Do you ever imagine what if your cat had hands?

#HotTake grapefruit is the best kind of crush #orioles #maryland #baltimore

First time moving out at a homeowner.

Man. We have a lot of shit.

Idea: "baby got back" but instead of butts, it's a PSA for using public transit

Nosebleed seats and cheap beers

#baseball #Baltimore #orioles

Anybody have fun #irc channel and #xmpp MUC recommendations? Anything involving #sysadmin, #programming, #selfhosting and maybe fun nerdy #memes?

My experience with larger IRC channels on Libera have not been great. It'd be fun to find an online hangout.

Eating kiwifruit with the skin on is the superior way to eat kiwifruit

#HotTake #Fruit #KiwiFruit #🥝

Are lunchables charcuterie boards for kids or are charcuterie boards lunchables for adults?

https://git.sr.ht/~sircmpwn/vim-classic

Pretty cool seeing my name up there

Got a follow from a guy with MAGA in his profile

Dude had my phone number, my name, sounded really nice and everything. Spoke professionally, no crackly audio from being in a cheap data center, nothing.

But also - since when does Google call you? And over trying to add a recovery address? The email itself says "if this doesn't look familiar just ignore it."

Scary stuff.

So then I say look, the caller ID shows you're calling from a toll-free number and that's all it shows - I can't really verify if you're Google or not. I'll handle it. End the call.

So then I sit down and look at that email that came in while I was on the phone. It was an authorization code to add my account as a recovery to somebody else's account.

I'm guessing the next steps would have involved me giving that code to add my account as a recovery to somebody else's account (4/?)

That kind of set off alarm bells because I know from administrating Google Workspace that you absolutely can see what app did what. So red flag.

So then he says something about he can reset my OAuth token. Like it sounded like my account has 1 OAuth token, the way he presented it. Which isn't right.

So I say "ok well listen I can log into my account and disconnect from apps" and he said something about how it's better if they do it? (3/?)

The guy says it looks like an OAuth app may have tried to do it and I think ok, yeah. I use "sign in with Google" all the time, there could be some rogue thing out there where maybe I granted more permissions than I should have or something.

The guy asks if I'm familiar with OAuth and I tell them I am, I've written apps that use OAuth before. He proceeds to give me a brief spiel anyway which I found odd.

So then I ask ok well can you tell me what app did it? He couldn't. (2/?)

I think I was just the target of a fairly sophisticated phishing attempt.

Got a call from a toll-free number, answered it, it was somebody claiming to be from Google.

Said they were calling about a recent attempt to sign in to my account and a ticket to change my recovery address. I said that didn't sound right, guy on the phone said he was going to send me what they received.

I get an email, I don't look closely at it but it's an actual email from Google (1/?)

#security #phishing

Welp, set up GoToSocial and moved there briefly but seemed to struggle to get things working, I think it was due to the split-domain setup?

I've decided to just join mastodon.social and to call it a day. Having a self-hosted fedi instance could be cool but, there's something to be said for just not doing things.

So yeah - my previous accounts were:

@johnny
@john@buffering.rocks
@john@gts.buffering.rocks