mercora

13 ms·

91.
by mercora 5y ago
this did indeed help understanding and fixing the issue.
92.
by mercora 5y ago
i likely ran into the same or a related issue. i dont know much about javascript though. for(var i = 0; i < elevators.length; i++) { elevators[i].on("idle", function() { for(var j = 0; j &l
93.
by mercora 5y ago
i would generally agree but there were times were i had seriously abstract dreams about implementation details i needed to come up with before going to sleep. these dreams are really hard to describe because they are so abstract but it feel
94.
by mercora 5y ago
i don't think that is necessarily the case but instead i believe in the near future the differences between container sandboxes and virtual machines might be less clear. I imagine CPU and memory namespaces coming implemented on hardwar
95.
by mercora 5y ago
... "hello, my credit card data has been acquired and used without permission. I still possess the card but want you to freeze the account and a new card mailed to me afterwards." do you see how this is just more accurate?
96.
by mercora 5y ago
> but every person who has used the product without paying for it is such a loss. i bought lots of products only after pirating them. would i not have done that i would not have bought many things at all. I also fondly remember simply no
97.
by mercora 5y ago
... or been acquired without permission?
98.
by mercora 5y ago
it is likely that way because it is an argument that often comes up when discussing losses accumulated through piracy. were the argument typically is that not every copy should be accounted for a loss of sale. it does not really apply here
99.
by mercora 5y ago
for me stealing implies change of possession. this does not apply here. what might have been taken is the possibility to monetize it the way they imagined or that they had been hurt by the PR afterwards and similar things. but nothing has b
100.
by mercora 5y ago
while i think this statement is flawed anyways, there is a difference in being the only one who can find these flaws easily or being part of a community were everybody could do this if qualified.
101.
by mercora 5y ago
note that every AZ assignment is mapped randomly for each account [0]; "To ensure that resources are distributed across the Availability Zones for a Region, we independently map Availability Zones to names for each account.". my e
102.
by mercora 5y ago
i would say try new technologies on problems you are familiar with and focus on the problem space itself otherwise. that is independent of if this is a new project or not. if my goal is to learn something new i try to find a project in a pr
103.
by mercora 5y ago
i feel like they are doing this to "scratch" themselves when their skin feels itchy...
104.
by mercora 5y ago
that's what i thought too. or somehow having to to relay specific broadcasts or similar ways to make the discovery work. this is why i had the impression it could be related to some routing trickery that might had worked for ipv4 but n
105.
by mercora 5y ago
> I would periodically get it working and then it would periodically break. wait a second... it worked sometimes? without doing any routing trickery or something? If you did some trickery maybe the devices sometimes chose to speak ipv6 b
106.
by mercora 5y ago
this is not different for any other internet connected device on your network. although i doubt its about connectivity to the internet but about connectivity to some backend over the internet. I think it is quite common to assume these ri
107.
by mercora 5y ago
if there is a new vaccine required or some follow up procedure or whatever it would make more sense to hand out a new certificate that validates this fact instead of revoking the old one that is actually still perfectly able to validate you
108.
by mercora 5y ago
at a previous job i cleaned up after such mess. they used to have fail2ban adding thousands of rules without ever deleting them automatically. I replaced it with a pam module that maintained an ipset for addresses with failed login attempts
109.
by mercora 5y ago
systemd-networkd keeps open that kind of socket for LLDP but apparently not for the DHCP client code. wpa_supplicant also keeps open this type of socket on my local system. and the dhcpd daemons on my routers have some of those too for each
110.
by mercora 5y ago
What did he suggest as a mitigation? or isn't that part of an audit?
111.
by mercora 5y ago
> Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot). so locked means i can not boot any other system until its unlocked? How do i do this? is there another passphrase involved? d
112.
by mercora 5y ago
i think technically you are correct but in case of a U2F key i am not authenticating the machine directly but check if the person in front of the screen is in possession of the token. that is different then assuring the device they are on i
113.
by mercora 5y ago
these are valid points and of course everything you do to improve your security posture should somehow be related to your real threat model. However, OP was implying TPM might be more secure then an encrypted key on a disk which i disagree
114.
by mercora 5y ago
> Once you have access and either root or pass whatever extra authentication the access requires. How hard would it be to boot a signed kernel with a system ready to give you all the access you want or need? > The extra failure mode h
115.
by mercora 5y ago
so that does mean once i have access to the computer the keys are somewhat free to use. thus i am authenticating the device not the user which is kind of an important distinction... IMHO this is not as secure as storing the key encrypted on
116.
by mercora 5y ago
are keys in the TPM really securely stored and accessed? can i trust those to only be used by myself by i.e. providing a password or similar? i also think touchid should rank even lower because its likely somewhat easy to forge.
117.
by mercora 5y ago
i feel the same and would like to see buildings get connected as a whole paid by part of the utility billing or similar. something akin to how central heating is paid for.
118.
by mercora 5y ago
> and perhaps pioneered? i highly doubt that. in fact i knew about ssl striping before i knew moxie or even sslstrip and this attack was probably already well known when someone came up with a seperate url scheme for https...
119.
by mercora 5y ago
import is part of ImageMagick and "saves any visible window on an X server and outputs it as an image file. You can capture a single window, the entire screen, or any rectangular portion of the screen."
120.
by mercora 6y ago
while that would partially help, i think there are better use cases for this type of setup. it is less about discovering endpoint addresses of peers (you could setup a statically configured mesh network too) and more about moving packets ef

More ›