Email or username:

Password:

Forgot your password?
Security Writer :verified: :donor:'s posts Back to profile
6 posts total
Security Writer :verified: :donor:

I’ll say it again for those at the back:

An ad-blocker is a security tool.

26 October at 8:14 | Open on infosec.exchange
Security Writer :verified: :donor:

Do you route your internal traffic through your firewall rules and policies?

If not, you are assuming a LOT of things about a LOT of things :)

27 Jun 2023 at 7:26 | Open on infosec.exchange
Security Writer :verified: :donor:

Further to this, do you have all of the IPs, Ports, and FQDNs for applications within your environment set as firewall rules?

:)

27 Jun 2023 at 10:30 | Open on infosec.exchange
Security Writer :verified: :donor:

You should check how many old versions of applications you have in your application whitelist.

They got patched for a reason, yet my money says that they’re still whitelisted.

🙂

Just bringing you your weekly dose of nightmare fuel, don’t mind me.

20 Jun 2023 at 16:23 | Open on infosec.exchange
Security Writer :verified: :donor:

Using websites in 2023 without an Ad blocker is like wrestling an octopus. Entirely unusable.

From an accessibility standpoint I fail to see how it’s not illegal. So many things steal focus from assistive technologies.

I challenge you to spend a day trying to use the web without seeing what’s on the screen, with only what your OS provides. And no ad blocker.

Or with only voice controls, or any other assistive tech. If more organisations did this, they’d soon see how actively hostile they’re being to those with accessibility needs.

Accessibility should be part of the design, testing, QA, and UAT for your website or product.

And don’t give me “but how do smaller organisations manage that?” - if this were law, within 6 months you could get off the shelf themes for WordPress or Wix or Bootstrap that manage it all for you.

It’s not a technical problem. It’s political will.

Using websites in 2023 without an Ad blocker is like wrestling an octopus. Entirely unusable.

From an accessibility standpoint I fail to see how it’s not illegal. So many things steal focus from assistive technologies.

I challenge you to spend a day trying to use the web without seeing what’s on the screen, with only what your OS provides. And no ad blocker.

1 Jun 2023 at 8:26 | Open on infosec.exchange
Simon Zerafa :donor: :verified:

@SecurityWriter

I don't need to try. The PC's in work don't have a proper content filter installed.

YouTube is almost unusable 🫤🤷‍♂️

1 Jun 2023 at 8:32 | Open on infosec.exchange
BoneHouseWasps 🔶

@SecurityWriter There was a time when the www was useless - slow, unwieldy, very little genuinely useful content. We used to joke that 'ISDN' stood for 'it still does nothing'. And slowly, we've let ourselves get back there. I despair.

1 Jun 2023 at 9:35 | Open on mastodon.social
Security Writer :verified: :donor:

Requiring website visitors to disable 500 categories of cookies to use your site without being tracked (where your choices actually work) shouldn’t be any more legal than automatically opting them is. Pass it on.

THEN after selection using dark patterns, weasel wording, and button colouring/positioning to get users to accidentally undo those settings, should also illegal.

If you’re using those plug-ins or went to the effort of making your own do this, I’m just not going to use your site - but my browser doesn’t save cookies anyway.

Requiring website visitors to disable 500 categories of cookies to use your site without being tracked (where your choices actually work) shouldn’t be any more legal than automatically opting them is. Pass it on.

THEN after selection using dark patterns, weasel wording, and button colouring/positioning to get users to accidentally undo those settings, should also illegal.

7 May 2023 at 8:23 | Open on infosec.exchange
Security Writer :verified: :donor:

Huge accessibility wall here, too. You’re coercing by fatigue those that can’t quickly make the selections many of us can.

“If you just relinquish your privacy and press accept all, you can use our site 10 minutes quicker”

Why 10 minutes? I watched someone with mobility issues try to use some popular sites only to get caught out on the confirmation dialog and it made me want to put a rag in a bottle and march down to the site’s headquarters myself.

Yes, I’m aware of assistive tech that helps with this, but out of the box accessibility is a thing. Do it.

Pass it on.

Huge accessibility wall here, too. You’re coercing by fatigue those that can’t quickly make the selections many of us can.

“If you just relinquish your privacy and press accept all, you can use our site 10 minutes quicker”

Why 10 minutes? I watched someone with mobility issues try to use some popular sites only to get caught out on the confirmation dialog and it made me want to put a rag in a bottle and march down to the site’s headquarters myself.

7 May 2023 at 8:23 | Open on infosec.exchange
Security Writer :verified: :donor:

We have one client which we manage an Azure tenant for. They require, and have specified, a zero-tolerance for device non-compliance.

In roughly two hours, 1647 devices are about to be locked out of access to organisation resources, wiped, and removed from Intune permanently.

4 meetings, 124 emails, and two phone calls a day for the last 14 days have warned them of this.

We’ve been *very* clear about what is about to happen for the last 13 months. Their internal management have *acknowledged* what is about to happen. But still, time marches on.

Death by middle-management.

🍿

We have one client which we manage an Azure tenant for. They require, and have specified, a zero-tolerance for device non-compliance.

In roughly two hours, 1647 devices are about to be locked out of access to organisation resources, wiped, and removed from Intune permanently.

4 meetings, 124 emails, and two phone calls a day for the last 14 days have warned them of this.

30 Jan 2023 at 10:01 | Open on infosec.exchange
Security Writer :verified: :donor:

Well, there’s movement on the ground following our final warning. Finance appears to have approved the spend, I’m waiting for the “how soon can you get this done?” email.

Certainly not today, friendo, if that’s what you were hoping.

For anyone wondering why we don’t just lift the compliance restrictions, we don’t specify it. Their Compliance department does, and as it’s a large company and the affected users are less than 25% of overall workforce… no exception will be made. One side of the org is going b-a-n-a-n-a-s and the other is taking a very parental “well you should have thought about that” tone.

You kinda have to admire their commitment to the cause.

Well, there’s movement on the ground following our final warning. Finance appears to have approved the spend, I’m waiting for the “how soon can you get this done?” email.

Certainly not today, friendo, if that’s what you were hoping.

For anyone wondering why we don’t just lift the compliance restrictions, we don’t specify it. Their Compliance department does, and as it’s a large company and the affected users are less than 25% of overall workforce… no exception will be made. One side of the org is...

30 Jan 2023 at 11:27 | Open on infosec.exchange
Go Up