yfiapo

5 ms·

1.
by yfiapo 11mo ago
Highly likely to be coincidence. Typically an exposed access key. Exposed password for non-MFA protected console access happens but is less common.
2.
by yfiapo 1y ago
I agree this was a security concern and it was reported and addressed appropriately. With that said as things go this is pretty minor; perhaps a medium severity issue. Information disclosures like this may be leveraged by attackers with exi
3.
by yfiapo 1y ago
The term was used by OpenBSD starting in 1999 for a group of devs getting together for a few days or a week and hacking on specific projects together in person. Not sure about earlier than that but that’s what I still associate the term bac
4.
by yfiapo 3y ago
The link goes to the press release. The actual advisory ( https://www.cisa.gov/news-events/cybersecurity-advisories/aa... ), linked from the press release, contains quite a bit more detail. They detail how they have
5.
by yfiapo 4y ago
Thanks, missed that.
6.
by yfiapo 4y ago
> We're not done with our request payload yet! We sent: > Host: neverssl.com > This is actually a requirement for HTTP/1.1, and was one of its big selling points compared to, uh... > AhAH! Drew yourself into a corner d
7.
by yfiapo 5y ago
This feels akin to excessively auto-completing shells to me. It is pretty awesomely quick when you are starting, but it feels like it has to impact learning/muscle memory which gives you the accuracy and speed in the long-term. Maybe j
8.
by yfiapo 5y ago
I don't know if this is everyone's reasons but for me it is: - it does too much. doesn't follow the Unix norms of doing one thing and doing it well. things like DNS resolution, time sync, etc all exist as systemd components.
9.
by yfiapo 5y ago
This honestly seems like it could be interesting but I don't grok it at all being dropped in with zero context.
10.
by yfiapo 5y ago
The article you linked is from five years ago when the new badges were being initially tested. They have been rolled out for years with color photos. Both styles still work and if you don't go into one of a few big offices you might no
11.
by yfiapo 6y ago
That's cool. As another alternative, this is the one I bought at start of lockdown which does everything but the USB-C: https://smile.amazon.com/gp/product/B0851CMHP2/ Not particularly cheap but at least
12.
by yfiapo 6y ago
I was diagnosed with ADHD almost twenty years ago as a young adult. In my experience learning about how your mind works and spending time to come up with the best system and techniques to keep yourself on task is absolutely critical and sho
13.
by yfiapo 6y ago
Ah, but there is so much value in fresh eyes. Miod, who has been involved with OpenBSD development for 20 years and has surely seen those function names a thousand times, provided the historical reason (they thought they might need to alloc
14.
by yfiapo 6y ago
That's neat to see. This may not be a big story but as a fan of OpenBSD who doesn't currently have time to read the CVS log I appreciate it. OpenBSD source is one of the cleanest I've had the pleasure to work with. You (gener
15.
by yfiapo 6y ago
I don't see any additional context but this does appear to be a new thing. Two commits credited to Carmack in the OpenBSD source and they are dated 5/16/2020 and 5/17/2020.
16.
by yfiapo 6y ago
Thank you for even trying to answer my rambles! :-) I think my contention with the iron is the tipping point and how quickly it goes. Pop-sci tv makes it seem like you fused a single iron atom and bam. Maybe it is you fused an iron atom and
17.
by yfiapo 6y ago
I'm sure there are great explanations out there but I haven't had time to read up on them, but a few of the space things that always bother me when I watch pop-sci space tv: - "as soon as iron starts to be produced in the cor
18.
by yfiapo 7y ago
Cool that there are some specialty tools in this space and will use if I hit that performance challenge. Minor nit, I found the performance table ( https://github.com/eBay/tsv-utils/blob/master/docs/P
19.
by yfiapo 7y ago
I'm sure that will be the case for certain companies. For companies who routinely deal with PII, PCI, or other regulated data the security teams are likely to be much more worried about the potential for sensitive data to be inadverten
20.
by yfiapo 7y ago
Site doesn't appear to be working in Firefox or Chrome at the moment. No idea what it is supposed to show based on the title.
21.
by yfiapo 7y ago
Mmmkay. Have fun with that. The attempt is also incomplete. I suspect this would miss ranges advertised through AWS's BYOIP ( https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoi... ) option. It wo
22.
by yfiapo 7y ago
I've worked for a company with a whale client like that (maybe not total shutdown bad but pretty close). The argument for why they never bothered to just acquire the startup was their fear of ruining the agility of the startup. That se
23.
by yfiapo 8y ago
Hmm, I'm straining my own analogy already so I won't try to beat that horse any deader. :-) I am mostly trying to argue the positives of centralized inspection at network chokepoints in simplicity and guarantee of coverage.
24.
by yfiapo 8y ago
I don't work for a bank so I can't speak definitively to their applications. A few sample applications I see listed as certificate pinned in Netskope (a CASB) though include: Adobe Creative Cloud Amazon Work Spaces Docusig
25.
by yfiapo 8y ago
The other side of the argument is frequently discounted and as an IT security person myself I understand that. However, there is a real challenge for companies who deal with large amounts of very sensitive data. To be able to effectively mo
26.
by yfiapo 8y ago
Certificate pinning is used by some very common applications and can break a MITM that relies on a self-signed certificate.
27.
by yfiapo 8y ago
I've submitted many such small corrections to OpenBSD to help keep that standard high. No one will place those contributions on the same level as real development but I like that I've helped. And I know I appreciate it when even t
28.
by yfiapo 8y ago
Yeesh, the mindwash is strong. I had a hard time continuing to read this post after the Prestige by Association section. Working at a respected company known for cutting edge work is generally a good sign but it does not make you an Interne