kro

Apps can bypass websecurity (CORS fetch), that allows for third party clients for example on video platforms using their internal APIs.

I don't think the reddit clients work this way though.

The tools can be an editor/terminal/dev environment, automatically iterating to testing the changes and refining until a finished product, without a human developer, at least that is what some wish of it.

There is a jti claim that can be used for storing a token ID, so you could enforce tracking all issued tokens server side.

Cracking 256bit by brute force is unrealistically unlikely as you said, and there are many systems that could be compromised by that compute, an isolated jwt sig seems like just a very specific example.

A nice benefit of JWT for me is that it can be asymm signed and verified (ID tokens)

That tool sounds a lot like rsnapshot, I'm still using it

Most IoT devices implement security and integrity using one time burnable registers (more importantly for keys). It's sad but yes, those devices are permanently bound to the vendor. There is no real alternative though, a TPM based approach makes it more complex and is another closed system.

imo it should be considered to achieve the 404 design with minimal complexity. Keep the document small, to prevent i.e. old touch/favicon requests from wasting lots of bandwidth.

(Not intended to criticize this post)

Yopmail does verify and show these results for free when receiving a mail, this not even being their core feature

The idea is good, as far as I understand TLS however, the cert / asymmetric key is only used prove the identity/authenticity of the cert and thus the host for this session.

But the main content is not signed / checksummed with it, but rather a symmetrical session key, so one could probably manipulate this in the packet dump anyway.

I read about a Google project named SXG (Signed HTTP exchanges) that might do related stuff, albeit likely requiring the assistance of the publisher

Last year I had a (of many) freshly provisioned Linux VMs clock change to the year 2257 2 nights in a row. Never figured that out sadly, reprovisioning "fixed" that.

Yes, The TPM & secure boot requirements are somewhat understandable, but the CPU whitelist on top of that is just weird.

Being one of the biggest publishing softwares naturally attracts all of that: more publicity/cases, uninformed users, incentive and a probing/persistence ecosystem for hackers,.

I have to host a few dozen WordPress sites for customers and the ones that got hacked were all backtracked to: enumerating usernames, and some had their password equal that. You could blame WordPress for not being more strict rejecting those per default.

Discord has already started integrating their own payment for content/channels recently.

https://discord.com/serversubscriptions

iirc often also with lots of fake comments claiming it's legit

I've also wondered that, seeing MrBeast giveaway ads to fakedomains every other day. Reporting all those gets exhausting soon.

Rotating (and removing old keys from DNS) without publishing the private keys would already make it really hard.

For proving an old signature you'd lack an _authentic_ source for the signing public key that could only really be a dump of the historic DNS trace with all DNSSEC signatures (i.e. gmail does not use it).

The site makes it appear Exim never took action on their info to them more than a year ago.

other: https://security-tracker.debian.org/tracker/CVE-2023-42115

That is for dedicated servers and additional IPs. The first on a VPS is 0,60€

dig +trace reveals that only some of the nameservers don't respond (on IPv4, but got a fine response after trying an IPv6).

    ;; communications error to 66.111.50.12#53: timed out
    ;; communications error to 66.111.50.12#53: timed out
    ;; communications error to 66.111.50.12#53: timed out
    ;; communications error to 66.111.48.12#53: timed out
    whatsapp.com.  60 IN A 157.240.223.60
    ;; Received 57 bytes from 2620:13e:100d:c::35#53(d.ns.whatsapp.net) in 119 ms

Especially a.ns.whatsapp.net still seems down (IPv6 also).

I wonder whether this could be a BGP thing again, it was modified very recently according to [1] but I don't understand too much about that.

[1] https://lg.twelve99.net/?type=bgp&router=bei-b2&address=66.1...

Flutter also comes to mind

The MX servers cert in my experience does not need to include your email domain name .

Installing without internet connection also has the major benefit that it allows you to use a local user account rather than forcing you to signup for an online Microsoft/hotmail/.. account

It reads like it indeed does not affect live data in running cloudservers, yes.

Aside from backups, the snapshots can also be used as base images to provision new nodes though, losing those could indeed be inconvenient.

I think they talk about worms that spread by infecting other devices in the local network using RCEs in net-services like rdp/smb/..

That or maybe drive-by downloads / java/activeX code execution, which have become more rare

Where does it say that? As per rfc7489 4.2:

A message satisfies the DMARC checks if at least one of the supported authentication mechanisms:

   1.  produces a "pass" result

Personally I did not test yet what a DMARC result 1 fully failing check produces. I can say however that only 1 successful identifier-alignment criteria (and the other credential being valid but not aligned) is enough for an overall pass.

Of course the receiving mailserver is free to enforce a strict DKIM&SPF requirement aside the DMARC check/spec. If your question is why that would be necessary, I'd love to hear the reason aswell

It's a rather simple Postfix setup:

transport.db:

hotmail.com relay:[relay.server.tld]:587 # and other domains

main.cf:

transport_maps = hash:/etc/postfix/transport smtp_sasl_password_maps = hash:/etc/postfix/relay_passwd

relay_passwd.db: # if necessary / not authenticated by IP relay.server.tld user:pass

The relay can/should rewrite the Return-Path to pass SPF. It's no problem for DMARC as the DKIM signature added by the initial server still authenticates it.

It requires manually adding domains of custom 365 installations to the list - at this size I do this manually, but should probably be automated "on bounce" or maybe even by a smart rule based on the MX record.

In Exim4 it's also possible to conditionally rewrite based on for example the recipient domain.

To most, including Gmail, it's actually no problem with DMARC in my experience too.

However, one of my servers IPs is on a Microsoft blacklist since many years now. It sends <10 messages / day. I've tried every unlist form I could find, even called MS but it does not get taken of that list and they "won't disclose why". I'm routing SMTP to MS via another relay now :)

I remember a few months ago I got a bug-report from a customer that "their site didn't show in link-previews in MS-Teams". The URL includes a German "Umlaut": ü

After tracing the HTTP requests received from the link-preview generation on the server (logging the network packets) I found that the "Host" header wasn't the expected/configured xn--test--ova.de (IDNA to ASCII).

To "work around it" I needed to add an extra VHost in Nginx with the server_name "test-\xFC.de" (that just redirected to a non-Umlaut domain).

I didn't bother or even know where to report it (to MS). But apparently not using proper tooling for URL handling / HTTP requests makes one wonder about the quality of the product or even possible security implications.

I already had Bind on the machine so it was logical to add the zone there and utilize nsupdate : https://gist.github.com/kronthto/893715f12cc0b1cda9fcfdbd8dc...

But what you are suggesting should work just fine aswell - there should be no need for a persistent service. Of course the service would need to run on port 53, so you actually cannot have another nameserver on that machine already, and also require CAP_NET_BIND_SERVICE .

A quick search lead me to this python project that could be an inspiration: https://github.com/pawitp/acme-dns-server

What I've done is delegate (NS record) only the subdomain _acme-challenge to a standalone DNS-zone the webserver has write access to. This way it cannot escalate to changing root A/MX.

The article is good, but misses an important point (that adds yet another confusing thing about email): the difference between Header.From and Envelope.From and how DMARC also solves this by requiring identifier alignment.

Without it, generally only partial validation of the envelope address happens by i.e. SPF.