• 1 Post
  • 411 Comments
Joined 2 years ago
cake
Cake day: June 7th, 2023

help-circle
  • Bitcoin is a ponzi scheme with a really long time horizon. In a way, any fiat currency kinda is as well. The difference is that a government backed fiat currency like the US Dollar is backed by the US Government saying “you will accept the USD, or else”. That backing keeps the game running. Bitcoin has nothing like that. The only reason it keeps going is because of speculation, money laundering and the purchase of black market goods.

    So, as long as you can go buy drugs or move money across borders with Bitcoin, it will have value. As long as it has value, some folks will speculate on it. That can keep prices up, right up until it doesn’t. So, as is always the case for speculative assets, caveat emptor.



  • I happen to be a prime example of how bad US Rail is this week. I’m taking my son from near Fredericksburg (the real one), up to Ballston for a summer camp. We have a couple options:

    1. Drive
    • Distance: ~70 miles one way, ~140 round trip
    • Time: 1 hour and 45 minutes one way, with traffic. ~3.5 hours round trip.
    • Cost:
      • 4 gallons (US) of gas @ $3.50/gal: $14
      • Wear and tear: estimate at 0.5 gas cost: $7
      • Parking: $11
      • Total: $32/day
    1. Virginia Railway Express (VRE) and Washington Area Metro (WMATA)
    • Distance: N/A
    • Time:
      • Drive to Fredericksburg station: 20 minutes
      • VRE (Fredericksburg to L’Enfant station) - 1 hour 20 minutes
      • WMATA (L’Enfant to Ballston) - 20 minutes
      • Total: 2 hours one way, 4 hours round trip
    • Cost:
      • Drive: we’ll just ignore this, it’s close enough to zero.
      • VRE: $23.56/person * 2 people: $47.12
      • WMATA: $3.45/person * 2 people: $6.90
      • Total: $54.02/day

    So, for the low, low cost of about 1.68 times the cost of driving, we can take slightly longer to get to our destination and have zero control over our schedule, which makes the actual time devoted to travel considerably longer. We tried the public transit route last year, and it meant leaving earlier in the morning (about 30 minutes) to catch a train to get us there on time, and getting us home around 45 minutes later. And this is right around the US Capitol, which has some of the better transit options. Needless to say, we’re driving this year.

    I really want to be able to take transit, but it’s basically dead in the US. Earlier this year, I needed to go to Boston for work. Catching a train from Washington, DC to Boston meant an 7 hour train ride (using the “high speed” Acela line) at ~$500 round trip. Flying was 1.5 hours and cost ~$300 round trip. Wanna guess which option I used?

    Basically, all of the incentives are stacked against transit options in the US. Except within certain metro areas, driving or flying is always cheaper and faster. Yes, inside those metro areas, public transit can be great. I used to work in Washington, DC and used the VRE I mentioned earlier to get there and then WMATA or the Capital BikeShare to get to my office. That was great, since I didn’t have to drive into DC every day, which sucks big donkey balls. But it probably wasn’t cost effective and wasn’t really time efficient either.


  • But have you considered, line goes up?

    Sadly, there are probably a lot of developers who are burning the candle at both ends to push this out the door, on an unrealistic schedule. And who will then burn the candle in the middle as well when the release is a buggy mess. Only to finally be tossed aside like so much trash when the game fails to realize these unrealistic expectations. And all of that will squarely be the fault of management, who will wipe away crocodile tears with the profits this game will generate. Just not the profit they unrealistically promised investors; so you know, the game was actually a failure. Fuck EA’s management, the world would probably be a better place if the C-Level suite and board room got emptied out by some disaster.





  • I have it on good authority that you currently have a project idea which you can use to pick one (or more) of those paths and start learning. ;-)

    For example user management in studio3T

    Not sure how I missed this on my first read of your post. But, this looks like a fancy front end to making MongoDB calls. That makes life easier, MongoDB has a well documented API and a driver for C#. As an aside, if you want to get really good at PowerShell, getting a basic working knowledge of C# and .Net in general is really helpful. For the lazy (and I always like lazy), there’s even a pre-built MongoDB module on the PowerShell Galley called Mdbc. There is also the Project’s GitHub Page which has a lot of useful info.

    Granted, this path likely means learning enough about MongoDB to create/delete/modify users. But you came here expecting a load of homework, right? Also, this is a good excuse to spin up a docker container running MongoDB and go hog wild breaking the fuck out of it (just call it “research” if management asks). And who doesn’t love breaking stuff?

    I’d also note that you may be able to get some help along the way by capturing the network traffic to the server caused by the Studio3T GUI. WireShark can capture the traffic to/from the DB server and you can read that to reverse engineer some of the calls you care about. Just, make sure you talk to your security folks before you download/install WireShark. If they are worth their salt, they’ll understand an engineer installing/running wireshark, it just makes their day easier if they know the alert is coming first. Assuming the GUI isn’t complete shit, it may encrypt traffic. This can be dealt with by using the SSLKEYLOGFILE environmental variable. In most cases, this results in the TLS keys being saved to a file and that can be imported into WireShark.

    Good luck, and have fun!


  • Theoretically, browsers could even stop from the JS engine from being started for the site in the first place.

    The NoScript extension is basically this. Most of the client side stuff is off by default and you can enable it per-domain. It breaks a whole lot of websites, but often in ways where the main content of a website is still readable. Over time, you can build up a list of “allow by default” domains and most of the web you care about works. Though, you may have to spend a moment or two sorting out permissions when you visit a new site.


  • There are a few options:

    1. Use AutoIT or some similar automation framework. Generally, this is pretty easy and gets the job done. Your security folks may hate you (AutoIT binary hashes are basically all assumed to be malware IoCs at this point),
    2. Depending on how the GUI works, you may be able to reverse engineer the calls made by the application and just make those calls yourself. For a Web UI, you can use something like BurpeSuite or even just the FireFox developer tools to catch the web calls and then modify/replay those as desired. For a console application, it could be trickier, as you may need to either load the software’s libraries (DLLs) or figure out database calls. It all depends on how the user data is stored and updated.
    3. Using P/Invoke you can load several functions from the Win32 API, specifically FindWindowEx and EnumChildWindows to locate the GUI application and any specific form items you want to manipulate (e.g. TextBoxes to fill, Buttons to click). You can then modify properties or send clicks. You’ll probably hate yourself at the end of this project, but you’ll learn a lot.


  • If you repeat a lie enough times, eventually you start to believe it. Others might also start believing it. Get enough people fully wrapped up in your lies and now you have a cult. Your cult followers will happily swallow any lie you tell them and defend it, often to the point of torture and death. This is pretty much where we are with MAGA, it’s a cult of personality and it’s followers will happily slurp up anything which dribbles out of Trump.

    I’m curious to see if the cult outlives its original prophet. Once Trump kicks it, does the cult undergo a transition to a full blown religion? Or, does it fizzle out without it’s original charismatic leader?


  • That actually sounds like a reasonable response. Driving assist means that a human is supposed to be attentive to take control. If the system detects a situation where it’s unable to make a good decision, dumping that decision on the human in control seems like the closest they have to a “fail safe” option. Of course, there should probably also be an understanding that people are stupid and will almost certainly have stopped paying attention a long time ago. So, maybe a “human take the wheel” followed by a “slam the brakes” if no input is detected in 2-3 seconds. While an emergency stop isn’t always the right choice, it probably beats leaving a several ton metal object hurtling along uncontrolled in nearly every circumstance.





  • Not a specific word or phrase, but Google Dorking is useful for limiting down search results. Just the basics of putting things in double quotes (e.g. “Find this exact text”) and negating words/phrases (e.g. -NotThis) can go a long way in refining search results. The “filetype:” modifier is much less useful than it was a decade or two ago, as SEO assholes have gotten wise to it and so include tags to show up on results using it. The “site:” keyword can be really handy, when you are pretty sure what you want is on a specific site/domain. Or, if you are trawling a website for specific information. You can also negate the “site:” keyword. So, you can add something like “-site:expertsexchange.com” to a search and get rid of useless advertising sites.




  • While I’m all for fresh ideas, one of the advantages to sticking with well known naming is that folks will often look for those things and might end up missing the community, if the name isn’t obvious and easily searchable. While “LFG” does imply that one is looking for a group, rather than maybe just a single other person, it also has a very long history in gaming and is a well known acronym. I suspect a lot of folks are going to specifically look for that acronym when starting their search. So, I’d argue with sticking with that classic.

    That said, it is your community and you should build the identity you want to build. So, don’t let some old curmudgeon like me push you away from doing something that interests you.