mercora

> IP spoofing is also a thing.

IP spoofing is pretty hard to do with 2-way communication channels like TCP and a lot harder with TLS too. usually IP spoofing only works meaningfully with UDP and protocols that allow for transactions were you don't need replies from the target. to pull this of you would need to do BGP hijacking in order to receive return traffic which is a little above the efforts spammers will make.

ive seen DKIM signed mails that did not have their key in DNS fail verification without being marked as spam by google. and i have (not) received mails because of failing spf validation made delivery fail silently so i think you are quite right in that regard at least for gmails interpretation of those signals...

how easy is it to test for these antibodies for a layman? could people actually easily get tested prior to considering a vaccination?

it is just a different record entirely. there is a special zone for reverse lookup on ip addresses for ip4 and ip6 respectively. the address gets transformed into DNS labels to make the lookup. i.e to do a lookup for the ip address "192.0.2.1" the actual name for which the lookup is done is "1.2.0.192.in-addr.arpa." and the delegation for these zones can be and typically is entirely different from the forward zone. if you only have access to the forward zone you wont affect the reverse zone at all...

> There's a free tier, so I'd imagine almost all iPhones are using some tier of it.

i was quite surprised to see this was the default or at least was setup unknowingly to me.

its in the article, i had overlooked it too though...

that's interesting i will investigate how to make use of that, thanks :)

EDIT: its really pretty easy to do apparently[0] although only unconditionally as it seems...

[0] https://cbonte.github.io/haproxy-dconv/2.4/configuration.htm...

what i do is somewhat like you suggest. if haproxy cant determine which hostname it should serve it responds with a "503 Service Unavailable". However, if i expect someone to be able to actually receive that i still need to present a certificate to the client. i use wildcard certificates for this reason. the server wont tell you what names would actually work... you could just terminate connections or signal some kind of handshake error immediately instead though... most sites and services aren't likely to do that as its not very helpful in figuring out why it went wrong or explicitly will try to make it work for clients not supporting this. that's why i noted it being practical as long as incompatible clients are expected to work...

while it is easy to see the desired hostname for an SSL connection that makes use of SNI it is also very easy to simply connect to the address someone is communicating with and see what certificate is presented to you. it probably even works by just intercepting it... that keeps being practical as long as non SNI enabled connection or let alone ECH enabled ones are expected to work as well...

it sounds a lot like this would need some kind of delegation mechanism where you could point to a different URL in-time before abandoning the place. or maybe some kind of sealing using a cryptographic function that lets you proof your are the owner of the current/previous content and also would proof you are not the owner of the newer content while this proof could be used to release the ban if ever needed.

> what is so difficult about pricing that you cannot write a one liner saying XXX dollars per YY nodes per ZZ period?

i always suspect the pricing is dependent on your budget and they want to figure out the amount of your budget before giving a quote...

i could not unsee it anymore after it got pointed out to me in "therapists" and sometimes giggle childishly when i encounter it

i wonder how much information is gained about me if a close relative decides this is a good idea to do...

its often not at all exactly as said... also you might miss a lot of the performance if you are not able to see how things are expressed...

i would think the only ones using this would be people who don't want to be tracked so setting this globally would be be great for them. However, what incentives would the products people see to have this implemented? i guess the same as for browsers...

i fear a little that it might mean doing this is just not legal no matter if its still possible to do yourself.

huh, for some reason i did not know about this utility but it really looks like a better approach. i feel a bit unsure if running in a new user namespace could break things in subtle ways somehow though. however, it works without user namespace separation too. the cgroup namespace separation is required on my machine to make it work without root for some reason yet unknown to me.

it might be a bit offtopic but there is a somewhat easy solution to isolate networking for some applications if needed;

  sudo ip netns add lonly
  sudo ip netns exec lonly sudo -u $USER -i

this should start an interactive shell session with isolated networking, the shell will only see a separate loopback interface without further ado. anything started like this will share the same isolated network environment but you can add and use as many separate network namespaces as needed...

https://www.man7.org/linux/man-pages/man8/ip-netns.8.html

> Another theory is that this should report 50% CPU usage, because even though that CPU-intensive program is causing the CPU to consume all of its available cycles, it is not consuming all off the cycles that are potentially available.

if they would be available wouldnt the CPU scaling kickin and ramp up the frequency as required? i think in this case it should really show up as 50%...

otherwise its somewhat similar to battery charge status... apparently nobody wants to know what percentage of the initial full capacity is left but just how much is left from what is potentially available... so in a low power state were throttling is done permanently at some frequency i would just like to know how much capacity is actually left...

later on they also had the need for it to be honest, albeit only for a very specific external service that required us to have a fixed public IP address to connect from. The only solution deemed scaleable was using such an AWS provided NAT Gateway..

so yeah, it surely depends on the case given...

when i evaluated using a NAT setup using AWS NAT gateways it appeared to be quite expensive. we settled for strict VPC rules using only SecurityGroups in order to restrict communication. the instances did have public ip but nothing but intended services could connect to it anyways... i.e an instance running a HTTP API could only be connected to if initiated from the load balancer and itself could only connect to relevant services such as a RDS cluster...

note that if the containers are bridged the iptables FORWARD table wont affect packet forwarding between containers either. you would need to use ebtables for layer 2 firewalling i am almost certain.

Edit: apparently there is a sysctl setting that makes the bridge netfilter code call the iptables filter routines (bridge-nf-call-iptables) so i am kinda wrong...

i feel the same way, systemd also has some comprehensive sandboxing capabilities built-in.... i have my gripe with systemd too though. mostly with journald because it is slow, likely due to its on disk format, really could have used sqlite for this...

CodeDeploy fails in horrible ways and the maintainers are somewhat unresponsive. I don't use it anymore but am still subscribed to some issues which apparently weren't fixed for years...

... even if you handcraft your rules, docker will still, by default, add its own rulesets... ive helped people bitten by this on occasions mostly because it changes the default forward policy to drop... its also really hard to manage this concurrently... i.e if you need to reload your own rulesets you need to tell docker to reinsert its own afterward or make sure you run after docker did its thing... oh and of course you should not just save your current rulesets either in order to leave the docker rulesets out of yours and still make sure you know how their rules will affect yours then... its horrible...

is "illegal termination" when you funnel calls via VoIP to some local mobile network operators using sim cards usually provided to customers? like lets say to avoid billing it like a call into another network?

i was told once some of the emergency lines on elevators in Germany could be called into once you uncovered their number and expected to read about something similar here but no. Still quite interesting of course.

i wonder if these machine-machine range numbers might only accept calls from other machines in that range...

if that is true disks should come with a very visible note stating this... seriously, 3 months would be nothing. i doubt it is true because 3 months is a time frame which should be surpassed quite often making this more known.

the official wireguard implementations only do unicast afaict.

unless they do do something funky only unicast packets are routed in wireguard. bonjour/zerconf/mdns all use multicast or broadcasts for discovery. integrating some kind of service discovery relay would be possible though.