«Researchers have found that loneliness takes a physical toll, and is as closely linked to early mortality as smoking up to 15 cigarettes a day or consuming more than six alcoholic drinks a day. Loneliness is even worse for longevity than being obese or physically inactive.»
[Edit: here’s what the kids over at Hacker News have to say: https://news.ycombinator.com/item?id=18638678.]
https://techcrunch.com/2018/12/11/microsoft-login-bug-hijack-office-accounts/
I’m tempted to say “The internet, how does it work?” but the truth is I wouldn’t have a clue, either. Seems like using a regex match against domain name is a Bad Idea, though.
And how did this bug get delivered? Emphasis on speed of delivery and human testing through the UI. “Looks good, ship it.” Which… is how all bugs get delivered, right? Less-careful developer + “hurry up and ship it”.
«Sahad Nk, an India-based bug hunter, discovered that a Microsoft subdomain, “success.office.com,” had not been properly configured, allowing him to take it over. He used a CNAME record, a canonical record used to link one domain to another, to point the unconfigured subdomain to his own Azure instance. In doing so, he controlled the subdomain — and any data sent to it, he said in a write-up, shared with TechCrunch prior to publication.
That wouldn’t be much of a problem on its own, but Nk also found that Microsoft Office, Store and Sway apps could be tricked into sending their authenticated login tokens to his newly controlled domain after a user logs in through Microsoft’s Live login system.
That’s because the vulnerable apps use a wildcard regex, allowing all office.com — including his newly controlled subdomain — to be trusted.»
https://www.bloomberg.com/features/2018-jealousy-list/
«The stories we wish we’d done this year.»
Seems like a good reading list.
Alex Katz 🌭 (@Alex__Katz) Tweeted:
Americans should think twice before they comment on French politics when they know absolutely nothing.
They might end up supporting Far-Right, Russian-backed hooligans because they’re “anti-liberal.” https://twitter.com/Alex__Katz/status/1071816812612902912?s=17
Barry Osborne (@barry_osborne) Tweeted:
This is one hell of a Star Wars opening crawl. By @costareports and @PhilipRucker for @washingtonpost https://t.co/jBgywrJwkA https://t.co/OXT6YS7MJn https://twitter.com/barry_osborne/status/1071580818739408896?s=17
https://www.bloomberg.com/graphics/2018-recovering-madoff-money/
«“That kind of recovery is extraordinary and atypical,” said Kathy Bazoian Phelps, a bankruptcy lawyer at Diamond McCarthy LLP in Los Angeles who isn’t involved in the case. Recoveries in Ponzi schemes range from 5 percent to 30 percent, and many victims don’t get anything, Phelps said.»
https://twitter.com/kevincollier/status/1071472462599241735
Huh.
«To clarify, we’ve known for a year that the NY AG’s office was investigating. News here is that the feds are, and that Massachusetts and DC AG’s office are involved with New York’s.»
https://github.com/ligurio/practical-fm
TLA+ shows up a lot.
Conservative outlets going bonkers, but this was a 5-0 decision by the school board. Not sure how Christian faith comes in to this.
«Vlaming, 47, who had taught at the school for almost seven years after spending more than a decade in France, told his superiors his Christian faith prevented him from using male pronouns for a student he saw as female.»
https://twitter.com/ALT_uscis/status/1071079388182126592?s=17
Heartwarming Christmas story (thread):
ALT- Immigration 🛂 (@ALT_uscis) Tweeted:
5/ by the time he walked out of the closed store, he had 4 shopping carts full of toys, Xmas goodies, food and some gift cards for other stores. He went to her home, knocked on her door with his uniform on late at night and delivered a Xmas blessing to her.
