mvkg

5 ms·

1.
by mvkg 1mo ago
I agree port knocking is a direct violation of Kerckhoff's principle. However, the proposed solution has non-discoverability from unauthorized sources which isn't necessarily in the threat model of OpenSSH or general cryptography.
2.
by mvkg 1mo ago
I think the answer is yes. A response from a remote system (or lack of) is a signal. The conventional ssh protocol method when connecting to a server is to instantly send over the identification string. RFC 4253 requires "both sides MU
3.
by mvkg 5mo ago
If the tool fails for some reason, couldn't an overly eager agent attempt to fix what's blocking it by digging into the tool (e.g. attaching a debugger or reading memory)? I think the distinction here is that skill+tool will have
4.
by mvkg 11mo ago
5GHz certainly helps, but congestion/co-channel interference can still be an issue in high density environments, especially in a multi-user environment like an apartment complex where nothing is coordinated. The addition of 6GHz will h
5.
by mvkg 2y ago
The paper's claim for Dijkstra's is it's "a single algorithm performs as well as possible for every single graph topology". A* is an augmented version of Dijkstra's only applicable when there is a priori knowle
6.
by mvkg 2y ago
802.1x allows for the client to validate the authentication server by way of X.509 certificates, although this normally does require manual configuration since there is no global namespace to tie an ESSID to like there is for domain names i
7.
by mvkg 2y ago
802.11w
8.
by mvkg 3y ago
As of TLS 1.3, the ClientHello (which includes the Server Name Identification (SNI) extension) is still sent in plaintext. There is a current draft for encrypted client hellos[0], but I don't think its adoption is widespread. QUIC appe
9.
by mvkg 3y ago
I believe section 7 of RFC 9000 would allow for the creation of a handshake protocol which could conform to SSH without the need for including x509.
10.
by mvkg 3y ago
It is every bit as bad. QUIC streams could map nicely to the SSH model of discrete channels. Sure, you can run it over tcp/443 and have it look like a normal TLS connection to anything that isn't monitoring the traffic patterns, b
11.
by mvkg 4y ago
You mirror Z-Library but don't support TLS on any of your sites. This seems like an odd choice. What is your threat model?
12.
by mvkg 4y ago
Regarding the collision attack replacement check, do you know if that is carried over into other git implementations (e.g. libgit2)?
13.
by mvkg 5y ago
I have found brave to be a decent chromium-based browser for android if the only addon needed is for ad blocking. It has a bottom toolbar provides a similar experience to the firefox bottom address bar.
14.
by mvkg 5y ago
What were the PRN and AUX files used for?
15.
by mvkg 5y ago
In recent versions of (maybe only GNU?) `tar` you can leave off the `z` flag and it will still decompress based on the filename.
16.
by mvkg 8y ago
A quick look at the source shows that it appears to be linear and just uses `strings.Contains` or `r.MatchString` on each line, so I don't think it has any of the optimizations that are built into `ag`.
17.
by mvkg 9y ago
https://peabody.io/post/server-env-benchmarks/
18.
by mvkg 9y ago
The two 'true' statements show that 12345678910111211 == 12345678910111212 transitively, which is obviously not possible.
19.
by mvkg 9y ago
For what purpose exactly? Surely you don't have multiple developers writing code with one cursor.
20.
by mvkg 9y ago
With TLS, the symmetric encryption keys are always newly generated regardless of the cipher suite chosen; the difference with the ephemeral cipher suites is how the keys are communicated. Without forward secrecy, the client chooses the prem
21.
by mvkg 9y ago
The threat for http to https transactions is that man in the middle can rewrite, drop, or add data before the user reaches the https site. See sslstrip[0] for an example of this attack. [0] https://moxie.org/software/s
22.
by mvkg 9y ago
I was a bit surprised to see that it wasn't published on April 1 and got renewed multiple times. Some parts of it are laughable such as IPv10 support on "all" Internet connected hosts can be deployed in a very
23.
by mvkg 9y ago
IPv10[0] makes IPv4 an extension of the IPv6 space. It'll be interesting to see if this takes off, but it doesn't really seem to solve the whole problem. All nodes in the path would have to support IPv10 for it to work. [0] htt
24.
by mvkg 9y ago
It's a good recommended that you don't use them. https://www.securecoding.cert.org/confluence/display/c/PRE00...
25.
by mvkg 10y ago
A good dual-stack implementation should also support Happy Eyeballs which does not result in simpler code.