Bu9818

5 ms·

1.
by Bu9818 2y ago
The take away of that story is: don't post a message from Tor that gives out the network that you're entering Tor from.
2.
by Bu9818 2y ago
They're talking about the attack surface to get accidental code execution from opening files that try to exploit vim. Integrating shell commands with vim/less is a valid feature.
3.
by Bu9818 2y ago
>namespaces (which have been a frequent source of vulnerabilities)... Unprivileged user namespaces sure, but I don't think that applies to namespaces in general (which without unprivileged user namespaces can only be created by root
4.
by Bu9818 2y ago
Yeah I was wrong about that, I confused it with socket-activation passing. The systemd-side socket is available from the process.
5.
by Bu9818 2y ago
Services may be in a different mount namespace from systemd for sandboxing or other reasons (also means you have to worry about filesystem permissions I suppose). Passing an fd from the parent (systemd) is a nice direct channel between the
6.
by Bu9818 2y ago
Use Invidious, use RSS, use yt-dlp, use Tor.
7.
by Bu9818 3y ago
The vast majority of services and user programs don't need to escalate privileges by invoking SUID/SGID binaries. no_new_privs should be used on them so that the "setuid with libc/LD programs" security boundary is a
8.
by Bu9818 3y ago
It could be a FOSS portable binary that runs outside of a web browser.
9.
by Bu9818 3y ago
They aren't preventing you from using a content filter nor are they making it difficult to scrape the site. The counter measures against this are the problem.
10.
by Bu9818 3y ago
I agree, I don't even care about ads in specific. I primarily use the tor browser which doesn't block ads due to fingerprinting (it's ok for casual browsing, though some sites are actually obnoxious and slow down the browser)
11.
by Bu9818 3y ago
For faster session establishment in OpenSSH consider ControlMaster in ssh_config(5), which multiplexes multiple sessions in one connection instead of creating a new connection for each session.
12.
by Bu9818 3y ago
Lots of games won't ever be converted to Wayland (maybe some unofficially by replacing libraries with updated ones that still work with the game), we'll need some nested X server like xwayland in rootful mode once wayland composit
13.
by Bu9818 3y ago
Also, malicious code can be pushed to the website if you are logging in through that. You have to trust that their infrastructure is safe.
14.
by Bu9818 3y ago
You can mark individual files as No_COW in btrfs, and No_COW + preallocation is a requirement for swapfiles anyway due to how the swap subsystem works.
15.
by Bu9818 3y ago
>affected 100% of the connections to XMPP STARTTLS port 5222 (not 5223) Why did they only target the STARTTLS port? On a related note, I would never use the STARTTLS port (opportunistic encryption) if I knew that the server had a regular
16.
by Bu9818 3y ago
Instead of replacing the md5sum on the download page an attacker could replace the infohash/magnet link/.torrent file.
17.
by Bu9818 3y ago
There's at least some differences, such as HTTP/2 usage, or maybe algorithm usage/bugs in newer versions. Whether or not most tracker staff actually bother to attempt fingerprinting, IDK.
18.
by Bu9818 3y ago
The article linked includes OOB verification as a scenario in TOFU. From the perspective of the ssh client it's TOFU (no CA chain for the client to perform a check), sure, that just means it's up to the user to do the work and use
19.
by Bu9818 3y ago
systemd.directives(7) is useful if you know what directive you want to read about but not in what manual it's in.
20.
by Bu9818 3y ago
I recommend programs using Tor to be run in an empty network namespace then set http/HTTPS/ALL_PROXY to a Unix domain socket created in torrc (or use socat to get it on the namespaces' 127.0.0.1 if not supported by the librar
21.
by Bu9818 3y ago
If I'm allowed to use a software implementation (like with TOTP) so that my private keys can be stored in for e.g. a KeePassXC database so that I can back it up by having multiple copies, then I'm okay with it. Is it possible for
22.
by Bu9818 3y ago
The captcha on this page takes a few seconds then says "Failure", with no message, then restarts itself, when using Tor Browser on the Safer mode. edit: Was able to get a mix of a few successes and a few failures upon multiple bro
23.
by Bu9818 3y ago
They have a couple more joke physical JP input methods: https://github.com/google/mozc-devices
24.
by Bu9818 3y ago
What in particular needs to be upstreamed and to what projects?
25.
by Bu9818 3y ago
Most of it is open source similarly to the Chrome/Chromium situation. But you're right that many Linux desktop users won't care about it due to it being locked down and limited, which was demonstrated in the article. It'
26.
by Bu9818 3y ago
I too use rsync over SSH for devices I own, but I would avoid using SSH to transfer files with someone else. As the receiving side you either allow them way more access to your system than necessary or do some extra configuration to limit t
27.
by Bu9818 3y ago
It's just a bit more involved to use for this use case, especially if the data is confidential (having to set the private flag so clients don't publish the infohash to DHT, using a built-in tracker in your client, transport layer
28.
by Bu9818 3y ago
Torrents also don't provide encryption between peers, unless you use SSL torrents, but it's clearly designed towards sharing between a group, not one-on-one transfers.
29.
by Bu9818 3y ago
I've seen sites like discogs do this for tor exits. You quickly realize what they're doing. Same with shadowbans, I verify by accessing the post in a clean session.
30.
by Bu9818 3y ago
>Honest question: why does this matter? If you end up with running malware as your user haven't you already "lost" in any of a wide variety of ways that Wayland does nothing against? The security benefits of wayland are us

More ›