drspod

joined 2 years ago
[–] drspod@lemmy.ml 2 points 11 hours ago

I think you forgot to post the article.

[–] drspod@lemmy.ml 5 points 19 hours ago (1 children)

Instead of linking to a jpeg hosted on a non-HTTPS website for a weird investments scam you could just link wikipedia:

https://en.wikipedia.org/wiki/Gartner_hype_cycle

[–] drspod@lemmy.ml 16 points 1 day ago

Reuters just regurgitating investor-bait because they have no domain expertise. Maybe Reuters journalists should be getting some training from experts too.

[–] drspod@lemmy.ml 52 points 3 days ago (1 children)

Halt and Catch Fire

[–] drspod@lemmy.ml 3 points 6 days ago

Then what you bought is not a mouse, it's a proprietary peripheral that emulates a mouse when you install its propretary drivers.

[–] drspod@lemmy.ml 8 points 1 week ago

Back in the 00’s we had to fiddle with ifconfig and friggin’ /etc/network by hand. Things have gotten a lot better.

I was just thinking that I've never had any problems with either WiFi or Ethernet connectivity since NetworkManager became a standard part of modern distros. Before that I was having to install windows drivers with ndiswrapper and configure interfaces manually in ifup and ifdown scripts, and I haven't had to do that for at least 15 years now.

[–] drspod@lemmy.ml 11 points 1 week ago

I hate to be the one to break it to you, but railing against "forced diversity" is just a dog-whistle for rejecting actual diversity.

Normal people don't actually care about it. If something is shit because it's badly written with bad character design then we say "it's shit because it's badly written and has bad character design," not "it's bad because it has women and minorities."

[–] drspod@lemmy.ml 27 points 1 week ago (1 children)

You clicked the tree somewhere and it would tell you either to try again, or you would win something. I think most people who won got $5 and a monkey plush toy. I'm not sure anyone ever won the jackpot. You could just click over and over again trying to remember where you had previously clicked, like a treasure hunt. Meanwhile they're showing banner ads on the page.

It worked using the ismap attribute on the image which tells the browser to add the x,y coordinates of the user's click to the link when fetching the result.

[–] drspod@lemmy.ml 39 points 1 week ago (4 children)

Does anyone remember the TreeLoot.com MoneyTree? It existed from 1998-2004 and looked like this:

I'm all in favor of going back to the old internet, but... not this.

[–] drspod@lemmy.ml -5 points 1 week ago (1 children)

Please down your use of "up" as a verb. It ups my blood pressure and downs my tolerance of reading newspaper headlines.

 

Threat actors are utilizing an attack called "Revival Hijack," where they register new PyPi projects using the names of previously deleted packages to conduct supply chain attacks.

The technique "could be used to hijack 22K existing PyPI packages and subsequently lead to hundreds of thousands of malicious package downloads," the researchers say.

If you ever install python software or libraries using pip install then you need to be aware of this. Since PyPI is allowing re-use of project names when a project is deleted, any python project that isn't being actively maintained could potentially have fallen victim to this issue, if it happened to depend on a package that was later deleted by its author.

This means installing legacy python code is no longer safe. You will need to check every single dependency manually to verify that it is safe.

Hopefully, actively maintained projects will notice if this happens to them, but it still isn't guaranteed. This makes me feel very uneasy installing software from PyPI, and it's not the first time this repository has been used for distributing malicious packages.

It feels completely insane to me that a software repository would allow re-use of names of deleted projects - there is so much that can go wrong with this, and very little reason to justify allowing it.

 

cross-posted from: https://lemmy.ml/post/4912712

Most people know at this point that when searching for a popular software package to download, you should be very careful to avoid clicking on any of the search ads that appear, as this has become an extremely common vector for distributing malware to unsuspecting users.

If you thought that you could identify these malicious ads by checking the URL below the ad to see if it directs to the legitimate site, think again! Malware advertisers have found a way to use Google's Ad platform to fake the URL shown with the ad to make it appear like a legitimate ad for the product when in fact, clicking the ad will redirect to an attacker controlled site serving malware.

Don't click on search ads or, even better, use an ad-blocker so that you never see them in the first place!

 

A reported Free Download Manager supply chain attack redirected Linux users to a malicious Debian package repository that installed information-stealing malware.

The malware used in this campaign establishes a reverse shell to a C2 server and installs a Bash stealer that collects user data and account credentials.

Kaspersky discovered the potential supply chain compromise case while investigating suspicious domains, finding that the campaign has been underway for over three years.

view more: next ›