What's on your mind at this instant? -- Volume 13

[ehsnils]

IKEA will try to stuff as many names with the characters Å, Ä AND Ö as possible on new products in the future.

[ehsnils]

Word of the day: callipygian.

[HDTurbo]

I like that one. As for elections, I often feel like I'm between scylla and charybdis

[DickDastardly00]

Here's a question I've never had to deal with, but I will in January.

 

Are Auto injury settlements taxed as income?

 

 

Generally, no, but not without some exceptions

 

If your settlement was due to physical injury or sickness, it will not be taxed. But there are certain standards you must meet before the IRS in earning this classification. The agency has ruled that these injuries must be observable, such as cuts or bruises, to qualify as physical. The IRS also specifies that taxes do need to be paid on a portion of the settlement for medical expenses, if you deducted those medical expenses in prior years. If you sustained lasting health consequences or the loss of a limb after a train accident, for example, you can be confident that your settlement won’t be counted as income.

 

Observable, like my lower back being out intermittently over the course of 6 months? That qualifies, I think, will need to ask our Taxperson though.

[jasejase]

Nope. You should be good. Unless something changed over the last year or two.

 

They're just trying to tell you that you must be physically injured, and not receiving proceeds of a defamation lawsuit etc.

Edited December 15, 2020 by jasejase

[Brady]

On the topic of Taxes - I've been thinking about Amazon Vine and wondering how much I didn't actually need this year

[DickDastardly00]

About that data hack reported earlier this week.....

 

They think the malware placed in the compromised Solar Winds update happened back in March. So basically they've been stealing sensitive data for 9 months? If true, this might be the single largest hack in history.

 

------

According to The Wall Street Journal, Republican Sen. Chuck Grassley and Democrat Sen. Ron Wyden sent a letter to IRS Commissioner Charles Rettig on Thursday requesting a briefing.

 

“Given the extreme sensitivity of personal taxpayer information entrusted to the IRS, and the harm both to Americans’ privacy and our national security that could result from the theft and exploitation of this data by our adversaries, it is imperative that we understand the extent to which the IRS may have been compromised,” they wrote.

 

I guess that means all of our tax records are now, possibly, compromised.

[whitexc]

Wonderful

 

Sent from my moto z3 using Tapatalk

[boxkita]

Anyone who believes the IRS is good at managing data, whether personal or not, is seriously delusional. Basically a team executed the largest FOIR ever with 100% approval.

 

If you have not started changing your financial passwords and secondary authentication methods, you might want to prioritize it.

 

We've had "do not sell our data" at all the credit bureaus for years along with confirmation codes and written authorization required. We still get a weekly inundation of offers & ads based on our credit information. Every time we call in to fix, "sure we can add that to the system, since you've never set it up".

 

/data security rant

// ex-data security tester

[thefultonhow]

If you have not started changing your financial passwords and secondary authentication methods, you might want to prioritize it.

 

Without actually knowing whether any of your financial institutions use SolarWinds, I think that's a little extreme. It's not like the hackers have access to the secondary factor, either. That's the whole point of MFA.

 

Do we even know if the SolarWinds hack was able to retrieve passwords? Even if it was, I would think it would depend heavily on the design of the webapp.

[boxkita]

Without actually knowing whether any of your financial institutions use SolarWinds, I think that's a little extreme. It's not like the hackers have access to the secondary factor, either. That's the whole point of MFA.

 

Do we even know if the SolarWinds hack was able to retrieve passwords? Even if it was, I would think it would depend heavily on the design of the webapp.

 

Source: bleepingcomputer.com

 

excerpt:

Victims of these attacks confirmed so far are FireEye, Microsoft, the US Treasury, US NTIA, US Department of Homeland Security, US Department of Commerce's National Telecommunications and Information Administration (NTIA), US Department of State, US Department of Health's National Institutes of Health (NIH), the Cybersecurity and Infrastructure Agency (CISA), the National Nuclear Security Administration (NNSA), and the US Department of Energy (DOE).

 

SolarWinds' list of 300,000 customers [1, 2] includes over 425 US Fortune 500 companies, all top ten US telecom companies, and US government agencies including the US Military, the US Pentagon, the US Department of Justice, the State Department, NASA, NSA, Postal Service, NOAA, and the Office of the President of the United States, some of which have already been confirmed as hacked.

/excerpt

 

Assuming your creds are safe because MFA is akin to thinking you're safe because the door dash delivery person puts on their mask before they get 10' from your door.

 

I used a 1%'er bank that had a data compromise. An employee took home a hard drive with customer data and creds. There was a break in. We don't use that bank anymore.

 

MFA is last feet security. If only the passwords are encrypted, and access to the data doesn't require decryption, what's the point of draconian password standards?

[DickDastardly00]

Some of SolarWinds’ customers. Source: solarwinds.com

[boxkita]

Sorted on posting date; after a customer success rep, a C++ programmer, the next latest posting is for a "Software Engineering Manager".

 

In the requirements section is this nugget:

We are seeking a Software Engineering Manager to join our engineering team developing our state-of-the-art Patch product across both our N-Central and RMM product platforms. This position will be responsible for leading a team of engineers developing new features related to our Patch Management Engine providing our end customers the most up to date and secure software. As such you will serve as the engineering leader and technical expert resolving issues brought forth by the engineering team whilst improving the engineering processes.

[boxkita]

Posted in the Solarwinds Linkedin profile.

 

To security professionals everywhere.

[ammcinnis]

We still get a weekly inundation of offers & ads based on our credit information.

Every "privacy policy" disclosure I've ever read in detail includes something like the following in fine print at the bottom: "In addition to the above, you agree that we can do anything with your private information that is not prohibited by law."

Edited December 18, 2020 by ammcinnis

[apexi]

What the **** is wrong with my neighbor's generator.

 

Wouldn't start a couple years ago, I suspected he didn't use gas stabilizer or shut off the fuel and run it till it died. Asked him about it a few days ago, offered to take a look because I don't know much about small engines, but I like to tinker. Homelite ut903611s, subaru 210dt0100 engine.

 

Drained gas from the bowl. Added "mechanic in a bottle" to the hard line going into the carb, let it sit overnight, did that process twice. Didn't want to take the carb apart and disturb bowl gasket if I didn't have to, was worried about a future leak. Got it to run, but only with choke on, and not well, surged.

 

Watched this vid.

Pulled idle nozzle and cleaned it from top of carb. Ran perfectly, but only with choke on, died with choke off. Took carb apart. Cleaned everything, def needed it. Now, it's friggin surging again. Dunno what to think, kind of venting I guess.

 

What strikes me as odd is that on the tank side of the fuel filter which is clear, there is very little fuel, sometimes none at all. When I was draining the old gas from the tank, it sounded like it was flowing okay, but toward the end I had to jiggle the hose to get a regular flow. Can shut off valves and fuel filters with metal mesh in the middle clog from sitting with old untreated gas too?

Edited December 19, 2020 by apexi

[boxkita]

bad gas causes all sorts of problems. I'd clean it all out, tank included. The lacquer can make a mess

[HDTurbo]

Could well be. I've found these sites sometimes helpful in identifying "parts" solutions:

 

 

 

https://www.repairclinic.com/RepairHelp/Generator-Repair/31-335-1430519-/New/Homelite-Generator-UT903611-ModelTroubleshooting

 

 

https://www.ereplacementparts.com/homelite-ut903611-3650-watt-generator-parts-c-18807_157116_203059.html

[snm95ls]

Source: bleepingcomputer.com

 

excerpt:

Victims of these attacks confirmed so far are FireEye, Microsoft, the US Treasury, US NTIA, US Department of Homeland Security, US Department of Commerce's National Telecommunications and Information Administration (NTIA), US Department of State, US Department of Health's National Institutes of Health (NIH), the Cybersecurity and Infrastructure Agency (CISA), the National Nuclear Security Administration (NNSA), and the US Department of Energy (DOE).

 

SolarWinds' list of 300,000 customers [1, 2] includes over 425 US Fortune 500 companies, all top ten US telecom companies, and US government agencies including the US Military, the US Pentagon, the US Department of Justice, the State Department, NASA, NSA, Postal Service, NOAA, and the Office of the President of the United States, some of which have already been confirmed as hacked.

/excerpt

 

Assuming your creds are safe because MFA is akin to thinking you're safe because the door dash delivery person puts on their mask before they get 10' from your door.

 

I used a 1%'er bank that had a data compromise. An employee took home a hard drive with customer data and creds. There was a break in. We don't use that bank anymore.

 

MFA is last feet security. If only the passwords are encrypted, and access to the data doesn't require decryption, what's the point of draconian password standards?

 

Reading the list of affected agencies...interesting.

 

Not good.

[boxkita]

Reading the list of affected agencies...interesting.

 

Not good.

 

Have been reading the security boards for more details. The tinfoil hat ppl will be eating this up due to timing.

 

The infected patch is still being pushed on solar winds site.

 

The compromised software has access to higher than system admin passwords. Essentially every customer has been rooted.

[jasejase]

With those types of motors, I'll shut off the gas. drain the carb (there's a nut usually at the bottom). Throw fresh gas in. Take out the plug, clean it off. Give it 10-20 pulls without the plug in it. (Possibly check for spark while I'm there). And then try to start it .

[thefultonhow]

SolarWinds' list of 300,000 customers [1, 2] includes over 425 US Fortune 500 companies, all top ten US telecom companies, and US government agencies including the US Military, the US Pentagon, the US Department of Justice, the State Department, NASA, NSA, Postal Service, NOAA, and the Office of the President of the United States, some of which have already been confirmed as hacked.

 

I mean, my work is one of the 300,000 customers. Thing is, we're running an old version that was pre-compromise. So we weren't affected.

 

And, even for those who are affected, once again, we don't know what was stolen. For all we know, it was just names and addresses from a bunch of them. Or maybe their network was compromised but the Russians never even bothered to gain access to the databases with PII. Obviously they were prioritizing sensitive government agencies and valuable IP over a bunch of schmucks with 5 or 10 grand in their savings accounts.

Assuming your creds are safe because MFA is akin to thinking you're safe because the door dash delivery person puts on their mask before they get 10' from your door.

 

I think you misunderstand what I'm saying. I made two different, independent statements:

 

1. Passwords are likely not compromised ("likely" may not be good enough of a probability for you, and I get that that's a subjective personal decision)

2. You can't compromise MFA unless you have ongoing access to the second factor

 

If only the passwords are encrypted, and access to the data doesn't require decryption, what's the point of draconian password standards?

 

Because once the companies patch their installs, Russia (and whoever else) lose access.

 

Yes, in the case of trade secrets or state secrets, there are a considerable number of secrets that are out of the bag, but new ones can't be stolen. And if they managed to steal account and routing numbers, theoretically speaking they could sell them, or use them to steal money... but they might not have managed to do that, and this is Russia we're talking about, not North Korea, so they don't need the money.

 

Plus, even if they did... what use would changing your password do? They've already got the account and routing numbers -- why would they need your online banking password?

 

BTW, the point of draconian password standards is not to prevent data breaches, and/or compromise of accounts elsewhere due to data breaches. The fix for that is you, as a user, not reusing passwords. No, the point of password standards is to prevent brute-force or dictionary attacks as a method of account compromise.

 

I've mostly (but not entirely) changed all my reused passwords, so that every service has a unique password. Most of the remaining ones that share passwords are low-risk ones like, I dunno, legacygt.com (actually, bad example, I changed that a month or so ago because the password had been in a long-ago breach ). By and large, even if a bank or some shit was a SolarWinds customer and the login credentials actually were stolen, and those are both big "if"s, only the bank itself would be affected, at which point I'm pretty sure they're going to have to know that the credentials were compromised, and they would be liable for failure to notify/remediate.

 

Regardless, I'm sure the class-action lawyers are salivating and have already begun jockeying for position. [emoji38]

Edited December 19, 2020 by thefultonhow

[jasejase]

Nerds.

[ehsnils]

What the **** is wrong with my neighbor's generator.

 

Wouldn't start a couple years ago, I suspected he didn't use gas stabilizer or shut off the fuel and run it till it died. Asked him about it a few days ago, offered to take a look because I don't know much about small engines, but I like to tinker. Homelite ut903611s, subaru 210dt0100 engine.

 

Drained gas from the bowl. Added "mechanic in a bottle" to the hard line going into the carb, let it sit overnight, did that process twice. Didn't want to take the carb apart and disturb bowl gasket if I didn't have to, was worried about a future leak. Got it to run, but only with choke on, and not well, surged.

 

Watched this vid.

Pulled idle nozzle and cleaned it from top of carb. Ran perfectly, but only with choke on, died with choke off. Took carb apart. Cleaned everything, def needed it. Now, it's friggin surging again. Dunno what to think, kind of venting I guess.

 

What strikes me as odd is that on the tank side of the fuel filter which is clear, there is very little fuel, sometimes none at all. When I was draining the old gas from the tank, it sounded like it was flowing okay, but toward the end I had to jiggle the hose to get a regular flow. Can shut off valves and fuel filters with metal mesh in the middle clog from sitting with old untreated gas too?

Fuel hoses not liking ethanol in the fuel?

 

 

There's often a small filter in the tank too.

 

 

And '"Steve's small engine saloon" has made a specific video on surging, it's if I remember right that the carb needs more cleaning.

[apexi]

There's no filter that I can see in the tank, but I'm going to take a closer look this afternoon. Going to clean the hole where the gas goes from the tank to the line, and also see how the flow out of the shut off valve is when it's open, maybe clean that. I know I can replace it cheap, but reviews for replacements seem mixed. Got a new fuel filter for $4, gonna throw that on there too. I'd imagine if the fuel nozzles can get clogged, then that metal mesh fuel filter can too. I'm really trying to avoid opening the carb again because I'm damn near positive I cleaned everything really well, looking at the fuel system first.

 

Edit: Tired and lazy, not gonna happen today.

Edited December 19, 2020 by apexi