champtar

5 ms·

1.
by champtar 5mo ago
There is also OVH (not affiliated, just happily using their VPS), but I would consider switching to 2 providers, as any provider can have data loss or just lock your account at anytime for any reasons. 2 providers with free egress so you ca
2.
by champtar 6mo ago
TIL `badblocks -t random` repeats the same random block over and over :(
3.
by champtar 7mo ago
Just being able to inject traffic is already huge as it allow you to send IPv6 router advertisement, which sometimes allows you to change the DNS config
4.
by champtar 9mo ago
You need working switch level filtering, many implementations can be bypassed / will never be fixed: https://blog.champtar.fr/VLAN0_LLC_SNAP/
5.
by champtar 10mo ago
CAP_NET_RAW also allow to capture packets (tcpdump) so you really can have some fun like running a TCP stack in user space or MITM http connections: https://blog.champtar.fr/IPv6_RA_MITM/ / https://blog
6.
by champtar 1y ago
Good news that it was found and fixed, but 140 days response time seems rather slow for such a critical vulnerability
7.
by champtar 1y ago
Curious what are the main benefits ? (I've only ever used DD-WRT and OpenWrt)
8.
by champtar 1y ago
In OpenWrt there is ujail, you give it an ELF (or multiple) to run, it'll parse them to find all the libraries they need, then it creates a tmpfs and mount bind read only the required files. https://github.com/openwrt&#
9.
by champtar 1y ago
2 big address block that have few chances of conflict: - CGNAT 100.64.0.0/10 - "Benchmark" 198.18.0.0/15
10.
by champtar 1y ago
It'll not, the new behavior is just a new naming scheme, and you just choose not to use any, which is totally fine if you have a single NIC.
11.
by champtar 1y ago
You can easily keep the current naming behavior with the 'net.naming_scheme=' kargs
12.
by champtar 1y ago
Hopefully the last breaking change. enoX should always stay stable, as it's the BIOS (in some ACPI table) telling that this device/port has this ID. ensX means the NIC in PCIe slot X, but in your PCIe tree you can have PCIe bridge
13.
by champtar 1y ago
I once had to maintain a CalDAV server that was developed in house, computing the "free busy" with recurring events, exceptions, different timezone than the organizer + some DST is a bug source that keeps on giving.
14.
by champtar 1y ago
https://github.com/rustic-rs/rustic?tab=readme-ov-file#stabi... rustic currently is in beta state and misses regression tests. It is not recommended to use it for production backups, yet.
15.
by champtar 1y ago
If you want to use some object storage instead of local disk, rclone can be a restic server: https://rclone.org/commands/rclone_serve_restic/
16.
by champtar 1y ago
I remember when contactless was introduced in France, someone from the CB bank card group ( https://en.m.wikipedia.org/wiki/CB_Bank_Card_Group ) said that contactless was secure because you are insured. At that time Fran
17.
by champtar 1y ago
If you are using Microsoft Outlook mobile app or the webmail, inline or bottom posting experience is garbage, it doesn't quote/format the previous email, it just slaps it at the bottom. If you want to respond inline you better put
18.
by champtar 1y ago
For timezones data go already has https://pkg.go.dev/time/tzdata
19.
by champtar 2y ago
AWS EBS volumes (except io2) have an annual failure rate of 0.2%, so if you have 1000 running statistically you will loose 2. For io2 it's 0.001%, but still not 0.
20.
by champtar 2y ago
With reproducible build you know that what you test on your dev laptop is the same as what will go out from your CI, and if hash mismatch you can chase why. For a concrete exemple, Mellanox driver configure script will auto detect if it&#x2
21.
by champtar 2y ago
All EBS volumes except io2 have advertised durability of 99.8%, which is pretty low, so don't count it in the magic networked storage category.
22.
by champtar 2y ago
You can securely store your asymmetric key for signing, but if I remember correctly the logs are pretty useless, basically you just know the key was used to make a signature, no option to log the signature or additional metadata, which woul
23.
by champtar 2y ago
Well TOTP need proper time sync, and most routers don't have battery in them
24.
by champtar 2y ago
u2f and webauthn require https ( https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent... ), don't know if it accepts self signed certs and IPs instead of fqdn. Also the auth is locked to the h
25.
by champtar 2y ago
Both exemples generate custom nginx config
26.
by champtar 2y ago
I would love if the container pull protocol stopped using custom headers or content-type, so we could use any dumb http server.
27.
by champtar 2y ago
What I would really love is for the OCI Distribution spec to support just static files, so we can use dumb http servers directly, or even file:// (for pull). All the metadata could be/is already in the manifests, having Conte
28.
by champtar 2y ago
Sewer are properly buried, Rogers cables are just thrown around with maybe a bit of dirt on top of it was a good day. I redid a wall in my backyard last year that is close to a Rogers box, I removed ~15 old cut cables from the ground.
29.
by champtar 2y ago
I invite you to not trust blindly L2 security features, anything that use denylist approach can miss some corner cases, have a good read :) https://blog.champtar.fr/VLAN0_LLC_SNAP/
30.
by champtar 2y ago
You should play with IPv6, you can bypass IPv6 RA Guard on some switches (including Cisco) https://blog.champtar.fr/VLAN0_LLC_SNAP/ , allowing attacks in 'trusted' networks

More ›