I happen to be a prime example of how bad US Rail is this week. I’m taking my son from near Fredericksburg (the real one), up to Ballston for a summer camp. We have a couple options:

1. Drive

• Distance: ~70 miles one way, ~140 round trip
• Time: 1 hour and 45 minutes one way, with traffic. ~3.5 hours round trip.
• Cost:
  • 4 gallons (US) of gas @ $3.50/gal: $14
  • Wear and tear: estimate at 0.5 gas cost: $7
  • Parking: $11
  • Total: $32/day

2. Virginia Railway Express (VRE) and Washington Area Metro (WMATA)

• Distance: N/A
• Time:
  • Drive to Fredericksburg station: 20 minutes
  • VRE (Fredericksburg to L’Enfant station) - 1 hour 20 minutes
  • WMATA (L’Enfant to Ballston) - 20 minutes
  • Total: 2 hours one way, 4 hours round trip
• Cost:
  • Drive: we’ll just ignore this, it’s close enough to zero.
  • VRE: $23.56/person * 2 people: $47.12
  • WMATA: $3.45/person * 2 people: $6.90
  • Total: $54.02/day

So, for the low, low cost of about 1.68 times the cost of driving, we can take slightly longer to get to our destination and have zero control over our schedule, which makes the actual time devoted to travel considerably longer. We tried the public transit route last year, and it meant leaving earlier in the morning (about 30 minutes) to catch a train to get us there on time, and getting us home around 45 minutes later. And this is right around the US Capitol, which has some of the better transit options. Needless to say, we’re driving this year.

I really want to be able to take transit, but it’s basically dead in the US. Earlier this year, I needed to go to Boston for work. Catching a train from Washington, DC to Boston meant an 7 hour train ride (using the “high speed” Acela line) at ~$500 round trip. Flying was 1.5 hours and cost ~$300 round trip. Wanna guess which option I used?

Basically, all of the incentives are stacked against transit options in the US. Except within certain metro areas, driving or flying is always cheaper and faster. Yes, inside those metro areas, public transit can be great. I used to work in Washington, DC and used the VRE I mentioned earlier to get there and then WMATA or the Capital BikeShare to get to my office. That was great, since I didn’t have to drive into DC every day, which sucks big donkey balls. But it probably wasn’t cost effective and wasn’t really time efficient either.

I have it on good authority that you currently have a project idea which you can use to pick one (or more) of those paths and start learning. ;-)

For example user management in studio3T

Not sure how I missed this on my first read of your post. But, this looks like a fancy front end to making MongoDB calls. That makes life easier, MongoDB has a well documented API and a driver for C#. As an aside, if you want to get really good at PowerShell, getting a basic working knowledge of C# and .Net in general is really helpful. For the lazy (and I always like lazy), there’s even a pre-built MongoDB module on the PowerShell Galley called Mdbc. There is also the Project’s GitHub Page which has a lot of useful info.

Granted, this path likely means learning enough about MongoDB to create/delete/modify users. But you came here expecting a load of homework, right? Also, this is a good excuse to spin up a docker container running MongoDB and go hog wild breaking the fuck out of it (just call it “research” if management asks). And who doesn’t love breaking stuff?

I’d also note that you may be able to get some help along the way by capturing the network traffic to the server caused by the Studio3T GUI. WireShark can capture the traffic to/from the DB server and you can read that to reverse engineer some of the calls you care about. Just, make sure you talk to your security folks before you download/install WireShark. If they are worth their salt, they’ll understand an engineer installing/running wireshark, it just makes their day easier if they know the alert is coming first. Assuming the GUI isn’t complete shit, it may encrypt traffic. This can be dealt with by using the SSLKEYLOGFILE environmental variable. In most cases, this results in the TLS keys being saved to a file and that can be imported into WireShark.

Good luck, and have fun!

How you gonna teach English without being able to teach nouns words which describe people, places or things?

FTFY, you dirty n-word user you.

Theoretically, browsers could even stop from the JS engine from being started for the site in the first place.

The NoScript extension is basically this. Most of the client side stuff is off by default and you can enable it per-domain. It breaks a whole lot of websites, but often in ways where the main content of a website is still readable. Over time, you can build up a list of “allow by default” domains and most of the web you care about works. Though, you may have to spend a moment or two sorting out permissions when you visit a new site.

There are a few options:

1. Use AutoIT or some similar automation framework. Generally, this is pretty easy and gets the job done. Your security folks may hate you (AutoIT binary hashes are basically all assumed to be malware IoCs at this point),
2. Depending on how the GUI works, you may be able to reverse engineer the calls made by the application and just make those calls yourself. For a Web UI, you can use something like BurpeSuite or even just the FireFox developer tools to catch the web calls and then modify/replay those as desired. For a console application, it could be trickier, as you may need to either load the software’s libraries (DLLs) or figure out database calls. It all depends on how the user data is stored and updated.
3. Using P/Invoke you can load several functions from the Win32 API, specifically FindWindowEx and EnumChildWindows to locate the GUI application and any specific form items you want to manipulate (e.g. TextBoxes to fill, Buttons to click). You can then modify properties or send clicks. You’ll probably hate yourself at the end of this project, but you’ll learn a lot.

If you care about your privacy, don’t use products from a company whose entire business model is built on invading your privacy.

That actually sounds like a reasonable response. Driving assist means that a human is supposed to be attentive to take control. If the system detects a situation where it’s unable to make a good decision, dumping that decision on the human in control seems like the closest they have to a “fail safe” option. Of course, there should probably also be an understanding that people are stupid and will almost certainly have stopped paying attention a long time ago. So, maybe a “human take the wheel” followed by a “slam the brakes” if no input is detected in 2-3 seconds. While an emergency stop isn’t always the right choice, it probably beats leaving a several ton metal object hurtling along uncontrolled in nearly every circumstance.

That’s the Preamble to the Declaration of Independence. And for as much as it is a foundational document of the US, it’s also not a legal document.

Violence is always a bad option. Sometimes however, it’s the least bad of the bad options. And knowing when that point has been reached is incredibly hard, and often misjudged.

Reminds me of the tech site from long ago, Experts Exchange. Their website was originally expertsexchange[.]com, and it showed in in google searches fairly regularly (they actually had some reasonable content at the start). Eventually, they added a hyphen.

Not a specific word or phrase, but Google Dorking is useful for limiting down search results. Just the basics of putting things in double quotes (e.g. “Find this exact text”) and negating words/phrases (e.g. -NotThis) can go a long way in refining search results. The “filetype:” modifier is much less useful than it was a decade or two ago, as SEO assholes have gotten wise to it and so include tags to show up on results using it. The “site:” keyword can be really handy, when you are pretty sure what you want is on a specific site/domain. Or, if you are trawling a website for specific information. You can also negate the “site:” keyword. So, you can add something like “-site:expertsexchange.com” to a search and get rid of useless advertising sites.

No fair! You changed the outcome by measuring it.

While I’m all for fresh ideas, one of the advantages to sticking with well known naming is that folks will often look for those things and might end up missing the community, if the name isn’t obvious and easily searchable. While “LFG” does imply that one is looking for a group, rather than maybe just a single other person, it also has a very long history in gaming and is a well known acronym. I suspect a lot of folks are going to specifically look for that acronym when starting their search. So, I’d argue with sticking with that classic.

That said, it is your community and you should build the identity you want to build. So, don’t let some old curmudgeon like me push you away from doing something that interests you.

do any of you hate how self-hosting services like photo- or document-management systems, or even a simple rss tool, forces you to sort your stuff out, and put your decades old files in order?!

What is this “sort” thing you speak of? I don’t sort anything, I have NextCloud syncing my entire photos, videos and documents folders and they are just as messy as ever. Granted, I do go through my photos and videos once a year and dump them in a folder named for the year they were taken. Occasionally, I’ll go hog wild and try to sort some of a year’s photos/videos into folders named after events. Though, that hasn’t happened in a number of years. I setup NextCloud so I could have everything synced to my own server and just forget, not have to deal with labeling my data.

As for bookmarks. I already keep those in folders; but, I don’t sync those. I use my desktop far more than I use my phone for web browsing. And the types of things I use my phone for (mostly recipes), I just keep bookmarked there.

The first issue with running a coin miner is using company resources for your own profit. Your own system, using your own electricity, go for it. Running it on a company owned laptop, while at a company building, burning electricity the company is paying for. Ya, that starts to get uncomfortably close to fraud or theft. There is also that whole, “running unauthorized software on a company system, doing who knows what else in the background.” There is a very real possibility that the coin miner has unknown vulnerabilities which could allow remote code execution; or, just outright be malicious and contain a remote access trojan. Maybe he was smart enough to audit all the code it was using and be very sure that’s not the case. More likely, he just grabbed a random implementation of XMRIG, put his wallet in the config file and ran it. Either way, he also made a point of refusing to remove it, so we escalated up to management. With the recent ransomware outbreak having been in the multi-million dollar (possibly low tens of millions) damage range, refusing to remove unauthorized software went over about as well as a lead balloon. There may have been other factors at play; but, the unauthorized software and being a dick about removing it was what got him out the door.

If you spin it up, fucking own it. When you’re done with it, shut it down. I have long lost count of the number of times I’ve reached out to a team to ask about the coin miner they are running on some random EC2 instance only to find out that some jackass spun it up for a test, gave it a public IP, set the VPC to allow any inbound traffic, installed all kinds of random crap and then never updated it. Nor did it get shutdown when the test ended. So, a year and a half later, when the software was woefully out of date, someone hacked it and spun up a coin miner. Oh, and the jackass who set it up didn’t bother to enable logging or security monitoring. But, they sure as hell needed the ability to spin stuff up on their own. Because working with IT to get it done right would be too hard for their fragile little ego.

You joke, but I’ve actually been responsible for a coder getting shown the door for running a coin miner on his work laptop.

In his defense, cyber security at that company was crap for a long time. After a ransomware outbreak, they started paying attention and brought some folks like myself in to start digging out. This guy missed the easy out of, “hey that’s not mine!” The logs we had were spotty enough that we would have just nuked the laptop and moved on. But no, he had to fight us and insist that he should be allowed to run a coin miner on his work laptop. Management was not amused.

ICE was formed in 2002, following the attacks which destroyed the World Trade Center. Like basically everything the US did in the wake of that attack (e.g. Patriot Act) this has been an absolute disaster and should be rolled back.

I work for a fairly large company, and we’re hearing about “AI” constantly. CoPilot is available and its use encouraged. Also, in the cybersecurity space, AI is fucking everywhere. Vendors won’t shut up about their “AI Enabled” products. And the new hotness is “Agentic AI”, which is basically automation, but we’re going to let AI hallucinations fire off the automated process which could bring production systems down.
Good times are surely coming. /s

ChatCCCPT

So, DeepSeek?