tolleydbg

36 ms·

31.
by tolleydbg 5y ago
~could~?
32.
by tolleydbg 5y ago
I aware what the license says, but it doesn't really matter how it's worded or how we would like to interpret it, under US law, this is likely non-binding clause without a release/distribution. The fact that the license menti
33.
by tolleydbg 5y ago
1. I didn't realize that anyone thought thought the service was launched. I've only seen reporting that it was discovered and defaced. This would make a difference. 2. and 3. The license can say whatever it wants and we can interp
34.
by tolleydbg 5y ago
A release and a distribution of a product have almost the same legal definition, but in both cases, the definition includes the product being available "for the consumer." If the license is poorly written to include anything else,
35.
by tolleydbg 5y ago
Section 5, which they are accused of violating, specifically mentions a release of the software in item (b). Item (c) does provide some ambiguity, but given that the access was unauthorized, regardless of how bad the OpSec was in the part o
36.
by tolleydbg 5y ago
It isn't an issue of whether the developers made an error or not, but whether this constitutes a "release". Both in terms of the license, and the general legality of the situation. I think they would have a hard time showing
37.
by tolleydbg 5y ago
I think this may be carelessly worded in the article. It was publicly accessible, but I don't think it was intended to be publicly available to anyone who wasn't developing it. Am I misremembering the reporting on this?
38.
by tolleydbg 5y ago
I didn't realize that this "test site" was publicly available. I thought it was "discovered".
39.
by tolleydbg 5y ago
Shouldn't we wait until it's launched to see if they include the license or not?
40.
Port Shadows via Network Alchemy (CVE-2021-3773)(breakpointingbad.com)
1 points by tolleydbg 5y ago|0 comments
41.
by tolleydbg 5y ago
I think there is evidence that this is true for some sweeteners, such as Ace K, but I don't think this is the case with aspartame.
42.
by tolleydbg 5y ago
NordVPN relocated to the United States late last year.
43.
by tolleydbg 5y ago
As a researcher studying VPN security, I have tested a lot of VPN providers, and there are few that stand out as trustworthy. Mullvad is mentioned in this thread several times for a reason. When we publicly disclosed CVE-2019-14899, they ha
44.
by tolleydbg 5y ago
Each connection is NATed through the VPN though and the fact that the port number does not change makes it possible to make inferences about connections a user has made through the tunnel and inject arbitrary data into the connections. htt
45.
Vintage Protocol Nonsense(breakpointingbad.com)
2 points by tolleydbg 5y ago|0 comments
46.
Blind in/On-Path Attacks and Applications to VPNs (CVE-2019-14899 and Beyond)(breakpointingbad.com)
1 points by tolleydbg 5y ago|0 comments
47.
Blind in/On-Path Attacks and Applications to VPNs (CVE-2019-14899 and Beyond)(breakpointingbad.com)
1 points by tolleydbg 5y ago|0 comments
48.
by tolleydbg 6y ago
200,000 Americans aren't dead because of something they read on Facebook.
49.
by tolleydbg 7y ago
Donenfeld has been great and makes a wonderful product. We've been using WireGuard as our primary VPN solution for a long time now and don't anticipate a change anytime soon. I think this class of attack can best be mitigated at t
50.
by tolleydbg 7y ago
Correct. It does completely prevent the attack for IPv4, however, so we didn't notice the attack until the rp_filter settings were changed. I can verify that turning rp_filter on in my use case is an acceptable solution on Manjaro and
51.
by tolleydbg 7y ago
This seems like the most popular solution, but there are concerns that it may disrupt routing, and also does not work on -some- systems.
52.
by tolleydbg 7y ago
Hi Colm, were still working on a response to your email, but we appreciate the insight you provided and look forward to our conversation. This disclosure only deals with the specific threat against active TCP connections, but there are more
53.
by tolleydbg 7y ago
Yes, it is correct that you cannot easily hijack connections that use TLS, but you can make inferences about active connections that use TLS. This is still fairly devastating for a large number of vulnerable users that rely on VPNs in natio