r1ch

20 ms·

181.
by r1ch 5y ago
It gives a false sense of security. The vast majority of users do not understand phone numbers can be spoofed, and will use this website to check if a call they received is from a "legitimate" number, instructions be damned. It wo
182.
by r1ch 5y ago
I think this comes from them using "Alpine" in the name for something that is not from the Alpine Linux team nor desired / supported by them. Users could be confused into thinking it's something officially supported and
183.
by r1ch 5y ago
I suggest using diceware or similar random words, not random strings. Humans are typically processing these, not machines. "What's your mother's maiden name" can be answered by "Oh, I just put a bunch of random lett
184.
by r1ch 5y ago
I'd bet good money that there are hundreds if not thousands of other buggy installers lurking on windows update, just waiting for the right hardware id to appear. Yes, this is a bit of a shortcut, but not really any different than boot
185.
by r1ch 5y ago
It's amazing how many hacks and data breaches all come down to dangerous default settings. Elasticsearch defaulted to no security, anyone hitting the IP has full access to the cluster. MongoDB is another infamous example. Even today, o
186.
by r1ch 5y ago
For all the things saying not to use it, I've not run in to any issues with .local. It's reserved so it won't be delegated on the internet, it makes sense as a word and mDNS continues to work correctly. So far I haven't
187.
by r1ch 5y ago
No one said it was trying to be real except the submitted title.
188.
by r1ch 5y ago
Indeed, the blog post is referring to this effect: https://youtu.be/KboaLRKbaBU?t=191 . Suggesting the entire thing was rendered is very misleading.
189.
by r1ch 5y ago
Once he found the SQL injection, downloading the tables was too far IMO. On the other hand if he had stopped at this point, the company would have no idea about the weak admin credentials that could lead to real data breach and internal com
190.
by r1ch 5y ago
I'm sure it does - the problem is that the disconnect trigger voltage could be a normal state of charge for one cell but a high / dangerous state of charge for another.
191.
by r1ch 5y ago
Batteries heat up depending on the rate of charge and while it is easy to measure and control to avoid damage from overheating, I don't believe it can be used to measure the state of charge. Charging at home in a garage would likely be
192.
by r1ch 5y ago
The problem is that batteries themselves don't have a concept of "full". Measuring the state of charge in Li-ion cells is not easy as the voltage curve can be quite flat, so you have to use all kinds of heuristics to determin
193.
by r1ch 5y ago
I love that they say this, then default to using it when ZFS is detected.
194.
by r1ch 5y ago
I see more and more queries suggesting autocompletion of "reddit" and similar sites these days. Google's default results are extremely poor quality for many queries.
195.
by r1ch 5y ago
The trend these days are DNS TTLs of 60 - 300 seconds, to allow "Cloud agility" or something, so sites are exposed to a much larger risk of authoritative nameservers going down.
196.
by r1ch 5y ago
For a small test or personal site it's fine, but otherwise you're trading developer convenience for a longer load time for every user.
197.
by r1ch 5y ago
99% of people if you tell them to go to website.com will type website.com into the address bar. This will send an unencrypted HTTP request on port 80, even if the site supports HTTPS. This initial navigation can be intercepted by a MITM and
198.
by r1ch 5y ago
Thankfully the impact of this is limited in modern browsers as the cache is partitioned by site.
199.
by r1ch 5y ago
Everyone I've talked with has experienced this, yet it's been a bug for years . I don't understand. Do Slack not use their own product?!
200.
by r1ch 5y ago
It only blocks IPv4 traffic, so on an IPv6 enabled host it can easily be bypassed without even involving DNS. But assuming an IPv4-only host, on a system using nscd, DNS lookup is performed over a Unix socket: Chain OUTPUT (policy ACC
201.
by r1ch 5y ago
This would still allow data exfiltration via DNS. It really needs to be done at the browser level.
202.
by r1ch 5y ago
You can't measure the CPU at 1 second granularity to see this problem, in fact measuring the CPU at the sampling rate required may be enough to raise the CPU frequency :).
203.
by r1ch 5y ago
You need to check your dropped packet statistics to know for sure. iperf3 TCP over LAN will not see throughput affected by a few dropped packets, a stream 100ms away may take longer to recover. High bandwidth UDP testing with iperf3 should
204.
by r1ch 5y ago
One thing I've run into when building my own 10gbps router that I didn't see mentioned - you probably need to disable power saving / frequency scaling. The handling of packets is done in software, so when you start a download
205.
by r1ch 5y ago
In Cloudflare's case they already have a consumer-facing product that supports relaying over their network (WARP, with separate IP range versus their reverse proxy service) so Apple is likely using a variant of that. I was very surpris
206.
by r1ch 5y ago
How on earth are they proxying through Fastly? I would expect Fastly only sends requests to their customers origins, yet Apple is proxying requests through them to arbitrary websites. I wonder if you could abuse this to bypass ACLs on Fastl
207.
by r1ch 5y ago
It depends a lot on which posts are on the frontpage and what rewards they've been given. Those tiny little icons next to each post can be upwards of 1 MB each as they are rendered with ridiculous resolutions sometimes (eg https:&#x2F
208.
by r1ch 5y ago
If a tool like this works for you, what stops you from sending validation emails yourself?
209.
by r1ch 5y ago
That works fine for locally generated traffic which has knowledge of the routes. For hosts going through a router, they have no idea what the outbound link MTU is, requiring PMTU discovery or messing with TCP MSS.
210.
by r1ch 5y ago
Doing this requires fragmenting at the IP level, which is notoriously unreliable over the internet. The other option is to send PMTU exceeded messages telling the sender to drop their MTU for the path, adding significant overhead for every

More ›