dtemp

When I heard of JRE many years ago, I said to myself, "do I care to hear the endless opinions of the former host of Fear Factor? Nope." And that was that, never even decided to give it a try with so much other potential content available.

They already had the person's name by that point. They traced the attack back to the attacker, and had already figured out they weren't an employee or associate of an employee.

I've installed Ubuntu 18.10 on my Dell laptop, and I've done no configuring/tweaking that you describe. Just the default install, changed maybe one or two settings in ubuntu's version of "System Preferences", installed my Firefox extensions, changed the desktop background. You don't need to do any configuring/tweaking if you don't want to. Everything works.

I work in infosec and I dropped out of a biology program.

Author here, if anyone has comments, questions, or suggestions for improvement.

I wrote this because I didn't see a good guide that explained the thought process that goes into choosing a cipher suite, so sysadmins could design the right cipher suite for themselves and not just copy a configuration from elsewhere.

Why wouldn't it be `mail | yes d` if you're trying to answer "d" to all of the input requests of mail?

I am also interested in this. This whole process has been a shitshow. I'd just like a decision to be made and a little warning so that I have time to replace my RapidSSL certs (they are signed by GeoTrust which is owned by Symantec).

I'm still trying to figure out if my 36 month wildcard carts from RapidSSL are going to be distrusted. Their intermediate is signed by GeoTrust which is owned by Symantec, and a blog post says with Chrome 59, certs with a period over 33 months will be distrusted. Chrome Canary on v60 shows them still working.

Google's entrant into the Conference Room Tech market is their Chromebox for Meetings. It doesn't do the whiteboarding, but it's an easy and cheap way to put a webcam/speaker/mic into a conference room that integrates well with Google Calendar.

Obviously it makes the most sense for companies with "G Suite" as employees can then use gCal to book conference rooms, set up Hangouts video chats in the rooms, etc.

And Google's product costs one-tenth as much. I know there's no way I'd get a budget to spend $7k/room at my company, given we only spend $500/room for furniture the last time we redid them.

Having an ok experience with them at my company. Occasionally one needs reimaging but overall I forget they are there.

For what it's worth, I've had server installs that were upgraded 10.04 > 12.04 > 14.04 > 16.04 and they're fine.

Don't forget, for most parts of the country, a car too. The fourth guy is being limited by his lack of a vehicle.

Wow. A noncompete to make sandwiches.

Maybe this is the way that I've been lucky, but I was always either a 10min drive or a 5min walk from school as a boy, depending on which building (elementary/middle/high school). At college, I was on campus, and a 10min walk from anything. First job was a 45min subway ride, second job is a 30min subway, including walking. My mother was 15min from her job her whole life.

Getting a CVE on your resume isn't bad either.

As someone who supports strong Net Neutrality and a free internet, I'm obviously extremely against the way they are manipulating their network. Redirecting Google to Baidu, slowing them down, etc, not to mention the rest of the manipulations of the Great Firewall. I don't give them a free pass that they can "do whatever the heck they want." A free internet is a human rights issue. All citizens of the world deserve to be on a neutral network with no blocking, redirecting, throttling, or proxying.

Especially if you ask for a little more. I had friend once who asked for a lot more and they rescinded the offer; because they (probably rightly) figured the two wouldn't have a long relationship together if it's starting like this.

Of the monitoring solutions, which is the "easiest" to deploy and optionally simplest? My impression of Nagios is that it's a pain in the behind.

I know I can backup the contents of Google Authenticator on iOS if I perform iTunes backups with the "Encrypt backup" option checked. I'd wager that many who are backing up their phones don't have this checked, and don't realize if they have to restore their phone that the gAuth app will pretend you just installed it from scratch with no codes.

I'm not sure what the backup situation is with Android.

I've started backing up the actual strings that the app uses to generate the codes in an encrypted vault. You usually have to manually have these strings shown to you in lieu of a QR code. While creating another avenue for someone to hack you, at least I have a backup as well as a way to add a second device go show me codes. This is definitely beyond the capacity of the average user.

I think there might be online services that handle keeping codes for you? Like you can install an app on your phone, log into an account, and it presents you with all of your codes. Anyone have a recommendation for one of these that works well for them?

Yup. Until very recently, you did most of your shopping on Amazon.com using unsecure HTTP, right up until you clicked Checkout. Only recently did they move all of the product browsing over to HTTPS.

I think the best thing you can do to speed up HTTPS is to move to HTTP/2. Check this out: https://www.httpvshttps.com/

I can see they've only enabled Elliptic Curve Diffie-Hellman Ephemeral and RSA key exchange cipher suites. That means users will either use ECDHE and get forward secrecy, or old clients will just use "RSA" (which means the client sends a "pre-key" back to the server encrypted with the server's public key) which works but doesn't give you forward secrecy.

What they HAVEN'T enabled is Diffie-Hellman Ephemeral suites, which give older clients forward secrecy at a big CPU hit.

So this is an example of performance-tuning your TLS settings. There's also stuff to do with session tickets, session resumption, and eventually they'd also be served using ECDSA certs, once all clients support it, or there is at least a great way to only show the older RSA cert to old clients.

Since we're talking about key exchange, shouldn't it be called CECPQ1-ECDHE? ECDSA is for the cert...

Or they knew exactly the potential but wanted to keep it to themselves.

So change it :)

Usually one of the first things I do when I set up a new router is generate two random numbers between 0-254 (say, 218 and 133) and make the local subnet:

10.218.133.0/24

I frequently VPN to other private networks, and when the local/remote address spaces overlap, like when both are 192.168.1.1/24, then the VPN has problems.

Short of something "going viral", I feel like it's likely an individual ex-employee's negative experience with a company won't become widely known.

Cloud-hosted JIRA is missing a lot of features compared to host-yourself JIRA.

For one, the cloud version doesn't support LDAP or any other directory schemes for controlling user accounts. That's a big deal for companies who have gotten big enough to start using directory to control access to everything, which is hopefully every company with over 100 employees.

Yep. I believe when I created my account, I picked ones that were definitely not real answers, ie. "What's your favorite sport?" answer "lawn darts".

Ah, the death throes of a big company that suddenly had its business model invalidated.

Well, not entirely; there are market niches that Let's Encrypt doesn't cover: org-validated and extended validation certs, wildcard certs, anyone who needs a cert that expires in years, ECDSA certs (for the time being)...

But theres no doubt that their revenue will be significantly cut, they'll lose shareholder value and need layoffs.

Their industry did it to themselves; a TLS cert company should have 5 engineers, 5 customer support people, and 2 managers, and should charge about 10% of what they do.

  _domainkey.yoursite.com TXT "t=y; o=~;"

Does anyone know how necessary this entry is, as opposed to just having records beginning with selectors?

It seems like the t=y means that testing is on and to not actually block messages that fail DKIM, and o=~ means that some messages aren't signed. I'm not sure why the article is suggesting people use those settings, since they are entirely variable between different users and their config.