kro

11 ms·

1.
by kro 1mo ago
Out of curiosity: How? They don't offload TLS to the kernel, do they? Most apps do it in userspace linked against openssl afaik. Do you patch that lib? If ebpf "just" operates at network/packet level, I don't see ho
2.
by kro 1mo ago
It does not even require the PoW thing Anubis does. I've setup a simple logic that just: Checks for existence of a specific static cookie, if it does not exist, output a small page that sets the cookie via JS and reloads. Sadly this ki
3.
by kro 2mo ago
I understand that most people don't use it and indeed rely on tofu, but the statement is not absolutely correct. ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a
4.
by kro 3mo ago
Only 1.31.0 and 1.31.1 are affected.
5.
by kro 3mo ago
These commits [1] are related to the issue. I am not too familiar with the code, but it appears nginx manages/closes streams in a pool at times the attacker cannot control, and during short windows, it is vulnerable. [1]: https:/
6.
CVE-2026-42530 – Nginx HTTP3/QUIC Use-After-Free(my.f5.com)
7 points by kro 3mo ago|4 comments
7.
by kro 3mo ago
I did that for a while because of compatibility issues with a newer laptop, it works but generally if there is no reason it's way easier to stay with the provided packages. Compiling weekly due to security patches becomes annoying over
8.
by kro 3mo ago
mysql/maria also lets you turn off/down the isolation level for queries if you know the guarantees aren't needed, to speed things up. I think postgres does not have that option.
9.
by kro 4mo ago
I've been receiving loads of spam from google MX servers lately until blocking all mails with X-Google-Group-Id headers. I don't know how it's possible, the contents were 100% spammer controlled, no Google template
10.
by kro 4mo ago
You are correct. Reminds me, we once got a letter by a German government body requesting some data exports from our company, and to upload them on findrive-ni.de It turned out to be legit, but it's neither a subdomain of the state of N
11.
by kro 4mo ago
That also often shoots you as when json_encoding it only becomes an array when ordered "correctly" (numeric 0-based keys without gaps), otherwise an object. So to be safe you generally need to array_values after filtering. If in
12.
by kro 4mo ago
Sounds good - which software supports this? Specifically I'd prefer if it would do a composite key derivation in-time rather than "just a pw prompt but TPM has the full key"
13.
by kro 4mo ago
Ubuntu also released TPM based FDE a few versions ago. I had these thoughts then and decided against using it. Typing my passphrase on boot is muscle memory and gives me simple security I can trust. Also can recover data without my mainboar
14.
by kro 4mo ago
No remotely reachable vuln should be taken lightly. At the moment though, the preconditions look odd. I've been using nginx in various constellations for 10 years and never once combined rewrite and set.
15.
by kro 4mo ago
However, some privs can be gained in namespaces/unshare.
16.
by kro 4mo ago
It says coordinated distro release today, and I've received a notice earlier today but that does not include the CVE number. That's confusing / does not seem very coordinated to release 2 separate security update notices in a
17.
by kro 4mo ago
Next easy attack vector is (non-rootless) docker run with rootfs mount, many are in docker group even when sudo is protected. Also, most sensitive data is in the user scope anyways (on a PC). You should always run dev stuff in containers t
18.
AWS to also block ipcomp and xfrm modules in DirtyFrag mitigation(aws.amazon.com)
1 points by kro 4mo ago|1 comments
19.
by kro 4mo ago
So far all the information suggested to disable esp and rxrpc modules. This bulletin suggest that more modules are necessary for complete mitigation
20.
by kro 4mo ago
Containers, even with root user, are often stripped of these capabilities unless --privileged
21.
by kro 4mo ago
VPN usage increased, but how to they draw the conclusion that this is children. I think it's more likely that adults are using VPNs to not have to deal with the ID process. I would do that. As VPNs usually cost some money, which is alr
22.
by kro 4mo ago
CAP_NET/SYS_ADMIN is required for this. So this would be "not as bad" as the others.
23.
by kro 4mo ago
It's scary to think that some day it will be more than a local attack vector. I don't want to imagine the fallout from a remote rce via tcp/ip.
24.
by kro 4mo ago
These copyfail exploits allow an unprivileged (daemon/app) user (not in sudoers) to get root without interaction from the original system maintainer. It's quite different from PATH-injecting an already privileged user. Also, these
25.
by kro 4mo ago
Maybe it would be reasonable for sysadmins to proactively whitelist used / block all exotic unused modules that are not needed in their system configuration. This would reduce the amount of ring 0 code. But I've never seen such ad
26.
by kro 5mo ago
That is true, but if at least the widely used ones would get notified before that would be beneficial. If they have a responsible security contact point. - Debian - Ubuntu - Arch - Amazon/Azure - Fedora/RHEL
27.
by kro 5mo ago
Major os vendors will publish pages with the fixed versions: https://security-tracker.debian.org/tracker/CVE-2026-31431 https://ubuntu.com/security/CVE-2026-31431 Also, disabling algif_aead is sug
28.
by kro 5mo ago
This can likely be shipped as binary code without dependencies like python, as the bug is in the kernel.
29.
by kro 5mo ago
Young people setting up a MITM and getting deeper into tech rather than consuming short-form-content is something I'd appreciate as a nice bonus effect. Of course the EU solution isn't perfect and there are bypasses (there will a
30.
by kro 5mo ago
Hetzner normally advertises their hardware servers as 2x 1 TB SSD, because it's strongly recommended to run them in SWraid1 for net 1TB. (Their image installer will default to that) Once the first SSD fails after some years, and your m

More ›