moviuro

29 ms·

1. 271.▲
   by moviuro 8y ago

   Redundancy I don't have backups myself, but I have 5 copies of my data at 3 different locations + snapshots everywhere: desktop, laptop (linux, BTRFS), NAS at home (FreeBSD, ZFS); off-site dedicated server at OVH (FreeBSD, ZFS); at s
2. 272.▲
   by moviuro 8y ago

   GDPR-compliant link: https://text.npr.org/s.php?sId=146490064
3. 273.▲
   by moviuro 8y ago

   https://inbox.google.com though programmed for termination looks unaffected here. Maybe worth a shot?
4. 274.▲
   by moviuro 8y ago

   > the best wireless configuration system going With hostname.if(5)? I've never run OpenBSD on a laptop: mind explaining it (or linking to man pages?)
5. 275.▲
   by moviuro 8y ago

   > The majority of websites run on https now We are talking about a specific use case of https: software repositories, which are far higher-value targets than your random website, with another set of challenges. Your package manager can a
6. 276.▲
   by moviuro 8y ago

   In the worst case, you only need to overcome one. And you ~double your attack surface.
7. 277.▲
   by moviuro 8y ago

   > adding https over http for the current system would always improve security No. If an attacker can inject packets that break your SSL lib, but wouldn't have broken your package manager, you added a vuln. Example: https:/&#x2
8. 278.▲
   by moviuro 8y ago

   Not in the case of OpenSSL, no. (Some) OpenSSL issues, just as (some) apt issues, end with RCE. Game over. Priv-sep, correctly handling untrusted files (e.g. 1. check signature, then 2. execute whatever; not the other way round), memory-saf
9. 279.▲
   by moviuro 8y ago

   No. My argument is that both arguments do exist and security is all about middle-ground. Do we add (yet another) layer of (bug-riddled) software to defeat one possible sort of exploits, or not? How much does it cost? (Time, money, etc.) Oth
10. 280.▲
    by moviuro 8y ago

    OTOH, they would have been right if there had been (yet another) bug in openssl/whatever lib would be used for https. FWIW: 16 vulns in apt in NVD [0]; but 202 for openssl [1] [0] https://nvd.nist.gov/vuln/search&#
11. 281.▲
    by moviuro 8y ago

    See OWASP's recommendations: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet > Argon2[7] is the winner of the password hashing competition and should be considered as your first choice for new appl
12. 282.▲
    by moviuro 8y ago

    https://play.google.com/store/apps/details?id=com.google.and... ? It's part of Android 9, I believe. (I have a Nokia 7 Plus)
13. 283.▲
    by moviuro 8y ago

    > How should we get them to fix this? Petitions? Nah, you're doing a full disclosure right here and now; so they better hurry up and fix that. Else, you can cancel your Yahoo account and go somewhere more security-focused (Protonmai
14. 284.▲
    by moviuro 8y ago

    see also https://techcrunch.com/2019/01/16/android-app-es-file-explor... 1. What about the timeline? 2. What about IPv6?
15. 285.▲
    by moviuro 8y ago

    I still can't understand what's going on :( Who's doing what, and which machine connects to the other one?
16. 286.▲
    by moviuro 8y ago

    Nope, this really is weird. Can't you add a root CA to the machine providing the service? e.g. https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...
17. 287.▲
    by moviuro 8y ago

    Depending on the criticity of your protected service, you could probably just be your own Certificate Authority, and publish the root certificate internally. How many machines are we talking about? A local PKI is probably overkill. Do you i
18. 288.▲
    by moviuro 8y ago

    GDPR is not about preventing innovation, it's about basic ethics: you don't do whatever you want with personal data. 1. Clear opt-in for customers regarding Personal Data Manipulation that is not necessary for your service (e.g. a
19. 289.▲
    by moviuro 8y ago

    In France, most employees have perks when purchasing/loaning stuff from their employer. Employees could get a discount on their company's telco public prices (e.g.: Orange or Bouygues) ; power suppliers (in France: EDF, Total, etc
20. 290.▲
    by moviuro 8y ago

    Nokia 7 Plus, starting 7am, now 4pm, tells me wireguard ate 27% (1026mAh, using 4G most of the time: 9am - 4pm). Though I'm not sure how much data I actually used. My phone does persistent keepalive so that I can use https:/&#x2F
21. 291.▲
    by moviuro 8y ago

    s!Linux!Ubuntu FWIW: https://www.archlinux.org/packages/community/x86_64/cuda/
22. 292.▲
    by moviuro 8y ago

    Wouldn't gzip encoding (apache/nginx/whatever is used today) compress that anyway?
23. 293.▲
    by moviuro 8y ago

    Did NPR finally stop tracking its users? It didn't display its usual GDPR banner! However, those still doubting should probably use: https://text.npr.org/s.php?sId=675923576
24. 294.▲
    by moviuro 8y ago

    Note that at the time of writing (2018-12-11T09:25:00+01:00), 12.0 has not yet been announced . See https://www.freebsd.org/releases/12.0R/schedule.html . The files available should not be used for production jus
25. 295.▲
    by moviuro 8y ago

    Depends on usage. Going to browse sketchy websites all day? Probably need something. Just doing dev work on Linux and also Thinking before clicking (TM)? Probably CommonSense2018 (C) will be enough. Keep in mind that AV software also runs
26. 296.▲
    by moviuro 8y ago

    Real source: https://www.eff.org/deeplinks/2018/11/poland-saved-europe-ac...
27. 297.▲
    by moviuro 8y ago

    https://ovh.com
28. 298.▲
    by moviuro 8y ago

    Isn't that just dangerous to keep all secrets unencrypted on your drive?...
29. 299.▲
    by moviuro 8y ago

    I'd probably have hooks in deployment to publish SSH keys in the DNS. See https://en.wikipedia.org/wiki/SSHFP_record and https://man.openbsd.org/ssh_config.5#VerifyHostKeyDNS I was trying to work
30. 300.▲
    by moviuro 8y ago

    > hardcoded IPs Do we have a definitive list somewhere? I'd like to block them and add them to my script [0] [0] https://gitlab.com/moviuro/moviuro.bin/blob/master/blackhole