bgc

I wonder how well Cloudflare et al defend against the class of “nobody could still possibly be using this” vulnerabilities.

Well-written, I appreciated the absence of the kind of over-excited writing you often see in these kinds of posts.

At least with the second app (admittedly judging by that UI) this is a classic case of some team that has only every built apps that sit behind the firewall being made to “move to cloud,” without any understanding of what it means that their code is exposed to the internet.

I’ve seen a lot of orgs “solve” this not by fixing their code but by using Direct Connect to keep everything within the corporate network boundary; since after all compromised VPN credentials are another team’s problem!

This is not a Google-wide thing… this is from Google’s Context-Aware Access product, which is configurable in Google Workspace environments. OP should direct their ire at their corporate IT or infosec team.

The November report mentioned in the article goes into (disturbing) details: https://senate.ucsd.edu/media/740347/sawg-report-on-admissio...

That episode is indeed based on this event: https://www.imdb.com/title/tt1111175/trivia/?ref_=tt_dyk_trv

The cdn-cgi endpoints are documented here: https://developers.cloudflare.com/fundamentals/reference/cdn...

Another fun Zendesk “feature,” that, to my knowledge, has never been fixed is if you CC it on a thread with any other email address that auto-replies, it will get stuck in a loop and ping-pong emails back and forth until the mailbox fills up.

> does there exist a well-defined secure subset of CSS such that we don't have to worry about weird vulnerabilities?

I don’t know the answer, but if it is “no,” would it be feasible to add a few more user settings ala topcolor to achieve a more basic version of this?

You’ll still have the ability to install arbitrary drivers and support software obtained directly from the manufacturer, this change only means that Microsoft won’t automatically supply OEM driver files via Windows Update.

Holy moley, my first “real” computer ran 98SE and had BLACK ICE, which behaved exactly the way you described.

I remember I would take the IP addresses of the “attackers” and plug them into a McAfee graphical tracert tool, and it felt like nothing short of something out of GoldenEye.

Thanks for the memories!

Maybe so, but regardless of the facts this would almost certainly not be worth pursuing… In the US, courts are generally prohibited from enforcing foreign libel judgements against US persons if the country in which the judgement was won has looser libel standards than the US.[0]

(IANAL)

[0] https://en.m.wikipedia.org/wiki/SPEECH_Act

An interesting tidbit from the Bloomberg live thread[0]:

>The FDIC prefers to close a bank over the weekend, shutting it down on Friday and reopening Monday, Steven Kelly, senior research associate at the Yale Program on Financial Stability, told me.

>“The midday takeover suggests the bank couldn’t responsibly operate until the end of the day,” Kelly said.

[0]https://www.bloomberg.com/news/live-blog/2023-03-10/the-fall...

60 Minutes followed an FDIC takeover in 2009, including when the agents actually walked into the bank’s headquarters: https://youtu.be/TAE8i40A5uI

There is a sort of such system[0], but as others have said it’s not without limitations, especially at a large and extremely busy airport such as JFK.

https://www.faa.gov/air_traffic/technology/asde-x

Related to (2) is an RWSL[0] system, which was supposedly in use at the time of this event and is designed to stop exactly this sort of thing… whether it was functioning, the pilots didn’t see it, etc, will surely come out in the ensuing investigations.

[0] https://www.faa.gov/air_traffic/technology/rwsl/

Sibling has the links to the authoritative data from the FAA, a search for “runway incursion” at AvHerald[0] will also yield some relevant info.

[0] https://avherald.com/ (may be hugged to death right now between this event and the turboprop crash in Nepal)

Communications of the ACM - https://cacm.acm.org/ - has a mix of industry news, columns, and research articles.

Membership in ACM includes a print subscription, I’m not sure if one is available separately.