r1ch

36 ms·

361.
by r1ch 8y ago
I'm a bit worried about the abuse potential here. It seems like a great way to distribute movies, warez, etc since not only is Cloudflare paying for the bandwidth but they're also caching the content so you won't be bottlenec
362.
by r1ch 8y ago
I've been using MT gear for about 10 years now. I actually think the devices themselves are very solid once they're up and running. I've had some running for years without any issues (try that with most other SOHO router bran
363.
by r1ch 8y ago
It's worth pointing out that the default configuration of almost every Mikrotik router these days comes with a firewall that blocks inbound access to all ports. Admins have to go out of their way to expose winbox to the internet (as ma
364.
by r1ch 8y ago
This affects pretty much everything running a modern Linux kernel (4.9+), not just AWS. It looks pretty bad. While there's no public POC yet, the kernel reassembly code path looks very expensive while small TCP packets are very cheap t
365.
by r1ch 8y ago
Trusting root certs is a lot less worrying with the advent of certificate transparency. It's now very noisy if a CA issues a cert for something like google.com, and smaller sites can get notifications about cert issuances for their dom
366.
by r1ch 8y ago
Every browser is vulnerable to DNS rebind attacks, since the burden of "fixing" it has been pushed onto the applications that are getting traffic forwarded by the browser. Also services like Cloudflare wouldn't work if low TT
367.
by r1ch 8y ago
You get a few benefits (protection against local interception) but it comes with a significant downside as it takes away the ability for an end user to identify if the connection is actually secure. For example I wouldn't enter my card
368.
by r1ch 8y ago
Unfortunately not. If you aren't setting up HTTPS at your origin then the connection still goes unencrypted over the internet. Full (Strict) is the only secure SSL option at Cloudflare.
369.
by r1ch 8y ago
U2F actually does prevent phishing since the domain is included in the token generation.
370.
by r1ch 8y ago
There's a non standard Noindex: /URL that Google accepts in robots.txt. Unfortunately it breaks many other crawlers which don't understand it, so you have to rely on user agent sniffing.
371.
by r1ch 8y ago
Disallows further use of unveil()
372.
by r1ch 8y ago
And as usual for cloud services the status page is saying everything is fine! Edit: there it goes after 15 mins
373.
by r1ch 8y ago
94% of the email addresses were already in the database according to the Twitter account. 6% still represents many millions in this case, but perhaps it's unnecessary to notify the ones already known.
374.
by r1ch 8y ago
Based on my experience this unfortunately does occur, as does removal of dots in the local part.
375.
by r1ch 8y ago
I really don't think HIBP should even be publishing or notifying people about these. It's almost always existing breaches just merged together in a different way. If I went and grabbed the raw torrents and combined them in various
376.
by r1ch 8y ago
If you received one of the breach emails, there is a 1Password ad in the middle with no obvious disclosure that it's an ad / affiliate link. https://i.imgur.com/g5btx15.png
377.
by r1ch 8y ago
Wifi roaming is pretty poor because it's entirely a client side decision (unless you have the AP forcibly disassociate a client - this is rarely done as it interrupts streaming / VoIP etc). APs can provide the client with a list o
378.
by r1ch 8y ago
I wonder what the real-world impact of this regression is as I'm sure there are plenty of IOT devices out there that are running the affected Linux versions. As the issue likely only manifests at higher bandwidths, I guess things like
379.
by r1ch 8y ago
Maybe I'm reading too much into it, but "We've received word that all workspaces are having troubles connecting to Slack." makes it sound like their internal monitoring didn't catch whatever is causing this. I was p
380.
by r1ch 8y ago
This benchmark is kind of meaningless. What is a "TCP request response" actually measuring? Any Linux server can certainly handle more than 340 HTTP reqs/sec for example. The "netperf" benchmarking software appears
381.
by r1ch 8y ago
These kinds of consent forms are often designed by advertising companies using the IAB consent framework. The idea is that once a user has opted in on one site, their consent will carry over to every other site using the same framework. Nat
382.
by r1ch 8y ago
Not really sure what this is trying to point out. It's hardly the fault of Windows or the CA if he signs his code with SHA1.
383.
by r1ch 8y ago
Far too expensive vs dedicated servers for our infrastructure. Bandwidth alone would cost more than all our servers combined.
384.
by r1ch 8y ago
It's sad that HPKP is being deprecated. It's one of the best ways to defend against an attacker with bgp hijack capabilities assuming you pin your own public key. Difficult to scale though and prone to disastrous misconfiguration.
385.
by r1ch 9y ago
This kind of behaviour is very standard in the anti cheating world. Some go much further like inspecting the Windows DNS cache for evidence of cheat servers. Calling this spyware is rather misleading. Cloud based antivirus services are even
386.
by r1ch 9y ago
Hmm, it seems like they may have fixed it, I can't seem to reproduce the problem I had (it would randomly fail to resolve CAA records for DNSSEC enabled domains).
387.
by r1ch 9y ago
Google DNS also has issues resolving DNSSEC-enabled Cloudflare domains.
388.
by r1ch 9y ago
If you're using a cable or DSL modem, most of that latency is from the signal modulation between you and your ISP.
389.
by r1ch 9y ago
I don't understand why DNS rebinding isn't being fixed by browser vendors. If I make an application that listens only on localhost I shouldn't have to take special steps to ensure random 3rd party remote hosts don't have
390.
by r1ch 9y ago
Yes, several users are already doing this as a workaround.

More ›