cimnine

It'd be a more or less automated version of this (German) article:

https://www.fabiblog.de/2018/08/21/openssh-certificate-autho...

Google Translate'd Version:

https://translate.google.com/translate?sl=de&tl=en&u=https:/...

IMO the most important lesson to learn from such incidents is that you should never put shitty content in „emails that never get sent“, because eventually they might get sent out anyway. That way you’re fuck-up is just a minor annoyance — to laugh about and tell the tales how everyone also fucked-up that one time — rather than an actual shit-storm.

Sounds like a great target for Server Side Request Forgery, https://owasp.org/www-community/attacks/Server_Side_Request_.... Could be fun to try if that software also visits links for internal-only applications, should such exist in your corp.

Yes. Yet maybe the switches aren't VLAN aware either. Then – as far as I understand – VLANs would not have helped here either.

This seams like someone configured multicast (smart!) in the hotel but did not use multicast-aware switches or did not turn on IGMP snooping. So the switches retrieved the package, did not know it was multicast and delivered it as broadcast to all connected endpoints.

> By default, a network switch which is not configured to use IGMP will forward Multicast traffic to all switchports on the switch. Devices will be responsible for filtering out the traffic that they do not want to receive.

https://service.shure.com/Service/s/article/multicast-and-ig...

You're right. I've updated my comment accordingly.

Cool, the source is available: https://github.com/mozilla/fx-private-relay

Edit: I've previously claimed it to be open source. But there's no License currently that would indicate that.

Not necessarily. Some infrastructure providers build P2MP (point-to-multipoint) fibre topologies with passive splitters. Which means that there's a shared medium once again for some part of the way to the next switch/router. As I understand it, if one device does not honour the assigned timings and sends constantly, then this would result in the same problem as with the malfunctioning TV. See e.g. https://www.tutorialspoint.com/ftth/ftth_epon.htm to learn more on the P2MP topic.

This is not Docker related.

If an application spawns a sub-process, that sub-process will inherit all environment variables. Which might be fine or might not be, e.g. if the spawned application is user controlled.

Also tools such as Airbrake or Sentry often send all your ENV variables to the error collection server, effectively exposing your secret values. Most such tools offer to filter variables, but that's in my experience almost always not done pro-actively.

The only thing that's Docker related in that post is that it does offer a turn-key solution for Docker-based projects. The solution's principle can be applied to other projects though, i.e. secrets should be read from a config file (or something like Vault).

Did anyone find a good loopback video driver ("virtual webcam") that works on recent macOS?

  $> [[ "$(echo)" == "$(echo '')" ]] && echo $? || echo $?
  $> 0

Trivial note. `; echo $?` instead of `&& echo $? || echo $?`

  $> [[ "$(echo)" == "$(echo '')" ]]; echo $?
  $> 0

If something is critical infrastructure for you, better make sure you have a backup.

I've seen this in a Swiss government agency that has Firefox installed exactly for this purpose. Their main browser is the built-in one, but if it can't or must not be used (e.g. because of a zero-day threat), they can quickly roll out a change to make Firefox the default browser until the problem/threat is over.

Ctrl+Shift+Eject/Power: Turn off the screen; Cmd+Alt/Option+Eject/Power: Send macOS to sleep

I've done such setups as well. E.g. my "personal" website cimnine.ch is set up like that.

Netlify was just a lot quicker to get started. It automatically compresses images, js, etc., if you tell it to. It automatically deploys branches to a special subdomain, so you can share previews of branches with other people. Also, though I haven't used that yet, it has this "Functions" thing that would allow you to add dynamic behaviour to your static website.

The thing is that `dig AAAA dns1.p04.nsone.net` does not resolve anything. A pure-ipv6 network would not be able to resolve my domain, as there is no way to contact dns1.p04.nsone.net via IPv6.

Plus you've invested a little in finding a nice theme :)

Yes. And no. It depends on the resolver. If the resolver is IPv6-only as well, then yes.

But thanks for pointing this out!

It's like almost every Apple Store works (when you're buying more than just accessories).

YubiKey supports TOTP/HOTP (the protocol behind "Google Authenticator" and similar). Clients for the YubiKey are available for Linux, Windows, macOS, Android and iOS. You can connect the YubiKey via USB (regular or Type C) and (depending on the model) via NFC (interesting on Android and iPhones). All clients are open-source afaik. There's even a CLI tool which is useful for workflows with e.g. Alfred or similar.

You can protect your TOTP/HOTP seeds on the YubiKey using a PIN (which I would recommend anyone to do). This is supported in all the Yubico Authenticator clients.

But: When your YubiKey is stolen/lost, your TOTP/HOTP seeds are gone for good. Make sure you have recovery codes stored in a safe place, e.g. your password manager.

YubiKeys support PINs for protecting TOTP/HOTP.

One of my favorite features of Google Maps is the one-finger zoom: Tap anywhere on the map and then make the scroll guesture (it feels like a double-tap, but the second tap is a swipe up or down guesture instead).

Because I usually operate my phone with one hand only the "pinch-to-zoom" guesture is just a pain (especially when you're carrying something in the other hand) and zoom buttons are easy to miss (e.g. while walking). This guesture also works to zoom in and out in Google Chrome, yet I don't think I've seen it in the Apple world yet (except of course in products made by Google for Apple devices).

As it's April fools day, I'm not sure if this is real or fake.

I guess the risk of missing an item is about the same as the risk of theft in regular stores, if not lower. So they just calculate it in. At least one can now only steal everything (as in not being registered) or nothing; deliberately stealing one or two things seems to be a thing of the past with their concept.

Did you ever consider Cap'N Proto [1] as well? How does it compare? It looks like it could easily be integrated as a third transport encoding besides JSON and ProtoBuf.

[1] https://capnproto.org/

This reminded me of the TED talk "A Precise Three Word Address for Every Place on Earth" [1]. I guess (and this has been mentioned in other comments) the systems he's referring to is known commercially as what3words [2].

[1]: https://www.ted.com/talks/chris_sheldrick_a_precise_three_wo...

[2]: http://what3words.com/

[1] is a nice summary about how contactless payment works under the hood.

[1] https://media.ccc.de/v/34c3-8965-decoding_contactless_card_p...

When will people learn to host their own private mirror for things on the web that they depend on?

For me, there are two compelling points in this:

  1) Environment variables are 'exported by default', making it easy to do silly things like sending database passwords to Airbrake. Sure we could introduce code to filter them out, but it's another thing we need to remember to update every time we add one - not robust in the face of code changes.  Better not to put them there in the first place

and

  4) if you restart an app by sending it a signal (e.g. SIGHUP) from an unrelated shell that causes it to re-exec itself, it will still have the environment of the original process.  So for example, you can't update config in environment variables and do a Unicorn "zero downtime" restart. This can cause confusion

While the restart/reload problem can be circumvented using multiple instances, the leaking problem can't be easily solved in a generic way.

That's why I would suggest not to put secrets into environment variables. Systems like Kubernetes or Docker Swarm have great support for such kind of secrets. Is there someone who researched this concern in more depth?

It appears that the blog post was removed shortly after publication. Here's what the text has been:

> Infineon Technologies, one of Yubico’s secure element vendors, has informed us of a security issue in their cryptographic firmware library. The issue weakens the strength of on-chip RSA key generation, and affects some use cases for the PIV smart card and OpenPGP functionality of the YubiKey 4 platform.

> FIDO U2F, OTP, and OATH functions of the YubiKey 4 platform are not affected. The YubiKey NEO, FIDO U2F Security Key and YubiHSM are not impacted, nor are the deprecated products YubiKey standard and YubiKey Edge. Externally generated RSA keys are not affected.

> Yubico estimates that approximately 2% of YubiKey customers utilize the functionality affected by this issue. We have addressed this issue in all shipments of YubiKey 4, YubiKey 4 Nano, and YubiKey 4C, since June 6, 2017.

> At this time, we are not aware of any security breaches due to this issue. We are committed to always improving how we protect our customers and continuously invest in making our products even more secure.

> We offer customers who are affected mitigation recommendations and optional YubiKey replacement. For more information please refer to our dedicated customer portal [1].

> The post Infineon RSA Key Generation Issue [2] appeared first on Yubico [3].

> [1] https://www.yubico.com/keycheck/

> [2] https://www.yubico.com/2017/10/infineon-rsa-key-generation-i...

> [3] https://www.yubico.com/

... because at some point they were not supervised by at least two persons, before it was taken into operation, that is. (Afterwards, they have to be locked into a rack that requires two different badges to open it's doors and which must have a CCTV system recording it at all times.)