tiredofcareer

11 ms·

31.
by tiredofcareer 13y ago
Without getting too far into specific operational security -- the same reason that I hate there's an entire branch off my thread discussing this specific attack, which I think is detrimental to the discussion -- we have monitoring in place
32.
by tiredofcareer 13y ago
User input is trying to kill you until proven otherwise. And even then, it probably still is. If you accept anything from a user, treat it like you're carrying spent nuclear fuel around your application; that doesn't just mean form inputs,
33.
by tiredofcareer 13y ago
> So for the hackers to get the decrypted private key, then either Linode must have royally screwed up and kept the decrypted key in-memory during the rest of the month (which seems rather unlikely), They bill you the moment you add a L
34.
by tiredofcareer 13y ago
> I wouldn't bet on that. I don't need to wager, and can speak with authority based on what I know (which I'd prefer to leave vague). There are two vectors into a Linode's filesystem from the perspective of an internal attacker: having
35.
by tiredofcareer 13y ago
While what you say has merit, Linode's actions demonstrate an ambivalence toward security. Public key encryption for card numbers (yay!). The private key stored on the same machine and the key loaded in memory (boo!). ColdFusion was not pro
36.
by tiredofcareer 13y ago
They didn't utilize the access to go after Linode. They intended to utilize it to go after SwiftIRC, which nobody gives a shit about. That's where my comments came from. Linode just happened to be a nice prize on the way.
37.
by tiredofcareer 13y ago
It's discussed elsewhere in this thread, and bitcointalk assumed incorrectly.
38.
by tiredofcareer 13y ago
> Unless it's becoming a problem, I think anyone would ignore increased latency because they have ten other work tasks to deal with. You'd be surprised once you start working with larger, higher-traffic infrastructures. If our average
39.
by tiredofcareer 13y ago
Agreed. The one thing I think Linode could do better is communicate. The secrecy model is ... odd.
40.
by tiredofcareer 13y ago
I didn't say it would be technically impossible, I said it would be noticed. If you make it a theoretical problem, and it most certainly isn't (there are a lot more practicalities involved), you're adding at least another string compare to
41.
by tiredofcareer 13y ago
To save vertical space, I'll refer you here: https://news.ycombinator.com/item?id=5667471
42.
by tiredofcareer 13y ago
It's not about size, it's about rate and introducing latency. Just the hijack itself is going to add DNS latency, which is monitored by any competent operations team. Expert operations teams, and I know of one, also monitor the BGP path to
43.
by tiredofcareer 13y ago
That's a good point and I hadn't considered it. It still reboots your Linode, though; worth considering a 'echo "I just rebooted! Did you expect that?" | mail' in your rc.local for this reason, since a reboot should be an infrequent event.
44.
by tiredofcareer 13y ago
Hence why I hedged impossibility, and while I can think of a way that would work, it'd be tricky. You could probably hack BIND to do this (in resolver mode) fairly trivially, but I'll defer to the actual security experts here of which there
45.
by tiredofcareer 13y ago
Some hopefully-helpful clarifications of the inside baseball talk from just the overview (I haven't read the full zine), enhanced with inside and general knowledge I've gained in my travels on this mortal coil: - HTP claims to have{, had} a
46.
by tiredofcareer 13y ago
You never answered me on the private school comment; did you miss my reply?
47.
by tiredofcareer 13y ago
Running on Windows on the developer's workstation, no less... Let me quickly clarify that I'm not anti-Windows, it was just a double-take to see it used as a workstation for security research like this (though I'm using the word 'research'
48.
by tiredofcareer 13y ago
I didn't want to call New Yorkers insanely aggressive, but yeah, I'd expect that as well.
49.
by tiredofcareer 13y ago
In Detroit the police used to round up homeless people in vans and after promising to take them to shelters, dropped them off in the nearby city of River Rouge. If you're not familiar with River Rouge, that's where nearly all of Detroit's h
50.
by tiredofcareer 13y ago
You basically just listed five awesome and/or touristy neighborhoods and a tourist destination, that's why. Most startup types here commute to SoMa, and, well...
51.
by tiredofcareer 13y ago
San Francisco is one of the only places I've ever commuted where the question isn't if you'll step in human shit, but when . The quality of my workday usually begins with "did I get a face full of hot, evaporating urine and avoid a pile
52.
by tiredofcareer 13y ago
The residents who fight tooth and nail against going up and more dense forms of housing are just as much to blame as the BoS. The city could ignore them, yes, but government is about what people want. Most residents of San Francisco -- home
53.
by tiredofcareer 13y ago
I didn't make that point.
54.
by tiredofcareer 13y ago
I don't think of it that way. I think of it as giving money to someone I don't know, so that person can forward (with my trust) it on to someone else who didn't ask for it and potentially doesn't need it (what if her family are billionaires
55.
by tiredofcareer 13y ago
There's a right and wrong conversation to be having?
56.
by tiredofcareer 13y ago
It's ridiculous to suggest that I'm implying we should do nothing now that we're aware of it, since I damn near typed verbatim "why are we aware of this?" as the thesis point of my comment. Reactions to my comment are all over the place, th
57.
by tiredofcareer 13y ago
If you notice, I never advocated for ignoring it. I wondered why we're aware of it in the first place.
58.
by tiredofcareer 13y ago
I have no idea what you just said to me, but it sounded like you were nitpicking my point.
59.
by tiredofcareer 13y ago
Then it's good that I didn't mean to compare them, and instead illustrate that overreaction is common.
60.
by tiredofcareer 13y ago
Come again? Can you elaborate on what you mean?

More ›