2 ms·
I whitelist my networks (by port and host name, At least until TLS 1.3 removes the visible SNI) and my top denies list is very interesting. They have access to
by lanstin 6y ago
I whitelist my networks (by port and host name, At least until TLS 1.3 removes the visible SNI) and my top denies list is very interesting. They have access to bits and pieces of the internet (especially PyPi damn you runtime downloads) and all connections to an allowed port will succeed (they will just be closed after the SNI or IP check fails).
Nonetheless the article was correct the hack did not need bizarre or rare circumstances to take effect.
- trulyme 6y agoWait... What do you mean by PyPi runtime downloads???
- meowface 6y agoNot exactly sure what they meant, but maybe just that it's often hard to install a single Python package if the machine can't reach PyPI. If you download a tarball or wheel of some Python package on a different computer and transfer it to the isolated computer, there's a pretty good chance the package is going to have at least one third-party sub-dependency, in which case trying to install it with pip or setup.py will cause it to try to install more packages from PyPI. Docker's a decent way to address this, since you install the dependencies when building the image rather than when running the container, so you can build the image elsewhere or through CI and run the container on any server without having to allow access to package management repo servers.
- Godel_unicode 6y agopython -m venv temp && temp/scripts/activate && python -m pip install -r requirements.txt && tar -czf temp/Lib/site-packages You're ready for offline install!