https://techcrunch.com/2018/12/11/microsoft-login-bug-hijack-office-accounts/

I’m tempted to say “The internet, how does it work?” but the truth is I wouldn’t have a clue, either. Seems like using a regex match against domain name is a Bad Idea, though.

And how did this bug get delivered? Emphasis on speed of delivery and human testing through the UI. “Looks good, ship it.” Which… is how all bugs get delivered, right? Less-careful developer + “hurry up and ship it”.

«Sahad Nk, an India-based bug hunter, discovered that a Microsoft subdomain, “success.office.com,” had not been properly configured, allowing him to take it over. He used a CNAME record, a canonical record used to link one domain to another, to point the unconfigured subdomain to his own Azure instance. In doing so, he controlled the subdomain — and any data sent to it, he said in a write-up, shared with TechCrunch prior to publication.

That wouldn’t be much of a problem on its own, but Nk also found that Microsoft Office, Store and Sway apps could be tricked into sending their authenticated login tokens to his newly controlled domain after a user logs in through Microsoft’s Live login system.

That’s because the vulnerable apps use a wildcard regex, allowing all office.com — including his newly controlled subdomain — to be trusted.»

Alex Katz 🌭 (@Alex__Katz) Tweeted:
Americans should think twice before they comment on French politics when they know absolutely nothing.

They might end up supporting Far-Right, Russian-backed hooligans because they’re “anti-liberal.” https://twitter.com/Alex__Katz/status/1071816812612902912?s=17

https://www.bloomberg.com/graphics/2018-recovering-madoff-money/

«“That kind of recovery is extraordinary and atypical,” said Kathy Bazoian Phelps, a bankruptcy lawyer at Diamond McCarthy LLP in Los Angeles who isn’t involved in the case. Recoveries in Ponzi schemes range from 5 percent to 30 percent, and many victims don’t get anything, Phelps said.»

https://twitter.com/kevincollier/status/1071472462599241735

Huh.

«To clarify, we’ve known for a year that the NY AG’s office was investigating. News here is that the feds are, and that Massachusetts and DC AG’s office are involved with New York’s.»

https://github.com/ligurio/practical-fm

TLA+ shows up a lot.

https://lamport.azurewebsites.net/tla/tla.html

https://www.richmond.com/news/virginia/virginia-high-school-teacher-fired-for-refusing-to-use-transgender/article_65be1826-50b2-5d38-be58-47d9b9480917.html

Conservative outlets going bonkers, but this was a 5-0 decision by the school board. Not sure how Christian faith comes in to this.

«Vlaming, 47, who had taught at the school for almost seven years after spending more than a decade in France, told his superiors his Christian faith prevented him from using male pronouns for a student he saw as female.»

https://twitter.com/ALT_uscis/status/1071079388182126592?s=17

Heartwarming Christmas story (thread):

ALT- Immigration 🛂 (@ALT_uscis) Tweeted:

5/ by the time he walked out of the closed store, he had 4 shopping carts full of toys, Xmas goodies, food and some gift cards for other stores. He went to her home, knocked on her door with his uniform on late at night and delivered a Xmas blessing to her.

https://www.politico.com/magazine/story/2018/12/07/year-of-woman-politics-campaign-strategists-consultants-democrats-republicans-222767

«Only a few of the women who spoke to POLITICO for this story suggested that this environment was rooted in intentional malice. Instead, most chalked up the slights to obliviousness.

The handful of men interviewed for this article were startled to learn the women around them are so alienated. All of the men said they were disturbed once they looked at the terrain through the eyes of their female colleagues.»