raesene6

36 ms·

331.
by raesene6 10y ago
So there's a couple of reasons to add a firewall. 1. If an attacker gets unprivileged access it can slow them down (if properly configured) in getting new tools onto the system or adding a shell. 2. If a configuration error results in
332.
by raesene6 10y ago
One thing to watch out for when reading anything about container/Docker security is the date of the advice. that paper is from March last year, and there have been a lot of improvements to Docker security since then. Docker makes use
333.
by raesene6 11y ago
in security where breaches can cost a lot of money, relying on heavy use as an indication of trustworthiness may not be a great idea. For example OpenSSL was and is used by lots of people, this has not stopped it having a lot of security pr
334.
by raesene6 11y ago
oh yes I agree /dev/urandom is the way to go, but the original comment said that the paper's suggestion that a container could exhaust the pool on /dev/random was false and that's what I was curious about. I t
335.
by raesene6 11y ago
excuse my potential ignorance, but I thought that /dev/random was at risk of exhaustion in the general case, with /dev/urandom not being so... e.g. http://www.onkarjoshi.com/blog/191/device-dev-
336.
by raesene6 11y ago
errrm and if a dependency is untrustworthy it can execute code on your system at install time... the fact that no-one else is checking and you are therefore in the same boat as other compromised people might not be that much of a consolatio
337.
by raesene6 11y ago
that's not a bad mechanism (if a bit time consuming) for personal usage, but wouldn't likely work for corp. use.. Even there though all it does is move the problem one step away. Most npm packages have dependencies (and quite a f
338.
by raesene6 11y ago
Ahh but that's one of the hardest pieces of the trust puzzle. On the internet, how do you know who's who. you download a package from npm. Who wrote it, what's their background, where do they work? What are their security p
339.
by raesene6 11y ago
Sure but SSL identification is a very small part of the process of having a "trusted source". There is, I'm sure, malicious software hosted on github, so I can download things from that trusted source and still have trouble.
340.
by raesene6 11y ago
I'd be interested in knowing, how do you assess whether something is a "trusted source" or not?
341.
by raesene6 11y ago
The video looks very cool and the opacity of the AR images was darn good. That said Magic Leap are still awfully light on some key details like :- - Will it be tethered or untethered. - If it's untethered what's the FOV like (loo