from Bastian Writes Stuff

An elder fish once spoke of watery truths to many a young egg that on the eve hatched:

“A worm whose jiggle does not entice,

that squirms but does not dance,

Whose spirit beckons not,

Steer clear! Clear at any cost,

For plenty a fishes live’s ma—”

A net entrapped all living things in the area and swept them up.

 
Read more... Discuss...

from brendan halpin

Felt the urge to listen to Husker Du’s Warehouse: Songs and Stories the other day, and since this album has been characterized as a battle between the band’s two songwriters (Mould in the grips of untreated depression, Hart in the grips of heroin addiction), I though it would be fun to actually rate the songs and call a winner.

Disclosure: Hart is the underdog here and in most critical appraisals of Husker Du, despite the fact that he wrote some of the band’s best songs. And let’s just be frank here: there are three listenable songs on Candy Apple Grey, and all of them were written by Grant Hart. (Mould lays the blame for the band’s breakup on Hart’s addiction and his own lack of compassion (well, Mould doesn’t say this, but I read his autobiography and he showed no compassion or empathy for Hart’s mental health struggles which is rich because he’s had plenty of his own), but I can’t help feeling like he was also smarting a little bit from Hart getting the lead single on Candy Apple Grey.

I shall do my best to be objective, but I’m hoping Hart will pull out a victory. I shall rate every song on a highly objective 1 to 10 scale.

“These Important Years”—killer melody, killer opening riff, but I’ve never cared for songs that take the form of advice for the listener. Also Mould mined this vein of nostalgia much more successfully in “Celebrated Summer.” 7/10

“Charity, Chastity, Prudence, and Hope”— “it was his aluminum that attracted her to him” is a great line. Chorus is catchy and rocks, though I can’t figure out how it relates to the verses, if at all. Seems to maybe be making fun of its protagonists, which I do not care for. 6/10

“Standing in the Rain”—absolutely classic Bob Mould pop punk, and, what’s more, sounds like the finished version of the halfassed “Eiffel Tower High.” Melody, lyrics, performance—everything works here. 10/10

“Back From Somewhere”—Really artful, melancholy breakup song, and the last line is perfect. Also, Hart seems more interested in rhyme than Mould does, and he drops a bunch of really satisfying couplets in this one. 8/10

“Ice Cold Ice”—Mould’s gift for melody salvages an otherwise unremarkable song. We may disagree, but I think “Ice Cold Ice” is a pretty weak turn of phrase to hang a song on. 6/10

“You’re a Soldier”—Absolutely the worst song on the album. It’s not that I disagree with the anti-military content (though I prefer to see the blame laid at the feet of the politicians, generals, and CEOs who feed young people to the death machine), but those lyrics! Jesus, it’s like he wrote them when he was in the 7th grade! Unvbelievable that the guy who wrote “Pink Turns to Blue” also wrote this turd. A puerile embarrassment that should have been left off the album. 1/10

“Could You Be The One”—Another pop punk gem from Mould. Also uncharacteristically upbeat by Bob’s standards in that the lyrics at least hold out some hope of a happy ending. 9/10

“Too Much Spice”— Great verses, terrible chorus. Also, “too much spice” as a metaphor for drugs or whatever is pretty on-the-nose for a white guy from Minnesota. You’re coloring your life with too much spice! Have a nice jello salad instead! 4/10

“Friend, You’ve Got To Fall”—Mould’s take on the “hey, you’re doing too many drugs, I’m worried about you” theme that Hart explored in the previous song. The juxtaposition doesn’t do Hart’s song any favors, as this one’s better in every way. Hampered a bit by the banality of the chorus. 6/10

“Visionary”—I dunno, man. It rocks, and the melody is catchy, but, like, what the hell is this song even about? Other artists have built careers on songs that are impenetrable unless you happen to be the songwriter (lookin’ at you, Elvis Costello!), but I don’t think it’s a good color on Bob. 6/10

“She Floated Away”—and here comes a sea shanty, because why not! I love that Grant is flirting with magical realism here, and it seems like he’s doing a collage about misogyny a la Graham Parker’s “Get Started, Start a Fire” (which came out two years later, but you take my point), but then he kind of ruins it with the last verse that shifts the focus to men and doesn’t tie the song together despite being a “what it all means” pronouncement. 7/10

“Bed of Nails”—Strong melody, but an overlong dirge in which Bob strains the metaphor to the breaking point. Skippable, and in fact when I used to listen to this on vinyl, I’d usually start side 3 after this one. 4/10

“I’ll Tell You Why Tomorrow”—inoffensive, but there’s just not really anything particularly interesting going on here. I like the cuckoo clock at the end. 5/10

“It’s Not Peculiar”—I like the chorus. Otherwise pretty unremarkable, except that Bob doesn’t seem to have the vocal chops to deliver the melody he wrote. 4/10

“Actual Condition”—The song that usually kept me from skipping side 3 altogether. Upbeat ray of sunshine with a rockabilly flavor on an otherwise quite dreary album. (Lyrics are intermittently dark, but the music is fun!) Probably the first glimpse of fun on a Husker Du album since “Books about UFOs.” Even Bob’s solo is fun! Also, on a record rife with overlong songs, this one gets its business done in under 2 minutes! 7/10

“No Reservations”—Really good lyrics, but the song is kind of meandering. Tries for some uplift at the end, but Bob just can’t sell the line “if we’re together we’ll have a happy time” as well as he sells “sit by a lake and cry.” It’s poignant, but not really the kind of thing I often feel in the mood to listen to. 7/10

“Turn it Around”—Killer riff and, again, a poignant look at someone clutching at happiness amid misery. I’m not a punk rock purist or anything, but the keyboards on this track have not aged well. Nor has the cheesy acoustic/electric guitar tone on the solo. Great chorus. 7/10

“She’s a Woman and Now He is a Man”—Journalistic look at a breakup with a great, catchy melody. I read the title to mean that the breakup is the first time the guy has faced any consequences for his actions, and therefore the event that turns him into a grownup. Can you write a (post) punk song that rocks AND shows emotional maturity? Apparently you can! 10/10

“Up in the Air”-Solid, and I like the quiet-loud dynamic on the verses as well as Grant’s echoey, ethereal backup vocals on the chorus. Bob’s gift for melody is on full display. Still, at this point in the album, I’m looking for a knockout punch, and this isn’t it. 7/10

“You Can Live at Home”—Whereas “She’s a Woman…” was examining a breakup from a distance, here we’re right in the thick of it, and everything works together perfectly as the song builds to the title being sung over and over as the band gets noisier and noisier, Mould solos at length, and the whole thing is held together by an uncharacteristically funky bass line. I don’t know if Grant was playing with the idea of the band’s upcoming breakup or if it’s about the end of a romantic relationship, but either way, it’s an absolutely perfect way for the band to sign off. 10/10

OKAY! Final Score! As I write this, I have no idea who’s going to win!

Bob: 11 songs, so 110 possible points.

FINAL SCORE: 73/110 66.4%

Grant: 9 songs, so 99 possible points

FINAL SCORE: 58/99 58.6%

CONCLUSION

Bob is the winner here, largely due to the inclusion of the execrable “You’re a Soldier” In other words, while Grant’s best songs are every bit as good as Bob’s best songs, Grant’s worst song here is WAY worse than Bob’s worst. Still, I hope my completely objective rating system has put to bed the myth that Husker Du was a one-songwriter band.

 
Read more... Discuss...

from Language & Literacy

“Semantic gradients,” are a tool used by teachers to broaden and deepen students' understanding of related words by plotting them in relation to one another. They often begin with antonyms at each end of the continuum. Here are two basic examples:

Semantic gradient examples

Now imagine taking this approach and quantifying the relationships between words by adding numbers to the line graph. Now imagine adding another axis to this graph, so that words are plotted in a three dimensional space in their relationships. Then add another dimension, and another . . . heck, make it tens of thousands more dimensions, relating all the words available in your lexicon across a high dimensional space. . .

. . . and you may begin to envision one of the fundamental powers of Large Language Models (LLMs).

LLMs Are Powered by Language: Or, Words as a Vast Sea of Interrelated Statistical Arrays of Tokens

At root, the most powerful current forms of AI derive their capacities from decomposing human language into vast arrays of numbers based on their high dimensional statistical relationships and then predicting probabilistically what the next tokens are most likely to be.

There’s a kind of alchemical transformation that occurs that seems to maintain the meaning in the generative pronouncements of the frontier LLMs, all the more amazing because so far the very engineers who have designed the structure for these operations to occur do not fully understand what the models are doing to arrive at their seemingly oracular destinations.

In other words – the power of LLMs seemingly derives from the statistical power of language. There is something in the nature of language itself that seems to provide these computations of vast arrays of numbers with a lattice of our world, enabling LLMs to gain uncanny abilities from superpowered next word prediction. That LLMs have the generative powers they have—and that they have them without any consciousness or social interaction whatsoever—bolsters the argument that there is something about language itself, not just our brains, that is powerful.

An Aside on Power Law Scaling

One of the interesting features of human language is that it exhibits power scaling laws, as with other complex adaptive systems such as animals, cities, or businesses, as I recently examined in this post about Geoffrey West's fascinating book, Scale. The frequency of word usage, the length of sentences and texts, and the number of words in a language all follow power law distributions. This means that a small number of words are used frequently, while most words are used infrequently, and long sentences and texts are less common than shorter ones. As an interesting parallel, power law scaling is exhibited not only by language itself and through its generative manifestations in LLMs, but furthermore through the data—and the data centers and energy—required for training and using LLMs. Thus far, there is no apparent ceiling for LLM advancement in capability beyond that of the ceiling on the scalability of computer chips, data centers, and training data.

Innate vs. Developed Language: A Review of Our Path Traversed Thus Far

In our series “Innate vs. Developed”, we have explored the nature of language, challenging a widely held view that language is completely and innately hardwired in the human brain. Drawing upon “The Language Game” and “Rethinking Innateness” as sources of inspiration, we have considered the notion that language is an emergent, culturally-evolved phenomenon that mounts atop an “inner scaffold” that exists within our brains and further refines and specializes our neural networks through simple repeated social interactions over time.

We also considered how developing proficiency in reading and writing yet further extends and reinforces these channels across our brains – and how developing proficiency in multiple languages and literacies makes those networks even yet more robust.

We went further afield and investigated Cormac McCarthy’s ponderings on a seeming division between language and the ancient parts of our brain that exist before and beyond language. We also investigated the paradoxical nature of language, in that it can both enhance and potentially occlude our connection to our unconscious selves and to our natural world.

I promised at the end of [the first post in this series]((https://languageandliteracy.blog/language-like-reading-may-not-be-innate) that I would “maybe dig into the relation of cognition and language and literacy a little, and riff on the implications for AI, ANNs, and LLMs.” It’s taken me some time to let all of this ripen, especially given the rapid pace at which LLMs are developing. I think I’m finally starting to gain some perspective on LLMs that may allow me to indulge in a little riffing.

Sources for Spelunking

Before said indulgence in my next post, I’ll first outline a few sources I will draw upon at the outset so you can go off and explore on your own before being further biased by my own rambling.

First, if you are interested in learning more about that analogy of a high dimensional semantic gradient and gaining insight into how LLMs kinda work, I recommend three sources shared by Ethan Mollick (he himself is also an excellent source):

Second, if you want to explore some interesting aspects of language itself that are related to LLMs, check out the following:

An Anticipation of Where We May Go From Here

From these and other sources, including dabbling with Copilot and Claude and Gemini, I will ponder some of the following points on what computational neural networks may be able to tell us about language and what language may be able to tell us about LLMs – and, ultimately, perhaps, what this all may be able to tell us about teaching and learning:

  • The surprisingly inseparable interconnection between form and meaning
  • Blundering our way to computational precision through human communication; Or, the generative tension between regularity and randomness
  • The human (and now, machine) capacity for learning and using language may simply be a matter of scale
  • Is language as separable from thought (and, for that matter, from the world) as Cormac McCarthy said?
  • Implicit vs. explicit learning of language and literacy

#language #literacy #LLMs #computation #statistical #learning #ai

 
Read more... Discuss...

from The Home Altar

Sailboat model

It’s been a little bit as I’ve been spending time being gentle with myself. I hope that my readers and clients find ways to take that freedom too when life is momentous, heavy, or hard. Almost immediately after sharing my post about the reflective practices of Holy Week, my own family life was upended by loss, grief, and bereavement.

Inside our household at St. Clare House, we’ve been riding the waves of challenge as our dog Matteo ages. He is losing his sight. He isn’t a puppy or even an adult dog now at 14 years old. He’s a senior. Along with this slow moving transition, he had a serious bout of pancreatitis, which can be fatal if left untreated. While he has made it through treatment and a restricted medical diet and seems to be doing well, this is another step in the aging process of decline. Recognizing that a beloved creature has less time left than we have already richly enjoyed brings grief.

As if this were not enough, all of these household gyrations and animal hospital visits took place in the same space as a broader family loss. My partner’s father had been failing in health since 2022, and in 2024 the decline worsened. So it was that on Wednesday of Holy Week we were rushing to the animal hospital even as our other family members were taking him to the emergency room on Holy Wednesday.

Unsure of how things might play out, knowing how many small emergencies had subsided in the past two years, we remained home for one more night. The very next morning we were greeted by the phone call no one wants to get, “something has happened and they are working to revive him.” Fifteen years of chaplaincy and bereavement care in the parish told me that we had arrived at the final chapter.

In lieu of the traditional Holy Week exercises, we spent Maundy Thursday racing to Connecticut so we could be bedside with the rest of the family. We participated in my father-in-law’s receiving the sacrament of the sick and last rites. We said goodbye to this well loved father, father-in-law, husband, friend. We learned the gut punch of the Paschal mysteries first hand as we watched him die.

We held each other in tears, through donated meals, in wondering, in processing, in sorrow, and in relief. We stayed close to the upper room of the family dining room, wondering if there could still be life in the face of this very real loss. We began the process of telling the story of this man we loved to one another, so that we would be ready to recount it to others in the days ahead.

The shock of Good Friday. The silence of Holy Saturday. All embodied in a gathered body in a family childhood home. Easter was weird. The mention of my father-in-law in the intercessions brought fresh weeping. The meal was delicious and good, and it was so good to be together and yet so strange. Somehow we had come to the day of resurrection “still doubting and wondering”.

At first, I felt thrown by this turn of events, and by the way in which the rituals of personal bereavement had supplanted the ritual practice of the Holy Days. In addition, I had finished a Lenten routine that I dearly loved and found very anchoring throughout the season, and it seemed as though now I was untethered.

It was only as I was reflecting with my own spiritual director that I saw how I was riding out the storm thanks to the ballast of my practice (both old and keeping a few items from Lent), and that while I might feel a bit rudderless (unable to steer), my balance in the waves was holding up. Daily meditation through breath prayer, walking, and my prayer rope had continued at habitual level, and I had barely noticed. The daily offices were like old friends, coming and calling each day to see how I was. Praying for others felt purposeful. These all anchored me as I gave loving guidance to family members as they planned a funeral and a celebration of life, prepared obituaries, and crafted heartfelt eulogies. My experience of doing this hundreds of times made these compassionate tasks a source of comfort to them and to me.

I’m still grieving and I will be for some time. My practice has not been a shortcut or a workaround for the bodily sensations, the warm tears, the sadness, the laughter at good memories, or the gratitude of watching a large family grieve well and marveling at the privilege of being a part of it. At the same time, I don’t feel like I’m sinking, and I’m confident that this moment of suffering can be met with compassion for myself and others.

Practice

Take a moment to sit quietly and anchor yourself in your breath.

Reflect on your week.

Can you catch yourself being kind to you?

What did that kindness look like?

When you have noticed yourself moving from fixing to experiencing, what habits helped you make that shift?

 
Read more...

from chaosorc

She climbed in the car and shut the door.

Hey girlfriend

Hey, the word dragging out in excitement

The two hugged

Let's go we don't want to keep him waiting

They laughed

So, she dragged out the word while putting together the next question and driving, turning the wheel. Someone's in love?

She laughed and it was infectious.

Yes, I think so.

Well you better be, you are moving in together

Yass

They paused and listened to the music, smiling at traffic at the stop light.

Moving closer

What

I'm not moving in in, I'm moving into the same complex, in.

That's not even the same thing

Shut up

The car started moving again, she was turning the wheel and making a left turn and when it was complete smiled at her friend, but you are in love

Yass

They were picking up speed on the highway now.

One thing at a time

It's how you get there

How about you

Oh you know, Marco is a piece of shit.

Well

She was picking up more speed, signaling to get into the middle lane now.

He asked for full custody

He doesn't even have full custody of himself

He lives with his girlfriend now, she can help

Oh

They were tailgating a work truck with a large orange cooler on the back.

They arrived at the moving company. The flat part of town, semi industrial, white washed buildings and black asphalt curling in the sun. Cars crowded the highway, glass front buildings, adult boutiques and lingerie shops next to strip clubs and boat dealerships. The moving company doubled as a storage facility, white stucco with red doors and awnings which matched the moving trucks for rented.

Want me to wait

That's him over there

Then call him over

She climbed out of the car and motioned, he was standing outside his car smoking. He crushed out the cigarette and hurried over. They hugged and he held her for a long time and the two leaned to look in the open passenger window.

Anna this is Andy

They rented a moving truck and he drove, she was in the passenger seat. It smelled like a plastic navy bench seat cooking in the sun, a public place that had been rented to many people.

Thirsty

So's the beast, he motioned to the gas gauge.

At the gas station he got out to pump and when it was finished he hung up the handle and approached her open window.

Let's go

Inside they got crushed ice drinks with funny straws. They stood and drank in the bright sun.

Gonna get burned

Bring anything

She held out her drink and he took it, looking inside and thinking about trying it. She had mixed cola and cherry, his was the lime green flavor.

She produced sun tan lotion and pulled his sunglasses off and put them on her forehead because she was wearing her own pair. She put lotion on her hands and then smeared it carefully on his skin, avoided his eyes. Then, put his sunglasses back on his head and kissed him on the lips.

He looked impressed that she came prepared.

She put her sunglasses on his head and repeated the process for herself, careful not to mess up her make-up. Once her sunglasses were back on and she had her drink in her hand he said, lets go, lady.

 
Read more... Discuss...

from bruegge.dev

🪣 Wow, more than 6 weeks since my last link dump post. But I like how this is going. I collect the links over time and revisit them later to write something about them. Some of them I hve totally forgotten by now. 😅

3 Vim commands for blazingly fast navigation between brackets: you can always learn something new. After +10 years of vim/neovim, I didn't know these little gems, mostly 2 and 3. 1 is a long time goto for me. Link: https://m4xshen.dev/posts/vim-commands-for-navigation-between-brackets/

Draw an iceberg and see how it will float: Lately, we had this topic where an iceberg is not floating like you know it from movies, where you see just the tip and the rest is underneath, like for example, a bottle half filled with water. This little game illustrates it nicely, how an ice could actually float. Link: https://joshdata.me/iceberger.html

Show distances of a map by time instead of space: I really like the Idea behind this. The Author also hast a Video where he explains everything about the idea. Link: https://spacetime-maps.vercel.app/

https://www.youtube.com/watch?v=rC2VQ-oyDG0

Price Per Part for Lego Sets: A little Lego geeking here. Link: https://brickinsights.com/statistics/ppp

Breaking Down Tasks: I had a nice read with this post, also the other posts from this author are good reads. This is how I have tried to tackle my tasks for some years now, and it works good enough, I think. Sometimes I'm a bit too lazy to work out the details, this is where my estimates are not the best ones. 😅 Link: https://jacobian.org/2024/mar/11/breaking-down-tasks/

Rethinking the startup MVP: Building a competitive product: Another good read. Link: https://linear.app/blog/rethinking-the-startup-mvp-building-a-competitive-product

Refactoring.Guru makes it easy for you to discover everything you need to know about refactoring, design patterns, SOLID principles, and other smart programming topics: This is a site I check out from time to time and read about some topics, mostly about design patterns. Just to verify that I still could explain a term. Link: https://refactoring.guru/


24/100 of #100DaysToOffload

#log #linkDump

 
Weiterlesen... Discuss...

from Quick Tip Tuesday

Ransomware is malware (short for malicious software) that prevents you from using your computer or phone and asks you to pay to restore your access.

It is most commonly spread through phishing attacks, but can spread the same way as any other malware.

If you'd like to know more, click here for a Berkeley University FAQ.

Did you like this tip?  Click Yes or No.

 
Read more...

from Zéro Janvier

Je connaissais la linguiste Laélia Véron pour le podcast Parler comme jamais qu’elle co-animait avec Maria Candea et que j’écoutais avec plaisir. Certains d’entre vous la connaissent peut-être également pour ses chroniques sur France Inter. Par contre, je ne connaissais pas Karine Abiven, « chercheuse spécialiste du discours à la Sorbonne » d’après Wikipedia, avec qui elle a co-écrit l’ouvrage Trahir et venger, Paradoxes des récits de transfuge de classe, publié en ce mois d’avril 2024 chez La Découverte.

Les récits de transfuges de classe – c'est-à-dire des personnes ayant connu une forte mobilité sociale, souvent ascendante – se sont multipliés ces dernières années, dans des domaines divers (littéraire, sociologique, politique, médiatique) et sur des supports variés (livres, journaux, réseaux sociaux). Comment expliquer un tel succès ? C'est que le récit de transfuge traite aussi bien d'enjeux collectifs (la place des classes populaires, les injustices et les possibilités de réparations sociales) que d'enjeux personnels (le parcours de vie singulier, l'identité fractionnée, l'acceptation de soi), dans une perspective souvent présentée comme politique.

Peut-on à la fois trahir les siens, en changeant de classe, en adoptant d'autres valeurs, voire une autre identité, tout en prétendant les venger, en leur offrant un espace de représentation, en leur rendant une parole publique dont ils et elles sont privées ? Tel est le principal paradoxe du discours de transfuge qui prétend porter une parole populaire mais qui peut être accusé de la confisquer.

En adoptant les outils de l'analyse du discours, ce livre interroge les ambitions du récit de transfuge de classe. Est-il un contre-récit, qui s'oppose aux récits dominants, ou bien est-il devenu, malgré lui, un récit mythique, récupéré par le storytelling médiatique et politique libéral ?

L’ouvrage comporte 6 chapitres qui commencent par définir la notion de transfuge de classe, de dresser la généalogie de cette expression, avant d’entrer dans le détail des caractéristiques et des limites de ces récits :

  1. Récits subjectifs contre catégorisations scientifiques ?
  2. Du traître au vengeur ? Histoire de l’expression « transfuge de classe »
  3. Transfuges partout ? Extension du domaine des récits
  4. Modèles, recettes et subversions du récit de transfuge de classe
  5. Langue dominée et langue dominante : vers un style de transfuge ?
  6. Des récits politiques ? Pouvoir dire « nous »

Les deux autrices proposent une analyse critique des récits de transfuge de classe, à la fois sur le fond et sur la forme : le style, le lexique, la structure des récits, mais aussi leur portée politique et les idées qui les portent ou en émergent consciemment ou inconsciemment.

J’ai trouvé cela très intéressant, souvent pertinent, avec de véritables questions posées sur la nature et les buts des récits de transfuges de classe, mais aussi sur leur réception médiatique et publique, qui peut être en décalage avec les intentions de leurs auteurs. Si comme moi vous êtes à la fois friands de ces récits de transfuge de classe tout en étant parfois agacés ou gênés par leur apparente omniprésence médiatique, je ne peux que vous conseiller de lire ce livre qui en analyse très bien les logiques.

 
Lire la suite... Discuss...

from An Open Letter

We went ice skating and talked for about two hours. After that, we ended up wanting to talk more and just went driving and exploring for a few more hours. I felt incredibly comfortable around them, and I really enjoyed their presence. There are some fears I have I guess, but that’s to be expected. I feel like I’m somewhat entering the unknown, this could go several different ways – but also a rich life is better than a safe one I think.

R – 3 breaths

E – I am a bit nervous about the uncertainty of dating this person, especially with my fear of having an incredibly good relationship that ends up becoming codependent.

S – Maintain boundaries and don’t put all my eggs into one person.

T – Hang out with other friends, like S and L and S and L lol.

 
Read more...

from phillip prado

Simple CTF is an easy, beginner-friendly capture the flag exercise on TryHackMe. It features a vulnerable CMS, a weak user password, and misconfigured sudo user privileges that lead to root level access.

Disclaimer 2: This post will include spoilers for the room, so be mindful of reading this if you want to solve the challenge on your own. Flags and cracked hashes will remain obfuscated.

Enumeration

Let's start our enumeration with Nmap.

We can run Nmap to check open ports with the -A flag, so we don't have to enumerate versions, run default scripts, and enable OS detection separately. Sometimes we will want to be more stealthy and avoid such an aggressive scan, but this is not one of those cases.

nmap -A 10.10.252.159

With the results, we find out many different pieces of information. We learn there is an FTP server on port 21, an HTTP server running on port 80, and an SSH server on port 2222, which we will explore in a bit.

This gives us the answers to the first two questions:

1. How many services are running under port 1000?

2

2. What is running on the higher port?

SSH

Not only that, but we also learn that FTP allows for anonymous logins. We can take advantage of this as we start exploring the rest of the system.


Exploration

Before exploring the website hosted on port 80, let's take a look at the vulnerable FTP server by entering the following command and logging in with the user “anonymous” when prompted.

ftp 10.10.252.159

Here, we can see there is a single directory called “pub,” and if we change directories to it, we see a file titled “ForMitch.txt.” Let's download that file to our local machine.

get ForMitch.txt

After downloading the file and exiting FTP, we can cat its contents. As expected, we see a message for someone named Mitch.

Dammit man... you'te the worst dev i've seen. You set the same pass for the system user, and the password is so weak... i cracked it in seconds. Gosh... what a mess!

This lets us know the user Mitch might be an easy target later on. For now, that's all we can gather, so let's start exploring the web server.

In the browser, we navigate to the target IP address. We don't really find anything of note here, so let's try further enumeration with gobuster to see if there are any other directories we can find:

gobuster dir -u http://10.10.252.159 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

The output tells us there are a few other directories worth checking out, including /simple and /server-status. The latter throws up a 403 error as stated in the gobuster output, but the former takes us to a CMS.

Upon further investigation, we find the CMS is running something called “CMS Made Simple version 2.2.8.” We can search Exploit DB to see if there are any exploits for this particular piece of software.

And, just like that, we find the answer to our next two questions by finding an exploit and reading about it:

3. What's the CVE you're using against the application?

CVE-2019-9053

4. To what kind of vulnerability is the application vulnerable?

SQLi

Now that we have an exploit to try, let's move on to the next phase and see if we can make any progress.


Exploitation

After downloading the exploit from Exploit DB, we now have a Python script on our system called “46635.py.” Now, this is where we run into our first real hiccups in this exercise.

Either from reading the script manually or attempting to run the script first, we realize this script is Python2, not Python3. After trying to run the code as Python2, trying to update the code manually, and even trying to automate the update process with 2to3, we aren't able to get the script to run 100%.

We can get the script to run and reveal a username, password hash, password salt, and an email address. The script should continue running to crack the password, but it keeps erroring out at this point, and I can't get it to work.

What we can do is use hashcat to manually crack the password, since we have both the hashed password and the salt. After some tinkering with hashcat, this is what we land on:

hashcat -O -a 0 -m 20 0c01f4468bd75d7a84c7eb73846e8d96:1dac0d92e9fa6bb2 /usr/share/wordlists/rockyou.txt

We can also use the --force flag to get the command to run instead of -O. Honestly, I'm not sure which solution is better, but at least there are multiple ways.

Anyway, after running hashcat we get the output revealing the cracked password and giving us the answer to the next question:

5. What's the password?

******

And, after some testing and referring to our findings from the enumeration step earlier, we find the answer to the next question as well:

6. Where can you log in with the details obtained?

SSH


Gaining access

Now that we have the credentials for the SSH server, we can gain a foothold on the system.

ssh mitch@10.10.252.159 -p 2222

With a simple ls command, we can find the user flag, and cat the contents to get the answer to the next question:

7. What's the user flag?

******************

The answer to the next question is as simple as navigating up one directory vid cd .. and another ls to reveal the other user:

8. Is there any other user in the home directory? What's its name?

sunbath


Getting root

We are on the home stretch now. There are only a few more steps to gain root and crack the box. First, we can see the next question is asking us how we can escalate privileges.

To achieve this, let's see what commands Mitch can execute as sudo. We find this out with the command sudo -l, which reveals the answer to our penultimate question:

9. What can you leverage to spawn a privileged shell?

vim

By navigating to our browser and heading to the GTFOBins GitHub page, we find that users can use vim to escalate privileges to root with a simple command:

sudo vim -c ':!/bin/sh'

All that's left is to navigate to the root directory, cat the “root.txt” file, and get the answer to our final question:

10. What's the root flag?

***********************


Summary

When all is said and done, we've now completed the Simple CTF exercise on TryHackMe. We first enumerated any services and ports on the target. Then, we explored the vulnerable FTP server, browsed the HTTP server, and enumerated a vulnerable CMS at a separate directory.

After that, we exploited that CMS to gain SSH login credentials, giving us a foothold into the system. Finally, we took advantage of poorly configured user sudo permissions to escalate privileges and gain root.

Tags: #CTF Comments:

 
Read more... Discuss...

from Fun Hurts!

I don't remember how many soccer balls I had in my childhood (not a lot though, it was a tough time). But I vividly remember one of them – it was a classic black and beige-white, vintage AF. Maybe it left such a sharp footprint in my memory because I also remember my father stitching it up after some good beating in the mud. Can't really imagine myself doing the same nowadays. With modern goods, you don't even have a chance to express love and care; that opportunity has been taken from us by mass manufacturing, for better or worse. Open “my orders”, click “buy it again”. Problem solved. Convenient and soulless experience.

But the brightest memory from around that age is my bike. Steel, single-speed, flat pedals, coaster brakes. Those brakes... they were so much fun! Spraying mud, competing for the longest skid mark, track standing, you name it. Article 31 of UN Convention on the Rights of the Child must include the statement that all kid's bikes must be equipped with coaster brakes, seriously.

We used to wrap the spokes with wires of various colors. Spoke tensioning? Compliance? Rotational weight? What are you, a boring 40-year-old MAMIL with a midlife crisis? Hell no (well, technically, the answer to that is “yes,” but I refuse to accept that). It's all about the look. It's all about silly boys having good old fun.

I want to be that boy sometimes. Or act like him. The moment this bubble-head dies inside me, I quit riding bikes. Doesn't matter if I'm still fit or not. I didn't start doing that because I had strong legs and high VO2max. And those in decline are not the reason to stop either. But if a grim face replaces a smile – that's a pretty good sign to switch focus to online chess or whatever.

So, back to the biological age of 40 years old. It sits on the porch, waiting for its turn to knock on my door. Tax day came here first. But a silly boy in me said “fuck off” to that creepy monster. Not interested. Not fun (anymore, it sure used to be). Too busy today. Chasing the piece of mind, aka shopping for the bike parts.

That's the curse and the joy of being an adult – you don't wait for presents, you make them. But the choice is all yours. And I made mine about six weeks ago. My credit card got charged, and a few days later, a delivery truck showed up. Just like that. Easy. Perhaps too easy. As if I was restocking on napkins and trash bags. In that box was a nice looking, well-specced, fancy racey hardtail. I quickly put it together, and then... nothing happened.

Fortunately, nearby trails were still covered in snow. So, the shiny new steed stood right in front of my desk for two weeks straight. Clean, fast-looking, spreading a delicate smell of fresh rubber. The trails were drying out, the temps were going higher, and the daylight was getting longer. The moment to take the new rig out was coming. You could feel it. Well, maybe someone could. Because I felt nothing. An absolute zero desire to ride the thing. Precisely the same level of excitement as in opening a new box of those trash bags, but sprinkled with a bit of regret for making such a mistake. So, thanks to a generous return policy, it went right back to where it came from. Relief.

I do still need/want a new bike. But not “just another” bike. I want it to be mine. Not the one that just belongs to me, but the one that is me. As a rider, I have opinions on what's important in bike design/componentry and what's not so much. I also have a taste (a terrible one, I'm not delusional in that regard, but it's mine). And I want to have fun. Fun building it, fun riding it, fun writing home about it. Her, not it. The moment I stepped back and looked at what seemed to become a final outfit, I couldn't help but whisper: “She's a beauty.” Her name is Penny now (it was supposed to be Penne because I expected it to come out as a spaghetti monster).

I won't go into the technical details of the build (but you can get a pretty good idea from the picture below). But I must mention the frame because the story about the ball would otherwise look irrelevant to the rest of this post. I own two carbon bikes. And I love them, like everyone loves theirs, for a good reason. They are freaking rocket ships. Mass-produced, easy to crack, not so easy to repair, non-recyclable. As cool as they are – they are a commodity. I don't know why, but it feels that way. Steel or titanium hits differently. Someone welded and engraved that thing! It's so crafty, so touchy, so natural. And if shit happens – a good welder can stitch it back up. It's truly yours for life.

Fun hurts, though, you know. Having fun building a bike means making not one choice but many. I had no idea how many. Last summer I was wondering why the flick a wheel builder put a spacer onto my XDR freehub body (at first I didn't even notice it was there, gave me such a headache). Well, now I even know its width by heart, down to the hundredths of a millimeter. You live – you learn. Cranksets having all kinds of a spindle diameter? Chainlines? Spacers? Gosh, give me a break... But the first time it all paid off was on Wednesday morning when a mechanic called me saying that this was one of the best builds he had ever worked on because every single part had been so perfectly picked. I haven't ridden it yet, but it felt like I've already got a PR, if not a KOM, on a “But First, You've Got to Build Your Bike, Sir” segment.

Lightweight or red? Red, of course. How's that even a question? Okay, okay... Who doesn't like their bikes to be light, right? I do appreciate my lightweight gravel race machine. Thing rips, as they say. But do you remember that taste thing I've been talking about, which I kinda have, but not really? Well, for better or worse, now that thing has become a priority. We are going all in on matchy-matchy, whatever it takes. And everything that doesn't contribute to the color accents just needs to be sturdy enough to last for a lifetime. And the weight... let's leave some room for the upgrades, right? Haha.

The pedals, though. Now I'm on eggbeaters, but I did put the flat ones on first, even though I hate them. I really do. “Why are you using them?” – my buddy asked me on a ride. There was one objective reason, but it's kind of irrelevant. The main idea was: that's all we had when we were kids. Yep, dead simple. Back to the roots. Back to the pure fun of riding bikes with other boys and girls, joking around, and drinking beer in the parking lot.

Happy birthday. Good luck, have fun.

 
Read more...

from I hope this blog post finds you well

I didn’t know. I had no clue. All this time, I thought the idea of owning a tactical EDC flashlight to be patently absurd. Why would I ever need 1300+ lumens? Is 1300 lumens even a lot? I have no way to contextualize what 1300 lumens even means. Until today.

I take prescription meds for Parkinson’s and depression. The Parkinson’s meds can cause addictive/compulsive behavior. I don’t drink and sports gambling is illegal in Georgia, so I online shop too much. I recently changed depression meds, and now I don’t sleep. I’m up all night tinkering with my tiny keyboard or my tiny computer and eventually I see an ad or get a thought in my head that leads me to spending $100s of dollars at two in the morning. Usually I end up canceling my order or returning what I buy. But last week I went a little overboard with my online spending.

Tweeting about tactical flashlights makes the algorithm send me ads and affiliate link spam articles about tactical flashlights, and as it turns out, one flashlight company was having a pretty good sale. I got a flashlight, a charger (that can charge other USB devices), and a free tiny flashlight. The tiny flashlight sold the deal for me. Now I have a tiny flashlight on my keychain. It joins my tiny Hydro Flask, my tiny keyboard, and my tiny wireless trackball as the latest member of my tiny everyday carry. Just look at how cute the little guy is!But the tiny flashlight was just a bonus. The tactical flashlight changed my life. When I saw how it illuminates a dark room, I knew that I had discovered something wonderful. I had uncovered a beautiful new facet of the universe. Look at how bright this thing is.The room is completely dark, but the flashlight beam is bright enough that I can read the spines of Volumes I-XX of the OED from across the room. This is what the discovery of fire must have felt like. I feel powerful. Indestructible. I want to start dressing like Oppenheimer. And if any of you think you can sneak into my house at the night and steal one of my weighted blankets, think again. The darkness cannot hide you from the tactical EDC flashlight. Unless I forget to charge it, because I guess the battery only lasts like seven minutes on the highest power. But during those seven minutes, I am the modern Prometheus.

#flashlight #tinyedc

 
Read more...

from Roscoe's Story

Monday 22/Apr/2024

Prayers, etc.: • 05:00 – Prayer to St. Michael the Archangel • 06:00 – the Angelus • 06:30 – Thought for today from Archbishop Lefebvre: It is not only desirable but indispensable to take the time of a retreat to truly recollect ourselves and to find God again in our soul, in our mind, by the grace which is in us. Our Lord Himself showed us the example. Even though He had absolutely no need to retire into that solitude, He spent forty days and forty nights in the desert. • 07:30 – Praying the Joyful Mysteries of the Holy Rosary, followed by The Memorare • 08:10 – Bishop Strickland on Tidal Wave of Apostasy – Refers to Daniel the Prophet – Dr Taylor Marshall • 12:00 – the Angelus • 18:00 – the Angelus • 20:15 – The hour of Compline for tonight according to the Traditional Pre-Vatican II Divine Office, followed by Fr. Chad Rippberger's Prayer of Command to protect my family, my sons, my daughter and her family, my granddaughters and their families, my great grandchildren, and everyone for whom I have responsibility from any demonic activity. – And that followed by the Monday Prayers of the Association of the Auxilium Christianorum.

Health Metrics: • bw= 223.40 lbs. • bp= 139/74 (70)

Diet: • 05:45 – ½ pb&j sandwich, 1 banana • 10:30 – 1 baked potato, 4 hot dog sandwiches • 16:00 – fish sticks, breaded shrimp • 19:15 – plate of nachos w. cheese and steak • 20:10 – ½ banana

Chores, etc.: • 05:00 – listen to local news talk radio • 05:45 – bank accounts activity monitored • 09:15 – Bannon's War Room • 09:30 – start my weekly laundry • 13:15 to 14:45 – yard work, trim front lawn • 16:00 – follow news reports from various sources • 18:30 – Wheel of Fortune • 19:00 – tuned into the White Sox vs Twins MLB game

Chess: • 13:15 – moved in all pending CC games

posted Monday 22/Apr/2024 ~20:35 #DLAPR2024

 
Read more...

from phillip prado

(Proton can now notify users when their information is found floating around the dark web.)

Proton's toolbox is ever expanding. From acquiring other companies like SimpleLogin or Standard Notes to building out features like Proton's Security Center, we have come to expect constant improvements from the Swiss-based company. Now, the aforementioned Security Center sees another update in the form up dark web monitoring.

Yesterday, the company announced a new feature that can notify users when Proton's system detects a breach affecting them and offers suggestions of how to mitigate risk. This retroactively includes breaches from up to two years ago and will include as many breaches as possible moving forward.

“With so many data breaches, including of major websites generally considered safe, protecting your accounts is no longer a question of whether your credentials will leak, but whether you are prepared with additional safety measures in place to prevent damage,” Proton write in their announcement blog post. “Proton offers a robust safety net to protect our community, of which Dark Web Monitoring for credential leaks is just the latest example.”

This feature is possible because of Proton's continuous scanning of dark web hubs known for illicit activities. Some notable sources are various hacking forums and dark web markets.

Proton search for their 19 available email domains to identify affected customers. This includes all Proton Pass and SimpleLogin aliases, not withholding your custom domains used on your accounts.

Proton utilize their own threat intelligence datasets mixed with data acquired from Constella intelligence to effectively hunt for these threats and breaches. They also assure none of this information is shared with third parties, though they do admit to ingesting data from other sources to better spot leaked Proton user credentials.

As I previously mentioned, once you are alerted that Proton has spotted your credentials somewhere on the dark web, they will label the severity of the leak and offer suggestions as to what you can do to safeguard your digital identity and mitigate further impact.

The feature is opt-in, and though Proton have plans to include dark web monitoring functionality into their mobile apps in the future, it's currently only accessible via the web and desktop apps.

You'll also need a paid Proton account to take advantage of dark web credential monitoring. So, if you haven't made an account, you can sign up for a free month of Proton Mail Plus at my referral link below and test it out for yourself.

Try out Proton Mail Plus for free

Tags: #News Comments:

 
Read more... Discuss...

from mimo

En janvier dernier, le chef du Bloc québécois qualifiait la société québécoise de «très généreuse société d'accueil». Si c'est le cas, comment s'explique la montée d'un nationalisme identitaire de moins en moins complexé qui me semble une dangereuse dérive?

#Migration #Nationalisme #Polarisation #Politique

Yves-François Blanchet était interviewé par la Presse canadienne dans un article repris sur le site de Radio-Canada. Blanchet ajouta «Il faut que ce soit une seule culture, une seule nation, avec toute sa diversité. C'est ça, le Québec. Et on est en train d'échapper ça.»

Notez la contradiction entre les mots «une seule» et «diversité» dans la même phrase.

De fait, ce que nous sommes en train d'échapper me semble plutôt le nationalisme d'ouverture qui caractérisa les premières années du Bloc québécois et surtout, du Parti Québécois.

Ce dernier est passé d'un nationalisme civique, politique, ouvert ou inclusif de ses premières années, à un nationalisme ethnique, fermé, replié ou exclusif, c'est-à-dire un nationalisme identitaire.

Jean-François Laniel, professeur au Département de sociologie de l’Université Laval, distingue trois tendances dans l'évolution récente du nationalisme québécois: «la renationalisation du champ politique québécois, reconnaissable à un regain nationaliste à la fois culturel et politique (...) la républicanisation du nationalisme québécois, plus exactement la républicanisation des politiques publiques et du discours sur l’identité et l’histoire nationales (...) l’écologisation du nationalisme québécois (extraits de l'article Le nationalisme québécois au XXIe siècle. Trois tendances récentes)

J'avoue que la troisième tendance m'a d'abord intriguée. Selon Laniel, elle procurerait une justification morale et un horizon éthique au nationalisme québécois.

En somme, Québec inc. remplacé par Québec vert.

Quant à la première, on a pu croire qu'après la défaite du oui au référendum de 1985, la lutte politique se ferait désormais entre les progressistes et les conservateurs. Mais le nationalisme s'était tout simplement fait plus discret.

Jusqu'à ce que la crise des accommodements raisonnables et le débat sur la laïcité du Québec, le remettent à l'avant-plan.

Comme le dit l'adage, chassez le naturel...

Sauf que ce qui est revenu au galop, c'est un glissement vers un nationalisme intolérant.

Autant l'approche civique du nationalisme québécois témoignait d'une ouverture et d'un accueil des personnes venant vivre ici à laquelle j'adhérais, autant le nationalisme identitaire me décourage.

Le nationalisme québécois avait cessé d’être un projet progressiste et «ouvert sur le monde» pour devenir un conservatisme centré sur la défense des valeurs de la « majorité historique francophone », comme l'explique la journalisme Francine Pelletier dans son livre _Au Québec c’est comme ça qu’on vit.

En écoutant l'entrevue qu'elle a donnée à Radio-Canada en septembre dernier où elle explique d'où lui est venu l'idée de ce livre – un Premier ministre qui dit dans une adresse à la nation que les personnes venues vivre ici doivent accepter de vivre comme nous –, je n'ai pas pu partager ses craintes, formulées vers la fin de l'entrevue, de voir la culture québécoise noyée dans la culture mondiale à la sauce étasunienne qui déferle sur le Québec.

Nous avons la chance de vivre à une époque où l'accès à toutes les cultures du monde n'a jamais été aussi facile et il faut s'en réjouir. Ce n'est pas plus une menace que l'immigration.

La véritable menace, une erreur collective qui a fait souffrir tant de personnes dans le monde, c'est le nationalisme identitaire.

————— En complément: mon billet du 18 avril Signes religieux, déroger ou non aux Chartes?

 
Lire la suite... Discuss...

from G A N Z E E R . T O D A Y

Mythomatic orders fulfilled and paintings hauled to the vault, and that's my exercise for the day. Read Dominic Boyer's NO MORE FOSSILS, which distills extensive research into an immensely insightful handy 96-page sort-of-pocketbook.

Remainder of the day will have to constitute feeding myself and tidying up after spending weekend with the child, get the space in good operational order for the work week ahead.

#journal

 
Read more... Discuss...

Join the writers on Write.as.

Start writing or create a blog