• 0 Posts
  • 93 Comments
Joined 3 years ago
cake
Cake day: June 9th, 2023

help-circle


  • I fully agree, there isn’t a good reason. The issue is that flaw is a systemic one in Windows.

    Modern operating systems should be operating under zero trust. The fact that Windows still operates on Intranet Era logic, where if a file is reachable, it’s probably safe, is exactly why these exploits keep happening.

    The problem comes down to a Windows API called ShellExecute. When an application like Notepad passes a link to this API, it is effectively saying to the OS, The user wants to open this, figure out how to run it.

    Windows looks at it and essentially says, Oh, it’s an .exe on a network share? The user must want to run that software, launch it, rather than, This is executable code from a network location I don’t control, download it and make the user double-click it themselves.

    The main reason it does this is for legacy enterprise convenience. Decades ago Microsoft designed Windows so that companies could put internal tools on a shared drive and employees could run them instantly. They prioritised seamlessness over security by assuming the network perimeter was the security boundary, and everything on it was there because they wanted it to be.

    Obviously that assumption is dangerous. Like you said, no remote executable should ever be treated as trusted by default, regardless of whether it came from the Store, an SMB share, or a web link. The action of clicking a link should never map directly to execution of code. It should map to retrieval of data. Microsoft basically turned a convenience feature into a permanent vulnerability.


  • Yeah I get your thought process, but the second vulnerability is actually just how Windows is designed to work. When Notepad follows a link, it isn’t opening a web page, it’s passing a command directly to the OS shell.

    Because Notepad is a trusted native application, it bypasses many of the security checks that a browser has.

    If the link uses the file:// protocol to point to an .exe on a remote server, or ms-appinstaller to trigger an install, the OS treats that as a direct instruction to launch that software, so it can trigger an app installation prompt or, depending on the exploit, silently side-load malicious packages.








  • Kids mess with those ants when they’re 5 and are fine. Sure it hurts but not really different to a bee.

    The only one I’d say the average Australian has above average exposure to is jellyfish, assuming they go to the beach even semi regularly. But I mean, they just float around, they aren’t coming for you on the attack.

    Spiders there’s only 2-3 anyone actually worries about, they’re rarely seen and even more rarely bite anyone. Same for snakes. You also won’t die even if you do get bit unless you can’t make it to a hospital/contact help for a very long time.

    Crocodiles are barely a concern outside select areas (eg think whether the average American would be concerned about alligators at all).

    Kangaroos can theoretically attack but generally want to keep to themselves. But also to give you an idea how much of a non issue they are there are zoos that don’t even have them in pens, they just roam around with the people.

    Edit: one thing I probably didn’t make clear, the average Australian probably does see a high amount of spiders, what I meant is the average Australian doesn’t typically see the actually dangerous spiders. I’ve seen them maybe 2-3 times in almost 40 years.


  • Do games count? I got scammed on runescape out of a 50mil item which was a lot at the time (this was sometime around 2003-2005). 50-100 hours of time for me to get it at an estimate. It was a stupid mistake that I thought I was smart enough to avoid, with what I now recognise as classic signs of a scam (slightly too good to be true, moving goal posts, slightly odd but not entirely unreasonable requests, time sensitive). But I can tell you I’m glad I got scammed young on a game, because it was a good lesson with very low actual harm (only time lost realistically) and made me WAY more wary of things.




  • IF there was some reason, first of all, God could give us the ability to understand if he wanted to, as he is not supposed to be limited. Second, it would imply someone is getting something from it, God, us, or otherwise, that for some reason, God can’t give in a way that doesn’t involve evil. But again, if he is never limited, that shouldn’t be the case.

    Also, if cancer and other diseases are supposed to exist and kill people for some kind of purpose we don’t understand, why do we have the ability to treat, vaccinate and cure those same diseases? If medicine gets to the point of preventing every ailment, then why does that “oh so important” reason for it existing not matter anymore? It would seem if these things NEED to exist, we shouldn’t be able to prevent them from happening under any circumstances.