Forgot your password?
Close
typodupeerror

Comment 100% offline (Score 1) 180

by kyoko21 (#66284500) Attached to: Reddit Bans 11-Year Account for GPL Game Post, Testing the EU's DSA

I don't play BackGammon but just reading the description on fdroid I fully support this app. The fact you can play this game completely offline without weirdo monetization or needing to phone home or be online is what I'm talking about. Why this post or game should get someone banned is absolutely bananas....

Then again I suppose the "AI" running inside Reddit is jealous that the AI for this game cab be fully offline and not be stuck in a data center and can be out in the world. Albeit it's still playing backgammon but it's doing it freely without any sort of weird digital handcuffs.

Hope he can get his account back.

Submission + - The Most Controversial Firefox Bug (mozilla.org)

Submitted by BrendaEM
BrendaEM writes: Mozilla/Firefox claims to honor and protect privacy, yet it collects data by default. Perhaps it's better than the rest, but with data collection on after installation, Firefox claims of privacy don't ring quite true.

Comment phpinfo (Score 2) 55

by kyoko21 (#66227244) Attached to: Microsoft Can Track Users Via a Windows Device ID

I don't know what kind of website he had visited but back in the day I'd used phpinfo as a simple "helloworld" app to test my nginx/php installs and the amount of information it'd dump out from literally doing nothing is astronomical. Granted, at the same time, you could override various browser/host settings if you had the right browser and you could confuse the heck out whatever server/daemon was running on the other side especially if it was trying to do some matching/filtering of the information it got from browser agent. The road goes both ways.

Comment Not surprised (Score 3, Insightful) 28

by kyoko21 (#66227218) Attached to: China's DeepSeek Developing Its Own AI Chip

Given that they have optimized the crap out of the software they probably feel like they have done everything short of going assembly. But if you're going assembly you might as well just full send and make the hardware itself then you own the assembly.

It will be interesting to see where they go with this.

Submission + - Paint is already peeling in renovated Washington Reflecting Pool after 2 weeks. (cnn.com)

Submitted by fahrbot-bot
fahrbot-bot writes: CNN, Reuters and other sources are reporting that the paint on Washington's newly renovated Lincoln Memorial Reflecting Pool on Thursday was peeling away from the bottom and into the algae-tinted water, less than two weeks after announcement of the job's completion. The historic pool was drained and refinished in a $14.7 million no-bid contract.

Tim Auerhahn, a pool infrastructure expert and the chairman of the Aquatic Council, said it’s difficult to tell from the videos what was causing the “apparent delamination.”

“A coating system can fail for several reasons, including substrate preparation, surface contamination, application conditions, adhesion issues, product selection, mechanical damage, environmental exposure, or a combination of factors,” Auerhahn said.

The larger question, he added, is whether this represents a localized issue in that part of the pool or a larger, more systemic issue with the coating. “If the coating is losing adhesion in multiple locations, that could indicate a more significant concern,” he said.

Submission + - CISA Admin Leaked AWS GovCloud Keys on Github (krebsonsecurity.com)

Submitted by ArchieBunker
ArchieBunker writes: Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.

On May 15, KrebsOnSecurity heard from Guillaume Valadon, a researcher with the security firm GitGuardian. Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures. Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive.

The GitHub repository that Valadon flagged was named “Private-CISA,” and it harbored a vast number of internal CISA/DHS credentials and files, including cloud keys, tokens, plaintext passwords, logs and other sensitive CISA assets.

Valadon said the exposed CISA credentials represent a textbook example of poor security hygiene, noting that the commit logs in the offending GitHub account show that the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories.

“Passwords stored in plain text in a csv, backups in git, explicit commands to disable GitHub secrets detection feature,” Valadon wrote in an email. “I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I’ve witnessed in my career. It is obviously an individual’s mistake, but I believe that it might reveal internal practices.”

One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers. Another file exposed in their public GitHub repository — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems. According to Caturegli, those systems included one called “LZ-DSO,” which appears short for “Landing Zone DevSecOps,” the agency’s secure code development environment.

Philippe Caturegli, founder of the security consultancy Seralys, said he tested the AWS keys only to see whether they were still valid and to determine which internal systems the exposed accounts could access. Caturegli said the GitHub account that exposed the CISA secrets exhibits a pattern consistent with an individual operator using the repository as a working scratchpad or synchronization mechanism rather than a curated project repository.

“The use of both a CISA-associated email address and a personal email address suggests the repository may have been used across differently configured environments,” Caturegli observed. “The available Git metadata alone does not prove which endpoint or device was used.”

Caturegli said he validated that the exposed credentials could authenticate to three AWS GovCloud accounts at a high privilege level. He said the archive also includes plain text credentials to CISA’s internal “artifactory” — essentially a repository of all the code packages they are using to build software — and that this would represent a juicy target for malicious attackers looking for ways to maintain a persistent foothold in CISA systems.

“That would be a prime place to move laterally,” he said. “Backdoor in some software packages, and every time they build something new they deploy your backdoor left and right.”

In response to questions, a spokesperson for CISA said the agency is aware of the reported exposure and is continuing to investigate the situation.

“Currently, there is no indication that any sensitive data was compromised as a result of this incident,” the CISA spokesperson wrote. “While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”

A review of the GitHub account and its exposed passwords show the “Private CISA” repository was maintained by an employee of Nightwing, a government contractor based in Dulles, Va. Nightwing declined to comment, directing inquiries to CISA.

CISA has not responded to questions about the potential duration of the data exposure, but Caturegli said the Private CISA repository was created on November 13, 2025. The contractor’s GitHub account was created back in September 2018.

The GitHub account that included the Private CISA repo was taken offline shortly after both KrebsOnSecurity and Seralys notified CISA about the exposure. But Caturegli said the exposed AWS keys inexplicably continued to remain valid for another 48 hours.

CISA is currently operating with only a fraction of its normal budget and staffing levels. The agency has lost nearly a third of its workforce since the beginning of the second Trump administration, which forced a series of early retirements, buyouts, and resignations across the agency’s various divisions.

The now-defunct Private CISA repo showed the contractor also used easily-guessed passwords for a number of internal resources; for example, many of the credentials used a password consisting of each platform’s name followed by the current year. Caturegli said such practices would constitute a serious security threat for any organization even if those credentials were never exposed externally, noting that threat actors often use key credentials exposed on the internal network to expand their reach after establishing initial access to a targeted system.

“What I suspect happened is [the CISA contractor] was using this GitHub to synchronize files between a work laptop and a home computer, because he has regularly committed to this repo since November 2025,” Caturegli said. “This would be an embarrassing leak for any company, but it’s even more so in this case because it’s CISA.”

Submission + - Norwegian Consumer Council Targets 'Enshittification' (forbrukerradet.no) 1

Submitted by DeanonymizedCoward
DeanonymizedCoward writes: The Norwegian Consumer Council, an independent, governmentally funded organization that advocates for consumer’s rights, has released a report addressing the trends of 'enshittification' in consumer goods and services and laying out some steps consumers can take to buck the trends.

"It should be easy for consumers to make sustainable choices every day. Consumers have the right to be protected against exploitation – both financially and digitally. To ensure this, we work to provide easy access to information, enforceable rights, and sufficient redress options when something goes wrong," says the organization.

They have also released a YouTube video making light of the matter,

Slashdot Top Deals

Whenever a system becomes completely defined, some damn fool discovers something which either abolishes the system or expands it beyond recognition.

Close