_synack

joined 5 months ago
[–] _synack 3 points 14 hours ago* (last edited 14 hours ago)

I never said that. I said do not follow known or suspected phishing links. It takes practice and skill, and it is not always simple. But if you know if it is a risk, you should consider avoiding the risk.

"This looks like it might be phishing. Let me check it out and see what's on the other side." <--- That's what I am suggesting to avoid.

Security is an onion: layered. Patched software. Good, unique passwords. MFA. Various security defense tools. But technology can have gaps, flaws, or be circumvented. It's important to keep in mind that us as individuals are also a security layer, and are often the first or last line of defense.

[–] _synack 2 points 14 hours ago (2 children)

Not all phishing links are related to credential theft or trying to get you to download something malicious. Zero-day vulnerabilities in web browsers are revealed constantly. A malicious website (or malicious content embedded into an otherwise benign website) can leverage these or other unpatched vulnerabilities when visited.

You should never follow a known or suspected phishing link unless it's your job and you are using the appropriate tools and techniques. Just report it to the security department or delete it and move on with your day.

[–] _synack 3 points 14 hours ago

I have spent many years in both the midwest and the south.

In some areas of the south, people drive extremely aggressively and there are lots of issues with compliance to various traffic laws but it is usually not difficult to get over if you need to. People will let you in. The zipper merge is a well-honed machine and almost everyone uses it and obeys it.

In the midwest, drivers tend to me more docile, cautious, and lawful overall but have an extreme sense of entitlement over their place in line. "How dare that person use that completely empty lane to get ahead of me! Can they not see there is a line!" They will absolutely not let you in. It does not matter if the zipper merge would improve traffic flow. It just is not going to happen.

 

Question

On iOS, why can the Jellyfin app play Opus music fine, but Finamp cannot without forcing transcoding to AAC in Finamp settings?

Details

I recently lossy-encoded my FLAC music library to Opus format and created a new library for it on my Jellyfin server. I started trying to use the Jellyfin iOS app to play music from the library, which works fine with one caveat: if the phone screen locks, the next track in the queue will not play. This seems to be related to a limitation in a library used for the Jellyfin iOS app (expo).

The only workaround I am aware of to continue playing music from a Jellyfin server on iOS after the screen locks is to use the Finamp app instead, which is a purpose-built music player app for Jellyfin servers. But it will not play Opus tracks on iOS, apparently because iOS doesn't natively support Opus except when it's in a CAF container, which is non-standard and exceedingly rare. I have to set Finamp to transcode all music to AAC in order to play the tracks.

Why can the Jellyfin app play Opus tracks on iOS without issue, but Finamp can't?

[–] _synack 1 points 15 hours ago

I really appreciate the feedback. Thank you.

[–] _synack 11 points 3 days ago* (last edited 3 days ago)

I’ve heard this related to Gaussian blur and it’s obviously possible with pixelation that uses a large number of smaller pixels, but I would honestly love to see someone demonstrate reversal of the pixelation I used here.

In any case the pixelated credentials were for limited, read only access for testing and the API client was already deleted before I posted the image.

I appreciate the concern and feedback in any case.

[–] _synack 2 points 3 days ago* (last edited 3 days ago) (3 children)

I saw someone mention it as an alternative to using Orca or Wiz for compliance use cases. I just wanted to check it out. I was attempting to run it locally rather than as a service with configuration via pipeline.

[–] _synack 2 points 3 days ago* (last edited 3 days ago) (5 children)

It seems you have a lot of experience with the tool. Can you recommend any resources that teach more advanced use cases and configurations? I'm finding that just reading the docs, playing with it, and watching the YouTube videos I found aren't really doing it for me. Most of the materials I'm finding are about AWS, but that's not relevant to me.

11
submitted 4 days ago* (last edited 4 days ago) by _synack to c/cybersecurity
 

I learned of the existence of steampipe recently, which seems to be an interesting tool to help teams - including cybersecurity teams - understand their cloud assets and ensure compliance with security policies.

I started playing around with it, and one thing that struck me immediately is the need to store API credentials for the various plugins in plaintext in JSON files in your user profile. This struck me as incredibly insecure, especially given that the default UNIX permissions on the files seem to be 644.

Does anyone know if there is a way to store and dynamically retrieve these API credentials more securely, such as in a remote key store like AWS Secrets Manager or Azure Key Vault? I spent awhile searching and watching some YouTube videos, but didn't come across a method to do this.

[–] _synack 37 points 5 days ago

Armadillos also can carry leprosy, so this is sound advice on multiple levels.

[–] _synack 7 points 5 days ago

No the reason was already mentioned earlier. Europe mandates a relatively short overall maximum vehicle length whereas the US mandates a maximum trailer length. So European trucks are almost always cab over design to maximize trailer length.

[–] _synack 7 points 5 days ago (1 children)

That truck was from 1985, but I know what you mean. That truck was awesome!

At least the Ford Maverick is something that exists. I know it’s based on an Escape platform, but that’s fine for most uses of trucks that size.

[–] _synack 9 points 5 days ago

Ultimately, even Democratic politicians are beholden to wealthy donors, including those associated with the health insurance industry.

In this post-Citizens-United world, the only way to make real change is to have a bunch of people willing to not hold onto power to do the right thing simultaneously. Sadly, the likelihood of that happening is vanishingly small.

[–] _synack 2 points 5 months ago

Supporters Shield!!!

What a game! Huge game by Messi and Callendar.

view more: next ›