I was leaning towards using this configuration for splitting devices into VLANs while using one SSID. Yeah, dynamic VLAN+per device PSK would be best, but I'm probably happy enough with a shared PSK per VLAN to isolate a guest or IoT network. Would this VLAN isolation have prevented this attack? At least to prevent an attacker from jumping between VLANs? (I assume shared PSK per VLAN might be vulnerable to attacking client isolation within the VLAN?)
Kaitai is pretty nice. Hex editors with structure parsing support used to be more rare than they are now, so I've used https://ide.kaitai.io/ instead a few times.
Also, the newest Kaitai release added (long awaited) serialization support! I haven't had a chance to try it out.
There was a conversation on their mailing list contemplating dropping NSS support. https://curl.se/mail/lib-2022-01/0120.html If you have a use case for NSS in curl, you may want to speak up. Perhaps "I want curl to look exactly like a browser" is a significant use case?
When I built an ARM based NAS, I chose to use the Banana Pi BPI-R2 because it was one of the very few boards with 2x SATA ports using PCI-E. It worked fine and got good speeds. It's difficult to run a current kernel on the BPI-R2 though (it is slowly creeping towards mainline). If I built another NAS again I'd just use an x86_64 or aarch64 SBC with a PCI-E port and connect a good SATA controller.
Technically `git push --signed` also exists which could fix the issue of rolling back commits. It would verify that the person doing the push also holds the GPG key at least. But as far as I can tell you have to manually do something with it in the post-receive hook and GitHub doesn't support it at all.
Or many of the other issues that plague archive formats: duplicate files in the archive at the same path, symlinks in the archive or relative links enabling directory traversal.
Wow, git's url bugs always seem to become easily exploitable due to .gitmodules.
I found CVE-2015-7545 a few years ago, a malicious URL using the ext:: scheme could cause code execution. It was only easily exploitable because you can ask the client to fetch any URL you want via git submodules. (This vulneriblity was fixed, and since then the entire ext url scheme was disabled by default.)
If the laptop is disconnected from AC, it hibernates. It will switch to hibernate if power is removed while already sleeping. If I want to force a hibernate manually, I just pull the power before closing the lid.
This reminds me of the time my party argued about how much modern information theory we were allowed to use in D&D. We wanted to maximize the amount of information to communicate using Sending which states that it sends "twenty-five words or less". Can I use a form of encoding and a compression algorithm? Or can we make up words and can they be arbitrarily long?
While strace is awesome in general, git has some very useful debug environment variables: GIT_TRACE, GIT_TRACE_PACKET, GIT_CURL_VERBOSE and a few more[1].
Also, curl gained a --next command line option somewhat recently. It lets you send off multiple requests in the same curl invocation. These requests will all be pipelined in the same HTTP connection, which might trigger slightly different behavior in the website.
I have considered writing a program that will let me send of a bunch of HTTP requests at once, but wait to close all the connections at the exact same time. That would probably be the most effective way to trigger race conditions.
I was leaning towards using this configuration for splitting devices into VLANs while using one SSID. Yeah, dynamic VLAN+per device PSK would be best, but I'm probably happy enough with a shared PSK per VLAN to isolate a guest or IoT network. Would this VLAN isolation have prevented this attack? At least to prevent an attacker from jumping between VLANs? (I assume shared PSK per VLAN might be vulnerable to attacking client isolation within the VLAN?)