Instead of rethinking whether the identity verification thing was such a good idea, after an entirely predictable data breach involving ~70,000 users, Discord doubled down and made it a requirement, globally, to use some of its core features.
Isn’t it strange that so many governments are suddenly trying to push the Online Safety Act bullshit, under different names, over the last year, and that the Corporate Media are telling us that messaging apps are to blame for what effectively are the social consequences of neoliberalism?
PGP has been around for about 35 years, more or less, and the single reason emails are rarely OpenPGP-encrypted is most people don’t know how to use OpenPGP. To get it right, we need to know what asymmetric encryption is, which algorithms and key sizes to use, how to include the correct key in our email signatures and how to make backups of our private keys. OpenPGP requires effort to use, and most of us invariably choose convenience over security.
Ironically, the Online Safety Act, and the way it was implemented last week, has made the online world decidedly more dangerous, and I need to belatedly share some of my thoughts on it.
Most people who knew about the Online Safety Bill would have been under the impression that it was about censoring harmful content on social media and implementing stronger age verification measures specifically for pornography sites. The idea would be that adults would provide scans of government-issued proof of identity.
The developers of SimpleX Chat are absolute legends! Clearly they’d thought outside the box when designing a messaging platform that combines End-to-End encryption, onion routing and distributed message queues. What makes SimpleX stand out is that the client applications are immediately usable, without any configuration. In fact, it’s even easier to use than WhatsApp.
SimpleX has been around for a couple of years, but I’d only recently learned of it from someone who was also frustrated with the absence of messaging platforms that allow for anonymous communication.
I have a rough idea of why Crowdstrike’s update bricked countless Windows devices around the world, but it’s more important to discuss some reasons why we collectively found ourselves in a situation where a vendor, that most people hadn’t heard of, was allowed to take down so many services people depend on.
Surprisingly my organisation came out relatively unscathed, but not entirely. Restoring our servers and VMs is a trivial job in itself, but most things running on them can’t be taken offline without that quickly cascading into a much bigger problem.
After ensuring I didn’t misunderstand what I read, when I learned about Microsoft’s Co-Pilot Recall thing, I couldn’t help but ask myself the obvious question: ‘Just how the hell could anyone possibly believe it’s a smart idea?’. But I sort of know the answer: It’s because the obsession among corporations with pleasing investors by forcing ‘AI’ onto everything and everyone, whether we like it or not, and regardless of the ramifications.
Recently I was asked to look into changing the authentication method to OAuth 2.0 for an integration service. It’s something I’d done enough times in Azure to know what’s involved: The service would need an app registration, which should provide a client ID and secret, an OAuth token request stage, and modifications to include the token in the Authorization header field of whatever was originally being sent.
After a little digging, it turned out the integration was a simple batch script, running on a Windows server, and it used curl to send data to a third-party service.
Something broke the default TLS/SSL certificate for my primary site (scarbrough.co.uk) the other week, and browsers started flagging it as unsafe, which really didn’t look good. I figure it had something to do with my inadvertently deleting the /wwwroot/.well-known directory and whatever it contained.
Whatever the case, it was something I needed to fix myself, with a quick workaround until I had enough spare time to get a handle on how to generate a valid Let’s Encrypt certificate using Certbot.
One of my Logic Apps originally had just three steps:
HTTP trigger Deserialise HTTP request JSON payload Send objects from the request payload to a Service Bus queue Another Logic App would read the objects from the Service Bus queue, use them to query another source for data, then send a email to whatever address was in the initial request. I used this approach because there could be more requests than a Logic App can handle concurrently, and it made sense, therefore, to queue the requests.
The security configuration of Azure services is a fairly broad subject area, and this is more of an introduction to how it works for a Resource Group, in the context of a Logic App that needs to interact with multiple resources. If a DevOps team, instead of the developers, is managing the security, a considerable amount of time will be spent planning and designing services beforehand, and later trying to figure out which security configurations are preventing the services working.
