slasaus

letztes Jahrdiscuss

No buffer overflows, no user-after-free and no double free issues. There is a garbage collector which stops the world here and there to cleanup, but for anything that is not constantly busy, like a small mail server, this is not noticeable.

slasaus

vor 4 Jahrendiscuss

Author here, I'm currently trying to get mongovi into Debian, if anyone can help that would be highly appreciated. :)

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1028418

slasaus

vor 7 Jahrendiscuss

I think this is huge. It reminds me of the early days of Firefox (back then still known as Phoenix) in a world where IE6 and pop-up ads dominated. At launch IE6 was really the best and most innovative browser of it's time (IMHO). But after IE6 had beaten Netscape, Microsoft stopped putting money in IE development and the situation got worse over time. It was Phoenix with, among other things, a pop-up blocker that was on by default that brought down Internet Explorers hegemony.

Today, with Chrome being dominant the situation is different because Google is still innovating Chrome at light speed. The one and only Achilles heel to beat this giant is by attacking their business model, which is to enable ad blocking by default. I expect this is something people want, just like pop-up blockers back in the days. Google will never be able to lead, or even follow in this direction without changing their business model.

Unfortunately, Mozilla’s own business model also heavily relies on selling ads, albeit indirectly. According to this statement from an independent audit report[1]:

"Note 10 - Concentrations of Risk:

Mozilla has entered into contracts with search engine providers for royalties which expire through November 2020. Approximately 93% and 94% of Mozilla’s royalty revenues were derived from these contracts for 2017 and 2016, respectively, with receivables from these contracts representing approximately 75% and 79% of the December 31, 2017 and 2016 outstanding receivables."

In other words, $539 Million, which is 93% of their total revenue, comes from companies that have selling ads as their business model (Baidu, Google, Yahoo and Yandex [2]).

I really hope Mozilla will be able to change this revenue stream to better align with their mission[3]. They have been trying to diversify their revenue since 2014 [4] and although they might not be as dependent on Google as they once were, they're still almost fully dependent on ads.

Oh, and yeah, of course simply making a better browser than Chrome would also help ;)

Background:

* https://www.mozilla.org/en-US/foundation/annualreport/2017/

* https://assets.mozilla.net/annualreport/2017/mozilla-2017-fo...

[1] https://assets.mozilla.net/annualreport/2017/mozilla-fdn-201...

[2] https://wiki.mozilla.org/Global_Search_Strategy_Status

[3] https://www.mozilla.org/en-US/mission/ "An Internet that truly puts people first, where individuals can shape their own experience and are empowered, safe and independent."

[4] https://blog.mozilla.org/advancingcontent/2014/02/11/publish...

slasaus

vor 10 Jahrendiscuss

> That's not really the sort of decision application programmers should be making for sysadmins.

As a programmer you have the right (or maybe even obligation?) to write secure software and I would argue software that's hard or impossible to use insecurely. It should live up to the standards of the time of release, not the time of the release of the first version (in case of OpenSSH that would be more than seventeen years ago).

As a sysadmin you can always decide to stick with an old version if that is what the environment you operate in demands.

I think this proactive mentality of OpenSSH is an important part of their success and why it has such a good track record from a security point of view.

slasaus

vor 10 Jahrendiscuss

> If you take the time to enter the voting booth when it opens and verify that the ballot boxes are empty at the start, and stay in the voting booth until it closes

Too late to edit my own post but please s/voting booth/polling station/ in the parent. Of course every voter should have absolute privacy in the voting booth in order to rule out coercion, but the ballot storage in the polling station should be publicly verifiable.

slasaus

vor 10 Jahrendiscuss

Knowing what one voted opens the door for coercion. Think of family members wanting you to vote a certain way. If you vote anonymously you can never prove to them what you voted, which protects the voter from any social, religious or other external pressure one might feel.

slasaus

vor 10 Jahrendiscuss

If you take the time to enter the voting booth when it opens and verify that the ballot boxes are empty at the start, and stay in the voting booth until it closes, you can verify yourself if everyone put at most one ballot in the ballot box. Later on you can double check if indeed every ballot is counted correctly and can thus conclude that at least your own ballot is counted correctly and exactly once without having to let anyone know what you voted.

slasaus

vor 10 Jahrendiscuss

How anonymous is your vote in the blockchain(s)? And how can you still verify the vote is counted correctly and exactly once while lacking hard proof to others about what you voted?

slasaus

vor 10 Jahrendiscuss

After trying json, yaml, json5, java properties, ini and toml, I finally choose hjson* as the configuration file format for the software I'm building. It's the easiest format to read and write IMHO, a bit like nginx config files.

* http://hjson.org

slasaus

vor 10 Jahrendiscuss

Really love the new persist option. It makes `doas su -` less compelling when you have to run multiple commands and use a complicated password.

slasaus

vor 10 Jahrendiscuss

Ok, just wondering, would "v=spf1 ?all" be the same in that case? I.e. a neutral spf policy?

slasaus

vor 10 Jahrendiscuss

Interesting note about DMARC, but still, if you're concerned about breaking forwarding for your domain, then why bother using spf at all? I still don't see the benefit of setting up ~all rules.

slasaus

vor 10 Jahrendiscuss

I think it's pretty weak they're advertising the use of "~all" in their spf records. Either use "-all" or just don't use SPF I would say. If you can't make a decisive statement about your own domain then it won't be actionable for receivers that evaluate your records.

slasaus

vor 10 Jahrendiscuss

FWIW, there is a petition for Intel to release an ME-less CPU design: https://puri.sm/posts/petition-for-intel-to-release-an-me-le...

(as mentioned in a comparable thread five days ago: "Intel and ME, and why we should get rid of ME" (fsf.org) https://news.ycombinator.com/item?id=11880935)

slasaus

vor 10 Jahrendiscuss

FWIW, there is a petition for Intel to Release an ME-less CPU design: https://puri.sm/posts/petition-for-intel-to-release-an-me-le...

slasaus

vor 10 Jahrendiscuss

    OpenSSL announced several issues today that also affect LibreSSL.

    - Memory corruption in the ASN.1 encoder (CVE-2016-2108)
    - Padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
    - EVP_EncodeUpdate overflow (CVE-2016-2105)
    - EVP_EncryptUpdate overflow (CVE-2016-2106)
    - ASN.1 BIO excessive memory allocation (CVE-2016-2109)

    Thanks to OpenSSL for providing information and patches.

http://marc.info/?l=openbsd-announce&m=146228598930416&w=2

https://twitter.com/bob_beck/status/727478594591543296

slasaus

vor 10 Jahrendiscuss

(I've updated the parent about bypassing bgp/dns etc. before I saw your reply)

The nice thing about using the onion address (transport layer) is that you have mandatory e2e authentication with only one id that solves multiple real world problems with bgp/dns/tls.

How would you propose to go further from current state-of-the-art WhatsApp to stop leaking meta-data? I know Ricochet is open to use a stronger encryption layer on top of Tor †.

† https://github.com/ricochet-im/ricochet/issues/72

slasaus

vor 10 Jahrendiscuss

I can see that but I think the self authenticating nature of Tor Onion Services and therefore bypassing bgp, dns and CA weaknesses is worth something†.

Maybe in the future when prop224†† is implemented the encryption will be more solid.

† https://media.ccc.de/v/32c3-7322-tor_onion_services_more_use...

†† https://gitweb.torproject.org/user/asn/torspec.git/tree/prop...

slasaus

vor 10 Jahrendiscuss

Don't forget Ricochet†, it only does synchronous communication but it does solve the problem of leaking meta-data. All the other clients except Pond leak meta-data.

† https://ricochet.im/

slasaus

vor 11 Jahrendiscuss

My hardened ~/.ssh/config on OS X 10.11:

  Host *
    Ciphers [email protected],[email protected],[email protected],aes256-ctr
    MACs [email protected],[email protected],hmac-sha2-512,hmac-sha2-256
    KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256
    HostKeyAlgorithms ssh-ed25519,ssh-rsa
    ChallengeResponseAuthentication no
    UseRoaming no

If you only connect to newer servers you can further restrict ciphers to only use AEADs (only list the chacha20-poly1305 and aes-gcm ciphers). I assume using AEADs-only makes the MACs keyword obsolete, is this correct?

Config is based on tips from https://stribika.github.io/2015/01/04/secure-secure-shell.ht...

Submissions

mongovi v2.0.0 - command line interface for MongoDB

Apple V FBI: It’s About Control

NSA Helped British Spies Find Security Holes in Juniper Firewalls

Climate Justice Movement “Extremely Disappointed” in COP21 Draft

Hard, Not Soft, Kill Switches

Hard, Not Soft, Kill Switches

WikiLeaks’ Julian Assange interested in publishing drone attack details

Can Servo be a clean and modern reference platform for developers?

Thunderbird and end-to-end email encryption – should this be a priority?

The Bitcoin Consensus Red Herring

5 simple ways to troubleshoot using Strace

Deleting secret data with public verifiability

[bcrypt] Determine the number of rounds for a fixed maximum amount of login time

Glenn Greenwald live tonight in Amsterdam

"An Algorithm for Differential File Comparison" aka diff (June 1976)

Disrupting “Disruption” Rhetoric

comments