How Do You Find and Delete Azure Services (e.g., Disks) That Cause You an Expense?

Problem scenario
In Azure's "Cost analysis" (in the Cost Management + Billing section), you see expenses associated with storage. How do you find "standard * managed disks" in your account for the purpose of deleting them?

Solution
1. Go here: https://portal.azure.com/#blade/HubsExtension/BrowseAll
2. Sort by "Type".
3. Find "Disk" and click on the radio buttons near those and click on "Delete"

How Do You Modify Vertical Blocks of Text on a WordPress Web Page?

Problem scenario
There are vertical blocks of text that are common to every posting of your WordPress site. (Or you want to add advertisement banners to your website.) How do you modify the text in those?

Solution

  1. Log into the WordPress web UI
  2. Go to "Dashboard"
  3. Click on "Manage widgets" or "Appearance" (either will work)
  4. To the left of "Available Widgets", expand "Footer" or other options on the right-hand side. You should be able to find the first words of the block of text that you want to change.

How Do You Find the File That Gives Mozilla Thunderbird Its Settings to Start Over with Thunderbird?

Problem scenario
You have uninstalled and reinstalled Thunderbird. You used CCleaner to eliminate traces of a previous configuration of Thunderbird. You want to have no vestiges of the old data and older email account. How do you get clean start with Thunderbird (like an installation on a new workstation that has never had it)?

Solution
1. Open Thunderbird
2. Right click on an email username on the left (e.g., John Doe or jdoe@acme.com).
3. Go to Settings -> Server Settings and scroll down to "Local directory" where there is a field and a "Browse" button to the right of the field. Copy the contents of the field like this: C:\Users\jdoes\AppData\Roaming\Thunderbird\Profiles\blah.default-release\ImapMail\mail.foobar.com
4. Copy this text (of the path) in the field.
5. Close Thunderbird.
6. Browse to the directory that is the parent of ThunderBird (e.g., C:\Users\jdoes\AppData\Roaming\ ).
7. Delete the files therein.

How Do You Install Erlang on CentOS/RHEL/Fedora?

Problem scenario
You are using a Red Hat derivative of Linux. You want to install Erlang (e.g., for development, or to use RabbitMQ or Chef Server). What do you do?

Solution
Run this script with the "sudo" command (e.g., sudo bash /tmp/erlang.sh)

# Written by www.continualintegration.com
#/bin/bash
# We suggest calling this script erlang.sh and placing this file in /tmp/

yum -y install ncurses-devel gtk2-devel
curl -Ls https://github.com/wxWidgets/wxWidgets/releases/download/v3.0.4/wxWidgets-3.0.4.tar.bz2 > /tmp/wxWidgets-3.0.4.tar.bz2
cp /tmp/wxWidgets-3.0.4.tar.bz2 /bin/
cd /bin/
bzip2 /tmp/wxWidgets-3.0.4.tar.bz2
tar -xf wxWidgets-3.0.4.tar
cd wxWidgets-3.0.4
./configure
cd /bin/
git clone https://github.com/erlang/otp.git
cd otp
./otp_build autoconf
./configure
echo "This next portion may take 15 minutes"
date > /tmp/datetime.txt
yum -y groupinstall "Development Tools"
make
make install
ln -s /usr/local/lib/erlang/bin/erl /usr/bin/erl
ln -s /usr/local/bin/erlc /usr/bin/erlc
yum -y install python3*
ln -s /etc/alternatives/python3 /usr/bin/python
echo "Script run completed."
echo " "
echo "Many errors above may be ignorable"
echo "try the 'erl' command with no quotes to see if Erlang was installed"
echo 'If you get to a carrot prompt, use Ctrl-c, then type the "a" key and then press Enter.'

How Do You Find Files on the C: Drive That Are Greater than 20 MB?

Problem scenario
Using PowerShell, how do you retrieve all files that are greater than 20 MB?

Solution
Run a command like this:

Get-ChildItem C:\ -recurse | where-object {$_.length -gt 20971520} | Sort-Object length | ft fullname, length -auto

This was adapted from this external website.

What Are Some Ways to Prevent MITM Attacks or Other Session Exploitative Attacks with a Web Page That Uses JavaScript?

Problem scenario
You know that sessions of a JavaScript can be exploited in today's world. This category of vulnerability is related to imperfections in authentication and is listed as the #2 biggest web application security risk as of June of 2020 (according to OWASP). What are some techniques to stop such attacks from happening when designing a website that uses JavaScript?

Possible Solution #1
Ensure cookie information is passed using connections that leverage HTTPS (as paraphrased from page 23 of Node.js Security by Liran Tal).

Possible Solution #2
Configure cookies to not be accessed from JavaScript's runtime (page 23 of Node.js Security by Liran Tal).

Possible Solution #3
Obfuscate the name of the cookie to hide the website's underlying technologies (page 23 of Node.js Security by Liran Tal).

Possible Solution #4
Use Cross-Site Request Forgery tokens for every form action on the website; the tokens are long, unguessble strings as taken from page 33 of Node.js Security by Liran Tal. CSRF are a form of session riding (page 31 of Node.js Security by Liran Tal). You may want to use csurf which is a middleware library to manage CSRF tokens (page 36 of Node.js Security by Liran Tal). Alternatively lusca is a "web application security middleware" tool that could help you (page 39 of Node.js Security by Liran Tal).

How Do You Install and Configure OWASP ZAP?

Problem scenario
You want to install OWASP ZAP (aka Open Web Application Security Project's Zed Attack Proxy). You want to test it out. How do you do this on Linux?

Solution
Note: It is advisable to only install ZAP on OSes that have JREs that have up-to-date patches with regular maintenance. If you need assistance installing the JRE, see this posting.

Procedures

  1. Gain access to a Linux server with a desktop GUI. If you need assistance with this, see this posting.
  2. Open a terminal. Run this: curl -Ls https://github.com/zaproxy/zaproxy/releases/download/v2.9.0/ZAP_2.9.0_Linux.tar.gz > /tmp/ZAP_2.9.0_Linux.tar.gz
  3. cd /tmp
    tar -zxvf ZAP_2.9.0_Linux.tar.gz
    sudo mv /tmp/ZAP_2.9.0 /opt/
    cd /opt
    bash zap.sh
  4. Now a GUI pop up should appear.
  5. Choose "Yes" to the question about persist.
  6. In the "Manage Add-ons" section, click "Update All".
  7. In a new Session window, click on the "Sites" tab.
  8. In the "Sites" tab click on "Sites" underneath "Contexts."
  9. Click on the "Spider" tab.
  10. Click on the "Ne…" (or "New Spider" button).
  11. Enter a URL to test. Only test URLs you are in control of (e.g., you own web server).
  12. Click "Start Scan".

How Do You Troubleshoot “Connect timeout on endpoint https://ssm.us-west1.amazonaws.com…”?

Problem scenario
You try to run an aws ssm command. But you get an error about a connection timing out. What should you do?

Solution
Find the EC-2 server's VPC and subnet. Go to VPC in the AWS console. Go to the Subnet section. Find the Route Table associated with the subnet for the EC-2 server. Make sure that the "Destination" field accommodates the IP address of the ssm.us-west1.amazonaws.com hostname. To find what IP addresses the ssm.us-west1.amazonaws.com resolve to, ping the hostname several different times manually. If you find the first octet is 43, then create a rule like this: 43.0.0.0/8 as the destination and have that traffic go to a NAT gateway. Now the EC-2 server should be able to route traffic to the ssm.us-west1.amazonaws.com URL. In our experience sending all traffic outward via 0.0.0.0/32 does not work very well.

This may not be a best practice as any traffic bound for an IP address that starts with the given octet will be sent outward through the NAT gateway. If you can do special configuration (e.g., forwarding) to limit the IP address resolution of the ssm.us-west1.amazonaws.com, that would be advisable.

How Do You Insure Your Bitcoin/Cryptocurrency Holdings?

Problem scenario
You have a sizable cryptocurrency position. You are concerned that if you lose it, you will not be able to get it back. What should you do?

Solution
This is not legal advice.

  1. Self-insure. Ensure you use multi-factor authentication if you use an online platform. If you need a username, a password, and access to a separate physical device (such as a smart phone for a passphrase or code number), it should be difficult to hack. If you do not use an online platform, it may be wise; you can use a cryptocurrency wallet, which is arguably more secure. One such wallet is Trezor. The Trezor wallet has the highest rating on CryptoCompare.com.
  2. Play it safe. Use Coinbase, Gemini Exchange or BitGo for a potential online provider. According to this article, they provide some insurance to the cash holdings. We do not know how much is insured and what the terms of making a claim are. So do be careful. But we do not recommend shunning investing in cryptocurrency either. Staying with a reputable company with a risky undertaking helps mitigate loss in general. (Coinbase often offers up to $200 in free coins when you sign up for the first time.)
  3. Read more about this topic. These next articles, as of July 2020, give some insight into a new market for insurance:

4. Try to find a wealthy person or company that can do customized insurance. A manuscripted insurance policy may not be run-of-the-mill, but they can be created. You may be able to get protection in case you lose your coins.

5. The laws surrounding I.T. and cryptocurrency change regularly. You may want to find an attorney for the state you live in to discuss how recourse can work.

Update on 11/24/23

HODL refers to Hold On for Dear Life. HODLers do not time the market or actively trade.

Protecting the recovery seed is essential for getting your cryptocurrency if your wallet is damaged. There are cryptocurrency wallet recovery plates made with titanium and steel capsules that can help protect your cold seed storage for your crypto wallet.

To learn more about insurance of digital assets, see the following links:

For Europeans, the platform/company Iconomi.com can allow you to buy crypto or learn more; they may or may not have a way to ensure the holdings.