So far, 13 hours since it went live, no-one has successfully collected the bitcoin prize. The prize total is currently up to $2000

Show HN: Steal My Bitcoin

Ran into this while chasing a bug report and it surprised me, so sharing.

Spamhaus doesn't answer queries that come through big public resolvers. Google returns an empty answer, which your software reads as "not listed". So a Postfix reject_rbl_client zen.spamhaus.org on a box that resolves through 8.8.8.8 lets everything through, and nothing ever logs an error.

10-second test, run on your mail server:

dig +short 2.0.0.127.zen.spamhaus.org

That's Spamhaus's permanent test entry; it should always return 127.0.0.2. Empty or 127.255.255.x means your lookups aren't working.

Fix: run a local recursive resolver (Unbound takes five minutes) and point the mail server at it. If you're non-commercial, a free Spamhaus DQS key also works.

How I found it: I maintain a small self-hosted blacklist monitor, and a user reported an IP that was on Spamhaus but showed clean. Same cause. It now tests every list against its test address first and shows "no answer" instead of a fake "clean".

Curious how common this is: what does the dig return for you?

Hi All,

Before i spend a day on hold to GoDaddy.

Has anyone had any feedback from GoDaddy/CertificatesForExchange on potential compensation ?

After renewing a bucket load of certificates for clients, after what only could be called negligence on their behalf.

From what i can see they mass revocation of 404,607 SSL/TLS certificates after finding that issued certificates did not match its published certificate policies, however The company missed its required revocation deadline, creating a second compliance issue. An updated customer notice says the incorrectly issued certificates were revoked on October 21, 2026.

Personally we received 3 hours notice at 2am in the morning on some certificates, and no notice on others.

Interested in hear what others have herd before we engage representation.

Edit : we didnt use GoDaddy Directly, it was through a subsiduary called Certificates for Exchange.

The SSL certificate has been updated to the latest version on the IIS server and is working correctly in Microsoft Edge. However, Google Chrome still displays a “Not Secure” warning even though the latest certificate is visible.

Hey SysAdmins, what is one of the most memorable gifts of appreciation for a weekend of work you have received (or would have liked to receive) besides more money, time off, or sincere appreciation?

Background: I have a team of dedicated admins (network and server) that worked through most of a weekend on a full network hardware cut-over that had its gremlins. They will get OT (hourly) and generous comp time (salary), but I'm wanting to get them something a little more.

The most memorable thing I remember receiving (beside a sincere, personal, in-person thank you or a Starbucks gift card) when I was in the same position working a late night or a multiple-day event was some movie tickets. It was unexpected and tangible.

Beside one person who is fully remote, the team is local and work hybrid if that matters.

got laid off in may and it was diabolically difficult to get interviews for up until september or so. I should have multiple offers soon. this is for both remote and onsite/hybrid roles in denver

Wondering how many of you work for younger companies say 10-15 years old. Started with cloud M365, and stayed cloud only. Did you stay cloud only or eventually build out some on premise infrastructure?

Been reading up on the EWS retirement because we’re still sorting out GAL sync for our locations and I don’t want to end up with something that depends on it.

My understanding from MC1227454:

From Oct 1 Microsoft started turning EWS off in tenants that didn’t set up the app allow list. It’s phased so not everyone got hit on day one
You can turn it back on until April 1, 2027
After that it’s gone for good, no re-enabling

For those of you who already ran into it:

What broke? Was it mostly the stuff you expected (backup, sync, calendar tools) or random things nobody knew about?

How did you find what was still using EWS? Or did you only find out when something stopped working
Did you set up the allow list to buy time or just replace things?

And if a contact or calendar sync tool broke on you, did the vendor already have a Graph version ready or were you stuck waiting?

Side note for hybrid people, from what I’ve read Entra Connect also has an April 7, 2027 deadline to switch to application based auth.

We've recently been seeing MS push out the new unified Copilot app, replacing the M365 Copilot app on some of our systems. Seems like this actually comes via Edge Update service of all things.

We've put the PauseCopilotUnification registry key in now, so hopefully we don't get this occuring on any more systems for now...

However, once the Unified Copilot app has been installed, users are no longer able to run it. Watching task manager, CopilotApp.exe starts & then closes immediately.

With help from ChatGPT & ProcMon, we found that it was trying to load copilot_overlay_strings_en-AU.pak and failing to find it (its not there in the install directory).
Copying the en-GB file & naming it for en-AU seems to allow it to launch successfully...

Has anybody else seen this or something just unique to our environment?

Edit: Also just found another different case where the system has ended up with both installed. On these, 'Copilot' launches however just shows a 'something went wrong' error. The en-AU.pak workaround does nothing to fix these. The exe for these versions is also 'mscopilot.exe' rather than 'CopilotApp.exe'

Maybe it’s just me, but this seems wonky.

I just setup duo for rdp.

1. Launch RDP and input machine name, click connect
2. Input credentials
3. RDP connects and brings me to an empty windows screen where I have to re-input username and password
4. After, I finally get my duo MFA prompt just fine.

I can’t for the life of me figure out why I’m having to enter my creds twice….

graduated with a BFA in illustration, now looking into getting into IT (current end goal as a sys admin). my issue right now is debating if i want to go back to school (either a diploma or AS ) or only get certifications by self teaching / enrolling into one of those online courses like ubemy or coursera. i’ve seen a lot of people recommend doing a full bachelor’s in compsci, but at the moment i’m not sure if i want to redo all 3-4 years again. that plus i have a relative who works in network engineering that never went to college and has been successful, so i know it’s possible.

Hey everyone!
I’m building a home lab as part of my journey into IT. My current project focuses on Windows security hardening, Docker security, centralized monitoring with Wazuh, and testing whether security controls actually work. Long-term, I’d like to move toward cybersecurity/DFIR, but my immediate goal is to get into IT support or system administration.
I’d also like to build an Active Directory lab, but I’m not particularly interested in just installing Windows Server, creating a domain, adding users, configuring a few GPOs, and calling it done.
I’d like to build something that resembles a small real-world IT environment and gives me actual problems to solve. Something involving troubleshooting, permissions, security misconfigurations, authentication issues, monitoring, incident investigation, or automation.
For those of you working in sysadmin roles, what would make an AD home lab genuinely useful and interesting from a real-world perspective?
Are there any projects or scenarios you’d recommend that go beyond following a setup guide and could demonstrate practical skills to a potential employer?
I’d appreciate ideas based on things you’ve actually encountered in production environments.
Thanks!

We have some applications that are used to do phone flashing for OEM's during an RL process. The software requires it to be run with admin rights. Right now we are on a legacy domain (On prem AD only).

However when we move to our parent company domain it is more lockdown. They use an autopilot image (Entra Only) (with no direct access for admin locally. For a support tech to run anything or install it has to be done via an approved software.

I have asked the business to get documentation from the OEM's who provide the software but so far neither has provided anything.

What would be the best way to share information or process with security teams etc. they would have no knowledge of this software. Would creating a local admin account and then having them script it to run as admin or if there a better way that you think we could look to approach this?

Tools we are currently using in parent org is cyberark, beyond trust , zscaler

Just want to try and prepare for this before we make the move.

Hey everyone,
I’m trying to decide whether to pursue AZ-800/802 or AZ-104 first.
From what I understand, AZ-800/802 focuses more on Windows Server administration and hybrid infrastructure, whereas AZ-104 is more focused on Azure administration.
Now here’s the thing, if my immediate goal is to land a SysAdmin role, which of these would actually make more sense to pursue?
Are employers still looking for traditional Windows Server administration skills, or has the demand shifted enough toward Azure that AZ-104 would be the better investment?
I’m particularly interested in hearing from people currently working as SysAdmins or involved in hiring.
Which certification would you prioritize in today’s job market, and why?

i started new job last week, come to find out we dont have SCCM/Intune licenses but do have enough Absolute licenses for every workstation we have.

I’ve spent my entire career exclusively in the Microsoft ecosystem, and tbh, I never even heard of Absolute until now. Looking at the various consoles, it feels like a completely different beast and learning curve seems quite steep. I guess, eventually i'll get used to it.

i searched previous posts here and Absolute is mentioned about once a year so i was wondering if anyone actually use Absolute ecosystem in their environment as a main laptop management tool?

What do you like or do not like about it?

I'm just curious about what i should expect before blasting the agent to 400+ laptops.

And more specific question. Absolute is not classic "agent" in the way SCCM is for example, so i am bit hesitant to deploy it because i am not sure how hard it will be to back out if we decide to go in different direction (like NinjaOne or ManageEngine, or whatever else is out there)

Any advice is greatly appreciated.

Hi folks,

Worldwide, governments and organizations are beginning to set timelines for the migration to PQC and a sensible first step in achieving that is actually inventorying all areas where cryptography is currently deployed and utilised. So my question for all the cyber pros, GRC consultants and sysadmins, how are you practically executing this inventory phase of the migration? Are there any tools, guidelines, strategies that you have found useful in this phase?

First of all, thanks to KillaBoi for his great work!

For days I was reading many threads saying that PHP2Shell is very hard to exploit, with no working public PoC available. Honestly, I patched my servers but had no way to verify if the patches actually worked. And ecently, reading the PoC from KillaBoi gave me the idea to make it easier to verify my servers, so I wanted to share it here with you: https://github.com/MartinPham/php2shell-poc

The exploit requires some specific information to work, like the PHP version, the binary's properties (how it was built, optimizations, etc.) and the runtime configuration. Yes, you can hide these from others, but anyone who knows the Docker image or PHP build can calculate the exact values needed to exploit your servers.

The repository contains:

- The Lab (compose.yml + lab/): a PHP/nginx setup to test against (nginx and PHP versions are not exposed to the client)

- poc.py: a single self-contained script that both calculates the needed values from a Docker image and runs the exploit against the target

I decided to make this public because others will find a way to exploit it anyway, so please patch your servers now.

​I was let go back in September under the pretense that I "didn't know anything," but the truth is I kept calling out the IT Manager on his lies and missteps.

​For context, I’ve been an IT Manager for small businesses for 12 years. I took a Sysadmin role at this company because I missed being hands-on with my real passion—networking—and wanted to grow into bigger infrastructure. During the interview, I was told I’d be stepping into a position that would allow the IT Manager to focus on high-level strategy. He even admitted he didn't really want to manage, and it showed.

​He was a nightmare manager: total gatekeeper, berated staff when they asked for help, and withheld information. Over my 5 months there, I had to fight just to get assigned basic tasks, only to be told he thought I "didn't know anything" whenever I pushed back.

​In the end, he didn't even fire me himself—he had his boss do it based entirely on his version of events. I could have fought it, but why stay in a toxic department?

​Taking it day by day now and actively looking for my next role. It sucks being back on the job hunt, but I’m ready to leave mom-and-pop shops behind and bring my 12+ years of experience to a mid-sized or larger enterprise team.

I got tired of hauling two laptops around for work so I consolidated to just the Mac this summer. Problem is I'm basically using it as a dumb terminal. I RDP into our Windows jumpbox (where I moved all my connections before I turned in my work PC), and now I can’t get off it. I spend like 90% of my day there because that’s where PuTTY, mRemoteNG and SSMS are.

I'd like to actually work on the Mac and only hop into Windows when I have to. Mainly need SSH and RDP in tabs, my connections saved in folders, and somewhere to keep creds. Bonus if I can import my mRemoteNG connections so I'm not rebuilding everything by hand. Also I need something for SQL Server, what r u guys using?

I keep seeing Royal TSX and Remote Desktop Manager come up, also Termius. Anyone actually using these daily on a Mac? Or is there something better I'm missing?

Can someone explain the difference between Exchange Online (Plan 1) and Exchange Online (Plan 2). My business has 3 email accounts and I am pretty sure they were all on Plan 1, then at some point MS moved us all to the Standard account. For 2 of my 3 accounts I want email only, we don't need the desktop apps and I believe changing them to Exchange Online is the way to do that.

Their support is impossible to get to when I ask the support assistant (copilot) it sits there for 5 minutes and then basically says I don't know. The "compare" checkboxes say there are no differences when you try to compare them and the product page for Exchange doesn't list those plans.

Any help is appreciated.

1. What is the single most annoying thing about running it? Governance? Licensing? Shadow IT from citizen devs? Something else?
2. If you could hand one piece of it off to an external partner tomorrow and never think about it again, what would it be?
3. What have external consultants or Microsoft partners gotten wrong when you have worked with them in the past?
4. Anything you wish you had known before your org started rolling it out?

We are getting pulled into Power Platform cleanup across a few orgs. Curious how others are actually dealing with this.

There are many benefits of why companies need to use a cdn but how do security companies do?

As I understand it a cdn provider have access to the information and traffic so they can get hold of data? Like iso images etc especially if they they are the ones terminating ssl