DorothySim

9 years agodiscuss

> For example, IIRC NetBSD required new developers to meet with one or two existing developers in person to verify their identity. (Pretty much like a regular PGP WoT.)

Debian also requires OpenPGP keys and WoT for all developers.

DorothySim

9 years agodiscuss

> What I'd really like to see is a JS implementation of the "dynamic" features like diffing

That's possible. I've made something like that (dynamically fetching git info via dump HTTP server protocol) using Git.js [0] although for a different reason and it worked very well. Some caveats: the decompression must be handled in a WebWorker or the UI is stuck pretty easily. But objects can be fetched on demand so it's kind of like Microsoft's Git Virtual FS. As you've said cross origin policies apply so either have the viewer on the same site as repos or add appropriate CORS headers.

[0]: https://github.com/yonran/git.js

I see git.js even has a "repo-viewer" demo [1]. Although it's very primitive it shows the ref list and diffs.

[1]: https://github.com/yonran/git.js/blob/master/demos/repo-view...

DorothySim

9 years agodiscuss

But if you don't provision the device yourself how can you be sure it hasn't been tampered with in a way that just displays "bootloader OK, everything good" but in the mean time it was rooted? Or is that a risk calculated in the "no full amount of trust"?

DorothySim

9 years agodiscuss

Interesting design. As far as I understood from old papers client certificates are used only to identify the device while user authentication is handled differently.

Could you elaborate on the technical details on user authentication? (If that's not top-super-secret) I guess it's just like accounts.google.com for Enterprise with mandatory 2FA (username+password+U2F key?). Does it work the same on mobile/Android (U2F via NFC or codes)?

DorothySim

9 years agodiscuss

They also take into account the state of the machine you're working on. So locked bootloader and probably a client cert in TPM-like component, plus "device health". Client certs alone are good for authentication (don't work in HTTP/2 though) but they want to reach even better target - no malicious software running on your computer.

That's from reading old papers, I don't know if anything changed now.

DorothySim

9 years agodiscuss

I think the only restriction is working on Google approved hardware so no BYOD there.

(Disclosure: not a Google employee).

DorothySim

9 years agodiscuss

For people interested in specs, here's the link: https://www.greenbytes.de/tech/webdav/draft-ietf-httpbis-cac...

DorothySim

9 years agodiscuss

The "Online Demo" button brings me to the download page. Is this a bug?

DorothySim

9 years agodiscuss

I suggest returning 404 Not Found instead of 422 Unprocessable Entity on failed GETs: https://jsonbin.io/b/2342342 as well as Content-Type: application/json instead of current text/html.

"Entity" in "Unprocessable Entity" refers to request body and for GETs there is no request body: http://www.restpatterns.org/HTTP_Status_Codes/422_-_Unproces...

DorothySim

9 years agodiscuss

> C# and Java allocate objects to the heap and primitive types to the stack by default (...)

Note that it only applies to local variables. If you have a primitive inside an object then it's allocated on the heap as part of the outer object.

DorothySim

9 years agodiscuss

Looks very good and I like that they have a screenshot right on the home page. I wish there was an anonymous instance to try it out without the tedious login process...

DorothySim

9 years agodiscuss

I've used a simple iptables approach to redirect traffic to new Docker container:

  iptables --wait --table nat --append PREROUTING --protocol tcp --dport 80 ! --in-interface docker0 --jump DNAT --to $new_target

Then removing tables for old one:

  iptables --wait --table nat --delete PREROUTING --protocol tcp --dport 80 ! --in-interface docker0 --jump DNAT --to $old_target

(repeat the same for ip6tables).

The same had to be repeated on system start but otherwise it worked flawlessly and had zero-downtime.

DorothySim

9 years agodiscuss

Also relevant: https://vimeo.com/110554082

DorothySim

9 years agodiscuss

Note that it is about TLS client certificates so it's not as widespread as it seems (unless you use these certs of course :) ).

DorothySim

9 years agodiscuss

Probably yes. Sending scores in HTTP requests is such a low-hanging fruit for exploitation.

A friend of mine was responsible for scoring system on games. As they had some real awards (like bikes, tickets etc.) they captured the entire flow of the game with various statistics and later analyzed them for weird variations. That was in Flash and people used browser plugins to slow down the play, that was easy to spot. Of course it won't stop 100% of attacks, but it raises a bar sufficiently to thwart most attempts.

DorothySim

9 years agodiscuss

Wow, very nice!

I think this comment on issues is also relevant: https://github.com/Microsoft/vscode/issues/1031#issuecomment...

DorothySim

9 years agodiscuss

...or Thunderbird (Enigmail) for people that like GUIs.

DorothySim

9 years agodiscuss

> For hostkeys on DO you can probably get a script to run that'll request a signed certificate from a server you own.

Or just embed the signed host certificate in cloud-init.

DorothySim

9 years agodiscuss

You are not required to use SSL to do hello world. You are required to use SSL if you want to use HTTP2 (yes, I know about h2c).

DorothySim

9 years agodiscuss

According to this [0] they are related ("SRP is related to Diffie-Hellman.").

[0]: http://web.archive.org/web/20130407190430/http://chargen.mat...

DorothySim

Submissions

Linux kernel: stack buffer overflow with controlled payload in get_options()

CVE-2017-7477 kernel: net: Heap overflow in skb_to_sgvec in macsec.c

Secure Remote Password protocol

Linux kernel CVE-2017-6353: sctp: deny peeloff operation on asocs

comments