Just a lvl 27 guy from 🇫🇮 Finland. Full-stack web developer and Scrum Master by trade, but more into server-side programming, networking, and sysadmin stuff.

During the summer, I love trekking, camping, and going on long hiking adventures. Also somewhat of an avgeek and a huge Lego fanatic.

  • 0 Posts
  • 11 Comments
Joined 2 years ago
cake
Cake day: June 20th, 2023

help-circle
  • Providing expiration notification emails means that we have to retain millions of email addresses connected to issuance records. As an organization that values privacy, removing this requirement is important to us.

    I fully support the privacy argument (I didn’t realize it has been mandatory to give some emai address to get a cert) but why not make it optional instead?

    The reminder email from them has saved me once when originally “temporary” domain was not so temporary after all and I forgot to set up auto-renewal and monitoring for it.







  • The website (Telegram in this case, but can be any website) adds a specifically crafted text to the clipboard and then tricks the user into pasting that text into the Windows Run dialog, which can be used to execute any command(s), basically like a command prompt.

    The text the attacker places in the clipboard is actually a command to download and execute an executable file from the internet, giving the attacker remote access to the system or whatever the payload happens to be.

    It’s a pretty clever trick. Perhaps MS should consider adding a warning before allowing pasting into the Run dialog or cmd for the first time. They already have this in the Edge browser console.