tux3

37 ms·

541.
by tux3 3y ago
Here's preemptively complaining about people who will complain about complaints about complaints. Complaints about complaints make sense!
542.
by tux3 3y ago
>you are free to use a dedicated USB key storage instead to store your private key As long as the server supports the device/protocol/options you want, and doesn't enforce attestation against a small list of enterprise ven
543.
by tux3 3y ago
"Exactly" is under a lot of strain here. SSH is nice because you don't have to think about it. Your private key sits in your .ssh folder, and then everything is transparent. You _can_ put an SSH key in a smartcard if you want
544.
by tux3 3y ago
The "garbage" at the end protects against cancer. It prevents cells from multiplying uncontrollably (and accumulating mutations in the process) by shortening the fuse at each generation. There's a hierarchy with stem cells at
545.
Quantum Algorithms for Lattice Problems – Update on April 18(chenyilei.net)
169 points by tux3 3y ago|23 comments
546.
by tux3 3y ago
I agree this one is terrible, but I don't think it's because this one is racketeering. If we think this tax is a racket, we should equally think that all taxes are a racket. That's because your "Try not paying it" a
547.
by tux3 3y ago
Right. But this position applies equally to all taxes. So that's a general "taxation is theft" type position. Which is fine in general, just not specific to this particular tax.
548.
by tux3 3y ago
I'm not sure how you're so sure. People being born isn't a new development. If it were significantly harmful, evolutionary pressure would have had ample time to apply. On the other hand, I can think of plenty of trauma that w
549.
by tux3 3y ago
There is no coercion or deception in this situation, so it can't be racketeering. Unless you want to classify all taxation as an extortion racket. It's just a bad tax policy that creates weird incentives ("use the canteen eve
550.
by tux3 3y ago
Faster program start, and potentially making it a soft-dependency instead of a hard dep (or letting you fallback on something else if it's not there)
551.
by tux3 3y ago
This is behavior introduced in OpenSSH 3.9 (grep for "re-exec" in the release notes https://www.openssh.com/txt/release-3.9 ) You should also be able to see the error message "sshd re-exec requires execut
552.
by tux3 3y ago
I would be happy with that result. Targeting something that's directly used by sshd means a much smaller attack surface. It's much harder for the attackers. The danger with supply-chain attacks is that it could come from practical
553.
by tux3 3y ago
sshd forks a new clean process for each connection, so this whole machinery happens each time you connect. Each connection is a full fork/exec, and the backdoor has to set itself up from scratch again, including all the parsing and hoo
554.
by tux3 3y ago
>it's important to understand that the author of this could inject arbitrary code into the library that ends up in the address space of a sensitive process. At that point, all bets are off: it could remap the GOT as writable if it s
555.
by tux3 3y ago
I believe it's all the ELF parsing and disassembly in memory that happens on startup. The really went crazy with the home-made x86 disassembler and everything they do with it. Must have been super fun to write though! Someone clearly h
556.
by tux3 3y ago
Isogenies vindicated? :)
557.
by tux3 3y ago
Not a lattice expert, so add salt to taste, but it looks like LWE in general (incluring RLWE) But the current attack essentially wants q > n^2, so even if it is confirmed, not all LWE schemes are dead. There will certainly be people who
558.
by tux3 3y ago
They really don't. In fact, conspiracy theorists often have the opposite effect. When an idea sounds vaguelly conspirational, it can lose credibility just by association of ideas. Conspiracy theorists have had a paradoxical chilling ef
559.
by tux3 3y ago
=> I think, therefore I am. Everything else is speculation.
560.
by tux3 3y ago
As far as complicated features that very few people understand or use and that are hard to implement correctly in compilers, std::launder ranks pretty high. Topping the list, for me, would be memory_order_consume. It's so complicated a
561.
by tux3 3y ago
I don't think it's fair to call them dishonest here. It's pretty clear they've heard about memory safe languages, they've thought about it, they've considered in details the pros and cons. >why not work on i
562.
by tux3 3y ago
It also allows "pk" and "sk" as overly short variable names, an argument developpers are sometimes tempted by!
563.
by tux3 3y ago
Better still, git-absorb figures out in which recent commit your fixups should go on its own (based on which file it touches)
564.
by tux3 3y ago
I broadly agree, but I think we can draw a parallel with the arms race of new exploit techniques versus exploit protection. People still manage to write exploits today, but now you must find an ASLR leak, you must chain enough primitives to
565.
by tux3 3y ago
One idea may be to create a patched version of ld-linux itself with added sanity checks while the process loads. For something much more heavy-handed, force the pages in sensitive sections to fault, either in the kernel or in a hypervisor.
566.
by tux3 3y ago
I think behavioral analysis could be promising. There's a lot of weird stuff this code does on startup that any reasonable Debian package on the average install should not be doing in a million years. Games and proprietary software wil
567.
by tux3 3y ago
You can store data by connecting to a database, and you can store logs by either sending them to the system journal and having a daemon collect them, or sending them to whatever cloud you like using a logging library. It's fine, really
568.
by tux3 3y ago
MS Azure Active Entra's FIDO2 implementation only allows a select list of vendors. You need a certification from FIDO ($,$$$), you need to have an account that can upload on the MDS metadata service, and you need to talk to MS to see i
569.
by tux3 3y ago
I agree we should look at the account and its contributions, I make a distinction between the account and the person. Sometimes the distinction is not meaningful, but better safe than sorry.
570.
by tux3 3y ago
The concern about other projects is fine, but let's be careful with attacks directed at the person. Maybe their account is compromised, maybe the username borrows the identity of an innocent person with the same name. Focus on the code

More ›