mjg59

17 ms·

181.
by mjg59 1y ago
Great. A tech swaps out a network card, now how do I log in to rewrite the ifcfg file when the interface wasn't brought up with the correct config because it has a different name?
182.
by mjg59 1y ago
It turns out that people do not love having to log into a machine after a network card swap to get the new network card to have the same name. Initialisation order is explicitly not guaranteed by the kernel and so absolutely does not work e
183.
by mjg59 1y ago
systemd's design choices here were influenced by a lot of bugs Red Hat received where failed hardware was swapped out and interface names changed as a result. Real world enterprise users wanted this, it wasn't an arbitrary desig
184.
by mjg59 1y ago
The idea is to be a space where existing social groups play, rather than a wider community - it's inherently based on a level of pre-existing trust. Writing about it is supposed to be an incentive for people to build their own little s
185.
by mjg59 1y ago
It's normal to consider it a security issue. Whether you consider it your security issue is contextual.
186.
by mjg59 1y ago
At a social level we should know how to do this well because there are cases where it needs to be done well. Some hardware is operating in incredibly safety critical scenarios where you do want to have strong confidence that it's runni
187.
by mjg59 1y ago
Having spent a while working in embedded and learning that this is not a lesson that's been internalised: this is why you never sign any executable that can boot on shipped hardware unless you'd be ok with everyone running it on s
188.
by mjg59 1y ago
A20 bugs were still with us until at least 2009, when I tripped over one: https://mjg59.livejournal.com/118098.html . I love the visualisations in this post, it makes it much clearer what's actually going on.
189.
by mjg59 1y ago
The fundamental problem was that x86 had no mechanism for verifying first instruction at the time (Boot Guard and Platform Secure Boot provide that now), and the only way to try to deal with this was by adding immutable storage - but given
190.
by mjg59 1y ago
The attestation is purely the MFA token, not the OS
191.
by mjg59 1y ago
The entire point of this is that I don't want to deal with non-standard port numbers or bouncing through hosts. I want to be able to host services in the normal boring way, and this approach lets me do that without needing to worry a
192.
by mjg59 1y ago
I have one public IP address. I have three machines behind it that I want to SSH into. How does the machine with the public address know where to route an incoming port 22 packet? For HTTPS this is easy - browsers send the desired site in t
193.
by mjg59 1y ago
Pretty much! My ISP was founded by https://en.wikipedia.org/wiki/Rudy_Rucker and is somewhat cheap and delightful and happily routes me a good amount of IPv6, and every 48 hours or so it RAs me an entirely different ra
194.
by mjg59 1y ago
Right yes but I (for various reasons) end up using a lot of different client systems and I don't want to have to configure all of them to transparently jumphost or use different port numbers and why are people spending so much time try
195.
by mjg59 1y ago
I can port forward port 22 to a single machine. I can't proxy port 22 in a way that directs the incoming connection to the correct machine, at least not without client configuration.
196.
by mjg59 1y ago
Yes, if I had multiple IPv4 addresses already it wouldn't be necessary to tunnel in additional IPv4 addresses, but since I don't and since there are no ISPs who will provide that to me at this physical address, tunneling is where
197.
by mjg59 1y ago
Depends on the protocol. For web, sure - for ssh, nope, since the protocol doesn't indicate which machine it's trying to connect to and so you don't know where to proxy it to.
198.
by mjg59 1y ago
That doesn't work well if you want to run the same service on multiple machines. For some you can proxy that (eg, for web you can just run nginx to proxy everything based on either the host header or SNI data), but for others you can&#
199.
by mjg59 1y ago
You could just set a default deny iptables policy for forwarding to that host, and then explicitly open the ports you want
200.
by mjg59 1y ago
I have multiple devices on my internal network that I want to exist outside, and dynamic DNS is only going to let me expose one of them
201.
by mjg59 1y ago
Shor's algorithm is primarily relevant to asymmetric cryptography, and disk encryption is pretty much universally symmetric. Quantum computers do nothing to break modern disk encryption.
202.
by mjg59 1y ago
No, the firmware never has any private keys. You sign offline with a private key and provide the public key to the firmware. All further bootloader updates are signed with the same key and require no additional firmware configuration.
203.
by mjg59 1y ago
The situation you're protecting against is one where someone who compromises the OS can make that compromise persistent by replacing the bootloader. That means you can't place any trust in any component after the bootloader, since
204.
by mjg59 1y ago
Secure boot.
205.
by mjg59 1y ago
> Secure boot requires that the bootloader match a hash derived from a TPM-stored key. This isn't even slightly accurate. Secure boot does not rely on TPM keys on any way.
206.
by mjg59 1y ago
If a device is running code you control, how does it defect?
207.
by mjg59 1y ago
How does the system know whether the new bootloader is legitimate or not? All TPMs have private keys from the factory. They're entirely unrelated to the secure boot keys.
208.
by mjg59 1y ago
You should be able to do what you want to it. You should also be able to configure it such that only you can do what you want to it, and nobody else can. Secure Boot protects against boot kits, malware that replaces the bootloader and bac
209.
by mjg59 1y ago
Where does Windows 11 check the set of trusted certificates?
210.
by mjg59 1y ago
I've found no evidence that it checks the set of trusted certs, only that secure boot is enabled (which is trivial to fake).

More ›