Hacker News Reader

jimsion Paaster – Secure by default end to end encrypted pastebin

I think that providing API to be used by standalone clients is far more better approach

jimsion Self-Hosting Dozens of Web Applications and Services on a Single Server

I would recommend to use borgbackup - it is very convenient for security (it provides very flexible encryption options with safe defaults) and efficiency (deduplication)

jimsion Ask HN: Are we entering a 0-click era?

I can't remember any recent good news about 0click mitigation

jimsion LastPass users warned their master passwords are compromised

I use KeePassDX on Android and KeePassXC on a laptop, and they are synced with Syncthing. I have no issues with this setup

jimsion Show HN: No PortScan

This might be a way better solution in terms of performance, but I cannot imagine way to run more complicated stuff rather only blocking IP in the firewall using iptables

jimsion Show HN: No PortScan

This ratio is only applied if there are more than 1000 SYNs, forgot to mention that in the README (https://git.encryp.ch/g00g1/no-portscan/src/branch/master/cm...)

jimsion AS13335 doing SSH scanning

My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.

jimsion AS13335 doing SSH scanning

How did you discover this? Anyway thanks for additional information

jimsion AS13335 doing SSH scanning

I have asked Cloudflare about this traffic, but support says "Cloudflare helps protect sites, and accelerate them. We do not attack sites, and our network can't be used to generate attack traffic." They deny any malicious outgoing traffic, but after I have provided pcap dump they just ignoring me and do not reply anything. Very odd behaviour for researchers.

jimsion AS13335 doing SSH scanning

I think single SYN packet would be enough to know whether this port open or not, but they trying to gather full banner.

jimsion AS13335 doing SSH scanning

I expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.

jimsion AS13335 doing SSH scanning

Probably yes, but hey! Why do Cloudflare Worker would need SSH connection establishment? I do not asking Cloudflare to block 22/tcp entirely, but all this situation is very odd - I am seeing anomaly, reported abuse to them, but no explanation why this is happening.

About password authentication I totally agreeing with you, but this is a bit out of scope of this thread.

The only purpose of this article is to know the truth what is really happening. I have never seen such many connections to the SSH even from researchers.

jimsion AS13335 doing SSH scanning

Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses

jimsion AS13335 doing SSH scanning

Previously this post was named in such way, but post get flagged... So I removed its mentioning and replaced with ASN

jimsion Authenticated Boot and Disk Encryption on Linux

https://github.com/xmikos/cryptboot/blob/master/README.md

jimsion Amazon SES and Postfix's no shared cipher warning

> In addition to offer encrypted connections, each publicly available SMTP server must accept unencrypted connections according to RFC 2487 as well. So while Amazon SES should definitely support common ciphers, its current configuration shouldn't result in delays and delivery failures if there are no common ciphers between Amazon SES and another SMTP server. They also state that in their configuration:

Amazon tried unencrypted connection only 8 hours after, which is strange behaviour