Hacker News Reader

moviuroon SSH certificates: the better SSH experience

That sounds like a lot of extra steps. How do I validate the authenticity of a signing request? Should my signing machine be able to challenge the requester? (This means that the CA key is on a machine with network access!!)

Replacing the distribution of a revocation list with short-lived certificates just creates other problems that are not easier to solve. (Also, 1h is bonkers, even letsencrypt doesn't do it)

moviuroon SSH certificates: the better SSH experience

All those articles about SSH certificates fall short of explaining how the revocation list can/should be published.

Is that yet another problem that I need to solve with syncthing?

https://man.openbsd.org/ssh-keygen.1#KEY_REVOCATION_LISTS

moviuroon Some Fritz!Box modems might have been hijacked

Search forums local to your country and write documentation on how to use Linux or BSD as a modem.

For OpenBSD on Orange France FTTH: https://lafibre.info/remplacer-livebox/remplacer-sa-livebox-... or https://try.popho.be/securing-home2.html

moviuroon Sudo for Windows

OpenBSD's team has already reacted and added Word to OpenBSD

* https://marc.info/?l=openbsd-tech&m=170742832804260&w=2

* https://news.ycombinator.com/item?id=39309638

moviuroon AdGuard Home: Network-wide ad- and tracker-blocking DNS server

Unbound with tags?

* https://unbound.docs.nlnetlabs.nl/en/latest/topics/filtering...

* https://try.popho.be/securing-home3.html

* https://git.sr.ht/~moviuro/moviuro.bin/tree/master/item/lie-...

moviuroon A data corruption bug in OpenZFS?

It's a very rare race condition, odds are very low that you were impacted. If you were, you would have noticed (heavy builds with files being moved around where suddenly files are zero).

[0] https://bugs.gentoo.org/917224

[1] https://github.com/openzfs/zfs/issues/15526 (referenced in the article)

moviuroon Using Goatse to Stop App Theft

See the explanation on the blog itself [0]

[0] https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQ...

moviuroon Factorio: Space Age

> The signals required a lot of patience to learn and I'm not entirely sure I still understand them.

Chain signals before an intersection; regular signals after those, and on the track to split the track for multiple trains simultaneously.

See: https://wiki.factorio.com/Tutorial:Train_signals if you haven't already.

moviuroon Google will add E2E encryption to Authenticator backups

> they lose the master password

The threat model for every lambda user having a password manager does not cover breaking and entering[0]: they should write down their master password and keep it at home in their bedroom drawer.

Use biometrics where possible (e.g. bitwarden on Android has that option)

[0] maybe it does for you, working on some DoD-confidential docs, but your computer-illiterate aunt doesn't.

moviuroon Initial support for guided disk encryption in OpenBSD installer

It's only now added as an interactive step in the install script. It has ~always been possible to create a crypto device with the install medium by dropping to a shell: https://www.openbsd.org/faq/faq14.html#softraidFDE

moviuroon Pure Storage Teases 300 TB Ultra-Large NVMe SSD with Tentative 2026 Launch

> You can stack storage to your heart's content

Unless you actually hit the maximum your building can sustain (heat, volume). Building datacenters is incredibly expensive, so reusing existing infrastructure and packing it with more is actually important.

moviuroon Ask HN: How do you start over with 2FA after losing your phone?

As specified when activating MFA, did you download (and print) your backup codes? If so, use them to re-enroll a new device into MFA.

If not, you can try reaching out to customer service after you get a new SIM card.

For banking and everything else IRL, you can just walk up to the teller with your ID.

moviuroon ssh whoami.filippo.io

To make use of one different key per host, you can use some ssh_config(5) magic[0]:

    IdentityFile ~/.ssh/keys/%h

[0] https://man.openbsd.org/ssh_config.5

moviuroon Tell HN: Doing a chargeback against Google will get your account banned

Which cannot be automated, AFAICT. I'm syncing pictures of 4 GooglePhoto accounts twice a week each on a machine at home. Fire and forget.

But yeah, Google takeout can be done once a month if you have time to spare for that task.

moviuroon Tell HN: Doing a chargeback against Google will get your account banned

Before this happens to you too: rclone[0] can be used to sync (or pull) data from Google's services to a local machine. It's pretty slow, but it "just works"^TM

[0] https://rclone.org, https://rclone.org/drive/, https://rclone.org/googlephotos/

moviuroon Atom Bank decide to leave Twitter

With the disappearance of the "verified" badge, that sounds like an awesome way to do phishing.

> Sorry @poorsod you're encountering issues with your Atom Bank account! Please reach out in DM to us ^mm

> @AtomHelp, sometime in 2023...

moviuroon FreeBSD 12.4

Usually, the upgrades are seamless (freebsd-update(8)[0]); system files that change between releases are looped through with some help of sdiff(1)[1] with relatively few surprises jumping dot releases (12.3 -> 12.4).

However, major pkg upgrades also bring their fair share of config changes; and those major pkg upgrades usually happen during major version changes (11 -> 12). Can't remember how I did it, but at one point I had an ancient nextcloud running on a recent FreeBSD system where a pkg upgrade broke everything in a spectacular fashion.

The latest OpenBSD upgrade though (7.1 -> 7.2) did break an important base tool I used (dhclient(8)) by dumbing it down to a lesser version that is less capable (no auth) (but probably better written)[2], so YMMV.

> Changed dhclient(8) to defer to dhcpleased(8) by doing execve ifconfig and providing syslog warnings about deprecated options.

[0] https://www.freebsd.org/cgi/man.cgi?query=freebsd-update&apr...

[1] https://www.freebsd.org/cgi/man.cgi?query=sdiff&apropos=0&se...

[2] https://www.openbsd.org/72.html, https://try.popho.be/securing-home2.html#and-openbsd-decided...

moviuroon Microsoft is phoning home the content of PowerPoint slides

You "just" need the key to the encrypted traffic. You don't have to change the handshake/negotiation, you just want a copy of the key so you can decrypt the traffic.

In TLS, the client authenticates server, then they both agree to use a key for the session; the OS can get a hold of this key (this is usually a bad move because then any captured traffic frames could be later decrypted).

moviuroon Brave browser now blocks cookie banners

> transparent browser

previously: Brave’s browser has been autocompleting websites with referral codes [2y ago, 57 point, 32 comments]

https://news.ycombinator.com/item?id=23441605

moviuroon “I don’t care about cookies“ web extension acquired by Avast

No forms = no consent = unbroken Web.

moviuroon “I don’t care about cookies“ web extension acquired by Avast

Write more filters for uBlock Origin and unbreak the web?

e.g. https://github.com/AdguardTeam/AdguardFilters/tree/master/An...

moviuroon A sane SSH(1) key management example

GitHub advises against this[0]:

> You may be tempted to use a wildcard like `Host *` to just apply [ForwardAgent yes] to all SSH connections. That's not really a good idea, as you'd be sharing your local SSH keys with every server you SSH into. They won't have direct access to the keys, but they will be able to use them as you while the connection is established.

[0] https://docs.github.com/en/developers/overview/using-ssh-age...

moviuroon A sane SSH(1) key management example

> You literally start an entry with "Host <hostname>" follwed by "User" and "IdentifyFile".

But that's so much pain.

> The config file already does this, this is just a shortcut with %h and the file system structure.

No.

    % ssh -F /dev/null -v whoami.filippo.io
    debug1: Trying private key: /home/moviuro/.ssh/id_rsa
    debug1: Trying private key: /home/moviuro/.ssh/id_ecdsa
    debug1: Trying private key: /home/moviuro/.ssh/id_ecdsa_sk
    debug1: Trying private key: /home/moviuro/.ssh/id_ed25519
    debug1: Trying private key: /home/moviuro/.ssh/id_ed25519_sk
    debug1: Trying private key: /home/moviuro/.ssh/id_xmss
    debug1: Trying private key: /home/moviuro/.ssh/id_dsa

moviuroon France experiencing worst drought on record

What if? (name of the channel I found)

https://www.youtube.com/watch?v=hzCvY0ENrhk

moviuroon France experiencing worst drought on record

There's a government website that lists all locations with water restrictions (and the map is a mix of yellow, orange, and red) [0]

Heat is also one of franceinfo's (national news broadcast) main topics [1]. Issues include: fires, no more cooling for nuclear reactors, no more water for our dams, and a village that cuts its main water pipe 8hrs/day [2].

[0] https://propluvia.developpement-durable.gouv.fr/propluviapub... (this site is extremely slow, I'm not sure what kind of potato they use)

[1] https://www.francetvinfo.fr/meteo/canicule/

[2] https://www.francetvinfo.fr/monde/environnement/crise-climat...

moviuroon Terminated

There's peertube [0], which was built to defend against arbitrary censorship.

> PeerTube aspires to be a decentralized and free/libre alternative to video broadcasting services.

> [...]

> Anyone with a modicum of technical skills can host a PeerTube server, aka an instance. Each instance hosts its users and their videos. In this way, every instance is created, moderated and maintained independently by various administrators.

[0] https://joinpeertube.org/

moviuroon Ask HN: Should I upgrade Ubuntu to 22.04 LTS?

  # dd if=/dev/sdX bs=4k status=progress conv=noerror | zstdmt - > /mnt/backup.zstd

moviuroon Privacy in email communication: we should use encryption by default

Does your bank at least use STARTTLS? I know banks that don't.

https://try.popho.be/email.html#tests

moviuroon 2FA app with 10k Google Play downloads loaded well-known banking trojan

> My guess is, as a bank, they're doing the right thing

Banks can and will do everything wrong.

* https://reports.exodus-privacy.eu.org/en/reports/fr.creditag...

* https://reports.exodus-privacy.eu.org/en/reports/fr.lcl.andr...

* https://reports.exodus-privacy.eu.org/en/reports/com.caissee...

* https://reports.exodus-privacy.eu.org/en/reports/fr.banquepo...

* https://reports.exodus-privacy.eu.org/en/reports/com.fullsix...

moviuroon Lego has designed a set that can't be taken apart

That's the example I had in mind because I built a MALM bed last month. I remember models with many more screws. The 1:1 print just makes it easier to differentiate, without having to pull all the different screws from the bag, trying to compare them to the not 1:1 drawings.