ruthmarx

29 ms·

511.
by ruthmarx 2y ago
DoH is sufficient to mitigate DPI.
512.
by ruthmarx 2y ago
What do you use instead?
513.
by ruthmarx 2y ago
> Dan Walsh who is quite famous in the SELinux community Yes, I know who Dan Walsh is, it's part of why I linked to his article in this case. > See the part "Why didn't SELinux block it?" Yes....did you understand
514.
by ruthmarx 2y ago
> Hacky way to accomplish something? Yes. > Literally every example you gave of AA not being "granular" enough was flat misinformation. No, there was no misinformation, and this stance you're committed to defending is o
515.
by ruthmarx 2y ago
> Right, so the problem isn't "choice" it's you being lazy. I never said the problem was choice, and no, it's not just me being lazy. Be reasonable and debate in good faith, please. The problem is having an ecosy
516.
by ruthmarx 2y ago
> But of advice. Outside of TV programming, when an American is talking about why a tool was created, they almost always mean its purpose, not its origin story. It's so bizarre you're giving advice here based on such strong ass
517.
by ruthmarx 2y ago
> Still don't care about the feature set, show me a useful benchmark. "I don't care to understand the differences in security thees systems provide" That's what you're saying here. Which means you're no
518.
by ruthmarx 2y ago
This doesn't even make sense. At all. First of all "OpenBSD stands on the logic of its own merits" what in the actual heck? OpenBSD has had two remote holes in it's default install and importantly, *no mechanisms in plac
519.
by ruthmarx 2y ago
> The link rules can get pretty granular and seem explicitly designed to prevent that scenario. It's still an inherent weakness. No getting around that really. > Assuming the AppArmor profile allows writing to and executing the s
520.
by ruthmarx 2y ago
I disagree with most of your points, which I will say are very subjective at a minimum, but specifically > In the hypothetical case of Alpine switching to systemd, you're 100% free to maintain your own Alpine distro This is the prob
521.
by ruthmarx 2y ago
Is having a bunch of symlinks and a giant config file really that much better than shipping the libraries an app needs to run with the app itself?
522.
by ruthmarx 2y ago
Honestly thank goodness. Choice is great and all that but I don't want system to infect Alpine or it's ecosystem at all. I never, ever want to see an apk that requires systemd.
523.
by ruthmarx 2y ago
Probably not a musl thing so much as a way less crap running in the background thing.
524.
by ruthmarx 2y ago
> I could not find any example of what is impossible in AppArmor, AppArmor is simply less granular. For example, it doesn't provide true RBAC or MLS security models. It also uses paths instead of inodes, so a hard link can be used t
525.
by ruthmarx 2y ago
I've never seen SELinux as a requirement for any auditing, and I've done a fair amount of auditing. It's not the only project like it, it's the one that is most well known because it has the NSA attached and because it g
526.
by ruthmarx 2y ago
The OpenBSD approach isn't even in the same league. Not only it is developer opt-in, but it is also limited to enforcing or restricting syscalls, that's it. If you have a root RCE in say sshd, pledge won't help you. SELinux w
527.
by ruthmarx 2y ago
> It's hard to completely dismiss the idea that SELinux was a NSA plot to keep userspace capabilities out of reach on consumer OSes. It should be trivial to dismiss given the widespread usage and real world advantages it provides. A
528.
by ruthmarx 2y ago
> I'm less interested in the feature sets of the two. I think what'd be more interesting is replicate exploitation scenarios with their default policies and see which subsystem succeeds in mitigating the exploit and which fail
529.
by ruthmarx 2y ago
> Some variants of Unix are designed for security; OpenBSD comes to mind. This is fundamentally not true. Don't buy into the aggressive marketing. OpenBSD has a less secure design than pretty much any modern Linux. Their reputation
530.
by ruthmarx 2y ago
Very much the wrong takeaway. SELinux is absolutely for people and corporations and has been for most of it's existence, and no, it doesn't make sense to disable it anymore than it makes sense to run as root because it's conv
531.
by ruthmarx 2y ago
I wonder if this article title is a deliberate reference to 'The Insecurity of OpenBSD' article which also addressed a lack of SELinux or similar systems.
532.
by ruthmarx 2y ago
> I’ve never seen one where disabling SELinux wasn’t a normal part of provisioning a server. These days that's just laziness/fear, and it's a shame to see it. It doesn't even make sense any more.
533.
by ruthmarx 2y ago
> How many years from now? Entirely up to you. Point is, vote with your money. > There isn't any high end CPU in laptops without those useless things now. Even not considering processors from Intel/AMD? > I don't thi
534.
by ruthmarx 2y ago
It's a society issue as well.
535.
by ruthmarx 2y ago
Assuming you can fluently speak in a language expected of a refugee and are not from a country that has your prints on file...
536.
by ruthmarx 2y ago
> That's what jury instructions are for. The judge can instruct the jury to ignore pretty much any facts and consider any subset of what really happened that they want. So they'd just instruct "did they access the system?
537.
by ruthmarx 2y ago
The question is, how do you treat this sickness in society? Truth doesn't work, so what's the answer?
538.
by ruthmarx 2y ago
> seeing intel and AMD include this sort of useless thing is anger inducing. I am paying for this. So don't pay for it. No one is making you. Wait for a model that doesn't have an NPU, or buy an older model that doesn't. I
539.
by ruthmarx 2y ago
Why then?
540.
by ruthmarx 2y ago
> Show me a FLOSS implementation of this standard and you will have a point I've had a point from my first comment and it hasn't changed in validity. It's just taking time to convince you, but I think I'm making progr

More ›