_wldu · HackerTrans

_wldu

no profile record

投稿

Phishing-Resistant MFA Does Not Mean Un-Phishable

linkedin.com

1 ポイント投稿者 _wldu4 年前0 コメント

Data is a Toxic Asset (2016)

schneier.com

2 ポイント投稿者 _wldu4 年前0 コメント

So I lost my OpenBSD FDE password (2016)

words.filippo.io

140 ポイント投稿者 _wldu4 年前74 コメント

Ask HN: Unsigned Software Downloads

6 ポイント投稿者 _wldu4 年前5 コメント

The Mossad/not-Mossad security duality [pdf]

usenix.org

2 ポイント投稿者 _wldu4 年前0 コメント

The Secretive Company Selling Mass Surveillance to Local Police

eff.org

2 ポイント投稿者 _wldu4 年前0 コメント

The End of Programming

mdwdotla.medium.com

1 ポイント投稿者 _wldu4 年前1 コメント

What I learned working two FT remote jobs

youtube.com

1 ポイント投稿者 _wldu4 年前0 コメント

[untitled]

1 ポイント投稿者 _wldu4 年前0 コメント

Defcon Password Cracking Contest

2 ポイント投稿者 _wldu4 年前0 コメント

The Defcon Password Cracking Contest

contest-2022.korelogic.com

2 ポイント投稿者 _wldu4 年前0 コメント

See SSL certificates as they're issued in real time

certstream.calidog.io

1 ポイント投稿者 _wldu4 年前0 コメント

The Linux Kernel Backdoor Attempt of 2003

freedom-to-tinker.com

3 ポイント投稿者 _wldu4 年前0 コメント

Ask HN: Agents for Password Protected Age Keys?

1 ポイント投稿者 _wldu4 年前0 コメント

Attacks on Email Sender Authentication

blackhat.com

85 ポイント投稿者 _wldu5 年前13 コメント

The Ultimate Persistence Bug Noreboot

blog.zecops.com

3 ポイント投稿者 _wldu5 年前0 コメント

Dice-O-Matic

hackaday.com

2 ポイント投稿者 _wldu5 年前0 コメント

Go – Reflections on Trusting Trust

github.com

2 ポイント投稿者 _wldu5 年前0 コメント

Ask HN: Distributing Age Public Keys

2 ポイント投稿者 _wldu5 年前0 コメント

Generative Adversarial Networks for IDS Attacks [pdf]

arxiv.org

1 ポイント投稿者 _wldu5 年前0 コメント

コメント

4 年前議論

Thank you, this is very helpful.

4 年前議論

Anyone may purchase a domain name from a registrar (such as 'example.com'). That is not a 'lower platform'. It's just a domain name. Sure, it's not as popular as 'github.com' but in every other way (in the DNS) it is equal. And unlike github.com, you have full control of that domain and its DNS records.

There are no unique legal issues with regard to buying a domain name and writing and publishing source code on that domain. Using 'github.com' to host your source code does not give you more legal rights or protections. Copyright is copyright and a license is a license no matter where you publish it.

You should not be afraid to buy a domain, write source code and publish it there. It's not illegal to do that and you are not at more risk (although these big central social platforms would like for you to believe that).

4 年前議論

That idea sort of proves that Github has evolved into a popularity contest/social platform. It use to be a git hosting company.

4 年前議論

I have been thinking about closing my Github account and moving all my code to gitweb on one of my personal domains. I'm tired of the social/popularity contest aspect of Github and just want to write and publish code that I find interesting. I also want more control and I don't want my code used for AI research like co pilot. I thought about trying source hut, or something similar, but I feel it will end-up just like github once it gets more users.

Has anyone else setup a simple gitweb server on a personal domain? If so, how did it turn out?

4 年前議論

You could probably use Twillo to make this work. It would require some coding to forward the SMS to email or post it to a website someplace where you could read it. I have done this in the past (outside of Antarctica) for 2fa that requires a certain DTMF tone be pressed and I only had an old Western Electric Model 500 phone at the time. Twillo worked great for that, but it's been years since I last did it.

https://www.twilio.com/docs/glossary/what-is-dtmf

https://www.twilio.com/code-exchange/forward-sms-email

The downside to doing what I did is it basically removes 2fa. You are back to a single factor as the 2fa is now automated and that may not be appropriate for many use cases.

4 年前議論

I do this too. I can do anything with vim, Go and a Makefile.

4 年前議論

They are probably trying to reduce SIP abuse. It's a big problem.

4 年前議論

Put the checksums in a separate system such as the DNS. Use DNSSEC on your domains. Manage your DNS system as an isolated system (don't mix your HTTP/Email/Other stuff with your DNS provider). Now, users may verify the downloads you provide at your website by getting checksums from the DNS.

DANE may be of interest here as well:

https://www.infoblox.com/dns-security-resource-center/dns-se...

4 年前議論

Every language dreams of being faster and safer than C and C++. Can't have it both ways.

4 年前議論

Nice, this Go version satisfies gofmt:

https://github.com/62726164/quine

4 年前議論

The complexity of C++0x is one reason Go was created.

"For me, the reason I was enthusiastic about Go was just about the same time we were starting on Go, I read (or tried to read) the C++0x proposed standard. And that was the convincer for me." - Ken Thompson

17:45 mark here: https://www.youtube.com/watch?v=sln-gJaURzk

4 年前議論

I agree 100%. Massive frameworks with massive complexity. I don't enjoy them at all. That's one reason I like Go. It's very modern, but I can still use vim and a simple Makefile to control it.

4 年前議論

It may be useful for websites to make these logs public. The logs would show the exact time, the IP and the specific abuse.

In my experience, a lot of 'threat intelligence' data has a mysterious origin and is marginally useful. Yes, Tor exit nodes do bad things. Thank you, we sort of already knew that.

But I'm not sure that's really beneficial either. It would be interesting to observe trends (such as log4j) and we could see first hand how Tor exit nodes are used for abuse and maybe collect a large list of 'known bad' IPs.

Also, when we say an IP is bad (because it was observed doing a bad thing), how long do we keep it on the naughty list? 24 hours? More? Less? It may have been dynamically assigned and later some 'good' person will come along and want to use it to browse the web. If the IP is still on the bad list, that person will potentially be blocked by over zealous 'security professionals' who don't understand or don't care.

What other uses could be made of this type of log data?

4 年前議論

I agree 100% with this statement (and with the article in general):

    “Basic hygiene” is arguably better than any of these bolt-on option, including things like:

    * Knowing what dependencies are present
    * Being purposeful about what goes into your software
    * Choosing a tech stack you can understand and maintain
    * Choosing tools that are appropriate for the software you are building

4 年前議論

If it earns 20 million + each year, I'd leave it alone.

4 年前議論

Off topic... What's the best way to easily recycle these batteries? I normally disassemble my old phones and securely dispose of the chips (for my privacy), but the batteries are glued in with a strong adhesive. Just trying to remove them can start a fire. I think most people just throw the old phones in the trash, but I don't like to do that. It's bad for the environment and potentially dangerous to trash workers.

It seems that phone manufacturers should make the batteries easy to remove, replace and recycle. Not sure why they do not do this.

Home Depot has drop offs for old batteries, but last time I was there they told me they were for power tool batteries only now.

4 年前議論

The Design Flaws of Password Managers - https://www.go350.com/posts/the-design-flaws-of-password-man...

4 年前議論

One example I like to use (when talking about entropy):

A four digit numeric PIN (that we know) has 0 bits of entropy. There is no uncertainty about what the PIN actually is. A randomly selected one (that we do not know) has just over 13 bits.

print(math.log(10)/math.log(2)*4)

13.28771237954945

The more entropy, the more uncertain we are.

However, humans are not random. We use the year we were born, some keyboard sequence or some other predictable number as our PIN. We don't know exactly how much entropy these PINS have (there is some degree of uncertainty), but we do know they are significantly less than 13 bits.

4 年前議論

I still see them. They come and go, but are always present at some level.

    2022-08-29T17:35:12.617Z [DEBUG] sshlog gen 113.61.219.237 admin admin SSH-2.0-HELLOWORLD
    2022-08-29T17:48:17.879Z [DEBUG] sshlog gen 218.92.0.190 root poohbear SSH-2.0-PUTTY
    2022-08-29T17:48:18.041Z [DEBUG] sshlog gen 218.92.0.190 root p@ssw0rd3 SSH-2.0-PUTTY
    2022-08-29T17:48:18.2Z [DEBUG] sshlog gen 218.92.0.190 root p@ssword! SSH-2.0-PUTTY
    2022-08-29T17:50:13.507Z [DEBUG] sshlog gen 185.191.205.92 hl hl SSH-2.0-libssh-0.6.3
    2022-08-29T17:52:57.28Z [DEBUG] sshlog gen 138.68.91.192 victoria abc123 SSH-2.0-libssh-0.6.3

4 年前議論

I agree. It's also an ISO standard that IMPO, will be in use for the next 50 to 100 years. Modern C++ is very safe and very fast and very mature.