mercora

this did indeed help understanding and fixing the issue.

i likely ran into the same or a related issue. i dont know much about javascript though.

        for(var i = 0; i < elevators.length; i++) {
            elevators[i].on("idle", function() {
                for(var j = 0; j < floors.length; j++) {
                    elevators[i].goToFloor(j);
                }
            })
        }

it only works for "i < 1" and then only the second elevator moves... its kinda sad as i immediately enjoyed playing ...

i would generally agree but there were times were i had seriously abstract dreams about implementation details i needed to come up with before going to sleep. these dreams are really hard to describe because they are so abstract but it feels a bit like running the debugger in your head and imagine code execution with some visual feedback. They are very tiring to me as my sleep definitely takes a hit in quality. I try to avoid going directly to sleep after working on something harder that could trigger it.

i don't think that is necessarily the case but instead i believe in the near future the differences between container sandboxes and virtual machines might be less clear.

I imagine CPU and memory namespaces coming implemented on hardware isolation features like VT-d io-mmus and alike thus making virtual machines integrated into some sandboxing feature.

... "hello, my credit card data has been acquired and used without permission. I still possess the card but want you to freeze the account and a new card mailed to me afterwards."

do you see how this is just more accurate?

> but every person who has used the product without paying for it is such a loss.

i bought lots of products only after pirating them. would i not have done that i would not have bought many things at all. I also fondly remember simply not having the funds to buy software and pirating them was the only way to move forward. in both cases my "stolen" copy should not account for a loss of sale and the former even supported making a sale at all....

... or been acquired without permission?

it is likely that way because it is an argument that often comes up when discussing losses accumulated through piracy. were the argument typically is that not every copy should be accounted for a loss of sale. it does not really apply here because this game will probably sell the same amount as before someone got a hold of the code. And if it does not its likely because of some second order issue arising like not being able to fight cheaters...

for me stealing implies change of possession. this does not apply here. what might have been taken is the possibility to monetize it the way they imagined or that they had been hurt by the PR afterwards and similar things. but nothing has been stolen everything is still in place were it was before and nothing is missing except for some of the confidence in their infrastructure security.

while i think this statement is flawed anyways, there is a difference in being the only one who can find these flaws easily or being part of a community were everybody could do this if qualified.

note that every AZ assignment is mapped randomly for each account [0];

"To ensure that resources are distributed across the Availability Zones for a Region, we independently map Availability Zones to names for each account.".

my eu-central-1a is not necessarily yours.

[0] https://docs.aws.amazon.com/ram/latest/userguide/working-wit...

i would say try new technologies on problems you are familiar with and focus on the problem space itself otherwise. that is independent of if this is a new project or not. if my goal is to learn something new i try to find a project in a problem space i am very familiar with, where i know the pitfalls and rough edges that make things harder than they should be. this gives me a much better understanding of whatever that new technology is about and if i really want to buy into it...

i.e i learned some programming languages by implementing a simple binary Usenet reader/client. i know pretty well by now what it encompasses to build that thing why it is harder to do with some paradigms then others and immediately see value whenever something turns out to be more elegant then previously. and if the task gets unpleasant i can usually state if that is because of the task or the technology or in this case the language i am using....

i feel like they are doing this to "scratch" themselves when their skin feels itchy...

that's what i thought too. or somehow having to to relay specific broadcasts or similar ways to make the discovery work. this is why i had the impression it could be related to some routing trickery that might had worked for ipv4 but not for ipv6 and the discovery process could make it appear as they are on the same network segment while link-local ipv6 is available when in fact its not...

> I would periodically get it working and then it would periodically break.

wait a second... it worked sometimes? without doing any routing trickery or something?

If you did some trickery maybe the devices sometimes chose to speak ipv6 but could not?

this is not different for any other internet connected device on your network. although i doubt its about connectivity to the internet but about connectivity to some backend over the internet. I think it is quite common to assume these risks to be your own problem as is mitigating them. I mean i would probably like it if there is some responsibility for manufactures to make sure it does not happen but i doubt we are even close to something like that.

if there is a new vaccine required or some follow up procedure or whatever it would make more sense to hand out a new certificate that validates this fact instead of revoking the old one that is actually still perfectly able to validate your previous actions. In fact it might be very beneficial to keep them around to give approval to another step like lets say you will only get that booster shot after you are able to present validation of your vaccination or similar... invalidating these certificates by giving them a date until they are valid is very easy without explicitly revoking certificates.

at a previous job i cleaned up after such mess. they used to have fail2ban adding thousands of rules without ever deleting them automatically. I replaced it with a pam module that maintained an ipset for addresses with failed login attempts.

systemd-networkd keeps open that kind of socket for LLDP but apparently not for the DHCP client code. wpa_supplicant also keeps open this type of socket on my local system. and the dhcpd daemons on my routers have some of those too for each interface...

i wonder if the slow path here could be avoided by using separate network namespaces in a way these sockets don't even get to see the packets...

What did he suggest as a mitigation? or isn't that part of an audit?

> Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot).

so locked means i can not boot any other system until its unlocked? How do i do this? is there another passphrase involved? do i have to reset the chip before anything else is booted? i am probably not that well informed on this topic.

> You cannot copy the key once it's moved into the TPM chip.

obviously not! but i can just use it right away without figuring out your password. That is assuming i can fool the system to trust me. It requires the same level of access but in case of the passphrase i am blocked until i solved this. If i use your key immediately to ensure my own keys are trusted i am already done.

i think technically you are correct but in case of a U2F key i am not authenticating the machine directly but check if the person in front of the screen is in possession of the token. that is different then assuring the device they are on is legit.

these are valid points and of course everything you do to improve your security posture should somehow be related to your real threat model. However, OP was implying TPM might be more secure then an encrypted key on a disk which i disagree with for the mentioned reasons.

> Once you have access and either root or pass whatever extra authentication the access requires.

How hard would it be to boot a signed kernel with a system ready to give you all the access you want or need?

> The extra failure mode here is that someone can copy the key and crack your password offline on their own time.

but what i was arguing about was once i could copy your encrypted key i could likely use it right away with TPM.

> At that point a camera catching your password should also be a potential threat. But yeah, if that's something you're realistically worried about then it's not a great solution for you.

i feel like everybody should be seeing this as a threat. Don't you look out for someone snooping on your typing when you enter passphrases? i certainly do and avoid it while being watched, especially in public places where cameras are more likely.

so that does mean once i have access to the computer the keys are somewhat free to use. thus i am authenticating the device not the user which is kind of an important distinction...

IMHO this is not as secure as storing the key encrypted on a drive where its only accessible using a passphrase. It is just harder or maybe even impossible to exfiltrate the key but you really don't need to do that in order to use it. i might be wrong though.

My remark about touchid came from the fact that fingerprint scanning is inherently insecure because it is trivial to fool most devices into thinking you got a matching fingerprint using something that was touched and left a mark and some glue.

are keys in the TPM really securely stored and accessed? can i trust those to only be used by myself by i.e. providing a password or similar? i also think touchid should rank even lower because its likely somewhat easy to forge.

i feel the same and would like to see buildings get connected as a whole paid by part of the utility billing or similar. something akin to how central heating is paid for.

> and perhaps pioneered?

i highly doubt that. in fact i knew about ssl striping before i knew moxie or even sslstrip and this attack was probably already well known when someone came up with a seperate url scheme for https...

import is part of ImageMagick and "saves any visible window on an X server and outputs it as an image file. You can capture a single window, the entire screen, or any rectangular portion of the screen."

while that would partially help, i think there are better use cases for this type of setup. it is less about discovering endpoint addresses of peers (you could setup a statically configured mesh network too) and more about moving packets efficiently between peers. it can reduce load, latency and bandwidth requirements all while being more resilient to outages... a full mesh network should still work after any other node/peer fails, making only itself unreachable to others. a mesh network could even be able to reroute packets avoiding the failing paths if possible at all. for example your phone could be connected to your home network and your mobile ISP network, so when your home network loses internet connection peers could still route traffic through your phones mobile isp network to other peers in your home network. if you use your VPN to connect home from abroad it is pretty useless though. a mesh network between two computers makes no sense and probably should not be called like that. However, just connecting few sites and some road warriors makes this option quite attractive already.