matt_wulfeck

157 ms·

1501.
by matt_wulfeck 11y ago
Ansible and Salt were both huge steps forward for provisioning. However, after switching to immutable resources I've largely replaced the need for such services. I don't mind that there's a panoply of bash scripts to configur
1502.
by matt_wulfeck 11y ago
I recommend yubikey for everyone else. It's cheap, safe, simple, and widely used.
1503.
by matt_wulfeck 11y ago
Personally I find a yubikey to be the best middle ground. Your private key is stored in the secure element and can never be removed from the hardware. You protect that also with a password, and the key must be physically touched to be activ
1504.
by matt_wulfeck 11y ago
Open hardware and open source. It's our only path. In my opinion the best way for this to happen is to make it part of the government procurement process, that will inject cash into the ecosystem. I really believe this has already begu
1505.
by matt_wulfeck 11y ago
Also if you look at the complexity of the code, you'll know something like port-knocking would have had no affect (probably just an extra line in the custom handler). People that discover these these types of exploits each machine code
1506.
by matt_wulfeck 11y ago
More specifically, the backdoor had been backdoored, as someone replaced the Juniper constants (which itself replaced the NIST constants) in dual_ec with their own, which allowed passive traffic snooping. The backdoor to the backdoor was ba
1507.
by matt_wulfeck 11y ago
Your assurances are good but the software simply _must_ be open source with a reproducible build. We're kidding ourselves to put our faith into these closed-source products and that's only just now becoming clear. Open source. It&