lvh

88 ms·

961.
by lvh 8y ago
Wireguard has taken third party funds to expedite development, but as far as I know the author is pretty adamant all the implementations are freely available and open source, so maybe angel funds aren’t the best direct way forward. Disclaim
962.
by lvh 8y ago
It’s great at roaming, but it is UDP; so if your bad WiFi doesn’t let you use egress UDP that won’t work. It’s pretty speedy though :)
963.
by lvh 8y ago
Public internet SSH isn’t the worst thing in the world; but for some people that doesn’t mean a reasonable bastion story but rather “every host has a public IP” — and that’s just just an extra opportunity to put an unauthenticated Redis or
964.
by lvh 8y ago
It’s a fine way to get started; sure. You probably need ssh anyway and getting forwarding up for free is neat. It also had the historical advantage of existing; wireguard is new. Perf is sometimes not great, but at least you’re likely to ge
965.
by lvh 8y ago
To illustrate the principle of removing attack surface with your example of a WP site, instead of parking a WAF in front of it, create a static mirror and move the WP site to your internal network.
966.
by lvh 8y ago
I'm going to assume that whenever you say firewall you're talking about a WAF, since you mention "web equivalent of iptables". Disclaimer: I also work with 'tptacek, but opinions my own. > it takes less than an h
967.
by lvh 8y ago
Because there are people who are willing to believe that something is good or bad without needing to understand the rationale behind it? Most people making the case for WAFs aren't posting detailed rationales of why WAFs are a good way
968.
by lvh 9y ago
I’ve done both and found the GPG route marginally more reliable but YMMV. You might run in to fewer issues if you’re not on macOS; one example of a problematic interaction is that the official OpenSC installer package installs a tokend plug
969.
by lvh 9y ago
How do you know there is a secure channel to the site? If the certificate doesn’t have to be CA signed, I can produce a certificate for google.com.
970.
WireGuard now works on unmodified Android 6+ devices(twitter.com)
3 points by lvh 9y ago|0 comments
971.
by lvh 9y ago
I already demonstrated that this is false: there are tons of examples of Google giving MSRC grace periods to hit a patch Tuesday, and in the example GF cited, Microsoft _skipped the patch Tuesday_!
972.
by lvh 9y ago
I already addressed why that doesn't really hold water: it assumes that you're likely to know if a bug is being exploited or not. Google found the bug. They're already doing the free research, giving Microsoft a reproducer, a
973.
by lvh 9y ago
What did I read into your comment that you didn't say? You claimed Google used a line of reasoning when it suits them, I refuted that. Your argument only works if a few things are true: * P0 is unwilling to budge from the 90 day disclo
974.
by lvh 9y ago
I have a hard time thinking of a more elite team than P0. They earned their stripes long before they got there. The disclosure policy is the right thing to do, not to make someone feel better about their job.
975.
by lvh 9y ago
They asked for multiple extensions, couldn’t give a hard deadline on the Redstone release, didn’t disclose why it was hard to patch (“unforeseen code interactions” is basically every patch ever, definitionally!) and a comparable bug has gon
976.
by lvh 9y ago
Because attackers only need 1 of the bugs to work? The argument only tenuously holds for disclosure to begin with, but it doesn’t make sense at all for patching. Also, the other bug has been known, with POC, for more than half a year.
977.
by lvh 9y ago
Not that I don’t welcome competition, but you mean the “splines” attribute? https://www.graphviz.org/doc/info/attrs.html#d:splines
978.
by lvh 9y ago
What is an acceptable amount of time? Why isn’t 90 days the correct number? A comparable bug has been out since Aug2017 and MS hasn’t patched it. Is a year the right number? Does everyone get that extension by asking? How does that help any
979.
by lvh 9y ago
Is Microsoft allowed to make arbitrary business decisions that prevent it from responding to security vulnerabilities or is backwards compatibility given a special pass? They own an operating system. We get to hold them responsible for what
980.
by lvh 9y ago
What gives Microsoft the right to set the deadline? It’s their bug, and the bad guys aren’t going to stop using a bug because Microsoft has decided to be slow at patching.
981.
by lvh 9y ago
“Long before Microsoft could patch” meaning when Microsoft decided to cancel a patch Tuesday? If Microsoft decided that the correct patch cadence was quarterly or annually (because so much QA work goes into a release), does that change wha
982.
by lvh 9y ago
Trademark is not the same thing as copyright. A work might be affected by both, but "put it under a CC license" does nothing to make the trademark freely usable. To make the trademark freely usable, they simply have to abandon it
983.
by lvh 9y ago
If an attacker compromises the credential, the credential is useless, yes? The credential is still customized _per origin_, so you'd have to decap the U2F key to extract the secret. This hardware is specifically designed to make that h
984.
by lvh 9y ago
PyPI has started requiring modern, secure TLS (TLS 1.2) to download stuff. You don't need Python 3, but you do need a more recent Python or at least one compiled against a more recent libssl. Which one are you running and do you have t
985.
by lvh 9y ago
Yeah, sorry, I didn’t mean to split hairs. They’re definitely both in use. I do plenty of work in Zp and I feel bad every time I don’t write \equiv or the \pmod for that matter :)
986.
by lvh 9y ago
Sure; I think we’re in violent agreement here, it’s absolutely the case that people write the simpler version when the meaning is clear from context. I’ve definitely done that a bunch.
987.
by lvh 9y ago
The usual notation for modular arithmetic uses three dashes, not two, to denote congruence.
988.
by lvh 9y ago
It's true that U2F/WebAuth doesn't fix e.g. a CSRF vuln or an XSS vuln where someone abuses legitimate credentials like a session cookie, but this does effectively beat phishing, and that's no small feat.
989.
by lvh 9y ago
UUIDv4s are. The other kinds are deterministic. (And to be fair, quite rare ;))
990.
by lvh 9y ago
The GP was presumably talking about TLS with mutual auth. There’s no excuse for not having TLS at all enabled, but mTLS is a great extra security feature. The cost of mTLS (performance wise) is negligible, and if you can’t keep a persistent

More ›