agwa

16 ms·

181.
by agwa 2y ago
Another issue is that without seek support, the HTTP server can't implement range requests. Interesting comment by Russ Cox about this: https://github.com/golang/go/issues/61791#issuecomment-16719...
182.
by agwa 2y ago
No, for the home version the app just connects over Bluetooth. The protocol is documented and there are robust open source implementations such as https://github.com/Anrijs/Aranet4-Python
183.
by agwa 2y ago
These are great. I have two of them and access the readings over Bluetooth using some Python code: https://github.com/Anrijs/Aranet4-Python (there's also a mobile app which I've never used) The eink display
184.
by agwa 2y ago
For me, it just said "Verifying..." indefinitely. Why does an article about programming languages need this?
185.
by agwa 2y ago
> systemd uses nss like everything else. systemd has an nss alternative: https://systemd.io/USER_GROUP_API/
186.
by agwa 2y ago
In general, the Go module proxy retains modules forever, for the explicit purpose of not breaking builds ( https://sum.golang.org/#faq-retract-version ). crates.io can delete content also. I don't think there is much d
187.
by agwa 2y ago
As kibween noted above, crates.io can be changed if there's a "good reason" so it's not truly immutable either. Go does not delete modules from the module proxy except for copyright/legal reasons (I suspect crates.i
188.
by agwa 2y ago
The problem is that if you clone the Git repository, or view it on GitHub, you have no assurance that you're seeing the same code that the go command or the Go module proxy saw. The author of a malicious module could change the Git ta
189.
by agwa 2y ago
Snarky answer: because they're the W3C and are high on their own supply ;-) But it does allow more flexibility. If you don't want to be tied to a domain name, you can use a URN with a UUID like urn:uuid:4603d9d3-e895-4000-9077-0a
190.
by agwa 2y ago
It's a way to ensure global uniqueness. In the end they're just compared byte-for-byte as strings.
191.
by agwa 2y ago
Schemas != namespaces. I'm sure some braindead software out there attempts to retrieve namespace URIs, but it would surely be a drop in the bucket compared to traffic for schemas/DTDs (which are intended to be retrieved).
192.
by agwa 2y ago
No, if you can complete challenges for every DNS name in the certificate then the API lets you revoke it.
193.
by agwa 2y ago
In general, rule-based solutions are good if they use fwmark, but this gives me pause: > And finally we add a convenience feature for still accessing the local network, whereby we allow packets without the fwmark to use the main routing
194.
by agwa 2y ago
Whoops, I posted too early in the morning, I meant to say "malicious subnet mask" :-) Basically, the DHCP server sends a subnet mask for an absolutely huge subnet (e.g. a /2), and the route for that subnet takes precedence ov
195.
by agwa 2y ago
Yes, namespaces are the gold standard solution.
196.
by agwa 2y ago
That's not really the problem - DHCP's subnet mask option is definitely not weird or legacy but can also be used to execute these attacks. The real problem is that encrypted packets from the VPN client use the same routing table a
197.
by agwa 2y ago
Ignoring or blocking these options is trivial but ineffective since the DHCP server can still send a malicious subnet mask. (Edited to replace "default gateway" with "subnet mask")
198.
by agwa 2y ago
Cryptographically-secure PRNGs are also deterministic, but as long as you have at least 256 bits of unpredictable seed, the output remains unpredictable to an attacker for practically forever. Linux used/uses user input and network jit
199.
by agwa 2y ago
Thankfully, Go is considering making crypto/rand infallible, because as it turns out the syscalls do not actually fail in practice (it's not possible to "run out of entropy"): https://github.com/golang&#x
200.
by agwa 2y ago
Do note that "exhausting the system's entropy pool" is a myth - entropy can't run out. In the bad old days, Linux kernel developers believed the myth and /dev/random would block if the kernel thought that entr
201.
by agwa 2y ago
I mentioned attacks using DHCP option 121 (aka "classless static routes") nearly 9 years ago in my blog post about attacks on OpenVPN: https://www.agwa.name/blog/post/hardening_openvpn_for_def_co... (und
202.
by agwa 2y ago
Debian is not switching to 64-bit time_t on their x86 architecture, because they see it as a legacy architecture whose primary use is running legacy binaries. This transition is mainly to benefit 32-bit ARM since it's likely to be used
203.
by agwa 2y ago
Good news! run0 will use polkit[1], which uses JavaScript for its rules[2], so there's no limit to how complex your rules can get! On the other hand, maybe adding a JavaScript interpreter to Linux's trusted computing base isn&#x27
204.
by agwa 2y ago
Firefox and Chrome display a permission dialog when a website requests attestation, and you can deny it. If you deny it, the website has no idea how your passkey is stored, allowing you to use a pure-software solution if you so desire. Th
205.
by agwa 3y ago
Good point!
206.
by agwa 3y ago
It would, but so would an HTTP proxy. It makes make think the hosting provider doesn't use HTTP challenges.
207.
by agwa 3y ago
Why does the proxy need to terminate TLS? If it were just a TCP proxy, then at least the monitoring wouldn't have been fooled into thinking the certificate wasn't about to expire. Heck, a TCP proxy might even allow automatic rene
208.
by agwa 3y ago
> And i tell pretty much anyone who wants to listen that they should just implement the proto on their own if thats rhe only reason for a libsystemd dep otherwise Could you point out where the man page ( https://www.freedesktop
209.
by agwa 3y ago
1. systemd (at least the PID 1 part) does not talk to the network, so a remotely-accessible backdoor would need to be more complex (and thus more likely to be detected) than a backdoor that can be loaded into a listening daemon like openssh
210.
by agwa 3y ago
Is that protocol documented/stable? For whatever reason, daemons are choosing to link to libsystemd instead of implementing it themselves. It doesn't matter that libsystemd links to liblzma for other reasons. It's still in

More ›