ivlad

7 ms·

61.
by ivlad 3y ago
Doesn’t certificate verification occur in PrevSep process? If so, this would only grant RCE with nobody’s privilege.
62.
by ivlad 3y ago
> Since you don’t want to have account enumeration, this means doing a primary authentication, e.g. passwords. Nothing prevents site from sending a blob of random data when real key is not found. > While hardware backed Security Keys
63.
by ivlad 3y ago
While I somewhat support the idea of avoiding debug-mode applications shipped to end customers, it seems in this particular case Brendan argues about the need to debug binaries in runtime on the server side. If there is a binary component r
64.
by ivlad 3y ago
Operating systems with lots of background tasks and threads.
65.
by ivlad 3y ago
If it’s me who disallowed “future me” (or someone pretending to be future me because my account was compromised) loading unsigned modules, I don’t see it as a problem.
66.
by ivlad 3y ago
Closing all means for root to access kernel memory is part of hardening. Modern mainstream distros don’t expose /dev/kmem and /dev/mem can be limited to less dangerous pages like MMIO, /proc/kcore can be disabl
67.
by ivlad 3y ago
In Signal, probably no. Signal has this sealed sender functionality hiding significant amount of metadata from passive observer and active examination post-communication: https://signal.org/blog/sealed-sender/ Wha
68.
by ivlad 3y ago
I got a port assigned a few years ago. I needed to write a justification why the organisation I represented needs a port number (a custom binary protocol), a formal confirmation that protocol has versioning built-in (so we will not request
69.
by ivlad 3y ago
You are proposing to use general propose language vs domain-specific ones. I think, this discussion has been settled quite some time ago. For example, awk itself is domain-specific, built for processing text (or filed-separated) files. On t
70.
by ivlad 3y ago
> TOML also is a good example of "creating problems instead of solutions": They deliberately (!) broke compatibility to the INI format due to "I can't stand unquoted strings". Yeah, emotional feelings about CONFI
71.
by ivlad 3y ago
25 years ago admin would be responsible for one server, that they would setup and then never touch until (and sometimes after) someone hacked it. Now people are responsible for thousands of containers, and GUI simply does not scale. And the
72.
by ivlad 3y ago
Facebook tested it and IPv6 resulted lower latencies: https://www.internetsociety.org/blog/2015/04/facebook-news-f...
73.
by ivlad 3y ago
You can disable IPv6 privacy extensions. The exact process depends on the operating system you use.
74.
by ivlad 3y ago
By that logic, you can disable IPv4 and still access the site via IPv6. IPv4 is useless. Also, running dual-stacked servers I can confirm, all scans come via IPv4, so not only it is useless, it’s actually less secure to use it.
75.
by ivlad 3y ago
> Azure was owned pretty hard a while back, very little was ever heard of it again. From what I recall, it was a Chinese APT (designated as Storm-0558, which I think means they could not reliably attribute it to any group: https:/&
76.
by ivlad 3y ago
Crowdstrike. FireEye.
77.
by ivlad 3y ago
They probably confuse it with Russians hacking Yahoo and having access to user account admin interface: https://www.csoonline.com/article/560623/inside-the-russian-...
78.
by ivlad 3y ago
Google or self-host. With self-hosting you get to use thing now considered legacy (e.g., IMAP servers), but I definitely have seen them working for organisations with thousands of employees. You’ll need staff to support it, too, but at some
79.
by ivlad 3y ago
We seem to be special: we are the only (so far) known species having complex speech as well as ability to convey our thoughts to others, capability to build tools, and abstract thinking.
80.
by ivlad 3y ago
Surprisingly, I am listening the latest Rolling Stone album right now and I wanted to check if they will tour our town. I went to their web site to check it and to my surprise I was not able to find any tour info there. Not a counterpoint,
81.
by ivlad 3y ago
I felt a great disturbance in the Force, as if millions of voices suddenly cried out in terror.
82.
by ivlad 3y ago
Apple/Google know your location anyway. It’s about limiting the number of parties that do.
83.
by ivlad 3y ago
Brad Smith ( https://news.microsoft.com/exec/brad-smith/ ) is a PR person at Microsoft. His role is to make loud statements on matters he has no knowledge of or qualifications to talk about.
84.
by ivlad 3y ago
That would require granting Starbucks app access to your location, even when the app is in background. Why would you do that?
85.
by ivlad 3y ago
Korea and Afghanistan are obvious counter-examples.
86.
by ivlad 3y ago
Yeah, that’s command injection in mailutils I mentioned, not in fail2ban itself. Did you see how it’s supposed to be exploited? Did you see a real-life exploitation? While it’s a nice trick, it’s simply not relevant. And the vulnerability b
87.
by ivlad 3y ago
I looked at fail2ban exploits and they are either LPE due to file permissions or command injection in other tools like mailutils. Citation needed for the claim “has been attacked” if you refer to real attacks in the wild.
88.
by ivlad 3y ago
Often, they do, however configuring it for different applications may be a bigger effort than doing so via fail2ban with minimal log parser tweaking.
89.
by ivlad 3y ago
While I agree fail2ban is a wrong tool to prevent password brute force - better authentication mechanisms should be used instead - it has its uses. For example, it can be used to automatically ban (or alert about) dumb http scanners like go
90.
by ivlad 3y ago
MacPorts over homebrew 100% all the time. It’s better suited for a multiuser system (and I share my desktop with my wife who has a different login) and is more stable, too.

More ›