finaliteration

> if the org-admins have approved the OAuth application and are able to send mail from within the organisation - then it's probably game over anyway

In my case the email came through due to a “bad” DMARC configuration so they were able to spoof our domain from an external server and the OAuth app in question had our company’s name on it.

And on a personal front, I was busy that morning and didn’t pay enough attention to the permissions being requested by the app before I clicked “allow”. So it was a failure of both systems and people controls.

My new rule is that if I get an email asking me to do any sort of action, automated or not, I’m going to sit on it for 1-24 hours before doing anything about it. If it’s actually urgent then someone will get ahold of me through some other method than email.

Agreed. However some service providers (like GitHub) allow a user with admin access to approve any OAuth app the first time it’s “launched” if they are the ones initiating the request, rather than using a pre-defined allowlist approach which I believe is what Office 365 does.

My wish would be for some sort of multi-person approval process rather than allowing anyone who is an admin to authorize an app. Even admins can be susceptible to a targeted and advanced attack.

Also, many people (like myself before my own “failure”) simply aren’t aware of OAuth apps as a serious attack vector. Most remedial training around phishing campaigns covers things like fake login pages but not “An attacker has spoofed an internal domain and an OAuth app with your company’s name in it”.

I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques.

The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material.

It was very sophisticated and I’m glad I fell for it during a simulation rather than in a “real life” situation. It was a learning experience and a situation I’m way more paranoid about now. I could easily see admins and developers anywhere falling for it if they were specifically targeted.

> more likely to be carrying it anyway due to misbehavior

I’m not sure about that. I’ve been pretty strict about physical distancing, mask wearing, and all of the other things necessary to help combat the spread of the virus. I’m also someone who gets a flu shot every year and I make sure my child is vaccinated.

That being said - I am majorly skeptical about a vaccine being rushed through the approval process for political reasons and how safe it will be for me and my family. I may refuse it if it seems like it will do more harm than good and/or the process isn’t transparent and the safety data aren’t made available.

> Maybe just have sex instead?

Having grown up with two addict parents I can tell you that “Just try doing something else” isn’t typically a useful strategy.

> His retirement had not brought the contentment it had promised, and no number of visits from his children could dispel his loneliness. He had little in the way of a social circle

This is actually a concern of mine regarding retirement and part of the reason I tell people that I will likely never retire. A large number of my social interactions are through work, and I feel if I didn’t have something “productive” to do I would be pretty listless and depressed.

I get wanting to enjoy leisure time and hobbies, etc, but there is something rewarding about doing work that you enjoy that is different for me.

Too true. Intellectual bullying can be insidious and is often overlooked because it doesn’t come with physical scars and bruises. Some of the worst bosses and coworkers I’ve encountered were those whose mentally abusive and toxic behavior was enabled or ignored simply because they were “intelligent” or technically indispensable.

Can you elaborate a bit more on what bothers you about Go? “It’s not Python” could encompass a lot of things.

Personally, I use both languages (as well as Java and C#) and find they do really well for different tasks. If I need a binary command-line tool that I can ship off fairly easily I turn to Go. If I need to quickly parse some text files, bang out a quick HTTP client script, or automate some AWS tasks, I’ll go with Python.

This is my concern, as well. We have some people at my place of work saying, “Working from home has been great! I’ve never been more effective and happy at my job.”, and then we have a smaller but more vocal group that says, “I hate working from home and it’s incredibly stressful. I want to go back ASAP.” I worry that the second group will “win” and the pendulum will swing the other way because of the latter group’s experience.

What we should really be aiming for is flexibility. Some people can be in the office, some can stay remote.

Personally, I dislike being in an office every day, but even more than that I hate the commute. If my manager forces me back, I’ll probably quit and look for a job/company that plans to allow remote work permanently. I’m trying to remain hopeful, however.

Portland State is actually on a quarter system, so you'd need to multiple those values by 3 or 4 (depending on if you include the Summer quarter or not).

Source: I'm a Portland State alumnus.

While I think this project and the data are interesting, one thing that becomes problematic is that you actually DO have to invest time in whatever courses you register for at most colleges and universities (or at least the ones that I've seen).

Generally, if you aren't making adequate progress in a course, you can be dropped by the instructor mid-semester/quarter or placed on academic probation, both of which can cause you to fall below the minimum number of credits needed to be eligible for healthcare coverage.

So while you may save some money on health insurance, you lose a potentially large amount of time due to having to keep up with coursework to maintain eligibility.

That being said, this may not be a problem if they are courses you are actually interested in and can dedicate time to completing.

I love asking for help in channels because I feel like it socializes the answer and process for finding it much better than a DM does. It also helps build trust within the team because someone can see a “stupid” question get asked and then answered and then also feel comfortable asking questions like that.

That being said, I have worked for some shitty bosses who have told me not to post questions and information in channels directly because they want them “vetted” first. I’ll never work for someone like that ever again.

As a parent myself who is guilty of this from time to time, I think it’s easy to judge those moments without seeing the full picture. Nowadays parents are expected to attend to kids basically 24/7 and keep them engaged, etc,. Just because you saw that happen at breakfast doesn’t mean it was happening all day, every day. Maybe they were out visiting museums or nature parks for the rest of the day.

There are mornings when you just want a quiet breakfast while you’re on vacation without an embarrassing meltdown happening and, for better or worse, the most effective way to accomplish that is by giving your kid a movie or show to watch on the iPad for 30 minutes while you eat.

Not sure if this is true in all states, but in mine getting fired for cause disqualifies you from receiving unemployment. You have to be laid off/terminated by no fault of your own.