mr_mitm

41 ms·

841.
by mr_mitm 3y ago
Port knocking is one of those things that sound like a good idea, but there are many possible footguns. And why is it that there is no one consensus (or "blessed") implementation? The implementation by Moxie seems interesting, but
842.
by mr_mitm 3y ago
What does it even mean for a number to exist? In math we are happy if the things we talk about are well defined. Numbers are just mathematical objects which satisfy a few interesting properties that lead to very rich structures we can study
843.
by mr_mitm 3y ago
Exactly what I thought. Exceptions are always possible, but more people need to channel their inner baysian and assign appropriate prior probabilities. Someone with impressive and relevant credentials gets a higher prior from me that their
844.
by mr_mitm 3y ago
Besides the wavelength being outside of human perception, an astronaut wouldn't see anything due to the low photon flux. These pictures have a very high exposure time.
845.
by mr_mitm 3y ago
I fly out of Stuttgart, Germany, with Eurowings a lot and if it wasn't for the payment process, I could fly completely anonymous, i.e. even under a fake name. Not possible to pay in cash AFAIK, and having a credit card or a checking ac
846.
by mr_mitm 3y ago
The article says the pilot was handed the wrong paperwork, so somebody else screwed up.
847.
by mr_mitm 3y ago
Are you talking about Germany? Because if you want to take a vacation day, it is subject to approval by the employer. They can deny if they have a good reason. And in many cases, like in my case, a short term absence would ruin a customer p
848.
by mr_mitm 3y ago
True, but that also means you cannot take a day off because you're not feeling it. You need at a doctor to attest that you're physically incapable of working. And in Germany, the employer has the right to demand a doctor's no
849.
by mr_mitm 3y ago
You could argue that conspiracy theories are falsifiable, and it's just that conspiracy theorists won't accept any proof. The flat earth theory for instance is easily debunkable: just take a flight from Auckland to Santiago de C
850.
by mr_mitm 3y ago
Interestingly, in the German-speaking scientific literature and science communicators, there is a movement to call it "conspiracy ideologies", "conspiracy myth" or "conspiracy narratives" (they have not found a
851.
by mr_mitm 3y ago
There is a Netflix documentary on it. They're real, they're having real conventions and everything. They sometimes even try to prove the earth is flat, but fail every time, which somehow does nothing to their convictions.
852.
by mr_mitm 3y ago
I think you can create such a playlist. I did that (I called it "on the road" for exactly that purpose) and every time I add a song it's downloaded immediately. Unless they changed something. But yeah in general I agree that
853.
by mr_mitm 3y ago
Or view the album and download that
854.
by mr_mitm 3y ago
How will it self update after it's been deleted by the AV? Also, there are many AVs with different detection strategies. It's not always static analysis that can easily be defeated by slightly changing some lines of code.
855.
by mr_mitm 3y ago
RCE as root is already the worst case though. The auth bypass is basically just a convenience feature of the backdoor. So yeah it's mildly interesting but not really a new development of the story.
856.
by mr_mitm 3y ago
In that case, true. I couldn't get past the paywall.
857.
by mr_mitm 3y ago
In a big rip scenario, the scale factor goes to infinity in a finite time. The author is correct on this one. Whether we are in a big rip scenario or not is not entirely settled, even though it's more on the unlikely side and just beca
858.
by mr_mitm 3y ago
They also found a better headline. NYT's headline is sensationalistic in the sense that astronomers didn't get anything wrong. Ten years ago, when I was in grad school, all my group did was study models with a dynamic dark energy
859.
by mr_mitm 3y ago
This comes up pretty much everytime Github is down. Github is not a replacement for git. Github is an issue tracker and CI platform just as much as it is a git hosting site, none of which git can provide by itself. It's complementary.
860.
by mr_mitm 3y ago
Sounds like an individual experience then. It's a bit of a stretch to blame "the physicists" for this. All of my teachers were very open about the short comings of our assumptions and solutions, and while it may be true that
861.
by mr_mitm 3y ago
You are complaining that you study the simple cases or simplified cases first before you study near unsolvable systems? Besides, very often the simplified case gets you surprisingly far because the difference between idealized situations an
862.
by mr_mitm 3y ago
Note that port knocking is vulnerable to replay attacks. Single Packet Authentication is better, but requires a private key (can be your SSH key). https://www.cipherdyne.org/fwknop/
863.
by mr_mitm 3y ago
> I never understood why clients are coded this way. Because it makes things less secure. If it was sufficient to send the hash to the server to authenticate, and the server simply compares the hash sent by the user with the hash in its
864.
by mr_mitm 3y ago
> You never submit your password, you submit that hash and they compare it. That's not true. If that were the case, the hash is now the password and the server stores it in clear text. It defeats the entire purpose of hashing passwo
865.
by mr_mitm 3y ago
For those who don't know, Quanta Magazine is financed by Jim Simons (from Chern-Simons theory) who became known as a very successful hedge fund manager. I just love the idea that he's using a portion of his billions to fund a lit
866.
by mr_mitm 3y ago
I mean, both can be true at the same time. I have to admit that I only use MFA when I'm forced to, because I also believe my strong passwords are good enough. Yet I can still acknowledge that MFA improves security further and in partic
867.
by mr_mitm 3y ago
No, because the phisher will get a token that is designated for, say, mircos0ft.com which microsoft.com will not accept. It is signed with the user's private key and the attacker cannot forge a signature without it.
868.
by mr_mitm 3y ago
The phisher will not receive a valid token, though, because you sign something that contains the domain you are authenticating to.
869.
by mr_mitm 3y ago
> And I don't see how MFA stops phishing - it can get you to enter a token like it can get you to enter a password. That's why I qualified it with "certificate-based". The private key never leaves the device, ideally
870.
by mr_mitm 3y ago
And even if you do want to track people, there are ways to ask a lot nicer than the vast majority of cookie banners. This guy does it well I think: https://www.dkriesel.com/ The request to allow cookies is reasonable, gen

More ›