Hacking/attack experiences...
I'm, for obvious reasons, only going to talk about the attacks I went through and the *legal* ones I did 😅 😜

Let's first get some things clear/funny facts:
I've been doing offensive security since I was 14-15. Defensive since the age of 16-17. I'm getting close to 23 now, for the record.

First system ever hacked (metasploit exploit): Windows XP.
(To be clear, at home through a pentesting environment, all legal)
Easiest system ever hacked: Windows XP yet again.

Time it took me to crack/hack into today's OS's (remote + local exploits, don't remember which ones I used by the way):
Windows: XP - five seconds (damn, those metasploit exploits are powerful)
Windows Vista: Few minutes.
Windows 7: Few minutes.
Windows 10: Few minutes.
OSX (in general): 1 Hour (finding a good exploit took some time, got to root level easily aftewards. No, I do not remember how/what exactly, it's years and years ago)
Linux (Ubuntu): A month approx. Ended up using a Java applet through Firefox when that was still a thing. Literally had to click it manually xD
Linux: (RHEL based systems): Still not exploited, SELinux is powerful, motherfucker.

Keep in mind that I had a great pentesting setup back then 😊. I don't have nor do that anymore since I love defensive security more nowadays and simply don't have the time anymore.

Dealing with attacks and getting hacked.

Keep in mind that I manage around 20 servers (including vps's and dedi's) so I get the usual amount of ssh brute force attacks (thanks for keeping me safe, CSF!) which is about 40-50K every hour. Those ip's automatically get blocked after three failed attempts within 5 minutes. No root login allowed + rsa key login with freaking strong passwords/passphrases.

linu.xxx/much-security.nl - All kinds of attacks, application attacks, brute force, DDoS sometimes but that is also mostly mitigated at provider level, to name a few. So, except for my own tests and a few ddos's on both those domains, nothing really threatening. (as in, nothing seems to have fucked anything up yet)

How did I discover that two of my servers were hacked through brute forcers while no brute force protection was in place yet? installed a barebones ubuntu server onto both. They only come with system-default applications. Tried installing Nginx next day, port 80 was already in use. I always run 'pidof apache2' to make sure it isn't running and thought I'd run that for fun while I knew I didn't install it and it didn't come with the distro. It was actually running. Checked the auth logs and saw succesful root logins - fuck me - reinstalled the servers and installed Fail2Ban. It bans any ip address which had three failed ssh logins within 5 minutes:
Enabled Fail2Ban -> checked iptables (iptables -L) literally two seconds later: 100+ banned ip addresses - holy fuck, no wonder I got hacked!

One other kind/type of attack I get regularly but if it doesn't get much worse, I'll deal with that :)

Dealing with different kinds of attacks:

Web app attacks: extensively testing everything for security vulns before releasing it into the open.
Network attacks: Nginx rate limiting/CSF rate limiting against SYN DDoS attacks for example.
System attacks: Anti brute force software (Fail2Ban or CSF), anti rootkit software, AppArmor or (which I prefer) SELinux which actually catches quite some web app attacks as well and REGULARLY UPDATING THE SERVERS/SOFTWARE.

So yah, hereby :P

Not just another Windows rant:

*Disclaimer* : I'm a full time Linux user for dev work having switched from Windows a couple of years ago. Only open Windows for Photoshop (or games) or when I fuck up my Linux install (Arch user) because I get too adventurous (don't we all)

I have hated Windows 10 from day 1 for being a rebel. Automatic updates and generally so many bugs (specially the 100% disk usage on boot for idk how long) really sucked.

It's got ads now and it's generally much slower than probably a Windows 8 install..

The pathetic memory management and the overall slower interface really ticks me off. I'm trying to work and get access to web services and all I get is hangups.

Chrome is my go-to browser for everything and the experience is sub par. We all know it gobbles up RAM but even more on Windows.

My Linux install on the same computer flies with a heavy project open in Android Studio, 25+ tabs in Chrome and a 1080p video playing in the background.

Up until the creators update, UI bugs were a common sight. Things would just stop working if you clicked them multiple times.

But you know what I'm tired of more?

The ignorant pricks who bash it for being Windows. This OS isn't bad. Sure it's not Linux or MacOS but it stands strong.

You are just bashing it because it's not developer friendly and it's not. It never advertises itself like that.

It's a full fledged OS for everyone. It's not dev friendly but you can make it as much as possible but you're lazy.

People do use Windows to code. If you don't know that, you're ignorant. They also make a living by using Windows all day. How bout tha?

But it tries to make you feel comfortable with the recent bash integration and the plethora of tools that Microsoft builds.

IIS may not be Apache or Nginx but it gets the job done.

Azure uses Windows and it's one of best web services out there. It's freaking amazing with dead simple docs to get up and running with a web app in 10 minutes.

I saw many rants against VS but you know it's one of the best IDEs out there and it runs the best on Windows (for me, at least).

I'm pissed at you - you blind hater you.

Research and appreciate the things good qualities in something instead of trying to be the cool but ignorant dev who codes with Linux/Mac but doesn't know shit about the advantages they offer.

ESET Antivirus is a strange animal. On one hand, it seems reasonably well written, because unlike Norton or F-Secure, it doesn't subject your computer to death by constant disk access and 100% CPU load for 10 minutes when you start it.

On the other hand, when I clicked the link in the mail about renewing licenses and filled out the form, I was not redirected to a page where I could enter credit cart details.

Instead, I got message that some representative would get back to me in 1-2 work days. Eh, what? It's a digital product for f***'s sake. Now, I suppose they'll send me a hand written letter (written using a quill, no doubt), delivered by a bloke riding a horse and wearing a tricorn.

Well, at least ESET virus definition updates are pushed on the internet, and not sent out on 5.25" diskettes.

!dev

Another tinder story from last night.

Matched with a girl, I thought she was cute and all. She texted me first, and we started talking. We kinda just clicked, had similar interests and everything. Conversation turned to musicals, she said she wanted me to come listen to one with her at some point when we were both free. I mentioned the whole story from Sunday night to her (see previous rant), and told her how the girl said I was a "rebound", but nothing actually happened. Then she changed the conversation by saying something like "rebounds normally involve sex, maybe I can make up for it".

After that the conversation got sexual. Dirty talk, nudes, everything. Talking about how hard she wanted me to fuck her and everything. That carried on until about 6 in the morning. We both decided we should go to sleep.

I woke up around 11, we talked for a few minutes, then she said she had to get ready for a doctor appointment, and I didn't think anything of it. Went to work at 2, had to go get a car from a dealership like 20 minutes away. Me and my coworker got back, I decided to check my phone and see if she messaged me or anything.

Come to find out, she basically just fucking ghosted me. Blocked me, unmatched me on tinder, the whole nine yards. No warning, nothing. 8 hours earlier she was saying how much she wanted me inside her (not paraphrasing), and now she just decided "nah fuck him altogether".

I don't fucking know what it is. It's been about 10 hours since I found out, and I just..I don't know. She could have just said "nah I don't wanna fuck" and I would have been 100% fine with that. But nope. No warning, just blocked me.

I'm not mad that she just backed out of it, I'm mad that she didn't say fucking anything about it. Like, even apart from all the sexting and stuff, I genuinely liked this girl. She was nice, cute, funny, just everything I could have asked for. And now, I'm honestly kinda sad about it. Everything seemed like it was going well (maybe all the sexting would have been better for another time in the future ya know, but I can honestly say I didn't initiate it), and now I have nothing again.

why you bully me

!dev

Sorry about another non-dev rant, but I can't help it :p

I have seen a post here on devRant a few minutes ago talking about being a millionaire, so I thought I'd write a lil something for people thinking of chasing that.

As I said in a comment on that rant: as Jordan Peterson (aka Lord of the Lobsters) said, in order to be successful you need to be an industrious person, i.e. you gotta work hard, very hard. Most success stories are from people that worked very very hard (Elon Musk is one I can remember off the top of my head) and had to put their life, friends, family in second place. To this day I remember watching a video on a 30 year old millionaire, he said he didn't have friends for about 6-10 years, he just worked, worked and worked. If that's what you wanna do with your life do your thing, I'm just saying that's not it for me.

A few years back I wanted huge success (being famous, being rich), but I've come to realize that's not what I want. Being famous must suck, people recognizing you everywhere you go and shit, and being rich comes with a price (pun intended?), which is working every minute of your time for 10 years. That's not gonna make me happy, I have realized that I want to get married in my early 30's at max, have kids, buy a comfortable house somewhere in europe, have enough money to be able to give my family a good life and be able to buy and tune a few cars (that's a dream of mine btw), and maybe even try to start a company of my own (I don't like the idea of having a boss). And I think that to achieve these goals, all I need to do is be a bit smart right now: invest in fixed income, don't buy expensive shit, live with my parents at least until I get out of college and get a relatively decent job.

Anyway I might've steered off-course for a bit there, the point is: before you decide you want to be a millionaire, think what you actually want in life. If you want to be rich and are sure you have the willpower to work a 100 hours per week, do your thing, whatever makes you happy. But if you are going to work 60 hours a week and you're looking to be rich you're just going to be disappointed. You'll be chasing money all your life, sacrifice the (IMO) important things in life (friends, family, health, fun) and you won't get anywhere.

It's all or nothing, make up your mind before you waste your time.