pfg

89 ms·

811.
by pfg 11y ago
I keep wondering if package managers (be it Google Play, apt or dnf) are in need of a solution like Certificate Transparency. Like Certificate Transparency, it would not necessarily prevent a backdoor(/certificate) from being pushed to
812.
by pfg 11y ago
The spec contains sample payloads for pretty much every resource. In fact, you can build a functional client for http-01 just by looking at the examples. On top of that, if you're using a programming language that's at least close
813.
by pfg 11y ago
Let me get this straight. People are criticizing CloudFlare for inconveniencing Tor users - a tool which, among other things, can be used to fight censorship. At the same time, people are calling them out on their abuse policy which essenti
814.
by pfg 11y ago
CloudFlare doesn't do anything other than web traffic. It's basically an nginx reverse proxy on steroids.
815.
by pfg 11y ago
Right, but this is about abuse and solutions for that. Obviously, blocking Tor is not going to prevent a determined attacker from scraping your site or trying some SQLi vectors. It might, however, prevent a large number of bots from scrapin
816.
by pfg 11y ago
My best guess is that reCAPTCHA doesn't just have two states (pass/fail), but rather something like a confidence factor and a threshold you have to reach to continue to the site (which might depend on your reputation).
817.
by pfg 11y ago
With signature detection, you're referring to browser fingerprinting? Because that's not going to work for Tor users (or, more specifically, TBB users).
818.
by pfg 11y ago
This was addressed in CloudFlare's blog post: > One suggestion has been that we treat GET requests for static content differently than we do more risky requests like POSTs. We actually already do treat more dangerous requests differ
819.
by pfg 11y ago
I believe Tor is working on a new version of hidden services which would address the first concern.
820.
by pfg 11y ago
> That said, based on what I know, the answer is to whitelist the TOR IPs That's an option CloudFlare is offering to their customers now. > give TOR users a global session that the user has the option to opt into (likely make sen
821.
by pfg 11y ago
That's what CloudFlare did in their blog post: > Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious.
822.
by pfg 11y ago
The reason some e-commerce sites are blocking Tor is not because of low conversion rates (that would be silly), but because of fraud (and attacks) coming from Tor users. Those two numbers are not related, and it has nothing to do with why C
823.
by pfg 11y ago
A large percentage of malicious traffic is most likely generated by bots, which are quite naturally better at creating a lot of requests.
824.
by pfg 11y ago
If this were possible, it would be a serious flaw in Tor's design.
825.
by pfg 11y ago
> 5) A report by CloudFlare competitor Akamai found that the percentage of legitimate e-commerce traffic originating from Tor IP addresses is nearly identical to that originating from the Internet at large. (Specifically, Akamai found th
826.
by pfg 11y ago
Are you referring to the server-side API the client is communicating with, or the internal API the client exposes? The former is documented in the ACME specification[1], currently being worked on by the IETF. There are many low-level ACME
827.
by pfg 11y ago
cron error reporting via email is an established solution. Why reinvent the wheel? I'd agree that a hint regarding MAILTO= in the crontab file would be neat.
828.
by pfg 11y ago
The default behaviour of cron is to email the user if a job finishes with a non-zero exit code, which seems to apply here in case of renewal failure.
829.
by pfg 11y ago
AFAIK TBB doesn't create per-domain circuits for every subresource on a site (that would kill performance on many sites with 10s of third-party trackers, CDN hosts, etc.), but rather one circuit per "URL-bar domain". That dom
830.
by pfg 11y ago
Yep, that's it. I think "normal" relays get blocked almost immediately, but bridges with OBFS work to a certain degree.
831.
by pfg 11y ago
You're putting words in my mouth. I merely pointed out that the reCAPTCHA page is not in any way a bandwidth hog. Whether you think captchas are an appropriate tool to filter out abuse from Tor users is a different discussion altogethe
832.
by pfg 11y ago
This wouldn't apply to Tor users (which this article is about), as reCAPTCHA can't identify users from China while they're using Tor.
833.
by pfg 11y ago
Probably just bad luck with your circuits and their latency to the image host. Tested this with a small number of circuits and didn't notice anything loading significantly faster or slower compared to other sites.
834.
by pfg 11y ago
Both requested with a clean cache using Tor Browser Bundle. Not sure if TBB does any caching at all anyway, seems like that would make fingerprinting easier, but I haven't checked. FWIW, the actual captcha image is ~20 KB.
835.
by pfg 11y ago
You're not going to make any significant profit mining bitcoin on a desktop CPU, or any "normal" CPU for that matter. If we assume 5 seconds of CPU time per comment, that's ~17k per day or ~500k per month. The first capt
836.
by pfg 11y ago
The entire CloudFlare recaptcha page is < 100 KB, and that's including the images. If you're annoyed by the time it takes for that page to load, you won't be happy browsing any site via Tor - even Google is > 200 KB.
837.
by pfg 11y ago
Spending 5 CPU seconds to submit one comment might be significantly cheaper for a spammer than paying someone to solve the captcha for them. Additionally, specifically with Tor users, you can expect a large chunk of the user base to have Ja
838.
by pfg 11y ago
To be fair, the "I'm not a robot"-one-click-thing wasn't done to make automation harder or impossible, but rather to make things more convenient for users. It will fall back to a regular visual captcha if you're d
839.
by pfg 11y ago
Apple's desktop version is iTunes.
840.
by pfg 11y ago
Customer service turns out to be the weakest link for many services[1][2]. I would not be surprised at all if this were the case. [1]: http://krebsonsecurity.com/2015/12/2016-reality-lazy-authent... [2]: https:

More ›