jethro_tell

10 ms·

91.
by jethro_tell 3y ago
You don't think every nation state has people inside private software shops? Especially big tech? Look at stuff getting signed with MS keys, hardware vendors with possible backdoors. Social engineering is social engineering and it can
92.
by jethro_tell 3y ago
I'm not looking for a loophole or a legal hypothetical, I'm wondering if our laws are keeping up, which they very often do not with tech. This is not unauthorized access, but is also clearly wrong. I'm wondering if its illeg
93.
by jethro_tell 3y ago
Brought in from a patch they rejected to accept because of this exact risk
94.
by jethro_tell 3y ago
Openssh has refused this patch that enables this in Debian multiple times as acrisk of preauth code execution as root. So maybe just don't patch sshd?
95.
by jethro_tell 3y ago
Its from the Gentoo maintainer of the package and libarchive project dev that submits changes, patches, is involved in the mail list and has ops on the groups IRC chan. It's included in Lasse Collin's FAQ now that he has been foun
96.
by jethro_tell 3y ago
To be fair, so could closed source code. The difference in this case is that a guy was running perf tests against postgres and noticed his ssh was slow, so he dove into that and found the backdoor a couple days after it was pushed. If you h
97.
by jethro_tell 3y ago
I see a dev on the project has just posted that it has been seen in the wild, so I guess you'd have standing there. https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b...
98.
FAQ on the xz-utils backdoor(gist.github.com)
141 points by jethro_tell 3y ago|30 comments
99.
by jethro_tell 3y ago
How does posting an exploit POC differ here?
100.
by jethro_tell 3y ago
Maybe I'm miss understanding things, but it seems like anyone can publish an exploit on the internet without being a crime. In the same way encryption is free speech. It would seem unlikely this guy would be also logging into peoples
101.
by jethro_tell 3y ago
RHEL won't get this bug for 2 years =)
102.
by jethro_tell 3y ago
And, If you break the embargo too many times then you just find out with the rest of us and that's not a great way to run a distro. I believe openbsd is or was in that position around the time of the intel speculative execution bugs.
103.
by jethro_tell 3y ago
What looks legit about a gmail address and some stock art for a profile?
104.
by jethro_tell 3y ago
And what law would you use to target someone who wrote some code and posted it for free on the internet that was willingly consumed?
105.
by jethro_tell 3y ago
You're assuming that it's even a single person, it's just a gmail address and an avatar with a j icon from a clip art thing.
106.
by jethro_tell 3y ago
I that no you usually give convent as part of the sign up for the rewards program. They can track your cards and if they want to track those back to an address and match them all up, not a big deal, but they can sell it if you agree to thei
107.
by jethro_tell 3y ago
They absolutely learn! These jackasses got paid in stock, inflated their income 10x, cashed out, and then when shit hits the fan, the corporation is on the hook. These leaders never go on trial for this shit because destroying culture isn
108.
by jethro_tell 3y ago
Of course, and that right there is luck of the draw. Didn't list the specific thing I need help with? Might not make it to the list of 20 I look at. Not because I wouldn't hire someone for not listing it, or demonstrating they c
109.
by jethro_tell 3y ago
I had a role open for a sr. Sys admin. I got 150+ applications per day. At some point, you just have to close the window. I can only realistically do 10/25 résumé per day and still do my job. All most all hiring has a strong element o
110.
by jethro_tell 3y ago
Additionally, in generational cycles where you can maintain or exceed your parent's class status without moving away. Whole swaths of the US don't have enough good jobs to maintain a middle class lifestyle for kids of middle class
111.
by jethro_tell 3y ago
Yes, defiantly not saying that's not how these work, and I do know that large boats tend to be direct drive. I'm just pointing out that most engines could do this and the limitation is generally how it interfaces with the externa
112.
by jethro_tell 3y ago
Yeah, in theory, there's not a lot about an engines running direction that matters, its all the stuff that's hooked up to it. As you start getting into more complex engines, where you have fuel injection, timed spark plugs, oil pu
113.
by jethro_tell 3y ago
This is actually common for a 2 stroke type engine and used in things like gas golf carts and snow machines. The direction the engine is started is the direction it runs. So to accomplish this for propulsion, you'd add a reverse polar
114.
by jethro_tell 3y ago
That doesn't work if you need to RMA the disk. So best to encrypt before you put anything on the disk
115.
by jethro_tell 3y ago
This is mostly me but the case that's the most common is that a disk can't be wiped because its dead. Gotta do that before hand.
116.
by jethro_tell 3y ago
Makes sense. Probably more work to go off the beaten path then to maintain two configs
117.
by jethro_tell 3y ago
This is really cool. I'm going to give this a try!
118.
by jethro_tell 3y ago
I use normal opensshd for this. No reason to support two ssh daemons when you can do it with one. The difference in size on your init image is minimal and you probably aren't even trying to optimize for space there. If you don't k
119.
by jethro_tell 3y ago
Its hit or miss if you can get the flight you need or of there and it always costs more from what I can see.
120.
by jethro_tell 3y ago
Except that it breaks other people in busy networks. Fuck everyone else my WiFi feels good.

More ›