Professional bugs

[jj2007]

https://pdf-insecurity.org/signature-shadow/evaluation_2020.html

[Vortex]

Application virtualization can be a good method to test some of those applications.

[hutch--]

I am no great fan of PDF format, occasionally I get a government PDF file that they thought they were smart in locking and you just looked for a PDF unlocker on the internet an BINGO, it was all yours. Even if you cannot find an unlocker, you can print screen and save it as an image. OCR it if you have the right software but in most instances, who cares when its a crap format.

[jj2007]

I'll kick Firefox into the dustbin now. This is the second or third time that I installed the latest version, and a day later the bloody bug complains that it can't update to the latest version. Now I've check the version numbers - I had controlled yesterday, it was 78.0.2, the absolutely latest one. Today it's back to 77.0.1, folks, and there is the whining box again, "Firefox can't update to the latest version". But you can silently revert to the previous one, dumb piece of s**t, right?

Back to Slimjet. It will trash my harddisk with GB's of writing for no particular purpose, but at least it works. Professional bugs, all of them

I've filed a bug. Now it's a known professional bug

[hutch--]

With Slimjet you can dump all of the junk if you want, run it in incognito mode and it does it automatically. Problem is you lose you link collection.

[jj2007]

Slimjet is a disk hog. After three hours in forums, it has already written 12GB to disk - why?? No good for your SSD

[hutch--]

I run Slimjet on an ordinary SATA SSD and have done so for some years and it shows no sign of capacity reduction.

[jj2007]

I finally cornered the WhatsApp bug: It starts writing to disk, at a rate of 3MB per second, when you post to somebody a link to a video. Yes, a URL, not the video itself. Every sane programmer would say "oh, a URL is just text, that's 50 bytes or so", but nope, WhatsApp TheBug starts writing 3MB per second.

It stops, btw, if you look at a different profile, and restarts when you come back to the profile where you posted the URL. So I thought "maybe I'll just delete that post", but nope, it continues to write 3MB per second, even after closing and restarting WhatsApp. This is sick, folks.

[K_F]

I wouldn't trust any multiplatform software on my PC, besides wozzap is a farcebook thing... They're spying on you again.

[jj2007]

https://forums.servethehome.com/index.php?threads/firefox-is-chewing-through-your-nand.11346/

If you're a Firefox user, you may find this to be of interest.

Purely by chance, I fired up a free copy of SSDLife on two consecutive days where I haven't really used my workstation for anything other than email and browsing. For those of you unfamiliar with this tool, it simply reports estimated lifetime for the attached SSD and it also shows the amount of data read and written.

In my case, SSDLife notified me that 12GB was written to the SSD in one day. Since I didn't recall downloading any huge files over the previous day or visiting any new sites that could've resulted in bringing down a lot of new content to the cache, this puzzled me. I monitored these stats over the next couple of weeks and this behavior stayed consistent. Even if the workstation was left idle with nothing running on it but a few browser windows, it would invariably write at least 10GB per day to the SSD.

To find out what's going on, I fired up Resource Monitor and looked at disk utilization.

At the very top of the list was Firefox, writing tirelessly at anywhere between 300K and 2MB per second to a file called "recovery.js". Googling around revealed that this is Firefox's session backup file that is used to restore your browser sessions in case of a browser or an OS crash. I was aware of the fact that Firefox had this feature, but I had no idea that session information was so heavy!

[hutch--]

There is a solution to hammering SATA SSDs but you must have enough memory, run a ramdisk and you save your disks/SSDs from being thrashed day in and day out. If your board is late enough, try a half gig NVMe drive that you only store data on which is used to load the ramdisk and for any session before you turn the computer off, you get one read and one write to the NVMe drive.

[jj2007]

There is a solution to hammering SATA SSDs but you must have enough memory, run a ramdisk and you save your disks/SSDs from being thrashed day in and day out. If your board is late enough, try a half gig NVMe drive that you only store data on which is used to load the ramdisk and for any session before you turn the computer off, you get one read and one write to the NVMe drive.

A bit risky if you live in an area where you have frequent power cuts, right? Which is not my case, but still...

I have a different solution in mind: a website that blames and shames misbehaving applications, such as SlimJet and WhatsApp. Every stupid browser comparison should have the question "can it destroy your SDD?" in a prominent place

[jj2007]

2020 United States federal government data breach

The attack used a backdoor in a SolarWinds library. When an update to SolarWinds occurred the malicious attack would go unnoticed due to the trusted certificate. The Cybersecurity and Infrastructure Security Agency issued Emergency Directive 21-01 in response to the incident.

The New York Times reported SolarWinds did not employ a chief information security officer and that employee passwords had been posted on GitHub in 2019. Reuters reported that a security researcher had alerted the company in 2019 that its update server had a weak password of "solarwinds123."

SolarWinds's share price fell 25% in the days following the breach. Insiders at the company traded $280 million in stock after the attack was revealed internally but prior to it being announced to the public. A spokesperson said that those who sold the stock were not aware of the breach.

On 15 December 2020, SolarWinds reported the breach to the Securities and Exchange Commission. However, SolarWinds continued to distribute malware-infected updates, and did not immediately revoke the compromised digital certificate used to sign them.

On 16 December 2020, German IT news portal Heise.de reported that SolarWinds had for some time been encouraging customers to disable anti-malware tools before installing SolarWinds products.

[hutch--]

Sad to say it in not uncommon for large organisations to have really sloppy security and this is more so the case with government and defence organisations. It is usually bad design of their security systems that they can be so difficult to use that users take short cuts to avoid the hassle.

I have recently configured 4 versions of Win 10 64 bit and the firewall is a disaster to set up, the AV scanner is a pig that you cannot turn off and to be safe, i use Kaspersky's KVRT.EXE if I need to do an on demand scan.

Another disaster is the Unix based assumption that mixed characters where it is enforced to use upper case, lower case, numbers and punctuation when the only factor is the length of the pass phrase as long as you don't use common phrases or names so as to avoid dictionary attacks.

[jj2007]

Apart from the fact that Thunderbird asks me every two days or so to install a new version, most of the time inviting me to reboot, it also crashes. Probably they are using C++ to program TB