agwa

16 ms·

211.
by agwa 3y ago
Thanks to autoconf, we're now used to build scripts looking like gibberish. A perfect place to hide a backdoor.
212.
by agwa 3y ago
> openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. The systemd notification protocol could have been as simple as jus
213.
by agwa 3y ago
> Or if they want to pin a root public key to ensure some other CA doesn't issue a MITM certificate, go for it Please don't pin roots, as that makes it harder to distrust CAs, reducing the agility of the WebPKI. See the Syma
214.
by agwa 3y ago
Apparently Greene learned about García while working for MI6 and it inspired Our Man in Havana ! https://earlybirdbooks.com/our-man-in-havana-excerpt
215.
by agwa 3y ago
Apple shared the details of valid.apple.com in a WWDC talk: https://devstreaming-cdn.apple.com/videos/wwdc/2017/701jvytn... Slides: https://devstreaming-cdn.apple.com/videos/wwdc/201
216.
by agwa 3y ago
Your consultants were helping you get a tax credit for R&D under section 163. That has not changed - not all software development is R&D for section 163 purposes, and you still need to justify why you're classifying software de
217.
by agwa 3y ago
> However I doubt they'd leave such an obvious loophole. Surely the IRS's definition of R&D includes all types of software development activity. I literally just linked to the IRS' definition that says not all softwa
218.
by agwa 3y ago
See section 5 of this IRS guidance: https://www.irs.gov/pub/irs-drop/n-23-63.pdf tldr: if they're developing new features, it has to be capitalized; if they're doing maintenance then it can be immediatel
219.
by agwa 3y ago
No, the law defines all software development costs as R&D (technically "R&E") for the purposes of requiring capitalization: https://www.law.cornell.edu/uscode/text/26/174 (c)(3) This is re
220.
by agwa 3y ago
A few ways you could verify it's off: 1. Try using the Privacy Sandbox APIs on your own site to confirm they don't work. 2. Examine your Chrome profile to make sure it doesn't contain ad topics or ad measurement data. 3. Snif
221.
by agwa 3y ago
Nope. See the following page for some screenshots of the UI to turn on encryption with sync passphrases: https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...
222.
by agwa 3y ago
Correct, with the caveat that if you have Chrome profile sync enabled (without a sync passphrase set) then the advertising data tracked by Chrome likely gets uploaded unencrypted to Google-operated servers. I don't know if their privac
223.
by agwa 3y ago
The rogue accounts would show up in the administrative settings in the third-party apps, and they would stick out like a sore thumb because they'd have weird email addresses. So they're not completely invisible, albeit not visibl
224.
by agwa 3y ago
Did Microsoft pay the entire $75k? The people who found that issue reported it to multiple stakeholders, and their blog post[1] merely says they were awarded $75k in total. I assume the bulk of the bounties were paid by the service provid
225.
by agwa 3y ago
To be clear, the information shows a rogue employee how to create accounts in third-party apps (Slack, Zoom, etc.) that won't be automatically deleted when the employee is terminated. I'd love to hear why you think this informati
226.
by agwa 3y ago
An LD_PRELOAD library would probably work. I wrote one which can make servers listen on UNIX domain sockets ( https://github.com/AGWA/ldpreload#ldpreload-unixbindso ) which would be a good starting point.
227.
by agwa 3y ago
I wrote an LD_PRELOAD library which can replace binds to a TCP port with binds to a UNIX socket: https://github.com/AGWA/ldpreload#ldpreload-unixbindso
228.
by agwa 3y ago
Outside of the EU, browser vendors will continue to ship browsers without eIDAS CAs, so just VPN into a non-EU country to download your browsers. But you'll probably have to keep an EU version on hand in order to access EU gov sites, E
229.
by agwa 3y ago
The browsers in fact proposed an alternative that decoupled eIDAS's real-world-identity verification from TLS connection verification, but the EU rejected it.
230.
by agwa 3y ago
They will not be restricted to their own ccTLD, and browsers will in fact be forced to ship a CA that allows Hungary to sign certs for whatever .com they want to.
231.
by agwa 3y ago
Warnings like that would likely violate eIDAS' requirements for "user-friendly" recognition, as well as its prohibition against "mandatory requirements". This is why eIDAS is so nuts - it forbids browsers from rolli
232.
by agwa 3y ago
eIDAS in fact forces browser vendors to do that, but there are two problems with what you're suggesting: 1. Good luck teaching 99% of people to be wary when they see the blue address bar. People generally do not understand address bar
233.
by agwa 3y ago
Unfortunately, the text is being drafted in secret and the latest version has not been released publicly. I have seen a leaked copy but I don't have permission to post it. I can attest that the various posts and letters speaking agai
234.
by agwa 3y ago
Browsers enforce Certificate Transparency by rejecting certificates which aren't published in CT logs. A certificate that is published in CT logs isn't necessarily legitimate, but at least it's public so domain owners can de
235.
Article 45 of eIDAS 2.0 will roll back web security by 12 years(eff.org)
253 points by agwa 3y ago|125 comments
236.
by agwa 3y ago
Yes, though eventually the state actor would run out of CAs to coerce as all the CAs in their country get distrusted. The threat of distrust means CAs have a very strong incentive to contest any government orders, since if they comply their
237.
by agwa 3y ago
> You genuinely believe that the only possibility here is a vast conspiracy to defraud and steal? Care to point out where I said that? example.com and test.com are real domains, and their owners did not authorize those certificates to be
238.
by agwa 3y ago
If you're a domain owner monitoring your own domains, a certificate is suspicious if it was not issued by one of the CAs that you use (e.g. you use Let's Encrypt, but you see a certificate for your domain in CT that was issued by
239.
by agwa 3y ago
> 1. Is this proactively monitored for? And how? And by whom? Yes, security researchers like myself are constantly looking in CT logs for suspicious certificates, and I've found many, most notably Symantec issuing certs for exampl
240.
by agwa 3y ago
Yes, but: 1. Major browsers (Chrome, Safari, Edge) only accept certificates which are published in Certificate Transparency logs. 2. If a CA is discovered to have issued MitM certificates, they are swiftly distrusted by browsers. So it&#x27

More ›