ckuehl

Purely a guess, but I've sometimes been able to work backwards from the content length (very often included in HTTP server logs) to figure out what the body had to be.

ckuehl

6 anni fadiscuss

The authors of The Expanse published an article last year acknowledging and paying tribute to the mission ("How a NASA robot messed up our science fiction"): https://www.nationalgeographic.com/science/2019/02/dear-dawn...

ckuehl

6 anni fadiscuss

Also keep in mind that if you use IP-based whitelisting, an attacker can register their own CF/Fastly account and target your origin server with whatever CDN settings they want (assuming they can discover your origin server). With Fastly at least you can even do this from the free tier.

ckuehl

7 anni fadiscuss

Another thing that isn't perfect but could help is doing a search of package contents of a large distro, e.g. here's a search of Debian for packages that provide a file called "node": https://packages.debian.org/search?searchon=contents&keyword...

ckuehl

9 anni fadiscuss

This is a somewhat dangerous pattern for picking temporary files (from #8):

    $ NEWFILE=/tmp/newfile_${RANDOM}
    $ touch $NEWFILE

The problem is that any user on the box can create files under /tmp. An attacker can set up a bunch of symlinks like /tmp/newfile_1, ..., /tmp/newfile_99999 pointing to a file owned by your user. When your script then writes into this temporary file, you'll write through the symlink and clobber one of your own files. Especially dangerous if root :)

This has been a historic source of software vulnerabilities (often with the PID used instead as the guessable component instead of random, though). One recommended alternative is to use the `mktemp` command instead.

ckuehl

9 anni fadiscuss

From the Spectre paper:

> As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2).

https://spectreattack.com/spectre.pdf

ckuehl

9 anni fadiscuss

There are some amusing notes about the /bin/true copyright claim here: http://trillian.mit.edu/~jc/humor/ATT_Copyright_true.html

ckuehl

9 anni fadiscuss

I've been using my packaged version pretty extensively (mostly in virtualenvs) and haven't encountered any issues yet myself, but would definitely be interested to hear (either on GitHub or here) what issues you encountered and if they occur with my packaged version as well.

I wouldn't really expect any issues since it doesn't replace `/usr/bin/python3` (it just adds a `/usr/bin/python3.6`), but it's definitely possible I just haven't run into them.

ckuehl

9 anni fadiscuss

Chris Lamb, the current Debian Project Leader, has said that it will not be in stretch but could potentially be available in stretch-backports:

> If someone puts in the work, sure :) There isn't a "they" in Debian... it's, well, volunteers doing the actual grunt work if they feel it's needed..

Source: https://www.reddit.com/r/debian/comments/5a0gcf/will_python_...

With that said, I've personally packaged a simple backport of Python 3.6 (currently 3.6.2) for Debian stretch. There are pre-built Debian packages available in the releases tab, and a one-liner in the README for how to build them yourself: https://github.com/chriskuehl/python3.6-debian-stretch

You can install these alongside the regular python3.5 installation (it doesn't replace it).

ckuehl

9 anni fadiscuss

I agree. Looks like I only noticed the apt-get install line and incorrectly assumed that's what you were referring to.

ckuehl

9 anni fadiscuss

A benefit of installing using your system package manager is that you can rely on your distro to manage the security of the package. If you just `pip install` it, you need to personally watch for new security bugs and upgrade (or backport them to your current version, which is what e.g. Debian will do for you). You'd also need to do that for all of the dependencies.

Up to you if you trust your distro's security team, of course :). I trust mine.

ckuehl

9 anni fadiscuss

Totally agreed they have the right to monitor your network traffic, but I still think in most cases employees should try to push back on this.

At least from my view, it's not so much that I don't want my company to know what I'm doing, as that I don't trust their software to securely MITM all of my traffic. This thread doesn't fill me with confidence about the competency of these corporate MITM proxies. And the recent Cloudflare news doesn't help either -- they're effectively the world's largest MITM proxy, and even they couldn't avoid leaking a huge amount of "secure" traffic.

There are surely sectors where it's necessary for a company to MITM all traffic, but I think most companies will do better security-wise by not messing with TLS. It's just too hard to get right.

ckuehl

10 anni fadiscuss

I found interesting djb's blog post about a theoretical scenario where mixing entropy can actually be dangerous: https://blog.cr.yp.to/20140205-entropy.html

ckuehl

10 anni fadiscuss

ISPs usually use the designated block (100.64.0.0/10) for this to avoid collisions with home networks: https://tools.ietf.org/html/rfc6598#section-7

Webpass is an example of a "good" ISP that does this. It's my only qualm with them. Besides that they are outstanding. IPv6 works great.

ckuehl

10 anni fadiscuss

Most operating systems have started detecting captive portals and presenting a notification. All of the modern consumer ones (OS X, Windows, Android, iOS) appear to have this detection. (I don't use it so not sure how well it works, though.)

ckuehl

10 anni fadiscuss

BART doesn't have that type of ticket. You tag your Clipper card (or insert your BART ticket, if you're not a frequent rider) upon entering a station, and again when exiting at your destination.

ckuehl

10 anni fadiscuss

For what it's worth, ISPs are definitely shaping traffic to try to game results on public speed tests.

I had an issue with Comcast last year where I would have large latency spikes for ~2 hours every night, and speedtest.net always remained at normal latency: https://i.fluffy.cc/kNCxLMbkF2wx7NHFJxbzcgX35Bsb5nvl.png

I couldn't find any non-speedtest sites where my latency was less than 100ms, but Comcast's own speed test, several other public speed tests, speedtest.net, and even ookla.com (the company behind speedtest.net) were perfect (the ~20ms you see on the graph).

ckuehl

10 anni fadiscuss

Just keep in mind that unstable is not guaranteed to get security fixes promptly, either. The Debian Security Team only handles supported releases.

The Security Team FAQ is a good read: https://www.debian.org/security/faq#unstable

It's quite explicit in saying that if security is important to you, then you should run a supported release.

ckuehl

10 anni fadiscuss

Just want to emphasize (and this is not directed specifically at you): you almost certainly shouldn't run Debian testing on anything that is public-facing. Packages get migrated to testing after some days in unstable if no high-priority bugs are filed against them during the days after their upload.

If a security patch is uploaded to unstable today, you won't get it in testing for a few days, and possibly many more if the migration gets blocked.

https://www.debian.org/devel/testing

ckuehl

11 anni fadiscuss

Just be very careful which direction you point those arrows :-)

I've have similar nightmares about typoing `if` and `of` when using dd.

Submissions

Introducing dumb-init, an init system for Docker containers

comments