Posts by SecureOwl@infosec.exchange
(DIR) Post #B5pgn2762elRHmmBHM by SecureOwl@infosec.exchange
0 likes, 1 repeats
some personal news: i recently put a power tool back where it was supposed to go and was able to find it with ease when i needed to use it today
(DIR) Post #B5qauDlugovWu5s8Jc by SecureOwl@infosec.exchange
0 likes, 4 repeats
trying a new thing, have 3D printed a QR code and put it on the front porchQR code triggers a canary tokenwant to see if any of the delivery companies are using the drop off proof of delivery pics to train AI#infosec
(DIR) Post #B5qauER2Dvouxd6yPY by SecureOwl@infosec.exchange
0 likes, 3 repeats
Whelp, sample size of 1 so far, but about 50 minutes after an amazon delivery - where a picture was taken - got a hit on the canaryi just checked the delivery photo and the QR code was visible in itUser agent was not a phone and clearly some sort of crawlerIP address was a CDNbut we are 1/1, lets see how it goes with a few more(i get a lot of random work deliveries)
(DIR) Post #B5sSbpk0syOPqPcm4e by SecureOwl@infosec.exchange
1 likes, 0 repeats
Spirit Airlines should just be like, "oh, btw, we're pivoting to AI" and people would be like, "woah, here have some money!"Then, when they just carry on being a (sorta) airline, and not AI, and people are like "huh, wheres the AI?" They can be all "oh, our bad, we meant AIR but forgot the R".Follow me for more business strategy tips.
(DIR) Post #B5vTxUFEAllyyOzeNs by SecureOwl@infosec.exchange
1 likes, 1 repeats
Experiment updateAmazon are 2/2 for hitting the QR canary token - same CDN, same non-phone user agent each time. Seems to happen async after the delivery, maybe 20 mins or so later.Actual delivery photo from today below.Only other test subject so far is Fedex, they did not trigger the QR.#infosec
(DIR) Post #B5vXpmzQzgrgbvBulc by SecureOwl@infosec.exchange
1 likes, 0 repeats
RE: https://live.acarsdrama.com/@acarsdrama/116511863311704573“mildly flooded” sounds like the way my 12 year old would describe a river in the house of his own creationRT: https://live.acarsdrama.com/users/acarsdrama/statuses/116511863311704573
(DIR) Post #B5yVMstgKqOW6ETBJ2 by SecureOwl@infosec.exchange
0 likes, 0 repeats
@EriogonumDarwin great idea- they have flock cameras at my local home depot - will take the qr on a road trip and report back
(DIR) Post #B6BjKxcDkJUqZEl4SW by SecureOwl@infosec.exchange
0 likes, 2 repeats
“Hi, my name’s David, I’m one of the repair techs here, I’v been looking after your broken soldering iron today.”“How’s he doing.”“Take a seat.”“Oh no.”“Unfortunately, and there is no easy way to say this, we looked at your Iron, and, well, we found something.”“Please, just give it to me straight.”“Ok, well we found, and I’m so sorry, we found, firmware.”“It has firmware?”“Yes.”“But it’s a soldering iron?”“Yes.”“So there is nothing you can do for it?”“Unfortunately, when a tool has firmware, it’s always fatal. There is nothing we can do. I am very sorry.”“But, it’s so young. I only got it like a month or so ago?”“Sadly, we often see firmware on younger tools.”“But it was fine yesterday, like totally fine?!”“With any kind of firmware, it can just, you know, stop working.”“What am I gonna tell the kids?!”“Obviously you know your kids better than me, but as a general rule, I always tell people that kids appreciate honesty, and are more resilient than you might think. Be honest.”“But how?”“Just tell them, you were drawn in by the features, rather than just a functional thing, so that’s why you got it.”“Ah man this is going to be rough.”“Would you like to see him?”“Not like this.”#microfiction
(DIR) Post #B6CFlmuyp8pRk3Mvs8 by SecureOwl@infosec.exchange
1 likes, 0 repeats
this was a genuine card i found while looking for mothers day cards that made me do a double takeit says 'aunt'
(DIR) Post #B6CNKKq7uRwqTOWFSS by SecureOwl@infosec.exchange
1 likes, 0 repeats
just got off a call where a vendor kept referring to their ai agent as “she” or “her” and now i want to cryits software.
(DIR) Post #B6EXlcJMRk7oKvlEXo by SecureOwl@infosec.exchange
1 likes, 0 repeats
RE: https://live.acarsdrama.com/@acarsdrama/116563653915617265risky move as rumors of a new pandemic swirlRT: https://live.acarsdrama.com/users/acarsdrama/statuses/116563653915617265
(DIR) Post #B6F8t8knv8M3Hq31DE by SecureOwl@infosec.exchange
0 likes, 0 repeats
delivery person today put package actually on top of the QR code so it wasn’t in the POD photo
(DIR) Post #B6F8t8v5IuZtnirEEi by SecureOwl@infosec.exchange
0 likes, 1 repeats
Update on my QR porch ornament experiment.There have now been 4 Amazon proof of delivery images containing the code.The first two, reliably hit the canary token within 20-40 minutes of the delivery, from a non-phone QR code. Definitely some sort of automated process.The third one, did hit the QR, but it was because the delivery person took it upon themselves to scan the QR code with their phone to see what it did - user agent confirmed that. There were no programatic hits like the first two.Fourth one, in the picture, but no hit registered.UPS/FedEx/USPS - not even as much as a flicker of a GET request to my canary.Bonus points, while driving I exposed my QR code to a couple of Flock cameras, but alas they didn't do anything.Next step will be a new QR code, one that points to a different domain, because the next thing to check is - did they start blocking the requests to Canarytoken dot org from whatever process was ingesting the images - because that is what it seems like.
(DIR) Post #B6KiEwpJPmFCqs5dsO by SecureOwl@infosec.exchange
1 likes, 3 repeats
BREAKING: GitHub switching status page default language to German in order to return to five neins.
(DIR) Post #B6MQvePAN8hhJLzcwK by SecureOwl@infosec.exchange
0 likes, 2 repeats
There is that famous technical interview question that goes: what happens behind the scenes when you type in a domain name and press enter? The intention is you talk all about resolving DNS of the host, TCP things and HTTP etc.A more truthful answer would include:- Your email address is sent to launch darkly to get applicable feature flags.- A gigabyte of data is logged to DataDog- Details about the way you moved your mouse are sent to segment.io- A bunch of telemetry is sent to Sentry.- Ads are injected from Facebook.- Metrics are recorded to Hubspot.- Page renders in browser.
(DIR) Post #B6MtEvy45yic04IeoK by SecureOwl@infosec.exchange
0 likes, 0 repeats
glad he was able to land that ping sponsorship after the ifconfig deal fell through
(DIR) Post #B6jo1rpEdKbpcFwrlg by SecureOwl@infosec.exchange
1 likes, 0 repeats
someone forwarded me a video from an aviation youtuber who was doing a bit on ACARS and described ACARS Drama as a “particularly shady website”, which I enjoyed since it has stricter privacy controls than actual ACARS
(DIR) Post #B6k0ScWkon1dRFpMxc by SecureOwl@infosec.exchange
1 likes, 0 repeats
spotted a baby bunny while out mowing the lawn, which mean the process took thrice as long because i slowed waaay down like a responsible boater keeping their distance from an orca pod
(DIR) Post #B6oQpsAoBgZA459OXQ by SecureOwl@infosec.exchange
6 likes, 3 repeats
that's how i've always done it, Microsoft
(DIR) Post #B6pVupHV3rqbTKQCiO by SecureOwl@infosec.exchange
0 likes, 2 repeats
recently designed and 3d printed sock and boxer short dispensersjust put the relevant item of clothing in the top hole on laundry day and collect it from the slot at the bottom when its time to wear themthis is the future we were promised