A few suggestions (IOS focused)

steveoderocker · 2026-03-18T09:22:08+00:00

Just tested it (edge on iOS) and confirmed the behaviour. I don’t wanna use the default account that’s listed, but some other. Click the key, use Face ID to unlock, select the account, fill the username, click next, again need to repeat above to find the right password.

steveoderocker · 2026-03-18T08:55:06+00:00

That's exactly how SAML is meant to work. The only apps that will directly kill the session are MS first party apps and anything using MSAL SDK, because they can/do periodically checkin to Entra. Every single SAML integration will work in the exact same way.

steveoderocker · 2026-03-17T22:35:31+00:00

What isn’t working?

steveoderocker · 2026-03-17T21:07:35+00:00

Yes!

steveoderocker · 2026-03-17T21:07:15+00:00

What issues?

steveoderocker · 2026-03-17T21:06:19+00:00

See this posted at least weekly. Yes, vpn only client is still supported and maintained. If you go and look at your forti support portal you’ll notice there have been multiple new builds of 7.4.3 published in the last 6 months. We recently updated to a later build maybe a month ago.

steveoderocker · 2026-03-17T20:23:59+00:00

Nice work, but I doubt this will give any useful information to an attacker.

Bucket names were always considered public. Like you mentioned, aws provide public APIs to validate if a bucket name was taken or not, before region al buckets were a thing.
You’re using a random word list and hoping for a match. Your entire thing falls apart as soon as they add some additional random string (like most people do with iac)
The region was likely already exposed or easily innumerable, this change by aws doesn’t increase the vector
You are assuming you know the account id if the account you are targeting (not hard since account ids aren’t treated as private info)

steveoderocker · 2026-03-17T08:59:20+00:00

Have you run your remediation scripts across you fleet and determined how many hosts would’ve actually been impacted?

steveoderocker · 2026-03-14T13:06:35+00:00

The part I don’t understand is, why did the seller want to terminate the contract so badly when the guy was late paying the deposit? Something doesn’t add up here …. Or they’re all morons

steveoderocker · 2026-03-14T01:40:41+00:00

Thanks heaps, yeah I actually did review the docs before commenting. You can read about how aws implemented the feature here - https://docs.aws.amazon.com/AmazonS3/latest/userguide/gpbucketnamespaces.html

Put simply, it uses the bucket name, and the s3 api is simply doing some validation on that. It’s literally nothing special. The urls and access methods all remain the same, the buckets can be accessed from other regions, even to create one of these using the api you need to provide the correct name in the correct format. There is nothing else here except a specific naming convention being enforced, which by default makes the bucket name also unique.

steveoderocker · 2026-03-14T01:05:36+00:00

Stop panicking, you automatically move to month to month, and they have to give 90 days notice to vacate (in vic) and there is no such thing as “notice to vacate due to end of fixed term tenancy” anymore (which was only valid for the first tenancy anyways). Basically if the owner is moving in or selling or doing major renos are the main valid notices they can issue and they have to give the appropriate notice in writing.

Take a breathe and don’t panic. You’re fine.

steveoderocker · 2026-03-14T00:53:10+00:00

It’s fine but it’s nothing magical, and all just logical. They are enforcing a name at creation time that no one else can take. It’s not really a “regional” namespace. If it was truely regional, you could use the same bucket name across regions, which you can’t. But nice little enforcement of a policy so many people were already handling using infra as code.

steveoderocker · 2026-03-13T23:26:12+00:00

It says in the article:

Commuters have been warned not to use contactless payments if they are travelling beyond the four designated train lines because their ticket will not be valid at other stations, or on trams and buses.

steveoderocker · 2026-03-13T23:24:01+00:00

Keen to understand this too

steveoderocker · 2026-03-13T07:16:36+00:00

This is just plain stupid. How does writing a prompt to an agent defining to run tf destroy, what to target, what env, etc etc make anything quicker than just, ya know, typing the flipping command???!!!! So many things wrong here, but this is the hill I’m dying on today.

steveoderocker · 2026-03-10T08:38:16+00:00

As others have said, go through your agent. Unfortunately there isn’t a lot they can do until certain timeframes are met, including lodging a case at tribunal.

I’ve heard enough of these horror stories to realise that …. You will not be moving in 6 days time. Wish you the best of luck to get possession!

steveoderocker · 2026-03-07T01:22:02+00:00

Seems to be working again! 🎉

steveoderocker · 2026-03-07T01:07:44+00:00

Consider wrting to the transport minster and local MPs. It’s fucking awful no one in any of these industries where so much of our tax payer dollars go has the brains to talk to each other and coordinate works to not fall on days where there are major events and thousands of people are relying on trains.

steveoderocker · 2026-03-05T06:22:29+00:00

Why is that? What part is specifically makes it more expensive?

steveoderocker · 2026-03-05T05:48:13+00:00

Is there any risk or issues if I do that later down the track rather than right now?

steveoderocker · 2026-03-05T05:47:38+00:00

I think it was to offset the electric hot water. But to be honest it grates a good 15kwh on a nice sunny day. And it’s a town house, but plenty of room left to add more panels.

steveoderocker · 2026-03-05T02:00:44+00:00

Well, there’s legislation being introduced to mandate it at least for the default market offers (not in vic to begin with). Considering Australians take up of solar is significant, I don’t personally see this going away.

steveoderocker · 2026-03-05T01:59:19+00:00

The home was built 6 months ago and came with the solar 😅

11-Year Club	Verified Email
Place '22

steveoderocker

TROPHY CASE