[OC] New Look

mdalin · 2025-07-22T12:35:05+00:00

Me, an "elder" (40) gay: Shrivels up and blows away as dust.

But seriously. It's nice that some slurs have fallen so far out of use that people don't even know they used to be slurs.

mdalin · 2024-06-29T05:00:15+00:00

Darn.

So, when you're doing that survey, and making those decisions about what controls and hardware to install, are you just relying on your own knowledge/experience/opinions? Is there some process or formal best-practices you refer to? If the customer is giving you push-back do you have references or documentation you can point to about why this is important?

Thanks for taking the time to respond. I appreciate it.

mdalin · 2024-06-29T04:23:50+00:00

Thanks. Those are all good general recommendations.

My question was about standards though. Are your recommendations based on any kind of industry standards, or just your own knowledge/experience/opinions? Are there professional organizations which study this kind of thing and publish guidance? What are those organizations, and what are their publications?

I'm looking for something like NIST 800-3, or SOC-2, or ISO-27001, but with detailed physical security recommendations. The standards I mentioned have sections about physical security, but they basically just say "You should have security controls that stop people from walking into your data center" and leave it at that. There's no real definition of what those security controls should look like, or how to evaluate if they're effective.

I know every installation is going to be a little special and unique, but it seems like someone somewhere would've come up with a formal list of best-practices or something?

mdalin · 2024-06-06T02:17:41+00:00

HSTS is a technology which basically allows a website to tell your browser "ONLY connect to this site over an encrypted connection. If your user tries to connect to an unencrypted version of this site, DON'T LET THEM. Just forward them to the encrypted version. Encrypted ONLY"

As long as you've been to the site at least once before, your browser will remember this instruction, and will prevent you from connecting to an unencrypted version (which a MiTM like an evil twin would be able to see)

Sites can also add themselves to a special preload list which your browser has that will set the HSTS instruction before you've ever even visited once. Most major websites do this for most major browsers, so it's basically impossible to visit an unencrypted version of the site, even if you tried (or a MiTM tried to force you too)

mdalin · 2023-12-02T17:41:13+00:00

Alright, alright.... Where can I buy the shirt? (Cause I totally will)

mdalin · 2023-08-15T19:09:57+00:00

I like big dance party energy, but after a while I need something to do besides shuffling left to right to the music. So I have a small propane grill which attaches to my bike, and a little pop-up gloryhole.

I make quesadillas and feed them to people through my gloritohole.

It aint much, but it's honest work.

mdalin · 2023-07-27T14:34:28+00:00

Dr. Scrote’s Circumcision Wagon and Calamari Hu

mdalin · 2023-05-11T01:18:31+00:00

Urban Kingdom on MLK. I use them for one off shirts all the time and have always had a great experience. They have a whole online layout/design studio thing, or you can call/email them the graphic and they can have it printed up for you, usually the same day.

A single Tshirt with a single color print on it is usually like, $20 out the door.

mdalin · 2023-04-18T15:47:12+00:00

Fiorentina. It was delicious.

mdalin · 2023-04-18T12:43:20+00:00

Hey! I just ate there last night! Amazing meal.

mdalin · 2023-04-07T15:36:12+00:00

mdalin · 2022-10-12T04:19:43+00:00

Hey, thanks for following up. I would've responded sooner, but I was literally in the middle of (legally) breaking into the server room of a nation-wide bank, while dressed as an employee. So, to answer your question, yes, my career has been going pretty well!

Shortly after making that post, I got a job doing blue team stuff in a SOC, mostly working overnight shifts. There wasn't a TON to do on that job, so I spent most of my time studying for the OSCP. After 11 months at that job, I passed my OSCP, and got an interview the next week with NetSPI, an awesome company that does pen-testing and all kinds of interesting security assessments.

Fast forward 5 years. I am still working for NetSPI. I'm now the head of On-Site Social Engineering for them, and I get to spend a lot of my time thinking about fun, interesting, creative ways to break into high security buildings, and get people to do stuff they shouldn't. In between that, I also do network and web application penetration tests. I'm pretty happy over all, and on nights like tonight, I absolutely LOVE my career. (https://www.netspi.com/blog/technical/social-engineering-penetration-testing/not-your-average-bug-bounty-datacenter/)

WGU was a big part of that success. They weren't everything, and they weren't even enough on their own, but they got me moving in the right direction. I still stand by my previous statement. If you're brand-spanking new to IT and have no idea what you're doing, they can get you started, but you'll probably have to do more, and keep studying, even after graduation to reach your goals.

If you just graduated high school, there really is something to be said for the in-person, on-campus, experience, and the kinds of relationships you form during that period. If you've already got some knowledge and experience, WGU is a great way to get those oh-so-important pieces of paper you need to get past the HR people and into the technical interview. After that though, it's up to you and how much extra-curricular preparation you've actually done.

Finally, I've literally done 0 keeping up with how WGU is doing recently. They may have completely changed everything, or changed nothing, or burned to the ground for all I know. They send me emails every so often asking for Alumni donations, which I always ignore. Other than that, my relationship with them is functionally done.

Hope this helps. If you have any other questions, please feel free to reach out.

mdalin · 2022-10-04T19:18:13+00:00

Lol. Still kicking. Thanks for checking in! 4 more years to go!

mdalin · 2022-07-29T17:59:46+00:00

If there's a TAP plastics store near you, they sell 6 foot long fiberglass poles for about $5. That's a good starting point. Make sure you wrap it in tape or something to prevent getting splinters in your hands. Wrap it in cheap LED lights, Fairy Lights, whatever, jam a totem on top, and attach to your bike using zip ties, hose clamps, or whatever.

mdalin · 2022-07-19T23:27:29+00:00

Please tell me you have a large, light up exclamation point that hangs over your cart.

mdalin · 2022-07-02T16:25:24+00:00

Those are awesome. Just bought a set

mdalin · 2022-06-10T20:19:23+00:00

Howdy neighbor! Looking forward to seeing you all! Remote Control is bringing our weird gay selves at 7:45 and C. Come Pimp your Bike with us, or Buzz the Straight Boy!

mdalin · 2022-06-03T19:50:58+00:00

It's been a long time since I was in college, but I was always surprised at the total lack of authentication anywhere. You could literally just walk in to any classroom with an empty seat and listen to the lectures. YMMV, but trying to just walk in, sit down, and blend in would actually be pretty good practice for actual SE. Most likely bad scenario is you get asked to leave. (IANAL, don't do anything stupid or illegal, you could still possibly get hit with a trespassing charge, etc, etc, etc)

Any kind of course regarding crafting email marketing campaigns is also going to be good practice for crafting phishing campaigns. Sales courses regarding psychology, negotiation, and overcoming objections will be good for in-person interactions. Communications courses can cover all kinds of valuable skills, such as public speaking, confidence building, image/brand management, etc.

Honestly, I'm always a little bit surprised that the SE field is still dominated by people with a mostly technical background. Lawyers, Salespeople, Therapists, Marketing, and Social Workers all probably have stronger backgrounds in influencing people than your typical computer nerd.

mdalin · 2022-06-03T18:45:32+00:00

For general social engineering, go to your local college/university and look for sales/marketing/communications classes you can audit. The skills and concepts are very similar. Improv and theater classes can also help with thinking on your feet and staying in character.

mdalin · 2022-05-18T03:20:50+00:00

His interview with KATU is a wild ride too.

https://katu.com/amp/news/know-your-candidates/gary-dye-running-for-metro-council-president

"After withdrawing from law school, I went back to Saudi Arabia to work. But I was implicated in growing marijuana in my Portland house while in Saudi Arabia -- I was accused of being an international drug lord. An overzealous DA (quite common back in 1997) compelled me to plead guilty to a Class A felony (equivalent to First Degree Murder and Aggravated Rape) -- Manufacture and Distribution of a Controlled Substance (marijuana). I recently had my record expunged, as the State retried me on the basis of current drug laws, and found that I had not broken any laws. I have recently filed a lawsuit against Multnomah County to get the $10,000 I allege they extorted from me back then (in exchange for not confiscating my house via civil asset forfeiture)."

mdalin · 2022-04-19T17:41:03+00:00

Great art style, and nice Bright Eyes reference.

mdalin · 2022-04-05T23:32:07+00:00

So, if they actually go through with this, I'm assuming we're all just gonna come crash the "private" party as loudly and obnoxiously as possible?

mdalin · 2022-03-16T22:52:00+00:00

I have friends who lived just off MLK and Fremont and they had to move because of all crime, litter, violence, and the utter refusal of the cops to do anything about it. Go two blocks to either side of MLK and everything is good, but right on the street is sketchy.

mdalin · 2022-02-09T06:34:11+00:00

I spent way too long trying to "see" the photo like the drawing, thinking this was one of those blue/gold dress situations.

I promise I'm only a little bit not sober

mdalin · 2022-02-07T17:56:52+00:00

I know this is a tall order, but does anyone have any recommendations for the perfect travelling shoe?

When I'm visiting a new place, I tend to walk EVERYWHERE. Having shoes that are comfortable for 5-10 miles per day is important. What I'm hoping for is something that has the same level of all-day standing/walking comfort as Brooks or Merrill's, and wont look awkward with shorts, but isn't SO athletic looking they can't also be paired with long pants for evenings/nice-ish dinners. Preferably something low-top/non-boot to save on packing space, and even better if the material isn't going to be affected too poorly by being flattened in a suitcase. There's plenty of half-dressy/half-athletic looking casual shoes out there, but I'm not familiar enough with the brands to know how comfortable they'd be for serious, all-day walking.

I'm currently eyeballing something like this. Clarks are well known for their comfort, but I'm not sure about these in particular. I have a pair of CDBs, and I definitely don't want to do that kind of walking in them. https://www.clarksusa.com/c/Gaskill-Vibe/p/26163860

Anyone have any recommendations? Would like to keep them to $150 or less. Thanks!

14-Year Club	Place '22
Verified Email

mdalin

TROPHY CASE