jqubed

According to Reco's writeup, the common thread across every technique is the same underlying issue: a guest identity that was granted more access than the site actually needed to serve the public. Salesforce Experience Cloud sites and ServiceNow portals both maintain a persistent guest user that unauthenticated visitors execute as, and that user cannot be deleted, only restricted. If the guest profile can read a record, the record is effectively public, whether or not the site requires login to view it in a browser.

[…]

Remediation, per the research, centers on tightening the guest profile rather than the endpoints themselves, since both the UI-API and the ServiceNow search endpoint are working as designed. On Salesforce, that means reviewing guest sharing rules, stripping unnecessary object and field level access from the guest profile, disabling self registration where it is not required, and turning off the Experience Builder setting that allows guest users to reach public APIs. On ServiceNow, the fix is mapping which search sources are exposed to public facing portals and auditing the Knowledge Base read criteria that decide what an anonymous search actually returns.

I wonder how many other services have the same problem? This sounds like something that could be common in the ERP/CRM/related spaces if they include a customer portal.

We always think we’ll get it out for some special occasion, we just haven’t hosted one ourselves in a while. We think we might after we settle from this move, but who knows.

I guess I had one or something like it when I first moved out. My parents gave it to me along with a matching dining table, all of which had been sitting in their basement. My wife wasn’t a fan of it and when we moved out of the house we listed it for sale, eventually selling it for a few hundred dollars, after sitting on the market for close to 2 months and dropping the price a few times.

My parents were upset when they found out; it turned out they had had that table custom made earlier in their marriage when they could finally afford new furniture. They said they would’ve bought it back for more than we got had they known. But a couple days later they begrudgingly realized they didn’t have room for that furniture and it wouldn’t have made sense for them to buy it.

A few years later they moved into a smaller home since all of us kids had been grown and moved out for years. As they tried to sell furniture and other things they weren’t going to have room for, it became depressing to them to see how little these things were worth that they had spent a lot of money on new. They had a set of china for each of us kids, one they bought or received as a wedding gift, others they had inherited from dead relatives. But it became apparent that we all preferred the same set, the one with the simplest design, yet it also was clear that we would only rarely, if ever, use the china and it’s largely a waste of space for any of us.

I think we might even have our set already, but we never use it and it’s not on display. If we have it it’s in the bottom cabinets of a console my wife loves. Also there are a couple very nice crystal bowls my uncle bought us, that my wife is almost terrified to get out of their box out of fear of breaking them. We understand they’re all nice items and expensive, but we might’ve preferred to have that money spent on things we’d get more use out of.

Better than Kit Kat and no Nestlé? Color me intrigued!

!taneggs@lemmy.ca

Better [Home & Finance] later faced a whistleblower lawsuit that was dropped, a Securities and Exchange Commission investigation that produced no action, and a disastrous 2023 SPAC merger. The company’s stock fell 93% after the merger, while losses continued to mount.

[…]

Better’s annual sales dropped from $1.5 billion in 2021 to $70 million in 2023. Garg says the company is now on track for $200 million in sales this year.

Hershey is giving other candy/food manufacturers below-market deals on chocolate or above-market licensing deals to produce their chocolate candies in the USA so Americans don’t discover how much better chocolate tastes without butyric acid. Inexpensive foreign chocolate could destroy The Hershey Company and there are big companies like Nestlé or Mondelēz that could do it relatively easily but instead let Hershey’s produce their brands under license with butyric acid added.

I loved how shooting on film cameras the focus would literally be set by using the tape measure and adjusting the focus on the lens accordingly, except for the time I forgot I’d been given the set our school had that was in meters instead of feet and wasted about 150 feet of 16 mm film.

This feels like Bender breaking up with the Planet Express Ship in the middle of battle.

“Eh, the moment seemed right.”

On our honeymoon, where we stayed we got a credit that we could use towards the spa or the high-end fine dining restaurant on the site. We chose the restaurant and even with the credit I think our bill was over $200, before tip. It was by far the best meal I’ve ever had, though, and our waiter was excellent, far beyond anything I’ve ever had before or since. He had extensive experience in fine dining, previously working many years in New York City at famous places, I think the Waldorf Astoria or something like that. That was when I understood the level of skill that can be attained in that career and how important that is to the fine dining experience.

Historically I would say I’m not a fan of turning over so much control to the car. However, since 2022 we’ve typically driven up to see my wife’s parents twice a year, a journey of roughly 1,200 miles/2,000 kilometers each way, because even flying normally wouldn’t get us to their rural Quebec town much faster and would cost a lot more. We got a newer Hyundai a couple years ago and it has some self-driving features taking advantage of the adaptive cruise control and lane-keeping systems. It can even change lanes itself when you activate the turn signals, although you still have to keep your hands on the steering wheel and that doesn’t work well half the time. I have found it works well enough in rural freeways with little traffic, and if I use it in those areas I’m able to handle more of the driving share on the trip and seem to be more alert and fresh in the heavier traffic areas around major cities. I test drove one or two GM vehicles that had a completely hands-off system, which I found freaky, but would probably appreciate even more in those rural stretches.

It is a self-contained runbook with explicit verification gates at every step — preflight checks, building libghidra, installing the LibGhidraHost Ghidra extension, building ghidrasql, and a first live query. Hand it to your agent and let it drive the install; intervene only if a gate reports a failure.