> if the org-admins have approved the OAuth application and are able to send mail from within the organisation - then it's probably game over anyway
In my case the email came through due to a “bad” DMARC configuration so they were able to spoof our domain from an external server and the OAuth app in question had our company’s name on it.
And on a personal front, I was busy that morning and didn’t pay enough attention to the permissions being requested by the app before I clicked “allow”. So it was a failure of both systems and people controls.
My new rule is that if I get an email asking me to do any sort of action, automated or not, I’m going to sit on it for 1-24 hours before doing anything about it. If it’s actually urgent then someone will get ahold of me through some other method than email.
Agreed. However some service providers (like GitHub) allow a user with admin access to approve any OAuth app the first time it’s “launched” if they are the ones initiating the request, rather than using a pre-defined allowlist approach which I believe is what Office 365 does.
My wish would be for some sort of multi-person approval process rather than allowing anyone who is an admin to authorize an app. Even admins can be susceptible to a targeted and advanced attack.
Also, many people (like myself before my own “failure”) simply aren’t aware of OAuth apps as a serious attack vector. Most remedial training around phishing campaigns covers things like fake login pages but not “An attacker has spoofed an internal domain and an OAuth app with your company’s name in it”.
I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques.
The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material.
It was very sophisticated and I’m glad I fell for it during a simulation rather than in a “real life” situation. It was a learning experience and a situation I’m way more paranoid about now. I could easily see admins and developers anywhere falling for it if they were specifically targeted.
> His retirement had not brought the contentment it had promised, and no number of visits from his children could dispel his loneliness. He had little in the way of a social circle
This is actually a concern of mine regarding retirement and part of the reason I tell people that I will likely never retire. A large number of my social interactions are through work, and I feel if I didn’t have something “productive” to do I would be pretty listless and depressed.
I get wanting to enjoy leisure time and hobbies, etc, but there is something rewarding about doing work that you enjoy that is different for me.
Too true. Intellectual bullying can be insidious and is often overlooked because it doesn’t come with physical scars and bruises. Some of the worst bosses and coworkers I’ve encountered were those whose mentally abusive and toxic behavior was enabled or ignored simply because they were “intelligent” or technically indispensable.
Can you elaborate a bit more on what bothers you about Go? “It’s not Python” could encompass a lot of things.
Personally, I use both languages (as well as Java and C#) and find they do really well for different tasks. If I need a binary command-line tool that I can ship off fairly easily I turn to Go. If I need to quickly parse some text files, bang out a quick HTTP client script, or automate some AWS tasks, I’ll go with Python.
This is my concern, as well. We have some people at my place of work saying, “Working from home has been great! I’ve never been more effective and happy at my job.”, and then we have a smaller but more vocal group that says, “I hate working from home and it’s incredibly stressful. I want to go back ASAP.” I worry that the second group will “win” and the pendulum will swing the other way because of the latter group’s experience.
What we should really be aiming for is flexibility. Some people can be in the office, some can stay remote.
Personally, I dislike being in an office every day, but even more than that I hate the commute. If my manager forces me back, I’ll probably quit and look for a job/company that plans to allow remote work permanently. I’m trying to remain hopeful, however.
Portland State is actually on a quarter system, so you'd need to multiple those values by 3 or 4 (depending on if you include the Summer quarter or not).
While I think this project and the data are interesting, one thing that becomes problematic is that you actually DO have to invest time in whatever courses you register for at most colleges and universities (or at least the ones that I've seen).
Generally, if you aren't making adequate progress in a course, you can be dropped by the instructor mid-semester/quarter or placed on academic probation, both of which can cause you to fall below the minimum number of credits needed to be eligible for healthcare coverage.
So while you may save some money on health insurance, you lose a potentially large amount of time due to having to keep up with coursework to maintain eligibility.
That being said, this may not be a problem if they are courses you are actually interested in and can dedicate time to completing.
I love asking for help in channels because I feel like it socializes the answer and process for finding it much better than a DM does. It also helps build trust within the team because someone can see a “stupid” question get asked and then answered and then also feel comfortable asking questions like that.
That being said, I have worked for some shitty bosses who have told me not to post questions and information in channels directly because they want them “vetted” first. I’ll never work for someone like that ever again.
As a parent myself who is guilty of this from time to time, I think it’s easy to judge those moments without seeing the full picture. Nowadays parents are expected to attend to kids basically 24/7 and keep them engaged, etc,. Just because you saw that happen at breakfast doesn’t mean it was happening all day, every day. Maybe they were out visiting museums or nature parks for the rest of the day.
There are mornings when you just want a quiet breakfast while you’re on vacation without an embarrassing meltdown happening and, for better or worse, the most effective way to accomplish that is by giving your kid a movie or show to watch on the iPad for 30 minutes while you eat.
Not sure if this is true in all states, but in mine getting fired for cause disqualifies you from receiving unemployment. You have to be laid off/terminated by no fault of your own.
My wife’s business had to shut down due to COVID-19 in early April. We filed for unemployment through PUA at that time and have yet to hear ANYTHING other than “your claim was accepted and we are processing it”. On top of that, the phone lines are totally backed up.
We’re extremely fortunate because my income covers our monthly expenses, but it was a huge financial blow for us and we are conserving cash like crazy. I can’t even imagine someone who lost all their family income going through the same thing.
- I bought an Apple Watch through them that was the cellular version. There was some activation error with the carrier when we tried to set it up, and rather than the employee I was working with shrugging it off and saying, “Sorry, you have to call the carrier”, they handled it all for me and got it fixed before I left the store.
- I bought a Logitech mouse. It was having issues with the cursor stuttering. I went to return it, they went though the process in store of updating the firmware to make sure it was a hardware issue, and then they gave me a full refund and recommended another mouse (which I still have and love).
I've commented here a few times that Best Buy really has turned itself around and now offers a great shopping experience. I have a location nearby and every time I go in to buy something the employees are super helpful and knowledgeable. They also have a decent selection and can usually have a pickup item ready in less than an hour. Additionally, they will price match with Amazon on most things.
I'll choose them over Amazon any time if they have the item that I need (which they typically do).
I also have some eczema/dry skin problems and one thing that I've found helps is not showering every single day. I used to shower once (or sometimes twice) a day, and it made the skin on my elbows and knees extremely tight, dry, and itchy. I now shower every other day (I still use deodorant and change my clothes) and haven't had nearly as many issues. That being said, I am fortunate because I don't have a lot of body odor and I don't sweat very much, so I can reasonably get away with not having a daily shower.
I'm in the same boat as you. I don't totally get the push to retire early. In fact, I don't think I'll ever retire if I can continue working and doing something that I enjoy. I have colleagues who dream of spending their days on a golf course or doing projects around the house. That sounds like a horribly boring life, to me. I'd love to be able to keep working at and solving technical problems until I die. That, and I think my spouse and I would hate each other if we had to spend every moment together. We love each other dearly but also appreciate our time away from each other.
The challenge is that even having a strategy fails when you’re in a vulnerable place and someone comes along and says and does all of the “right” things.
Many people are deeply lonely and will do and believe anything someone says if that someone is offering love and affection.
In my case the email came through due to a “bad” DMARC configuration so they were able to spoof our domain from an external server and the OAuth app in question had our company’s name on it.
And on a personal front, I was busy that morning and didn’t pay enough attention to the permissions being requested by the app before I clicked “allow”. So it was a failure of both systems and people controls.
My new rule is that if I get an email asking me to do any sort of action, automated or not, I’m going to sit on it for 1-24 hours before doing anything about it. If it’s actually urgent then someone will get ahold of me through some other method than email.