akerl_

34 ms·

811.
by akerl_ 1y ago
It seems like you may not be familiar with Arch? No, makepkg doesn’t run in a sandbox. The system tries to stop you from running it as root, but otherwise all validation of the trustworthiness of the pkgbuild and any sandboxing of the build
812.
by akerl_ 1y ago
And even with 3rd party package managers like yay, the package manager is pulling the pkgbuild definition locally, running makepkg for you, and then installing that.
813.
by akerl_ 1y ago
Is this accurate? My understanding is that the AUR does not host binary packages. It hosts pkgbuild files, which contain config and scripts that a user has to build on their own machine in order to install. The malicious code here is fetche
814.
by akerl_ 1y ago
Your disagreement seems to be with the spec for HSTS, which does say it should prevent showing a site with HTTP or with an invalid cert. https://datatracker.ietf.org/doc/html/rfc6797#section-12.1
815.
by akerl_ 1y ago
Isn’t that what’s happening? The browser shows a big warning with context and then the human makes a decision to click the “do this it’s fine” button. The exception is cases where the site operator has opted in to HSTS or similar to indicat
816.
by akerl_ 1y ago
This isn’t about perfect vs good. The thing you’re suggesting is outright not possible given the staffing that the Python maintainers have.
817.
by akerl_ 1y ago
That’s basically no validation at all. Python doesn’t even have that kind of namespacing to need to validate. The kind of validation being discussed here would take way more than “a staffer”.
818.
by akerl_ 1y ago
It looks like they are deciding how to approach this. The article you’re commenting on is about how they identified malicious behavior and then blocked that behavior. It seems odd to pitch suggestions for other things they ought to do but t
819.
by akerl_ 1y ago
Do you have a serious pitch?
820.
by akerl_ 1y ago
Who would do the manual review?
821.
by akerl_ 1y ago
I’m speaking from experience, not assuming. The way you get quality products is by requiring and validating quality, not by picking a lowest common denominator and then pinning it in place for a decade with paperwork and calcified standards
822.
by akerl_ 1y ago
It’s way better at preventing usage of modern crypto than it is at blocking snake oil.
823.
by akerl_ 1y ago
I don’t understand what you mean. If you want Ethernet run through your house, or coax in more places, or access points mounted, you don’t call your ISP. You call an electrician or a handyman or somebody and tell them you have some low volt
824.
by akerl_ 1y ago
It doesn’t bother me as much as having an in-group trying to close the door on people they’ve decided are below the bar and don’t get to use a word. I think engineers will survive just fine.
825.
by akerl_ 1y ago
> If the system you’re interacting with isn’t deterministic, you don’t understand how it really works internally, and you’re prodding it to see what happens if you do this instead of that—then that just isn’t engineering! Biological engi
826.
by akerl_ 1y ago
Isn’t this the same thing folks said in the past when software developers got reclassified into “engineers” alongside civil/electrical/etc engineers who had standards bodies, professional credentials, and licenses? It’s really con
827.
by akerl_ 1y ago
"credible threats" is a term of art, and these comments aren't that.
828.
by akerl_ 1y ago
Sort of by definition, prior restraint is when the government prevents someone from doing something (in the context, of the term, generally always speech/expression) prior to it happening. This is the kind of bluster that has certain
829.
by akerl_ 1y ago
Yea, that makes more sense, but still seems incorrect? Just on my phone, several apps let me subscribe via the Apple AppStore but also by subscribing on their website with a credit card (like Discord, NYT, AllTrails, HBO, etc) And that’s no
830.
by akerl_ 1y ago
What is this article talking about? Basically every app I have on my phone that takes payments from me accepts ApplePay and also credit cards.
831.
by akerl_ 1y ago
Likewise. My first introduction to scripting was automating EverQuest. I learned the basics of path resolution writing a script to grind misty thicket picnics. I wrote my own HUD-style UI overlay to replace most of the default windows. And
832.
by akerl_ 1y ago
I've not seen any indication at all in LetsEncrypt's announcements that this is the case. Can you say more about how you're deriving that intuition?
833.
by akerl_ 1y ago
The difference is the directionality. The attack here isn't "snatch a domain from somebody who previously got a cert for it", it's "get an IP, get a cert issued, then release it and let somebody interesting pick it
834.
by akerl_ 1y ago
I’m not sure what that would even mean. What is the network operation scenario where you want the credentials for your machines to be tied to a global PKI tree whose roots are all either multinational companies or world governments.
835.
by akerl_ 1y ago
I don’t think it’s malicious. I usually see it happen when the company staff in charge of working with the auditors either aren’t interested in engaging (often due to stigma and baggage about the compliance industry) or don’t realize the dy
836.
by akerl_ 1y ago
“Management” here is a term of art. For many compliance regimes and controls, the engineer responsible for a system can make a statement as “management”.
837.
by akerl_ 1y ago
In my experience, it's more likely it was the approach of the folks at your company that made your controls. SOC2 (and a bunch of similar regimes) basically boil down to "have you documented enough of your company's approach
838.
by akerl_ 1y ago
Why would you want to tie either of those to a global PKI?
839.
by akerl_ 1y ago
I don’t think you’re grokking what a BGP hijack looks like. The attacker steals traffic destined to an IP address at the routing layer. They aren’t hijacking a name, they’re hijacking traffic to the IP that name resolves to. In the case of
840.
by akerl_ 1y ago
Ok, so deploying DNSSEC would specifically solve the threat model of an attacker who can perform a BGP hijack of IP addresses, but doesn’t want to hijack multiple DNS server IPs because that’s more work, for a domain that has CAA records an

More ›