keithmccammon

From time to time, Musk will send out an e-mail to the entire company to enforce a new policy or let them know about something that's bothering him. One of the more famous e-mails arrived in May 2010 with the subject line: Acronyms Seriously Suck:

There is a creeping tendency to use made up acronyms at SpaceX. Excessive use of made up acronyms is a significant impediment to communication and keeping communication good as we grow is incredibly important. Individually, a few acronyms here and there may not seem so bad, but if a thousand people are making these up, over time the result will be a huge glossary that we have to issue to new employees. No one can actually remember all these acronyms and people don't want to seem dumb in a meeting, so they just sit there in ignorance. This is particularly tough on new employees.

That needs to stop immediately or I will take drastic action - I have given enough warning over the years. Unless an acronym is approved by me, it should not enter the SpaceX glossary.

keithmccammon

# Things that might be required to install atomic-operator on an M1-based Mac running macOS Montery. 
# 
# This script assumes:
# * Python3.9 or later
# * Homebrew 3.3.9 or later

git clone https://github.com/swimlane/atomic-operator.git
cd atomic-operator

# Satisfy ModuleNotFoundError: No module named 'setuptools_rust'

keithmccammon

/*
Copyright (c) 2021 Michael Leggett, simpl.fyi

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

keithmccammon

javascript:(function(n,t)%7Bt%5B%27true%27%5D%3Dn%3Bvar i%3Dfunction(n,t,i)%7Bvar r%3Dn.style%3Br.webkitTransition%3Dr.transition%3Di%2B%27s%27%3Br.webkitTransitionTimingFunction%3Dr.TransitionTimingFunction%3D%27ease-in-out%27%3Br.webkitTransform%3Dr.Transform%3D%27translate3d(0, %27%2B-t%2B%27px, 0)%27%7D%3Bvar r%3Dfunction()%7Bvar n%3D%5B%5D.slice.call(arguments)%3Bvar t%3Dn.shift(),i%3Dn.shift(),r%3Dn%3BsetTimeout(function()%7Bi.apply(null,r)%7D,t*1e3)%7D%3Bvar e%3Dfunction(n,t,i,e)%7Br(t,o,i,e)%7D%3Bvar a%3Ddocument.getElementsByTagName(%27body%27)%5B0%5D%3Bvar o%3Di.bind(null,a)%3Bvar s%3De.bind(null,a)%3Bvar l%3Dfunction(n)%7Bvar t%3D%27Enter delay (in seconds), distance to scroll (in pixels) and the scroll duration (in seconds).%5Cn%5CnRun the script a second time with options 0 0 0 to reset the page.%5Cn%5CnExample:%5Cn%5Cn1 800 5%27%3Bif(n)%7Bt%3Dn%2B%27%5Cn%5Cn%27%2Bt%7Dvar i%3Dprompt(t)%3Bif(i%3D%3D%3Dnull)%7Breturn%7Dif(/%5Cd%7B1,%7D %5Cd%7B1,%7D %5Cd%7B1,%7D/.test(i))%7Breturn i.split(%27 %27)%7

keithmccammon

#!/usr/bin/env python

"""
To use me:

1) Make a file full of indicators, one per line, call it indicators.txt.

NOTE: This was written to handle IP addresses. Change line 40 from ipaddr to md5 if passing hashes.

2) python iocs_to_definition.py indicators.txt

keithmccammon

#!/usr/bin/env python

import json
import pprint
import requests


if __name__ == '__main__':

    request_all = requests.get('https://attack.mitre.org/pre-attack/api.php?action=ask&format=json&query=%5B%5BCategory%3ATechnique%5D%5D%7C%3FHas%20tactic%7C%3FHas%20ID%7C%3FHas%20display%20name%7Climit%3D9999')

keithmccammon

#!/usr/bin/env python

import json
import pprint
import requests


if __name__ == '__main__':

    request_all = requests.get('https://attack.mitre.org/api.php?action=ask&format=json&query=%5B%5BCategory%3ATechnique%5D%5D%7C%3FHas%20tactic%7C%3FHas%20ID%7C%3FHas%20display%20name%7Climit%3D9999')

keithmccammon

{
    "Snake Files": {
        "filemod": [".gdm-selinux",
                    ".gdm-socket",
                    ".ur-*",
                    "/Library/Scripts/queue",
                    "/Library/Scripts/installd.sh",
                    "/Library/LaunchDaemons/com.adobe.update.plist"]
    },
    "Snake Network": {

keithmccammon

#!/bin/sh

### Why?
# Because it's apparently too much to ask that my $3K laptop be able to
# broker access to my camera without letting it die. But I totally get that
# this is a low priority in comparison to the Touch Bar. You can live without a
# camera, but you can't live without emoji.
###

sudo killall coreaudiod

keithmccammon

#!/usr/bin/env python

"""
Given a sensor ID and a file path, delete the file. This performs no logging
and returns no status. It is generally unhelpful and not a template upon which
you want to build. But if the file is present and not locked it will be
destroyed :)
"""

import argparse