146 posts
A follow-up to my last post, "Post-Mortem: Redis on 6379 Got Hacked, Turned into a Replica and Used to Mine Monero". This one analyzes the attacker's script and reproduces how they exploited unauthorized Redis access to get a shell and mine crypto.
We use Redis at work to cache and speed up static content. Since it was a dev environment I just spun up a Redis image in Docker and skipped setting a password, figuring iptables would keep me safe. Recently it started misbehaving.
Why am I griping about Gitee on my own blog instead of reporting it to Gitee? Because that's one of the things I'm griping about. Their issue workflow is broken too: I filed an issue, an official replied and rejected it, and once rejected I could no longer respond — so here I am, griping on my own blog.
This tool uses the webmaster tools or open platform APIs of Baidu, Bing and Google to push site updates to search engines immediately, speeding up crawling and indexing.
OmniOutliner, built by Omni, is a powerful outlining tool for writing and recording text information. Use it to capture ideas from your daily work and boost productivity — drafting to-do lists, building schedules, managing tasks, tracking expenses, taking notes, planning activities, flexibly combining creation, collection, and organization of information into one.
OmniFocus is the most powerful "Getting Things Done" tool for managing tasks and affairs on iOS and Mac, helping you organize your work and life logically. This Mac productivity tool helps you capture and manage tasks and ideas to get things done.
Somewhere along my long history with macOS I hit a bizarre failure from unknown causes, and Apple support suggested I create a new account. So I changed my username from "neil" to "renfei". After copying my data over from the old home folder, various apps kept throwing errors — and judging by the messages, they were still looking for paths under the old username.
Baidu quietly launched another tool: Baidu ZhenZhan, offering site diagnostics including a "Baidu search heat score", browser behavior, site certificate information, site security scanning, and site company information lookups.
Recently it emerged that the domain of the well-known Chinese blog Lu Songsong, lusongsong.com, had its DNS resolution suspended because the site carried content in violation of regulations. After the offending content was removed, the block was lifted and access restored.
Recently a user on the V2EX forum reported that their security software caught the PC version of WeChat scanning browser history, and that browser cookies were involved. They included a screen recording catching it in the act.
