chaosmarmot
The archcloudlabs blog and Jared's presentations helped guide my own homelab, a large honeypot, and motivated me to journal about my projects more.
Thank you for continuing to share so much and helping me grow in my security knowledge.
chaosmarmot
Pros
— You don't have to pay anything. You can sync to your system and still have encrypted notes.
— Can switch between Markdown and rich text
— Web Clipper is fantastic for storing full website copies as reference material
— Can sync between mobile, desktop, etc
— Works with various OS's
Cons
— Printing crashes the desktop app on PopOS!. I have not reported this as it does not affect me that often.
—— The print crash does not affect OSX
— The mobile app can be a bit slow to start on older iPhones (several years old)
Overall, I view Joplin as similar to Apple notes, with a bit more control, ease of export, and benefits of Markdown.
My use case is journaling, work, and the first cut of writing that I publish.
- I no longer have to switch peripherals to use the same desk with the same peripherals: monitor, keyboard, mouse, microphone, DAC for music, and webcam. This simplified my wiring on the desk and reduced overall clutter, something I appreciate greatly.
- It helped me have a clear delineation between workspace and not workspace. When I'm done for the day, I tend to put my desktop into suspend or shut down entirely. I endeavor not to perform any tasks from my desk for the remainder of the day. Prior, I think I struggled with the mental transition of finishing the workday, switching peripherals, and then pivoting to my desktop for personal projects.
Recently, I purchased a modern laptop. My 2017 laptop was struggling, I needed to travel, and I needed access to software that wasn't readily available on my desktop OS. Post new laptop, I noticed the following:
- I am significantly more productive at my desk w/desktop versus pure laptop work. The peripherals, dedicated space, and compute power have a noticeably positive impact on my productivity. This is most impactful for development work and moderately impactful for my writing.
- My desktop is fast, and the screen is crisp. I thought my new M1 laptop would outshine my ~1-year-old desktop on Pop!_OS, and it does not. Desktops can pack a serious punch when it comes to computing power. This power does not require a large amount of space. My case is 6+ liters with a mini-itx board.
Having access to both a desktop and laptop has let me use both devices where they shine best. The laptop is great if the priority is mobility. The desktop is great is the priorities are power (compute / network), comfort, and a dedicated space.
https://www.nytimes.com/2019/11/04/business/secret-consumer-...
Non paywall: https://archive.ph/FKQ6d
The article does mention use cases for fraud, however it also states that the consumer score can
...determine how long each of us waits on hold when calling a business, whether we can return items at a store, and what type of service we receive. A low score sends you to the back of the queue; high scores get you elite treatment.
The article also mentions usage by social / dating applications such as OkCupid, which would indicate that a score can have an impact on your social life.
On one hand, I do understand the need for fraud mitigation. On the other hand, I've had to deal with the negative consequences of incorrect data provided by companies such as LexisNexis, how you can't fix it, and the impacts it has.
Tracking screenshots to builds has been an outcome of feature releases that included documentation w/screenshots. The documentation was part of the feature epic, and the epic was associated with a product release. The product releases had a product version.
What processes do you use to keep them up to date?
Feature updates include a documentation review, docs include screenshots. Depending on your org, some ownership between documentation teams or the feature owner can call out if an update is needed. For documentation teams to be enabled to make this call out, they should be provided with a feature outline that includes relevant screenshots. Relevant screenshots show product differences between empty state and the feature in use. It can be helpful internally to use a tool similar to Sketch to indicate the points of interest regarding empty state versus feature action.
It can also be helpful to have feature onboarding capabilities in your UI, something that guides customers through the feature with live data. Onboarding via the UI in my experience is a one-time event.
For documentation teams: Tie your docs (containing the screenshots), directly to the feature epic (or whatever you use) that will be released.
For marketing teams: I've worked with teams that used the same or similar source material as the documentation teams. The marketing teams can simply reference the product version somewhere in the marketing material. This calls out that the docs are dated, rather than attempting to update them. Preference is for new marketing material with updated screenshots, versus updating older marketing material.
How do you handle pre-release screenshots?
I'm assuming that pre-release may be synonymous with beta release.
You may be able to provide access to pre-release docs (including screenshots) via your normal docs UI if your docs are behind your feature gating systems. This can leverage the same docs > epics > release association. My greatest obstacle has been the docs not being complete for pre-release, not the portal itself. Instead, I've delivered PDFs or a similar format of documentation w/screenshots to beta customers in the upmarket > enterprise space. That has worked well, since there is frequently a manual onboarding associated with beta customers and innovative features in that space. I could see that not being the case in b2c or other scenarios.
Personal processes
I make feature screenshots and drop them into Joplin, annotating them at the time, so I remember why the screenshot was made. e.g., did something look wrong, was there something I should call out, did we fix a bug that provided different data? This also preserves a personal history so that I don't have to remember and provides a checklist of what I need to update. The web clipper function is helpful for getting historical doc references as well.
My experience is primarily in startups working with b2b upmarket > enterprise SaaS, so please keep that context in mind.
I do not believe it to be a waste of time. I regularly make reports for my personal systems for two types of abuse.
1. Email: phishing/spam
2. Text: a) political spam b) banking fraud
Positive instances. Results vary by the abuse@ owner. In cases where there is a successful take-down or escalation, I typically receive a positive response within 24 hours. Gandi.net and AWS are examples of an abuse@ that responds quickly. These types of escalations take ~5 minutes of my time when the data includes a screenshot of the activity/logs + whois details.
Some instances take longer. I have an ongoing escalation with Microsoft that started at abuse@microsoft, was redirected to junk@o365, and has now been redirected to abuse@azure. I assume Microsoft is just a massive org and there are inefficiencies. While somewhat arduous, I have received a response ~24 hours from Microsoft staff, and they have been helpful in forwarding the requests.
Some instances may be successful and have no response. I have never received a response from SendGrid (small number of escalations); however, the group associated with the activity appears to have been kicked off SendGrid or moved to Microsoft services. This is the same group I am escalating to Microsoft.
Some instances are not successful. For text message spam, I have found that bandwidth.com (owner of the source phone number) will only forward the complaint to their downstream customer w/o identifying the customer. Similar to what you have described. My bandwidth.com experience includes cases of what I would consider excessive abuse. Note that the downstream customer for bandwidth.com may not be the consumer of the phone number, rather a reseller of the phone numbers (if I understand their responses correctly)
I have never received a response from godaddy for any type of escalation. I do not recall a single escalation to godaddy ever resulting in a takedown.
reported by hundreds of others on sites like AbuseIPDB, etc.
A report to a blacklist is not equivalent to a report to an abuse@ address. A few of my opinions/experiences working at the ecosystem / platform level:
- IP addresses for abuse may be highly ephemeral. Professionally, I've run into many occurrences of AWS Lambda (and other serverless) IP's being marked as malicious. This is not limited to Lambda, but it provides a good example, as the owner of a serverless function often has no control over their public IP addresses.
- Data quality can be a major problem with crowdsourced abuse lists. Especially when it comes to evidence, last_seen timestamps, and classifications. This can be an impairment to monitoring these lists as a provider.
In summary, I've been able to do take-downs on banking fraud that took me less than five minutes. I have also had some failures and these can be frustrating. I don't mind doing the escalations, and in total I spend less than 20 minutes a week on this. I do hope that you continue to try. Further details to the above anecdotes are linked in my profile.
*edit for formatting.