banister

7 ms·

1.
by banister 2y ago
Ok. Well, the attack is so rare that i don't believe putting mitigations against the DoS is worth the effort. The mitigations are not that trivial (though it's arguable that just removing the route is kind of trivial, but still no
2.
by banister 2y ago
Cool! glad we're on the same page finally :) Yeah, lots of cool stuff you can do with Linux. just wish that the other OSes were half as good, unfortunately most of them require kernel code to do what would be a simple shell script in l
3.
by banister 2y ago
Yes exactly. It becomes a "denial of service" against the option 121 pushed subnet routes. That's already discussed in the paper, i assumed you knew that already. There's nothing else you can do in this situation other t
4.
by banister 2y ago
Your examples are strange as you're using rfc1918 addresses (i.e private range) rather than public ips. So all your examples are very odd. 10.7.7.7 will get dropped. This is correct behaviour based on the routing rules in your example.
5.
by banister 2y ago
Read my reply to the other poster, i answer exactly this. Actually test it yourself. Stop theorizing. I tested it. It works exactly as I said. I think i know where you're confused. There is a firewall whitelist on the VPN endpoint rout
6.
by banister 2y ago
No, you're wrong again. I just tested this (simulating routes added by a DHCP option 121) and it works exactly as I said. C is what happens. But it doesn't happen the way you say at all. Only the traffic heading to the new 121 rou
7.
by banister 2y ago
Let's walk through this step by step because there's a lot of confusion on your end. * Step one - You connect your computer to a network - yes you'll get a DHCP lease, and you'll get an ip address, and a default gateway
8.
by banister 2y ago
Well said. This is a nothing-burger for all VPNs except the ones that are likely heavily leaking already due to the absence of basic firewall rules. Their "side channel attack" also made me spit out my drink. EDIT: looks like Nord
9.
by banister 2y ago
I'm talking about the specific side channel attack mentioned in their report. Not side channels generally ;)
10.
by banister 2y ago
Yes. I just provided simplified firewall rules in my answer. You also need to whitelist either the VPN endpoint itself (and add a route to that endpoint) or you need to whitelist the process (such as wireguard or openvpn) that hits that end
11.
by banister 2y ago
"closing specified programs" has to be the silliest thing i've ever heard. By the time you close it, it's probably already leaked thousands of packets. The leak of a SINGLE packet is already too much. Such an "appli
12.
by banister 2y ago
Mobile is an exception (but they already state android is immune), let's stick to desktop for the sake of discussion, the 3 major desktop platforms: mac, win, linux :) On mac - just implement a block everything rule with pf and then ju
13.
by banister 2y ago
The side channel attack is silly and impractical. You know it's silly. I know it's silly. Let's quit pretending. The firewall rule is 100% sufficient to defend against this exploit. All good VPNs already provide it by default
14.
by banister 2y ago
They don't know what they're talking about. Kill switches are not "tripped" there is no "control channel". A kill switch is just a firewall rule that is ALWAYS engaged and all it does is blocks off-VPN traffic.
15.
by banister 2y ago
The "side channel" is silly. You assume someone is hitting the same endpoint over and over and over and with significantly high traffic that it rises above the noise. Did u even do any of the math required to demonstrate it can ac
16.
by banister 2y ago
Most decent VPNs are already protected against it. It's a simple firewall rule known as leak protection or a kill switch which blocks all off-VPN traffic including on option 121 routes. This article is 99% FUD IMO.
17.
by banister 2y ago
I looked at this in detail. This exploit is a nothing-burger for most decent VPNs. A simple "leak protection" (aka Killswitch) firewall rule completely negates this attack. All decent VPNs implement such a rule by default. Dealing
18.
by banister 7y ago
Mullvad does not have split tunneling, so it's a no-go from me. Also their client looks like ass and is a RAM hungry electron app.
19.
by banister 12y ago
whose
20.
by banister 13y ago
Why are you talking about rape? I thought rape required penetrative sex, this is a sexual assault isn't it?
21.
by banister 14y ago
which features is pry missing?
22.
by banister 14y ago
``` If methods were first-class functions, this would work — > method_a would return method_b, which would then execute when x() was called. This doesn't work because Ruby methods aren't objects. ``` Seems the OP is just confused by syn
23.
by banister 14y ago
REPL requires [binding_of_caller]( https://github.com/banister/binding_of_caller ) anyway, which i doubt rails would include any time soon ;)
24.
by banister 14y ago
Just curious but why does singleton classes/singleton methods in Ruby make it "so there's no guarantee that a change made in code and evaluated in the runtime will have the desired effect" ?
25.
by banister 14y ago
Possibly :) tab-completion will be substantially improved in an upcoming release :)
26.
by banister 14y ago
hmm, weird. Aside from tab-completion what else is slow? I've never had responsiveness issues with Pry, even tab completion is snappy.
27.
by banister 14y ago
Not sure it's quite the same. My understanding is that `ipython --pdb` would run the entire program in debugging mode, causing a dramatic slow-down in performance of the app. The approach taken by pry-rescue in contrast is to check for exce
28.
by banister 14y ago
Definitely check out Pry ( http://pry.github.com ). It's designed specifically for your use case... Just start Pry, load the gems you want, and then navigate to the method/class you want to know about using Pry's `ls` and `cd` commands. Onc
29.
by banister 14y ago
If you use Pry's `edit-method some_object.some_method`[1] you can actually open the method in an editor and it'll even fast forward the cursor to the first line of the method. [1] https://github.com/pry/pry/wiki/Editor-integration#wiki-Edi
30.
by banister 14y ago
Pry knows its place, it doesn't pretend its a nice environment for writing real code - instead when you want to edit a method definition you type "edit-method my_method"[1] and pry will open the source file of that method in an editor and t

More ›