remx

9 वर्ष पहलेdiscuss

Yeah Hypothesis is a bit nerdy. This is why Genius exists, and if rap/hip-hop is not your thing, Hypothesis can be used for any niche annotation.

remx

9 वर्ष पहलेdiscuss

Yep. Tor is just a great big eye for the NSA and GCHQ. For them it doesn't matter if scoundrels use it, as long as they can use it too.

remx

9 वर्ष पहलेdiscuss

Make everything static. Unless you really need some sort of dynamic content. If you do need dynamic content, make sure to stress test it. There are tools out there to load test your website to see if it breaks.

Put it on Cloudflare. Cloudflare can absorb huge volumes of traffic with ease. Keep in mind there are other WAFs (Web Application Firewalls) you can check out.

Use as little third party widgets / bells and whistles as possible, and self host assets when you can. If these go down (which they will when your site is trending on Hackernews), then your site may not load correctly and leave your users frustrated. Remember the recent S3 failure? It broke thousands upon thousands of sites.

remx

9 वर्ष पहलेdiscuss

For those looking for something similar there are these: Telescope[0], Drum[1], Slashcode[2], and Microscope[3]

[0]: https://news.ycombinator.com/item?id=7861985

[1]: http://drum.jupo.org

[2]: http://www.slashcode.com/www.slashcode.com/

[3]: https://github.com/DiscoverMeteor/Microscope

remx

9 वर्ष पहलेdiscuss

> So why now?

I think it's because it's cool to use the word "cyber" now in the news. It makes news outlets appear edgy and with it. Infact these cyber attacks are nothing new, and have been an ongoing problem for organizations like the NHS, the only difference being there is a remarkable uptick in the scale of the attack. The reason it stands out is because it's a cluster, instead of a slow, trickling problem for the NHS and other organizations.

> What's so special now?

The sophistication and worm capabilities. Were it not for the Shadowbrokers leak, small time malware authors had to use tired old strains of malware to spread. Now they can draw upon the vast arsenal of the Shadowbrokers leak and appear like state actors, which they are not.

If anything, the leaks were a blessing, because now we can mitigate against such attacks. NSA's mantra 'NOBUS' (No-one-but-us) does not apply here.

remx

9 वर्ष पहलेdiscuss

This is what I want to know[0] too.

To mitigate, you can disable SMB1.0 with the following command. Make sure to run as administrator:

    dism /online /norestart /disable-feature /featurename:SMB1Protocol

[0]: https://news.ycombinator.com/item?id=14335845

remx

9 वर्ष पहलेdiscuss

After the recent so called 'cyber attacks' of WannaCry, I was careful to update any Windows machine I have and install things like EMET and MalwareBytes on them. I switched to Linux years ago because I've heard nothing but bad news concerning Windows, but one thing struck me about the WannaCry infections: I heard the attackers used an exploit pulled from the recent ShadowBrokers leak, something related to 'SMB'. A few questions: Explain it to me like I'm five please

1.) What is SMB? And is it easy to remove from systems by simply uninstalling it (like I have done[0])?

2.) Does WannaCry just land on a machine through a simple point-and-click exploit? Do they just enter a vulnerable IP address and they can plant the exploit on the machine and run it?

3.) I am aware that it also gets onto machines by people randomly clicking on shady e-mail attachments, but I am very curious about how it simply lands on computers with very little or no user stupidity at all?

[0] I uninstalled SMB by going to > Add or remove programs > Remove windows features

remx

9 वर्ष पहलेdiscuss

There's also all different types of work. Work on the body, the mind, etc

remx

9 वर्ष पहलेdiscuss

A lot of people also forgo carrying a smartphone completely for privacy reasons

remx

9 वर्ष पहलेdiscuss

> But what's new? What's your favorite new upstart project?

A few:

- https://hypothes.is

- https://genius.com

- https://www.ethereum.org

- https://thegrid.io

- https://neocities.org

- https://github.com/ipfs/ipfs

remx

9 वर्ष पहलेdiscuss

Certain Linux live CDs usually have a read only filesystem and are useful for tasks where you don't want to leave a trace, and everything is flushed from RAM after use. Ubuntu, for example, allows a user to try out the O.S without installing and is a great way to 'trash the hotel room' and then shutdown leaving no trace of your actions. Any files you create, for example will be wiped, and the kernel is exactly the same when you restart the system cleanly. Just to be safe, I would recommend booting from read-only media like an actual read-only CD so nothing can persist.

remx

9 वर्ष पहलेdiscuss

Greasemonkey[0] is fairly handy for scraping. You can even include remote resources like jQuery if you're targeting specific DOM elements in the page. For storing the data, you can just use LocalStorage (for example if you're paginating)

[0] https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/

remx

9 वर्ष पहलेdiscuss

Thanks for the tip, and I will try this. As I said, .DOCX files work best in their native Win Office environment as I've had problems with them in open source solutions (formatting issues), whitespace injection ruining the layout, etc

remx

9 वर्ष पहलेdiscuss

To mitigate, I am running Debian as the host and jailing Windows 10 in a Virtual Machine, and have uninstalled SMB1.0 on the machine by going into > Programs and Features > Add or Remove Windows Components. I have also blocked port 445 (SMB) with ufw (On Debian)

    sudo ufw deny out to any port 445

Aswell as this I am not deferring updates in any way and dutifully patching. I've always hardened Windows in this way and I've never had issues with malware, and if I did, the impact would be minimal because I've compartmentalized my files in such a way that even the worst malware would only encrypt some of my files and not all of them.

I store all my critical files in an offline environment (sandbox) so the only files that are going to be encrypted are replaceable (non important) and disposable. For example, I wouldn't cry if my C.V got encrypted because a copy of it exists in about 50 locations either offline and online.

Unfortunately I need Windows because my colleagues like to send Windows-only .DOCX files which work best in MS Word, and I don't have a Google account, so I can't open them in Docs. This is a conscious decision to permaban Google from my life, but Windows is staying.

remx

9 वर्ष पहलेdiscuss

I doubt this could happen on any grand scale in a city. This does sound like the temporary autonomous zones you find in Burning Man, or the sustained exaltation you find at dinner parties and get-togethers. The key word here is sustained, because something always breaks exaltation. Someone makes a rude remark, or the wine goes to everyone's head and they make cynical remarks which dampen the mood of the dinner. Multiply this concept to cities and it's clear you're going to have bad apples ruining it for everyone. The bikes casually parked outside shops will be stolen even if they're freely given out to tourists to explore the city. The bum drinking cheap Olde English liquor will start begging for change.

remx

9 वर्ष पहलेdiscuss

    As long as you know the index into p of your file and its length,
    its a simple task to extract the file using the Bailey–Borwein–Plouffe
    formula Similarly, you can use the formula to initially find the index of your file

    Now, we all know that it can take a while to find a long sequence of digits in p,
    so for practical reasons, we should break the files up into smaller chunks that
    can be more readily found.

    In this implementation, to maximise performance, we consider each individual
    byte of the file separately, and look it up in p.

I'm not entirely convinced my files would be present in those smaller chunks. You would need a copy of π (p) going way past the 5 trillion digit world record. Even then it's not guaranteed the bytes needed would be there.

remx

9 वर्ष पहलेdiscuss

http://thunder.cat

http://trashbat.co.ck

https://xn--vi8hl0c.ws/ (.ws)

http://www.xn--vi8hiv.ws/ (.ws)

http://xn--n3h.com (.com)

remx

9 वर्ष पहलेdiscuss

I enjoy applying the I Ching[0] to decision making. It's like a coin toss, but on steroids

[0] https://www.goodreads.com/book/show/534289.The_I_Ching_or_Bo...

[#] https://en.wikipedia.org/wiki/I_Ching

remx

9 वर्ष पहलेdiscuss

There's a big discussion about PGP here and why so many fail to use it: https://news.ycombinator.com/item?id=13114538

Some of the comments are worth reading if not for the sheer size of the discussion. It could take an afternoon or two to fully digest that thread.

The comments are in response to this: https://blog.filippo.io/giving-up-on-long-term-pgp/

remx

9 वर्ष पहलेdiscuss

I remember this from a while back:

https://news.ycombinator.com/item?id=12158174

&&

https://techcrunch.com/2016/07/25/security-as-a-service-star...

I have no experience with the Stackpath CDN itself, but I can only guess it's exactly like MaxCDN, which are apparently the cheapest and fastest. All these CDNs are more or less the same in terms of speed and availability though. Since it's such a competitive space, I don't really mind what CDN I use, as long as it's cheap compared to others and it has a decent amount of PoPs (Point of presence) scattered around the globe.

Submissions

Netizens in Kashmir Turn to VPN, Render Internet Ban Ineffective

SSHuttle: Transparent proxy server that works as a poor man's VPN

Which VPN Services Keep You Anonymous in 2017?

15 Blockchain and Bitcoin-Focused Startup Incubators

Libecc – Library for elliptic curves cryptography

Wanna Cry some more? Ransomware roundup special edition

AES Encryption with HMAC Integrity in Java

NSA Brute-Force Keysearch Machine

Job Application for Crypto Engineering Working Student (Werkstudent) at Mozilla

Virginia Tech made lightweight exosuit for heavy lifting

Sharing public keys between iOS and the rest of the world

SSH-MITM – SSH man-in-the-middle tool

Tor Browser 7.0a4 is released

Wyden Pushes for Stronger Security in Collection of Personal Information

How to Setup OpenVPN on Synology NAS

Ethtrade – Invest in Ethereum

Crypto Wars 2.0: The European Front (Event)

Wikileaks publishes documents showing how Google helped Al-Qaeda in Syria

Stealing Windows Credentials Using Google Chrome

More Than Half the Population of Nepal Uses Internet

comments