ransackdev

Woah woah woah let’s not give megachurches extra points for things they didn’t lead in. Tax breaks yes, more dishonestly, no.

If you don’t think every business that makes it, and even more so for those that make it big, don’t have shady dealings to thank for getting them there, you should join one of these megachurches.

Also, Amazon isn’t a church with tax exempt status but I remember headlines a few years back something along the lines of they paid a whopping 0 dollars in federal tax or something just as unbelievable yet actually true.

If anything, churches are looked at harder because they have the tax exempt status, so people are looking for abuses of that, yet we have corporate entities that can sway the global economy skirting taxes in the open and even legally, somehow.

But I get taxed when I make my money, and then again when I spend that money, which was already taxed.

There’s no difference between a FANG and a megachurch. They are both for profit machines that bleed people dry. When the church pamphlet has bar charts on the back with quarterly projections, and the pastor/whomever lets everyone know that they are a few million behind their target, before discussing the scripture, their priorities are very clear.

The screens, coffee bars, childcare, and well produced music and video, are all there to make you feel special, part of something, relaxed, and wanting to come back, next week, after you get paid again.

The same way in Mad Man the account execs would take clients out to dinner and then to strip clubs to make them feel special and relaxed, so they’d later associate good feelings when asked to hand over their wallets, megachurches have what I listed above. If bowls of cocaine could be legally laid out, you’d be handed one while walking in.

Gotta spend money to make money, but they know the high rollers and if you pay attention, they don’t pay any attention to anyone not forking over cash.

Edit: if you want more signal that megachurches are not about God, look at how many of the 7 deadly sins they proudly embody. Greed. Gluttony. Pride. Those are obvious. Sloth probably also obvious. That’s gotta mean something right? These complexes are tiny cities that sit vacant most of the week.

Ah yeah I guess it’s true they don’t have permission. At the end of the day I think it comes down to the owner choosing to press charges or not, or even detecting it and subsequently reporting it. I would guess that if the systems have ways to be hacked, the owners likely won’t see the hacks until the white/grey hat reports it to them.

Somewhat related, the hackers submitting a vulnerability disclosure to the companies are in a very “extortion-y” dynamic. I wonder how often companies get something like “pay us X amount or we let the world know today instead of waiting for you to fix it”.

Greyhats and especially bug bounty programs, pen testers, etc, have explicit authorization from the owners of the systems to access their systems, and perform ethical hacking with a mutually beneficial goal, hackers get paid, and the company gets a little bit less of an attack surface.

That’s not illegal

What’s illegal is accessing a computer system without the authorization of the owners of the computer system. Technically speaking, port scanning the internet is illegal hacking, as you are not authorized to scan each port number on any of those machines. Ever find a random ip and give port 22 a few random tries over ssh to see if the root password is “guest”, you just committed a federal offense, because you were not authorized to access and attempt to login to that system. Is anyone going to report port scans to the fbi? Failed ssh loggin attempts? (Use a vpn/tailscale and don’t expose ssh to the internet anyway).

I often wonder where “knowing” someone’s password and “hacking” their social accounts falls in this discussion. You see or hear about it all the time. “So and so hacked my page” If you have someone’s FB login info and they have no idea that you do, you may have permission to access FB, as everyone does if you accept their TOS, but you don’t have the account owner’s permission to access their account, and if FB knew it wasn’t the account owner, they would not allow that either. So if they don’t allow that, you’re likely violating their TOS, and no longer allowed to access their systems, so maybe it could technically be able to be prosecuted as illegal hacking, idk.

I will agree that recently, esp the last 2 major versions, the OS has gotten worse from a stability perspective. I have errors in my logs at a steady pace even on new machines and fresh, untouched OS install from the factory. They just never go away. The cloud services are always on and phoning home, even when you have everything that uses an Apple ID signed out. It’s becoming more intrusive and less configurable, but nothing beats the shortcuts or the mac keyboard layout, and the UI intuitiveness. I can’t go back to ctrl-s and everytime I’m on my Linux machine I struggle to do the ole carpal tunnel-s to save haha

Golang is in a special class on its own. Write some handler functions and pass around a context struct and call it a day. I wish every stdlib took care of all that stuff :)

Smaller file sizes or less LOC is not inherently safer than larger sizes or more LOC. if you’re building web apps, you’re more than likely reaching for a handful of packages, and so are millions of other people, and so are multi billion dollar companies, companies with staff who’s job it is to do supply chain security, PCI compliance auditing, security assessments, who hire pen testing firms, and some even write browsers and can sway the direction of our entire industry and the internet as a whole. Countless static code analysis is ran on the millions of CI jobs a day on builds that pull in the package, etc. If you’re using popular and maintained open source packages, people are looking at them. Shy away from no name packages with no usage unless you personally look at the code. That’s my take on it. I tend to trust the open source community to all be working towards the shared goal of well crafted and secure code for the world to use and benefit from

You aren’t being downvoted for telling people to have full control over the OS. You can do that with SIP enabled, or boot to recovery, disable, modify, enable, and have full control over your OS. How often are you needing to modify low level OS config that you’d rather make your entire machine vulnerable to root exploits than dance around SIP a couple times a year if that? That’s why you’re being downvoted, for advocating folks make their machine way less secure to save 3 minutes worth of reboot time a year, if that. Bump the hard limit once and you never need to touch it again.

How’s your vulnerability reporting process and how much experience do you have interpreting complicated pen tester bug reports about some buffer overflow zero day in your homebrew query string parser?

Huge difference between working fine, and working right. The security implications of rolling your own, is why I say “you don’t want to…”

Also, none of that code has anything to do with the product you’re actually trying to build. Imo it’s additional maintaining, tech debt, attack surface, and it’s a solved problem by a large community and has more knowledge from the security community baked in, and more eyes finding and plugging holes.

I’ve rolled my own mvc framework before, In php even! This was years ago when CakePHP was the new hotness and Laravel didn’t exist. Take it from someone who had your mentality and set off to make a tiny and no bs mvc that just gets the job done, the amount of work these frameworks are doing for you (backend frameworks) that you don’t consider, is why you should run a framework.

You don’t want to deal with processing a raw http request from the web server. You don’t want to split headers. You don’t want to sanitize input params, deal with character encoding, content types, gzipping, cache control, etags, basic authentication, flushing headers, chunking bodies, file streaming, tcp sockets, slow client avoidance, and probably 1000 other things I can’t recall.

No matter how unnecessarily complex you think a http framework might be, I assure you, it’s saving you from a mountain of already solved by people smarter than you or I complexity.

Sounds like it’s by design. Payouts for clicks is way higher than impressions. Sneaky sneaky. Or, malicious payloads await on the other side.

My favorite is when a full react site loads up, doesn’t have error boundaries, hits some unimportant js exception, and the entire page that was fully rendered and ready to go just pops out of existence and you are looking at a white page. That doesn’t seem like forward progress at all.

The US government doesn’t have legal permission to kidnap and murder you, not within the US. So it seemed to me like the comment was about china, sparking my reply. The comment could honestly apply to either imo, and maybe that’s the point. Do cops arrest people and kill them? Way too often. Those cops should be charged with crimes. But cops not being charged with crimes is not the same as it being legal, even if the end results are both the same. Or are we talking about the ability to imprison a criminal and put them to death for their crimes?

This is the problem with the original comment, it’s way to vague, or I’ve failed to make sense of it.

Ever heard of Guantanamo bay? Ask those people (those alive) if our country’s government has the ability to illegally arrest and detain people, torture them, kill them. They straight up said all this shit is illegal so we can’t do it in the US, we have to break our laws in some place we can’t be held accountable to them. That’s our government. Want more examples of illegally detaining, beating, and letting people die? Ask the folks locked up in cages when they come here seeking asylum, some of them kids, who die of starvation while being held against their will for showing up at the door and knocking. I’ll stop there but we should knock off the “them bad, us good” bullshit because all of the governments are shit that do horrible things, and america is world famous for drone striking entire families just to get one dude we labeled terrorist (our free pass to do whatever the fuck we want to someone), and dropping nuclear bombs on cities filled with innocent civilians, twice, when intel suggested a surrender was imminent without having yet dropped one.

When you point your finger at someone, you have 4 pointing back at yourself.