No honour among thieves

from here and here

Of all the databases to leak on your hacking forum, one that exposes you and/or your own forum's users seems like one that would be considered off limits, but apparently the ExposeForums admin who leaked the RaidForums user database didn't feel the same way. If they wanted to just notify the members that their data had been breached there were other, more privacy-preserving ways they could have done it than to post the database where all could see it and misuse it.

Nominative determinism in cybercrime

from here and here

The notorious BreachForums was taken down after a new admin found evidence that law enforcement had breached it following the arrest of the previous admin, and the idea that a site nick-named "Breached" got breached is just too fitting. If you're going to call it Breached, don't be surprised when it gets breached.

What's good for the victim is good for the attacker

from here and here

It never gets old watching those who victimize others become victims themselves. It's like it almost makes you believe the universe is fair and just when bad things happen to bad people. Of course then bad things happen to good people and the illusion is shattered. Hopefully this breach of the chat logs for the Conti ransomware group will lead to more meaningful consequences for them.

How many patches before we can call it a quilt?

from here

If you installed the previous Log4J patch, guess what you get to do now? That's right, you get to install a new patch all over again because the old one has multiple vulnerabilities.

The best way to hack back

from here

You know what they say: Live by the sword, die by the sword. In this case the sword is vulnerabilities, and the company making profit by exploiting vulnerabilities in phones for the benefit of police and authoritarian regimes just got their ass handed to them in the form of exploitable vulnerabilities in their own product.

No honour among data thieves

from here

If there's one thing I hope I never get tired of it's laughing at the misfortune of bad guys. Crooks getting hacked will never get old.

Security through recursion

from here and here (image source)

While this provides absolutely no additional protection against bolt cutters or lock picking, there is one threat model where this actually does offer added protection. Specifically, when you share ownership of something with someone you no longer trust, apparently this is the kind of thing you use to protect it.  

GIF no quarter to the enemy

from here

I LOVE the idea of someone driving botnet operators slowly crazy by replacing the most important parts of the botnet with funny pictures. I hope they got so frustrated they pulled their hair out.

All your bugs are belong to us

from here

No one has perfect security, not even the security companies. What's important is how they handle it and it seems like HackerOne handled it pretty well.

See something, say something

from here

Apparently this is a true story, and it's also an excellent demonstration of why average joes are terrible at deciding what is or isn't suspicious.

Outsourcing done wrong

from here

What are the odds of finding a string of 5 hitmen that are all so greedy and lazy that none of them actually wants to bother doing the hit?

The Middlemen

from here

I finding myself wondering how stuff like this is legal. I'm not sure how to express it except that it feels like they inserted themselves into an existing criminal business model. 

Making private browsing private again

from here

It might not be perfect, but if major websites are actively trying to thwart it that suggests incognito mode must be doing something right.

We'll update you on further updates

from here

Though understandable, there's still a certain irony about needing to update an updater.

Nothing Facebook does surprises me anymore

from here

Well, these are some pretty profound privacy violations on Facebook's part. Just remember Zuckerberg's maxim:

"They 'trust me'. Dumb fucks"

Gosh darn policy revisions

from here

One of the computing ironies I encountered years ago was the fact that Microsoft had to update the software it uses to perform Windows Update. Literally, Windows Update needed to be updated before it could update anything else.

Microsoft isn't the only software vendor that has a special piece of software designed to update other software, either. Google has one for updating Chrome, for example.

I feel certain that at least 1 if not more of those updater programs that themselves sometimes require updates also had a privacy policy update in the wake of GDPR.

Pimp My PC

found on the Global Nerdy blog

It's not a bad explanation of virtualization, all things considered.

Said every tech vendor always

tweeted by @flohio_

If you think patching simply subtracts vulnerabilities without adding new ones no one knows about yet, I've got a bridge I'd like to sell you.

User awareness training in a nutshell

found on Meme Generator

I know there's a little more to it in reality, but definitely plays a significant role in how people get trained to be safe online. Not sure that's good enough, though.

What's good for the goose...

from here

In case you're wondering, the answer is yes, this has already happened.