Manif grenobloise, beaucoup beaucoup de monde dans le calme.

RE: https://infosec.exchange/@jerry/117457041484080186

To be clear, this ONLY helps with accounts that haven't been accessed in the past 6 months. That means you, who are reading this, could have your mastodon/fedi account taken over if the password you use has been stolen and do not have MFA enabled. Please, make sure you use a unique password here and everywhere and enable MFA. I know it's a PITA, but it makes a difference. thanks

RE: https://wien.rocks/@b2c/117457087514717275

I apologize if the infosec/fedia/ioc/convo family of instances becomes unavailable. just know that it is because I am running doom on the database server.

There are major account take-over problems happening right now on mastodon instances - all appearances are that the actor is using stolen passwords, probably from malware running on desktops. I've suspended hundreds of compromised accounts over the past 48 hours, but only two on mine.

If you run a mastodon instance, here is a postgres query I use to randomize the passwords of accounts that have been inactive for 6 months or more. It also removes logged in sessions. This doesn't lock people out, just makes them perform a password reset. Yes, I wish I didn't have to do this, but here we are. I hope it helps someone else.

BEGIN;

CREATE TEMP TABLE dormant_batch ON COMMIT DROP AS
SELECT u.id AS user_id
FROM users u
WHERE COALESCE(u.current_sign_in_at, u.created_at) < now() - interval '6 months'
AND NOT u.otp_required_for_login
AND NOT EXISTS (SELECT 1 FROM webauthn_credentials w WHERE w.user_id = u.id)
AND NOT EXISTS (SELECT 1 FROM oauth_access_tokens t
WHERE t.resource_owner_id = u.id
AND t.revoked_at IS NULL
AND t.last_used_at > now() - interval '6 months');
UPDATE users u
SET encrypted_password = '$2a$10$' || left(replace(gen_random_uuid()::text || gen_random_uuid()::text, '-', ''), 53),
updated_at = now()
FROM dormant_batch b
WHERE u.id = b.user_id;

UPDATE oauth_access_tokens t SET revoked_at = now()
FROM dormant_batch b
WHERE t.resource_owner_id = b.user_id AND t.revoked_at IS NULL;

DELETE FROM session_activations s
USING dormant_batch b
WHERE s.user_id = b.user_id;

SELECT COALESCE(y::text, 'total') AS last_seen_year, count(*) AS locked
FROM (SELECT date_part('year', COALESCE(u.current_sign_in_at, u.created_at))::int AS y
FROM dormant_batch b JOIN users u ON u.id = b.user_id) s
GROUP BY ROLLUP (y) ORDER BY y NULLS LAST;

COMMIT;

#mastoadmin #fediadmin

The term "single use software" currently lives rent free in my head.

People use LLMs to create software specific for their needs. But neither can other people use it (hardcoded variables, no rights management, too specific), nor do they use it again (too specific, easier to produce a new one).

Single use software is not maintained. Nobody understands it or has an interest in keeping it working.

The creation of single use software feels cheap, but isn't. It takes time to create the software, it needs infrastructure and power. The time is experienced as short compared to how long it takes to create maintainable and reusable software. But once you take into account how many people benefit from reusable software, the single use software takes way more time to create than what it saves. The infrastructure and power costs are hidden because the data center isn't visible. The costs are subsidized by venture capital.

Like other single use items, single use software brings risks of unforeseen consequences. From data loss or leaks to issues for maintainers of reusable software (eg. verbal abuse, less motivation and lost income).

As an example of single use software is a German LinkedIn post of a person who slopcoded a HEMS (home energy management system). It took them more than a week. While open source projects like https://evcc.io/ already provide the same functionality. They could have used it for free or paid 100€ and got support for some additional devices. But they decided that they know better how it should work and now have a single use software. If it breaks there is nobody they can ask. There won't be updates and no community to discuss and develop new features. No organization will ever be interested in officially supporting it. And even if it works, it only benefits that one person.

(This doesn't mean people shouldn't build things that only they use. But they should enjoy doing so.)