sylver_dragon

So, classic “do more with less”. But with a side of “let’s enshitify our products”.

As excited as I am for this, it’ll be a while before I can get back to Valheim. My wife and I finished our last run, defeating The Emerald Flame in Ashlands, a couple months back and we’re not ready to deal with the Mistlands and Ashlands again quite yet. We also just enjoy the early game enough that we’d usually rather re-roll to experience the new content than continue an old world.

I’m also going to be curious to see what, if any changes and tweaks happen to the game with it officially released. In our last playthrough, the Mistlands still suffered from issues dealing with enemies which were slightly off-plane. A situation you cannot avoid in Mistalnds. Also, the particle effects and screen shake for magic were way over-done. Casters basically blind everyone else, but the magic is so incredibly invaluable that someone needs to do it, especially in Ashlands. I don’t know how you’re supposed to deal with the forts without it. Between spawn rates turned up to “yes” and melee weapons which have all the stopping power of a limp dick, the only reliable solution we found was yeeting a couple trolls into the fort with a batch of vines setup to hold the breach.

I’m also curious about support for mods. It makes sense that they didn’t want to put time into support during early access, but that’s now over. We basically don’t play without the Mass Farming mod and the Better Wisps mod. The former is just a tedium reduction mod and the later strikes a nice balance (for us) between keeping the mists and actually being able to find anything in the mists. The hunt for black cores is tedious enough without being able to see any further than my own feet.

Several of my co-workers got upgraded laptops recently. Teams (yup, Microslop’s own product) has been an absolute disaster on those systems. Cameras not working. Sound or Mic cutting out. Even chat just fucks off from time to time.

I get that software is complex and hard. Operating systems even more so. But, if you’re charging hundreds of dollars for a product, you ought to have done some QA.

I daily drive Windows 11 for work. I’m so glad I upgraded by personal system to Linux.

Even when a company is doing things pretty well with a VPN, all it takes is one mistake and the cat is out of the bag. At one of my previous employers, we had a fairly good setup with VPNs using single sign on via our IdM provider. IdM enforced SSO and the VPN had a number of policies setup which kept good control over what users could login. And then someone had the brilliant idea to take an old VPN appliance, reset it to factory defaults and configure it just enough to work on our network and then hung it out on the internet for some sort of test (our configuration management left a lot to be desired). Of course, that led to it being left there for a couple months and an attacker finally found it. They also had a valid username/password combination which got them in the door.

Security is hard and often expensive. But still, compared to “we put out OT devices on the internet” a basic VPN is a huge step up.

Sadly yes, this is exactly what happens. And it ends up being IT holding the bag at the end, with the managers having long since cashed out their stock options and left.

The hacks target internet-facing programmable logic controllers (PLCs)

Why the fuck
is your PLC
facing the fucking internet!

Jesus Zombie Christ an a pogo stick. Has no one been paying attention for the last two decades? Seriously, we learned this sort of lesson in Two Thousand and fucking Three. Your critical assets do not get public IP addresses.

I’m getting a red motherboard light for CPU

Is it flashing, or just solid? Some Motherboards use LEDs to provide a trouble code, this will be a specific sequence of flashes which detail what the problem is. Look at your motherboard manual and see if it has anything about the light and what it might be telling you.

Also, is the system beeping at all? System beeps are a really old method for giving trouble codes. If it is beeping at you, again refer to your manual to figure out what the beeps are telling you.

If you have someone around who can loan you a PSU, that would be an easy test to run. Even if the PSU is underpowered for your GPU, the system should at least POST and let you get into the BIOS.

Once you get it booting, the failure under load could be a couple of issues. It could obviously be the PSU and that is the root of everything. But, there are several things which might be worth checking. Specifically, I’d check the thermal paste on the CPU and GPU. If you’ve done any work on either recently, it’s possible that you got a bad application. That stuff also wears out. My wife’s system had a similar crash under load which turned out to be the GPU overheating. That was caused by old thermal paste not working well. Replaced the paste and she got another year out of that card.

While I’m glad these guys are going to jail, this does go to show that one should not use Windows if they care about OPSEC.

Not surprising. Web search from the Start Menu was always a bad idea.

Hell, I’ve had to deal with users getting their systems compromised because of this idiocy. User typed ‘ms teams’ in the start menu, clicked on the first link and ended up at an attacker’s page which mimicked the official Teams download page. User clicked “Download”, received the trojaned .msi file and ran it.

Sure, there’s some blame to go around in that case (and we finally got some default configuration changes out of it), but the fact that Microslop’s greed led to a malvertising link showing up in a user’s Start Menu is indicative of everything wrong with Windows 11.

All of the above.

Is it that ISPs are being paid by tech-bros to assign them these IPs?

Bullet Proof Hosting is a thing. Some ISPs basically advertise to criminals about their ability to evade take down orders and unwillingness to work with law enforcement. So, some infrastructure ends up on these devices. However, the IP ranges from these services often get discovered and are added to public reputation and block lists.

Along side this, cloud providers are pretty bad about policing their networks. On my own home server, I have blocked much of the Digital Ocean IP space, as it’s home to a lot of scanners, bots and other malicious traffic.

Is it that residential devices have been hacked /contain malware that does this?

This happens, a lot. The Mirai Botnet thrived on compromised home routers. People are pretty bad at updating their devices and many SOHO routers ship with some pretty bad vulnerabilities. It’s only a matter of time until someone finds an unpatched or misconfigured router and adds it to a botnet. People also get phished or install trojans all the time, adding to botnets. Darknet Diaries just had a fantastic episode on the Bayrob malware, part of which was turning infected machines into a custom botnet.

Is it trivial for companies to assign themselves residential IPs?

Some ISPs just look the other way when they get reports of malicious activity on their network. Also, attackers can force a DHCP refresh and just get a new IP when the old one seems blocked. Getting one in the first place is often as simple as signing up for service and/or compromising someone’s home PC and using it as a relay.

Paid volunteers are doing this for AI companies?

This probably happens. Afterall, we’ve already seen a company selling an AI product which was just workers in India.

Obviously this is a problem because one can rotate / cycle through residential IPs and if I aggressively block each offender in my logs permanently, then the next person assigned this IP who may be a legitimate user will be unable to access my site.

Look into Fail2Ban. This program monitors your logs and will ban IPs automatically based on criteria you set. This can include specific HTTP requests in your web logs. The ban can be permanent or can be time limited. For example, I have a container running in a cloud provider which I use to proxy requests through my ISP’s CGNAT setup. There is an NGinx reverse proxy running there and I have fail2ban watching the access log. If certain request strings are seen, the sending IP gets dumped in a permanent jail. I also have it scanning the sshd logs and banning IPs which fail to login 3 times within a short period.

It’s far from a silver bullet, but it’s something which should be running on any web facing system. Attackers will always be rattling the door knobs. There is no reason to let them keep rattling away.

I have trouble feeling sympathy for any company which didn’t greet the Broadcom buyout of VMWare with a firm plan to migrate. Expecting anything other than “abusive conduct” out of Broadcom is like expecting to jump in the ocean and not get wet.

Edge is just Chrome with a Microslop skin. They went from crushing Netscape so hard it got open sourced (mostly via monopoly shenanigans) to copying Google’s homework. And their attempts at mobile anything has been failure (Windows CE) after failure (Windows Phone) after failure (Windows for ARM).

If it weren’t for Office and companies’ undying love of Active Directory and Exchange, Microslop would be a memory and little more.

LLMs are a tool. Like all tools, we are going to go though a learning curve as we adapt to safe usage of that tool. LLMs cratering companies would be a really tame way to learn those lessons. Usually, we don’t start writing regulations around tools until we have buckets of blood to write those regulations with.

I still break out the old Sierra games (specifically the Quest for Glory series) from time to time. Those are still a lot of fun and ScummVM makes them run damn near perfectly.

Most non-indie stuff is complete and utter trash.

Ya, it’s telling that some of my favorite games these days all started as indie games. I do worry about them as they get in bed with larger producers, but I also understand the draw. E.g. I still love Valheim, but they were Embracer’d by private equity. And I’m waiting for that relationship to push them to shit all over their players. Though I understand that publisher backing lets them focus more on development and less on the marketing and distribution of the game.

So now I expect it will be just a patronising nostalgia IP reboot fest designed to extract as much cash as possible.

Ya, this is one of the big turn-offs for me. For example, I really liked Prince of Persia: Sands of Time back in the day. I’ve got exactly zero interest in the remake. Ubisoft’s logo now looking like a neat pile of dogshit, viewed from above, is pretty apt.

I think it’s pretty telling that so many of the people they talk to and a lot of the focus of the article isn’t really about older gamers, it’s about their money.

The opportunity is substantial. The 40+ segment in the US is on track to grow from $19 billion in 2022 to $43 billion by 2030, a 132% expansion at a moment when the rest of the industry is shrinking. These are players with the most disposable income, the longest gaming literacy, and the highest brand loyalty.

I’m in that “40+ segment” and I suspect part of the “problem” these companies face is that older gamers have seen the enshitification of so many of the brands we love. Our tolerance for bullshit is basically gone at this point. Micro transactions, season passes, fucking ads in games, all of that bullshit is a quick way to not get our money.

I also suspect “brand loyalty” is basically gone for the same reason. As a kid, I looked for the Electronic Arts logo. If I saw this logo on a game package, I knew I was looking at a good game. I haven’t bought an EA game in years. I don’t expect to buy an EA game any time soon and I basically ignore everything they do. Sure, if a trailer for Starflight 3 dropped, I’d sit up and take notice. I’d also expect it to be an enshitified mess wearing the skin of a beloved series to sucker me in, before pouncing on my wallet.

So ya, maybe just make good games and older gamers will inevitably buy them. I mean, Larian can pretty much say, “hi we’re making…” and I’ll have my wallet out and be pulling bills before they get any further. And maybe that’s your “brand loyalty”. Game companies who make good games and aren’t private equity firms wearing the dead skin suits of brands we used to love.

My company has let us get Enterprise Copilot and has been pushing us all to “use AI”. So, I now use it as a a semi-functional search for SharePoint/Outlook/Files on an almost daily basis. I also ask it questions about Microsoft documentation on a regular basis. I wonder how long it’s going to be until they yank my license.

Answer #1: Someone gutted CISA’s budget. We’re not naming names here, but perhaps a branch of government with the “Power of the Purse” could figure out how to fund the organization properly.
Answer #2: Maybe don’t fire the people who actually make the organization work, just because they aren’t political hacks.
Answer #3: Cyber security is hard and it takes skilled people. Laying off large swaths of the staff isn’t conducive to good cyber security and leads to the remaining people taking short cuts which they shouldn’t. And a robust cybersecurity program has a batter chance to catch and correct these shortcuts before someone else finds them.

Of course, this would require the MAGAts in Congress to unwrap their collective mouths from Trump’s cock long enough to tell him to stop gutting critical government operations. Something we know isn’t going to happen. And given recent Primary results, is only going to get worse.