sdeziel

24 ms·

1.
by sdeziel 3y ago
`snap refresh --hold` will hold updates indefinitely https://snapcraft.io/docs/keeping-snaps-up-to-date#heading--...
2.
by sdeziel 4y ago
Nice article! However some numbers are a bit off: The IPv4 overhead is normally 20 bytes but can reach 60 bytes with many options. For TCP, it's between 20 and 60 bytes as well. Just ran a quick tcpdump on Linux and curl's TCP con
3.
by sdeziel 4y ago
> AES128 is weird too since 128-bit key ciphers are kind of deprecated unless your target is a fridge magnet. Why is AES128 preferred over AES256 by browsers then? https://www.ssllabs.com/ssltest/viewClient.html?name
4.
by sdeziel 5y ago
> Why can't I select text on that page? Enabling "reader mode" in Firefox did the trick.
5.
by sdeziel 7y ago
From the article: "This drops all ICMP packets. ICMP is only used to ping a host to find out if it’s still alive." Please stop this non-sense, there are too many ICMP blackholes already.
6.
by sdeziel 8y ago
https://caniuse.com itself only supports TLS 1.0. They know about it https://github.com/Fyrd/caniuse/issues/4198
7.
by sdeziel 8y ago
One can always go to about:config and set security.pki.distrust_ca_policy to "2" to distrust Symantec TLS certificates. Reference: https://blog.mozilla.org/security/2018/07/30/update-on-the-d...
8.
by sdeziel 8y ago
1.1.1.1 uses anycast so it's effectively being served by any of Cloudflare's point of presences (152 data centers around the world).
9.
by sdeziel 9y ago
3. Don't let your DB engine execute random executable like wget/dd (Apparmor/SELinux) 4. Don't let your DB host make outbound connections (iptables/ip6tables)
10.
by sdeziel 9y ago
Yeah, I quoted the wrong line.
11.
by sdeziel 9y ago
> * enforcing SSH key authentication That cannot be enforced by the server because the key decryption occurs client-side. An alternative is to use Two Factor Authentication.
12.
by sdeziel 9y ago
No, you just have to pin the current and future/backup intermediate CAs (X3 and X4) and be done with it.
13.
by sdeziel 9y ago
That's why it's nice of Let's Encrypt to publish their current and backup intermediate CAs (X3 and X4) https://letsencrypt.org/certificates/ . That's what I pin for my sites.
14.
by sdeziel 9y ago
Apache httpd also supports some features that are not available with NGINX. (Easy) LDAP authentication is one of those.
15.
by sdeziel 9y ago
LXC (with LXD) or OpenVZ containers are typically shipping full OS in the container. Docker is different in that it typically only have a few processes per containers.
16.
by sdeziel 9y ago
> since hypervisors can share identical pages (e.g. the Linux kernel) With ASLR, I'm now sure the gains are that substantial.
17.
by sdeziel 9y ago
Unfortunately on Ubuntu, seccomp is opt-in only. Works well when enabled though.
18.
by sdeziel 10y ago
I just wanted to mention that the path to modprobe is something reversible (containers aside) if the sysadmin wants autoloading. /proc/sys/kernel/modprobe is not writable from a container. Disabling module loading is not
19.
by sdeziel 10y ago
No, /proc/sys/kernel/{modules_disabled,modprobe} are not writable from a container. Tested with LXD on Ubuntu 16.04.
20.
by sdeziel 10y ago
root can undo that with echo /sbin/modprobe > /proc/sys/kernel/modprobe at any time so you are better off using: echo 1 > /proc/sys/kernel/modules_disabled
21.
by sdeziel 10y ago
OpenSSL is in "main" and as such, it is supported by Canonical for the whole lifetime of the LTS. Upstream dropping support doesn't change that, it simply means that Canonical security team will be backporting patches themsel
22.
by sdeziel 10y ago
Fortunately, Linode supports running custom kernels like those provided by the distro. That's how we run our Linode slices with the stock kernels from Ubuntu.
23.
by sdeziel 10y ago
> the problem for the PC industry is that old PCs are good enough, hence people don't feel the need to upgrade. Throwing away a working electronic device to replace it with a new one is really bad when you think of the ecological im
24.
by sdeziel 10y ago
OSTIF are the ones that audited VeraCrypt
25.
OpenVPN security audit fundraiser(ostif.org)
3 points by sdeziel 10y ago|1 comments
26.
by sdeziel 10y ago
You can get an overview of the various CVEs affecting curl: https://people.canonical.com/~ubuntu-security/cve/pkg/curl.h...