ckuehl

6 ms·

1.
by ckuehl 6y ago
Purely a guess, but I've sometimes been able to work backwards from the content length (very often included in HTTP server logs) to figure out what the body had to be.
2.
by ckuehl 6y ago
The authors of The Expanse published an article last year acknowledging and paying tribute to the mission ("How a NASA robot messed up our science fiction"): https://www.nationalgeographic.com/science/2019&#x2
3.
by ckuehl 7y ago
Also keep in mind that if you use IP-based whitelisting, an attacker can register their own CF/Fastly account and target your origin server with whatever CDN settings they want (assuming they can discover your origin server). With Fast
4.
by ckuehl 7y ago
Another thing that isn't perfect but could help is doing a search of package contents of a large distro, e.g. here's a search of Debian for packages that provide a file called "node": https://packages.debian.o
5.
by ckuehl 9y ago
This is a somewhat dangerous pattern for picking temporary files (from #8): $ NEWFILE=/tmp/newfile_${RANDOM} $ touch $NEWFILE The problem is that any user on the box can create files under /tmp. An attacker can
6.
by ckuehl 9y ago
From the Spectre paper: > As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). https://spec
7.
by ckuehl 9y ago
There are some amusing notes about the /bin/true copyright claim here: http://trillian.mit.edu/~jc/humor/ATT_Copyright_true.html
8.
by ckuehl 9y ago
I've been using my packaged version pretty extensively (mostly in virtualenvs) and haven't encountered any issues yet myself, but would definitely be interested to hear (either on GitHub or here) what issues you encountered and if
9.
by ckuehl 9y ago
Chris Lamb, the current Debian Project Leader, has said that it will not be in stretch but could potentially be available in stretch-backports: > If someone puts in the work, sure :) There isn't a "they" in Debian... it&#x
10.
by ckuehl 9y ago
I agree. Looks like I only noticed the apt-get install line and incorrectly assumed that's what you were referring to.
11.
by ckuehl 9y ago
A benefit of installing using your system package manager is that you can rely on your distro to manage the security of the package. If you just `pip install` it, you need to personally watch for new security bugs and upgrade (or backport t
12.
by ckuehl 10y ago
Totally agreed they have the right to monitor your network traffic, but I still think in most cases employees should try to push back on this. At least from my view, it's not so much that I don't want my company to know what I&#x2
13.
by ckuehl 10y ago
I found interesting djb's blog post about a theoretical scenario where mixing entropy can actually be dangerous: https://blog.cr.yp.to/20140205-entropy.html
14.
by ckuehl 10y ago
ISPs usually use the designated block (100.64.0.0/10) for this to avoid collisions with home networks: https://tools.ietf.org/html/rfc6598#section-7 Webpass is an example of a "good" ISP that does this.
15.
by ckuehl 10y ago
Most operating systems have started detecting captive portals and presenting a notification. All of the modern consumer ones (OS X, Windows, Android, iOS) appear to have this detection. (I don't use it so not sure how well it works, th
16.
by ckuehl 10y ago
BART doesn't have that type of ticket. You tag your Clipper card (or insert your BART ticket, if you're not a frequent rider) upon entering a station, and again when exiting at your destination.
17.
by ckuehl 10y ago
For what it's worth, ISPs are definitely shaping traffic to try to game results on public speed tests. I had an issue with Comcast last year where I would have large latency spikes for ~2 hours every night, and speedtest.net always rem
18.
by ckuehl 11y ago
Just keep in mind that unstable is not guaranteed to get security fixes promptly, either. The Debian Security Team only handles supported releases. The Security Team FAQ is a good read: https://www.debian.org/security/f
19.
by ckuehl 11y ago
Just want to emphasize (and this is not directed specifically at you): you almost certainly shouldn't run Debian testing on anything that is public-facing. Packages get migrated to testing after some days in unstable if no high-priorit
20.
by ckuehl 11y ago
Just be very careful which direction you point those arrows :-) I've have similar nightmares about typoing `if` and `of` when using dd.
21.
by ckuehl 11y ago
Good question! The problem is trying to signal it from outside the Docker container. If your container has a process tree like PID 1: /bin/sh +--- PID 2: <your Python server> then if you use `docker signal` from
22.
by ckuehl 11y ago
Yup, tini is really really similar and looks pretty cool! They're solving much of the same problem. It's unfortunate that we didn't find tini before we went and wrote dumb-init. There are some minor differences (dumb-init loo
23.
by ckuehl 11y ago
> From my own experience with docker in production, I'm yet to see any of the described scenarios crop up. Has anyone else, or is this solving an extreme edge case? The biggest issue we see at Yelp is leaking containers in test (e.g
24.
Introducing dumb-init, an init system for Docker containers(engineeringblog.yelp.com)
161 points by ckuehl 11y ago|37 comments
25.
by ckuehl 11y ago
You can simply use `git add -p` to stage hunks individually (or `git reset -p` to unstage some hunks).
26.
by ckuehl 11y ago
As an interesting example, Lavabit tried handing over their RSA private keys in an illegible printed font: https://nakedsecurity.sophos.com/2013/10/04/cheeky-lavabit-d...
27.
by ckuehl 11y ago
The past few Nexus phones (and some tablets?) have had this built-in. It's amazingly convenient.
28.
by ckuehl 11y ago
Is there a security benefit to encrypting at the filesystem layer as opposed to just encrypting the underlying block device (like dm-crypt)? It seems like whole-disk encryption would be much harder to accidentally implement insecurely.
29.
by ckuehl 11y ago
I think for most moderately-technically-inclined people, a decent password manager is going to be much more secure (and in many cases, more convenient). If you steal my credit card, I'll just call my bank and cancel it (and I'm no
30.
by ckuehl 11y ago
Rather than copy their suggestions for SSL configuration, I think you can probably find better (and more well-maintained) advice on the Mozilla wiki: https://wiki.mozilla.org/Security/Server_Side_TLS

More ›