ckuehl

9 ms·

31.
by ckuehl 12y ago
With that said, the English is actually quite good compared to most of the spam I see (although some of the synonyms don't make sense, so were probably automatically generated).
32.
by ckuehl 12y ago
There's nothing wrong with adding your public key to many servers, as long as you keep the private key secure -- almost everyone does this. The article is discussing sharing of SSH host keys, which allows impersonation of an SSH server
33.
by ckuehl 12y ago
Are you talking about SSH host keys? Those are normally generated automatically, and should be unique for each server. (These are the things you're asked to verify the first time you connect to a new server.)
34.
by ckuehl 12y ago
You should check out reprepro [1]. The configuration is really easy compared to other solutions [2], and once you've set it up, it's just one command to add or remove packages. The hardest part is generating a GPG key. One note: i
35.
by ckuehl 12y ago
> for example injecting an older version of a package with a known security issue There's a limited window during which an attack like this will work. If you look at one of the Release files [1], you'll notice the pseudo-head
36.
by ckuehl 12y ago
> it’s also almost impossible that I could influence the value ahead of time even if I had an insider at the NIST. Even if I’ve hacked into the NIST’s servers and tried to change that one value, the way that the values are chained will
37.
by ckuehl 12y ago
Sorry, I should have clarified. That list is the top 10 IPs by number of requests, not the top 10 cities. I just replaced the actual IPs with the cities in their whois (since I'm not sure I want to post the IPs publicly).
38.
by ckuehl 12y ago
> It makes me wonder what sort of numbers the really famous sites are seeing Not exactly a famous site, but I thought a larger sample size might be interesting... We [1] provides shared hosting for about 500 WordPress installations, of
39.
by ckuehl 12y ago
> There is a solution: parentheses without commas. I don't know why this works, but I'm glad it does. It's worth mentioning that this is a somewhat controversial practice. Guido has even discussed removing C-style string
40.
by ckuehl 12y ago
Debian has a pretty nice mirroring system. Not only are all packages signed, but the Release file (which includes checksums of package lists) is also signed, preventing a mirror from omitting packages. For repositories which receive securit
41.
by ckuehl 12y ago
A quick plug: for those who enjoy Serial, there's an incredible amount of high-quality discussion about it on the serialpodcast subreddit [1]. The very high level of engagement the show has with some listeners is surprising. I don&#x27
42.
by ckuehl 12y ago
While I understand the point that you're trying to make, I think that characterizing suicide this way is unhelpful. It ignores the fact that most of the people who end up committing suicide are deeply sick, and does nothing but make th
43.
by ckuehl 12y ago
Your understanding is pretty much correct. To quote DJB [1]: Think about this for a moment: whoever wrote the /dev/random manual page seems to simultaneously believe that (1) we can't figure out how to deterministically ex
44.
by ckuehl 12y ago
The author is referring to the case where you use a blacklist to drop traffic to certain ports. Dropping traffic looks different than responding with a RST, which distinguishes that port (since all the others respond with an RST). But, if y
45.
by ckuehl 12y ago
It seems that it might be more appropriate to simply have your default firewall rule be to drop incoming traffic, and to then open only those ports you need. If you're using a port whitelist (rather than blacklist), the problem the aut
46.
by ckuehl 12y ago
Right, the point being that bash is vulnerable, not zsh (as was suggested by the post I was replying to). I'm not claiming that using zsh as your interactive shell somehow makes you immune.
47.
by ckuehl 12y ago
How are you testing it? If you're just pasting one of the proof-of-concept lines into zsh, such as this one: env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...then you're really just e
48.
by ckuehl 12y ago
You could mitigate it somewhat by switching your sources to HTTPS, assuming you trust the mirror you're using. (The official ftp.xx.debian.org mirrors don't support this, but some popular mirrors do; you're still at the mercy
49.
by ckuehl 12y ago
I'm very skeptical that traditional screen-lock passcodes offer useful protection for the average person. Most people still choose to use 4-digit passcodes for convenience, leaving exhaustive key search [1] well within the reach of eve
50.
by ckuehl 12y ago
One thing worth keeping in mind: it's no longer possible to purchase "raw infrastructure" on the Rackspace cloud; new accounts only have the option of "Managed Cloud" [1], which includes a service charge (minimum $5
51.
by ckuehl 12y ago
Messages like "your connection is encrypted with 256-bit encryption" don't tell you anything about the size of the RSA keys in use. During the TLS handshake, your browser and the server do public-key crypto to authenticate ea
52.
by ckuehl 12y ago
I'm interested in statistics (especially from websites with non-technical and international audiences) about what percent of visitors are using browsers/devices that don't support SNI. I don't know how representative thi
53.
by ckuehl 12y ago
> It's good, because you have control over the certificate creation, and never have to share your private key. You will never have to share your private key when getting a certificate from a proper CA, either.
54.
by ckuehl 12y ago
Out of curiosity, can you provide an example (or examples) of what you consider to be a well-designed CLI?
55.
by ckuehl 13y ago
Not sure if this is what you're referring to, but this was done last year in secret by ESEA, a US gaming league (primarily Counter-Strike) [1]. They claim the value was almost USD$4,000 over about two weeks, although we don't real
56.
by ckuehl 13y ago
Can you elaborate on this at all? I connect to an OpenVPN server while behind NAT all the time and it has worked behind almost every possible network configuration I've tried (no NAT, "home" NAT, carrier-grade NAT, cellular d
57.
by ckuehl 13y ago
Ideally you would use port 587, which is the designated port for mail submission. See RFC 2476 [1]. This requires that your mail provider supports that port, of course, which is unfortunately not always the case. [1] http://www.i