jamescun

Coincidentally, Channel 4 in the UK broadcast a series called "The Bank of Dave" in 2012 where a resident of Burnley called David Fishwick tried to launch a bank of the same name.

They subsequently couldn't get a banking license, and dropped the "Dave" name.

https://en.wikipedia.org/wiki/Burnley_Savings_and_Loans

> Before the internet, that meant car ads in car magazines and watch ads in the Economist. Ads were based on context, and on inferring the audience from the context.

You can still do this. Car ads on car websites. Watch ads on the Economist website.

Has there been any research on the effectiveness of retargeting?

> While investigation has not revealed evidence of unauthorized usage of the exposed GPG key

I'm curious how they'd investigate or verify this, the key in question is used for downloaded releases and plugins.

This mirrors my experience.

I've seen more problems caused by the JVM, by default on some configurations, caching DNS indefinitely, regardless of TTL, than caused by a short TTL.

So if I am reading this right, in addition to a null dereference, turning on strict certificate validation actually disabled the check asserting that non-CA certificates cannot issue other certificates?

We don't know what the vulnerability is yet. Sure it could be a buffer overflow, readily possible in a language like C, or could be a bug in the crypto/implementation itself, no memory safe language will save you there.

WireGuard is being removed from FreeBSD 13 (the base for pfSense).

There were some tit-for-tat messages between devs here, and while the implementation was probably fine, it is pretty reasonable to take a step back here, take stock, and take it from there.

https://lists.zx2c4.com/pipermail/wireguard/2021-March/00650...

What do you see as the biggest challenge at getting Mojeek integrated into existing platforms, like browsers or mobile devices, that typically rely on less privacy-preserving options, namely Google?

Some people just want to watch the world burn.

I've seen nothing to suggest SSE would be (or is even capable of being) deprecated on HTTP/2.

You may be confusing it with HTTP/2 Push, where a server can inform a client of a future resource it will need, which is _de facto_ dead, with only a few real implementations beyond the bare minimum required by the HTTP/2 specification.

It may be quipped that Docker or Kubernetes is remote code execution (RCE) as a service!

The vulnerability pointed out here is server operators who have exposed Docker's API to the public internet, allowing anyone to run a container. The use of a privileged container is just icing on the cake, and probably not nessecary for a cryptominer.

A more subtle and interesting attack vector is genuine container imags that become compromised, much like any other package manager, particularly ones that search for the Docker API on the host's internal IP address, hoping only public network access is firewalled.

What are the proposed benefits of QUIC?

May be misguided, but I feel a little uneasy about bundling TCP functionality, TLS and HTTP into a single protocol over UDP.

Haven't noticed any issues (London), but I do appreciate the attention FastMail give to their uptime and outages, given they handle something as critical as email.

Sounds very regular, may be worth contacting your ISP to see if that is their maintainence period or any other regular operation they may perform.

I am with a broadband provider in the UK called Zen, at 23:15 every Sunday our PPPoE session is terminated, and it takes a couple of minutes before it successfully resumes. Occasionally it will happen mid-week, however still at 23:15. At one point I suspected the provided FRTIZBox router, however the problem persisted once we moved to an MT992 modem and a Unifi USG.

This post touches on "innovation tokens". While I agree with the premise of "choose boring technology", it feels like a process smell, particularly of a startup whose goal is to innovate a techology. Feels demotivating as an engineer if management says our team can only innovate an arbitrary N times.

Bear in mind that the "results" of a notorious hack are often offered for sale as a diversionary technique, and in particular this offers up nothing beyond commercially sensetive information, if even legitimate at all.

The UK has left the EU however the Data Protection Act 2018 which implemented GDPR within the UK is still in effect.

Would this not be misuse of PII?

You own a particular vehicle registration mark as much as you own a particular phone number, and both can reasonably be used to identify an individual (motor database verus telephone database).

Thanks!

> To lock an instance into a 6PN network, all we really need is a trivial BPF program that enforces the “don’t cross the streams” rule: you can’t send packets between different 6PN prefixes.

Are you using eBPF for this egress filtering? My (hopefully mis)understanding is XDP programmes, the higher performance cousin of eBPF, can only work on ingress packets currently.

Preventing the target resolver from seeing client's IP address breaks GeoDNS. This is already a problem with 1.1.1.1 which doesn't honour the EDNS client subnet extension.

Given generally DNS is just the start of an intereaction, usually followed by the connection directly between the client and intended destination, I don't see what kind of snooping these privacy measures are there to prevent.

Not quite sure what they're suggesting, as CloudFlare's approach to privacy is put them in the middle and they promise it's private... not exactly phase 3 of the internet.

In my opinion, "Phase 3" of the internet is end-to-end encrypted, no middlemen.

You are correct, however CloudFlare does support supplying your own certificate, and I'd consider it an element of dogfooding to use their own CA on their own site.

Probably just an oversight, but I find it odd their (ZeroSSL) site does not use a certificate issued by their own CA, it is instead one of CloudFlare's SNI certificates.

Nuclear was perhaps the correct option 20 years ago.

A nuclear power plant can easily take a decade to build (Hinkley C, announced 2010, approved 2016, generation expected 2025), how many decades will it take to build enough plants to replace our current fossil fuel based generation?

It is time we don't have anymore. We should now be focusing renewables and, more cruicially, storage.

I find this article very interesting. I'm coming at this from the other way around. I am a Site Reliability Engineer, so I've been writing code, architecting systems, building networks etc for 8 years professionally; I am however eyeing a more security oriented position so only now I am looking at courses and training.

I've personally switched to using Ubuntu 20.04 on my desktop, and honestly the switch has been uninteresting - which is a good thing. Works perfectly as a software engineering environment.

I know it has been controversial in the Linux community and among long-term Ubuntu users, but Snaps are what made my switch relatively painless. Everything I need on my daily driver (Firefox, VSCode, Slack, Spotify...) is just there waiting for me. Don't need to fuss around with a package manager, third-party repositories etc.

I am not completely Linux however, I still maintain my MacBook Pro for on-the-go work and an iPad down-time/multimedia purposes.

The tooling right now is pretty much directly exposing the underlying netlink api, so can seem a little clunky. wg-quick does go someway to making it more userfriendly.

WireGuard has been very pro-active at adopting useful abstractions, personally I've used https://github.com/WireGuard/wgctrl-go to build https://github.com/jamescun/wg-api a JSONRPC server for WireGuard, so expect tooling to improve over time.

Feature detection isn't the only use case User Agent strings service, two I've seen frequently are:

* Exception Tracking - The User Agent string is usually attached to exceptions to aid in reproduction.

* Outdated Client Detection - Primarily in internal dashboards in BYOD environments, I've seen the server display an error when a known outdated/insecure browser connects.

I'd personally prefer to be greeted with a screen providing me with the option of multiple DNS-over-HTTPS providers, and the option of not using one at all, than being silently forced into handing CloudFlare even more of my data.