Meta on Ben's ideas and projects

Reblog: Tackling the Microsoft Windows Zerologon Vulnerability

locutus@the-collective.net (Ben Mason) — Wed, 28 Oct 2020 09:00:00 -0400

Check out a post I wrote on the CDW blog about Zerologon

https://blog.cdw.com/security/tackling-the-microsoft-windows-zerologon-vulnerability

Installing slackin on Heroku

locutus@the-collective.net (Ben Mason) — Wed, 08 Jan 2020 10:00:00 -0500

slackin provides a self-service interface to join a slack team. I found it as a solution when I was setting up the mainesec slack team eliminating the need out unique links to every member that was joining. slackin creates a sign-up form where a user enters an email address and is automatically sent an invite to the slack team.

I have seen the script running in the Heroku cloud before but could not find any good instructions to install or run set it up other than a vague mention for a link to a button to automatically install it that did not exist.

This post covers the steps I went through to set-up a slackin instance in the Heroku cloud. To start off there are a couple of API keys that need to be created or gathered and used during the configuration.

Google reCAPTCHA (Must select reCaptcha v2 (not v3))
Legacy Slack Token

Both of these API keys will be used towards the end of the setup. Next, fork the slackin repo to your Github user, the URL to the slackin repo is:

https://github.com/rauchg/slackin

Once the repo is forked to your account you will need to create a Heroku account (if you do not have one already). The free tier was sufficient for me to run the slackin.

Once you have logged into Heroku you will want to choose “New” and select “Create new app” in the upper right-hand corner. On the next screen, you will enter the App name, this will be used in the URL Heroku will generate for you.

Once you click the Create app button you will be sent to the Deploy tab. On this screen, select Github under the “Deployment method” section. (If you have not already connected your Github account to Heroku and you will need to and allow Heroku access to your repos.) Once connected, search for the forked slackin repo usually named “slackin” and click the Connect button.

Once connected you will need to deploy it to Heroku. There are a few options to deploy the app, for the first deployment I ran a Manual deploy by clicking the Deploy Branch button. This will take a while and will display any errors that occur.

Moving forward if you wish to have Heroku automatically deploy any changes you make in Github to the slackin app click the “Enable Automatic Deploys” button.

After the deploy is complete, select the Settings tab and add a few Config Vars. There are two settings that are required for slackin to operate. In these variables, we will enter the API keys you gathered earlier. The Google reCAPTCHA keys go into GOOGLE_CAPCHA_SECRET and GOOGLE_CAPCHA_SITEKEY. The Slack API keys go in SLACK_API_TOKEN and SLACK_SUBDOMAIN. the SLACK_SUBDOMAIN is the name of the Slack team that you are inviting users to.

Finally, to gather the URL that was assigned to the site you can scroll down on the Settings page to the Domains section and it is shown there.

You will now have a slackin instance setup for users to invite themselves to a slack team. For the mainesec team, I set up to domain redirection to the Heroku URL to make things a little simpler. If you encounter issues with slackin there is a lot of useful information in the Github issues for the main slackin repo.

Daily work log

locutus@the-collective.net (Ben Mason) — Mon, 03 Nov 2014 08:15:17 -0500

Like a lot people I regularly have the problem at the end of a workday or even a workweek answering the question, “What did I do?” let alone what “What did I accomplish?” To find an answer for these questions I have started to keep a daily journal using both an automated report and a manual entry. Between these two entries I tend to have a good idea of what occurred during my workday and work week. The idea to keep a journal was inspired in part by a post over at Productivityist: Taking Journaling to Another Level. It is useful to note that I am a Mac user so all off the tools that I use and have strung together to generate my automated report are Mac specific. That being said, I have found this this practice to be very helpful in keeping track of what I am or am not accomplishing and use it in concert with my daily and weekly review.

I started this project by writing the automated script using an AppleScript that glues together all of the various apps I use (Mail.app, Omnifocus, Lync, and Apple Calendar) and generates an automated report of what email I sent, tasks I completed, my scheduled meetings and people I interacted with over IM. There were some limitations on what I could actually pull out of all the various apps, but in the end this is high-level list, if I need more I can the app that has the information I need. I kick off this script when my workday comes to an end and the script will collect all the data and stuff it into a new entry for the day in Day One.

After using the script for a while I would still have a lot of those “oh yeah I did XYZ task that day” moments when doing my daily and weekly reviews. The items I was not capturing were items such as phone calls, general thoughts, gripes, or half done tasks that may not show up in any of the apps I collect data from. This eventually led me to keep a daily journal entry in Day One along side my scripts entry. These entries maybe something as simple as a few bullet points I add over the course of the day, or something more detailed along side of the basic thoughts.

Reviewing these two entries feeds into my own daily and weekly review of my to-do lists to figure out what needs to be put in the list for tomorrow or a later day. A by-product also this simplifies a weekly status I report for my manager. These reports also provide me a view into items that have been touched in the many projects I have running concurrently and random tasks that come in through all of my various inboxes.

I recommend this practice for anyone, it can help you feel more accomplished, remember those ideas you had that you couldn’t do anything about, and vent about the frustrations. I also find it helps me see what all I have accomplished even when my to-do list does not get smaller or items did not get completed when I planned them to be completed. You can download a copy of my daily script can be found in my Github at,

https://github.com/suidroot/workprojects/blob/master/Daily%20Report%20to%20DayOne.scpt
I implore you to not laugh too hard; this script has been hacked together with a lot of twine, glue, and duct tape, and has been my first attempt at AppleScript.

Footnote: This post was inspired in part by an Engadget post about DayOne.

My interest of academics of systems

locutus@the-collective.net (Ben Mason) — Mon, 13 Oct 2014 10:17:10 -0400

Lately I’ve been very interested in academic side of computers. Complex systems, Theoretical Computing, and Control Theory are two of my focuses right now. This has come about because I’m getting more interested in how the systems work and how ti measure them, more then how to implement them. My career has been very focus on the implementation then how systems work and can be measured. I’ve never had any sort of formal Computer Science education, making a lot of this new territory to me. As I dive deeper into these topics I realize how much math I have forgotten over the years. These topics are some of reasons for me to refresh my math skills, however math skills are also analyze sampled data such as monitoring data. A great video discussing data analysis is by Noah Kantrowitz at Monitorama PDX 2014.

Monitorama PDX 2014 – Noah Kantrowitz from Monitorama on Vimeo.

Some of the topics I’m learning about are much broader then others. The definitions of these fields of study as defined by their Wikipedia articles are as follows,

Control theory is an interdisciplinary branch of engineering and mathematics that deals with the behavior of dynamical systems with inputs, and how their behavior is modified by feedback.
Wikipedia: Control Theory

The field of theoretical computer science is interpreted broadly so as to include algorithms, data structures, computational complexity theory, distributed computation, parallel computation, VLSI, machine learning, computational biology, computational geometry, information theory, cryptography, quantum computation, computational number theory and algebra, program semantics and verification, automata theory, and the study of randomness. Work in this field is often distinguished by its emphasis on mathematical technique and rigor.
Wikipedia: Theoretical Computer Science

Complex systems present problems both in mathematical modelling and philosophical foundations. The study of complex systems represents a new approach to science that investigates how relationships between parts give rise to the collective behaviors of a system and how the system interacts and forms relationships with its environment.
Wikipedia: Complex Systems

All of these topics I feel are important as products start to become much simpler and centrally controlled or incredibly complex in their interactions. Algorithms, controls, and data are becoming more and more important to understand.