Tempiz

joined 1 year ago
sorted by: new top controversial old
Here’s the note Reddit sent to moderators threatening them if they don’t reopen in c/[email protected]
[–] [email protected] 1 points 1 year ago

“Guys this is a democracy I promise. Just do your jobs and don’t complain, speak out, or vote against anything we say. You guys totally still are stakeholders in this platform though. Please volunteer more of your time so we can monetize your free content. Thanks!” - Reddit Admins

Reddit CEO slams protesters, says he'll change site rules in c/[email protected]
[–] [email protected] 58 points 1 year ago (3 children)

I love the irony of him calling Reddit a democracy while also refusing to budge on the API issue. You can’t have it both ways.

What do you use for outgoing smtp? in c/[email protected]
[–] [email protected] 3 points 1 year ago

I’m also on gmail. Haven’t had any issues with it, no real desire to change.

Understanding Fortinet's Legacy of Security Flaws From Magic Back Door to XORtigate CVE-2023-27997 in c/[email protected]
[–] [email protected] 1 points 1 year ago* (last edited 1 year ago)

They’ve really been dropping the ball lately. Especially with the SSL-VPN component. This is especially troubling considering I’ve had to implement emergency patches several times for this flaw on my own boxes.

2
Fortinet SSL-VPN Critical Vulnerability - June 12, 2023 (www.fortiguard.com)
 

A buffer overflow vulnerability was found within SSL-VPN in FortiOS leading to unauthorized code execution. Options are either to disable SSL-VPN or upgrade to a patched version.

3
Fortinet SSL-VPN Critical Vulnerability - June 12, 2023 (www.fortiguard.com)
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
0 comments fedilink
 

A buffer overflow vulnerability was found within SSL-VPN in FortiOS leading to unauthorized code execution. Options are either to disable SSL-VPN or upgrade to a patched version.

2
QNAP Security Advisory | Bulletin ID: QSA-23-05 (sh.itjust.works)
 

cross-posted from: https://sh.itjust.works/post/87144

Received this QNAP security bulletin this morning. Update your QNAP products!

June 14, 2023 - QNAP® had published security enhancement against security vulnerabilities that could affect specific versions of QNAP products. Please use the following information and solutions to correct the security issues and vulnerabilities.

Vulnerabilities in Samba

Release date: June 14, 2023 Security ID: QSA-23-05 Severity: Medium CVE identifier: CVE-2022-37966 | CVE-2022-37967 | CVE-2022-38023 | CVE-2022-45141 Affected products: Certain QNAP Devices

Summary

The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba, including vulnerabilities related to RC4 encryption. If exploited, some of these vulnerabilities allow an attacker to take control of an affected system. The following QNAP operating systems are affected:

• QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) QES is not affected.

Only QNAP devices that run the affected operating systems and also act as a domain controller or AD member are affected.

Standalone QNAP devices are not affected by the vulnerabilities.

QNAP is currently fixing the vulnerabilities in QTS, QuTS hero, QuTScloud and QVP (QVR Pro appliances).

Please check this security advisory regularly for updates and promptly update your QNAP operating system to the latest version as soon as it is available.

Recommendation

Because RC4 encryption poses a high security risk, we strongly recommend replacing RC4 with the more secure AES algorithm when using a QNAP device as a domain controller or AD member.

• When the QNAP device acts as a domain controller, we strongly recommend enforcing AES encryption. • When the QNAP device acts as an AD member, the encryption method should follow that of the domain controller. We also strongly recommend that the domain controller is configured to enforce AES encryption. Before security updates are available, depending on the AD domain role of your QNAP device, we recommend enforcing AES encryption only or at least allowing both AES and RC4 encryption to mitigate the risks posed by the vulnerabilities.

1
QNAP Security Advisory | Bulletin ID: QSA-23-05 (sh.itjust.works)
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
0 comments fedilink
 

Received this QNAP security bulletin this morning. Update your QNAP products!

June 14, 2023 - QNAP® had published security enhancement against security vulnerabilities that could affect specific versions of QNAP products. Please use the following information and solutions to correct the security issues and vulnerabilities.

Vulnerabilities in Samba

Release date: June 14, 2023 Security ID: QSA-23-05 Severity: Medium CVE identifier: CVE-2022-37966 | CVE-2022-37967 | CVE-2022-38023 | CVE-2022-45141 Affected products: Certain QNAP Devices

Summary

The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba, including vulnerabilities related to RC4 encryption. If exploited, some of these vulnerabilities allow an attacker to take control of an affected system. The following QNAP operating systems are affected:

• QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) QES is not affected.

Only QNAP devices that run the affected operating systems and also act as a domain controller or AD member are affected.

Standalone QNAP devices are not affected by the vulnerabilities.

QNAP is currently fixing the vulnerabilities in QTS, QuTS hero, QuTScloud and QVP (QVR Pro appliances).

Please check this security advisory regularly for updates and promptly update your QNAP operating system to the latest version as soon as it is available.

Recommendation

Because RC4 encryption poses a high security risk, we strongly recommend replacing RC4 with the more secure AES algorithm when using a QNAP device as a domain controller or AD member.

• When the QNAP device acts as a domain controller, we strongly recommend enforcing AES encryption. • When the QNAP device acts as an AD member, the encryption method should follow that of the domain controller. We also strongly recommend that the domain controller is configured to enforce AES encryption. Before security updates are available, depending on the AD domain role of your QNAP device, we recommend enforcing AES encryption only or at least allowing both AES and RC4 encryption to mitigate the risks posed by the vulnerabilities.

My collection of clocks and watch hands in c/[email protected]
[–] [email protected] 1 points 1 year ago* (last edited 1 year ago) (1 children)

This is a really neat! I don’t know much about radium watches, so I have to ask, are any of these dangerous with continuous exposure? Do collectors need to take precautions?

3
FYI - Windows 10 21H2 Home & Pro go EoL today (sh.itjust.works)
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
1 comments fedilink
 

Just a reminder that Windows 10 21H2 home and pro editions are EoL today. Make sure you get updated to 22H2.

22H2 will be the final release of Windows 10, with an EoL of Oct. 14, 2025.

Enterprise 21H2 still has one year of support which will end June 11, 2024.

1
FYI - Windows 10 21H2 Home & Pro go EoL today (sh.itjust.works)
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
1 comments fedilink
 

Just a reminder that Windows 10 21H2 home and pro editions are EoL today. Make sure you get updated to 22H2.

22H2 will be the final release of Windows 10, with an EoL of Oct. 14, 2025.

Enterprise 21H2 still has one year of support which will end June 11, 2024.

[Question] Does anyone run their own email server? in c/[email protected]
[–] [email protected] 3 points 1 year ago (1 children)

Nope. It can’t really be self hosted anymore, as having a residential IP is a straight track to the spam folder. It can be done if you also pay for a mail relay service, but then what’s the point of self hosting when you need to rely on a cloud service anyways.

1
What is your security role within your organization? (sh.itjust.works)
 

With this new community, I figured it would be interesting to get a gauge on if there are any security professionals within the community, and what roles everyone holds?

I personally specialize in GRC, but have also worked in network engineering in the past.

Testing a new encrypted messaging app's extraordinary claims in c/[email protected]
[–] [email protected] 1 points 1 year ago

Saw this one over on /r/cybersecurity and just goes to show why you should always have healthy skepticism for new closed source applications with wild claims.

Reddit experimenting with blocking mobile browsers in c/[email protected]
[–] [email protected] 9 points 1 year ago

Not surprised. They need to milk every last drop of revenue from their users free content for the upcoming IPO.

Welcome to [email protected] - What do you selfhost? in c/[email protected]
[–] [email protected] 1 points 1 year ago

Jellyfin and Nextcloud with UptimeKuma for monitoring. A pretty simple stack running on a mini tower, but it works great for my primary needs. Portainer for managing docker containers and stacks from a GUI.

Reddit CEO: We're Sticking With API Changes, Despite Subreddits Going Dark in c/[email protected]
[–] [email protected] 13 points 1 year ago

I wouldn't say it was a flop. A massive number of subs and users are participating at the moment (some forced due to the blackouts). But I do agree that reddit executives definitely don't give a shit, and will eventually just start booting mods to bring the subs back if they don't fall in line.