codesniperjoe

5 ms·

1.
by codesniperjoe 4y ago
Warning: Do not go to this site with enabled javascript! They spam your uplink DNS provider with thousands of uniq, uncachable (fingerprinting?) 'test' dns keys without your consent, to identify & track the DNS service you ar
2.
FreeBSD Status Report Fourth Quarter 2022(freebsd.org)
11 points by codesniperjoe 4y ago|2 comments
3.
by codesniperjoe 4y ago
Projects Console screen reader infrastructure Vessel - Integrated Application Containers for FreeBSD Enable the NFS server to run in a vnet prison Pytest support for the FreeBSD testing framework Userland Base System OpenSSH Update Ker
4.
by codesniperjoe 4y ago
TLDR: Avoid it if you can!
5.
by codesniperjoe 4y ago
TDLR: How You Respond to Security Researchers Says Everything ... [ About Your Business State ].
6.
NSA CSI IPv6 Security Guidance (2023) [pdf](media.defense.gov)
64 points by codesniperjoe 4y ago|53 comments
7.
by codesniperjoe 4y ago
The compiler (go) is part of a static read-only (compressed/in-memory) RootFS. Build on a air-gap build server, touching only signed/verified/reviewed code from git-offline mirror snaps. Go has no libs, all static. The resul
8.
by codesniperjoe 4y ago
Yes, the base idea is not that new. I store since years every GO based application I use as small (few kb) source code tree checkout only, no binary at all. At runtime the wrapper compiles a randomized individual one-time-temporary-uniq bin
9.
by codesniperjoe 4y ago
For this new feature you pay indeed with the need for r/w and executable tmpfs/overlay somewhere. This does not replace classic ASLR: OpenBSD 5.7 activated position-independent static binaries (Static-PIE) by default. https:&#x2F
10.
by codesniperjoe 4y ago
Plain, simple and effective as always! The highly complex 'black magic' is 'sort --random' and (re-)link it all again. :) Makefile.relink: cc -o sshd `echo ${OBJS} | tr ' ' '\n' | sort -R` ${LDADD} .
11.
SSHD: Random boot time relinking, OpenBSD(undeadly.org)
101 points by codesniperjoe 4y ago|54 comments
12.
by codesniperjoe 4y ago
Finally! At least, someone finally understands that static, fully predictable, reproduce-able-builds are only an convenience feature for the attacker side.
13.
by codesniperjoe 4y ago
In general I would tend to agree, but have lately took a look at the gh dependencies this tool draws in today? [0] This is not a (classic) unix cli tool, as it was some month before. Do you think anyone will be ever able to make a coderevie
14.
by codesniperjoe 4y ago
We should really pin a daily reminder about the unfixable SSL truststore dumpster fire situation (every day a different one) to the top of YC!
15.
by codesniperjoe 4y ago
Netflix contributes. Real Code. Rock stable. High quality. For so many years. So its not only the Free-Beer-License for them. I have never seen a single commit comming back from others, who build the most (financial) successfull trillion do
16.
by codesniperjoe 4y ago
FreeBSD Hammer2 [r/o][pending] Lots of work will end up (as often) in the ports section, if nobody has a strong point why it is usefull to maintain it in base. Users/use-cases feedback are welcome. https://reviews.freeb
17.
by codesniperjoe 4y ago
If google is on the way to fix this, a look at the resources on (EVERYONES LOCAL!) not de-duplicated $GOMODCACHE would be very welcome too! (At least from an enviromental perspective.) Easy to verify, get a report [1]: go install paepcke.de
18.
by codesniperjoe 4y ago
If you need a local & offline first tool to log/track/archive changes from all kind of git repos yourself, from: * github.com * sourcehut (sr.ht) * gitlab.com * codeberg.org * ... published ssh keys & changes, to verify (o
19.
by codesniperjoe 4y ago
TLDR: gps tracker with backup battery and activated sim card found in sealed car ECU (BTO from china, to save some pennies, in a high-security-custom build car)
20.
by codesniperjoe 4y ago
Thank you! That is a quick (helpful) fix! Beside of checks for the integrity of SelfSigned Certificates, I do not used this function directly. My assumption about the TLS impact was based on the fact that [Certificate.Verify] uses internall
21.
by codesniperjoe 4y ago
One example, the started (and then stuck) net/ip to net/netip migration? The tailscale netip package is great (as external pkg), but without commit to a full migration plan, just sprinkle here and there some (half/done/
22.
by codesniperjoe 4y ago
> TLS handshakes now return a CertificateVerificationError if they fail because of, well, certificate verification. ... as long the crypto/x509 CheckSignatureFrom ignores the pathlen contraint (the /ONLY/ way of an CA Owne
23.
by codesniperjoe 4y ago
Go is great. But if you look close enough, go also has some dark corners. The reason the biggest parts of go/crypto is well designed, good readable code, is mostly the work of one person (the author).
24.
by codesniperjoe 4y ago
> Finally, reviewing the BoringCrypto integration by Russ. Do you think there is a rollback/cleanup possible of current boring/fips <enter most diplomatic/nice phrase here> situation? (eg. push it back into a sepera
25.
by codesniperjoe 4y ago
Maphash is an (non-cryptographic-secure) hash function, like CRC32 / CRC64 / XXH3-64 and others, so it turns data in an (almost) uniq uint64. The main difference is, it is an hardware accelerated & optimized compiler function,
26.
HN: Help make Golang more (resource|env) friendly(github.com)
1 points by codesniperjoe 4y ago|1 comments
27.
by codesniperjoe 4y ago
Hi, just discovered that the (sometimes excessive large) golang mod disk cache is - in opposite to the compiler cache - not (yet) properly deduplicated. Try yourself: Made a little hack/tool to deduplicate data via hardlinks (unix&#x2