Joker (May 09, 2016, 12:54 PM)

How would that work on Chome OS though? You don't normally keep your files on the Chromebook, you keep them in Google Drive. So a hacker would need to hack Google's server to be able to access and encrypt the files. At that point it would also become Google's problem, so the user is not entirely alone to face the problem, like when it's your Windows machine that gets infected.

-dr_andus (May 09, 2016, 01:27 PM)

No need to hack anything since the user is already logged in, so anything accessible within the current users context is automatically subsequently...exposed.

While it's possible to keep files locally in a Chromebook, it is not encouraged, and there is not a lot of space (a typical Chromebook comes with 16GB local drive). But it's not possible to run an executable in Chrome OS, so the risk of ransomware seems remote.

-dr_andus (May 09, 2016, 01:27 PM)

People are people... And .exe is not the only 'executable' code, Flash, Java, JavaScript, and friends all have options to reak havoc if applied in that fashion...and once again: There is no security blocking access - by the current user - to the current users files...and those are ransomware's target. That's precisely what makes the damn thing so freaking dangerous.

Chrome OS probably is just fine for less adept users...but assuming that it will magically defend against ransomware just because it isn't Windows is a very very risky strategy.

-Stoic Joker (May 09, 2016, 12:54 PM)

Actually security by obscurity worked well enough for quite a few years for those on the Mac and Linux platforms. So if Chrome OS is obscure and its obscurity gives it some safety, maybe there is some value in that, even if it's temporary and not absolute.

-dr_andus (May 09, 2016, 01:27 PM)

Yeah, unfortunately (back then), it worked just well enough to dramatize the nice big hole in the "Target Market" that is now being closed ... Because now this has become a money game. Back in the day it was about pride, prowess, and bragging rights. Now it's a mercenary money game...and that makes it a very very ugly game indeed.

First rule of security, is to never assume you are safe.

444

General Software Discussion / Re: advice on security setup for my elderly inlaws

« Last post by Stoic Joker on May 09, 2016, 12:54 PM »

Trying to hide in/on an obscure platform ultimately makes one more vulnerable because in the new platform agnostic attack age everybody gets a turn, and the ones that think they're 'safe' tend to get hit the worst.

-Stoic Joker (May 09, 2016, 07:00 AM)

Are you calling Chrome OS an "obscure platform"? 

-dr_andus (May 09, 2016, 08:12 AM)

Not to put too fine a point on it, but...yes I am.

Security by Obscurity = nobody is writing exploits for this platform so it must be secure, because nobody is writing exploits for it... (see where that loops?)

As variety becomes more the norm, the platform isn't always guaranteed, so web based attacks can/will start using more - platform agnostic - web based code.

It might not be the most widely used platform, but it's now used in over 50% of US schools, and part of that is (besides it being idiot-proof) the security. You can't run a .exe file on it. Enough said. How confident is Google about this security?

-dr_andus (May 09, 2016, 08:12 AM)

All the more reason why its user base should start expecting some - unpleasant - attention..

See exhibit 1:

Google Will Pay You $100,000 to Hack a Chromebook

-dr_andus (May 09, 2016, 08:12 AM)

Completely, utterly, and mind-blowingly academic. Nobody cares if you can or can't hack the Operating System, it's not the target ... The user is.

Ransomware targets the user to get them to compromise their own files. Click here...boom! Your stuff is gone (/encrypted). Now what?


Chrome OS probably is just fine for less adept users...but assuming that it will magically defend against ransomware just because it isn't Windows is a very very risky strategy. Because - regardless of how well you lock down any OS - the user will always have full and complete access to their own stuff, and that's what ransomware is counting on.

It doesn't have to be encrypted well, it just has to be encrypted some how.

445

General Software Discussion / Re: advice on security setup for my elderly inlaws

« Last post by Stoic Joker on May 09, 2016, 07:00 AM »

Ransomware - No amount of user lockdown is going to prevent them from breaking their own stuff.

Trying to hide in/on an obscure platform ultimately makes one more vulnerable because in the new platform agnostic attack age everybody gets a turn, and the ones that think they're 'safe' tend to get hit the worst.

Either Malwarebytes, or one of the other anti-ransomware options available probably would be a good thing to add. As well as locking down the outbound firewall rules in an attempt to make Motherships and C&C channels at least a bit harder to contact.

446

Living Room / Re: Custom dice for board games, etc.

« Last post by Stoic Joker on May 07, 2016, 08:09 AM »

Found a 1/2 square hole punch on eBay: http://www.ebay.com/...0:g:1agAAOSwsN9W~gdk

True 15mm would be 19/32 or 15.0815mm which might still run afoul of the rounded edges. 1/2 inch is 12.7mm which might not be too bad, and is a "standard" size to can potentially be found as apposed to cu$tom made..

I'm just thinking out loud here ... Feel free to ignore me.

447

Post New Requests Here / Re: System tray notification of remote computer status

« Last post by Stoic Joker on April 30, 2016, 08:24 AM »

Thanks, Stoic Joker.  Totally agree that the  simple solution you suggested would be more  ideal. Did some experimenting with the printer; it prints great but configuration options are a bit lacking. If I send a job to the main paper tray, and a page is is in the manual feeder, it will print the first page of that job from the manual feeder, even if I've set the manual feeder size/type and the paper tray size/type to different sizes. It's such a good multi-function otherwise we hate to upgrade at this time. I suppose that's just the difference between the small office printer and the expensive printers you find in larger corporate settings.

-javadecaf (April 28, 2016, 02:20 PM)

Well... Good News, Bad News.

It's not a device class/cost issue.

It's an almost universal device behavior issue.

The manual Feed tray is also - almost universally - known as the bypass tray. Which means that the default behavior is to ignore it when it is closed, and to bypass all other trays when it is open and allow (virtually) anything to be pulled from it.

So the solution I was proposing requires an additional regular paper tray because the - usually but not always tray 1 - manual feed tray has a habit (again universally) of either not allowing the media type to be set, or of clearing the setting when it is closed.

I don't know what brand/model you're working with, so I've no idea if it allows for/has available an additional tray. But if it doesn't you might consider getting a small/cheap/disposable class laser printer for her to keep on her desk that can be dedicated to low volume check printing. This would most likely pay for itself rather quickly by not requiring a rather workflow disruptive step for everyone else in the office remembering to check what color an icon was before they hit print. TBH - User space one-liners aside...I could easily see myself screwing that one up.

Something like this perhaps: HP Factory Recertified Laserjet Pro P1102W $83.99 at Newegg.

448

Living Room / Re: Custom dice for board games, etc.

« Last post by Stoic Joker on April 30, 2016, 07:52 AM »

Try it backwards. Apply the stickers as originally planned, and then apply a clear/plastic coat to enhance durability.

Just be sure do some material compatibility testing first so you know the two wont react badly to each other (some paints may smear/lift/dissolve the sticker's ink).

449

General Software Discussion / Re: Script to edit registry setting all network profiles to private

« Last post by Stoic Joker on April 30, 2016, 07:46 AM »

This is for those times when I get tired of people who cant at least wait 5 minutes for me to get from the 2nd floor to the 5th floor to see what the heck they did to cause it.

-questorfla (April 29, 2016, 03:40 PM)

Understood, but I was getting the feeling from your description that there was a bit of a repeat offender aspect to this. In which case it's not always valid to blame the user - fun yes - but there is a good bit of - I suspect - misdirected culpability going on there. Because the NLA Service is actually notorious for doing exactly that if it happens to 'wake-up-cranky'

if it's set to delayed start, it won't be tying to play guess the network (usually wrong) when it fires off a tad early and the network connection isn't quite ready for its "interview".

So my suggestion was more (repeat offender) prevention, than first failure remediation.

They just want to Print and don't care that I am not psychic, cannot levitate nor teleport.

-questorfla (April 29, 2016, 03:40 PM)

Ah! End Users... They're so cute when they're angry ... Not!

They are also the ones who complained the most when I suggested we shift to a Domain network because they are 'afraid' that IT will be 'spying' on them. 

-questorfla (April 29, 2016, 03:40 PM)

Actually, from what I've seen even on a domain - when the Network Location Awareness service shits the bed - you're still screwed. But the domain does make it easier to push out service startup and firewall settings and other configurations to prevent that sort of thing ... in addition to it's other more typical benefits.


Note: I've actually seen a Domain Controller seal itself up like a clam because of the NLA service jumping to early. Console logon showed unidentified network, and a NLA service restart made it go "Oh! Lookie! There I am!!".

Delayed start is now part of my base configuration.

450

General Software Discussion / Re: Script to edit registry setting all network profiles to private

« Last post by Stoic Joker on April 29, 2016, 03:34 PM »

Restarting the Network Location Awareness service (and/or setting its startup type to delayed start) can help with that sort of thing.

...As would that 'D' word thing you're tired of us mentioning.