kokx

The article literally talks about how one of the server implementations does exactly that:

Does this affect Prosody?

Not directly. Let’s Encrypt is not the first CA to issue server-only certificates. Many years ago, we incorporated changes into Prosody which allow server-only certificates to be used for server-to-server connections, regardless of which server started the connection. [...]

I wouldn't be surprised if this happened without JD Vance's knowledge. This sounds like a thing that Secret Service would make happen to make sure they can secure him at all times.

Our politics does have some good parts. The political system we have is reasonably good. We have many political parties due to the proportional representation system. A single party is also unlikely to get a majority in parliament on their own, so parties with different backgrounds will have to work together to form a functioning government.

We do suffer from many political parties not willing to cause short term pain to improve long term outcomes. There are a few urgent issues going on in politics at the moment. Stuff where a decision needs to be made now and action should be taken. But the political parties do not want to make those decisions because they would inflict short term pain to some voters but would also improve the long term quality of life and economics of the Netherlands.

The worst part is that those issues have been known for a long time, but decisions were postponed over and over again because politicians didn't want to make the decision. Making the issues worse and more urgent over time.

At the same time populism is clearly on the rise in the Netherlands. A famous thing happening in a debate before the previous elections was a populist saying "But this woman cannot wait for the costs to be decreased, she needs it now." about decreasing a specific part of healthcare costs for citizens. Of course when the same populist became the biggest party during the elections, they never introduced anything to decrease that part of the healthcare costs.

This depth you are never going to get in a college education anyway. Especially not since programming isn't (and shouldn't be) the only thing you learn in a Software Engineering / Computer Science bachelor.

The type of work the people working at an APT do, is mainly office work, while it still is very much "hands-on-keyboard" work (so you cannot set an action to automatically occur when nobody is checking the results in the middle of the night). You might want to try shuffling this up when you are in charge, but your (usually highly skilled and expensive) employees probably don't want to be working weird shifts all the time. Especially when they have families.

It also may not be worth it. Generally APT's want to stay under the radar while they are executing. But after the goals have been reached, most of the time it doesn't matter much if they get attributed. We have yet to see real consequences against any APT's. So paying your employees more to work night shifts, likely doesn't stack up against the consequences of attribution.

The biggest piece of advice I have is to not give up too easily. The writeup makes things seem a lot easier than they actually are. While working on this project I had many moments where I almost gave up. Pushing past such roadblocks can get you to great insights.

For learning how to do such things? Well, a general computer science or electrical engineering background is a great start already. Ideally you learn a bit about embedded systems and how electricity works on circuit boards. A great resource for this is Big Clive on Youtube [1] who reverse engineers many circuits on his channel.

Tinkering around with hardware at a lower level will also reward you with a lot of knowledge. For example just working with an ESP32 and some off-the-shelf sensors will help you get a feeling for how these things work. See if you can communicate with other systems as well this way. Try to do as much as possible using jumper wires and breadboards rather than premade cables, so you get to know how it works. Also get a multimeter (one that beeps) and get comfortable using it. If you're unsure which multimeter to get, Big Clive has a pretty good video about that.

One thing I recommend getting is a logic analyzer. You don't need to go for an expensive Saleae (you can find pretty cheap clones on your regular Chinese webshops for example). Then just use it to investigate things that you already have access to. Attach it to a UART port where you know data is sent over and see if you can obtain that using the logic analyzer.

Then you can probably step over to investigating things you don't know. Just figure out with a multimeter what the voltages are and see if maybe data is sent over the line.

[1] https://www.youtube.com/@bigclivedotcom

With a little trickery with URL's you could construct something like:

https://github.com/example/project/releases/@example-project...

Due to everything in a URL before the @ being interpreted as a username for basic authentication, this would result in the user navigating to https://example-project-v1.zip instead of to github.

Edit: Fortunately it seems like browsers have caught on to this trick

Usually that CFO doesn't have admin privileges. However, the exe he ran could very easily make use of a privilege escalation exploit on a service that does run with admin privileges. An exploit that is a buffer overflow or otherwise an exploit that is possible due to memory safety issues.

Or that exe tries to connect to other services in the network to exploit a buffer overflow on another system. An example of such an exploit was EternalBlue.

So yes, you're probably right that from a purely external perspective, attackers are unlikely to gain initial access using exploits targeting memory safety. However, once they are in, there are all sorts of memory safety bugs that could be used.

As a pentester that did exactly this in many corporate networks: this is extremely effective. Just announce with a router advertisement that there is a DHCPv6 server and start handing out link-local IPv6 addresses while you specify your own system as DNS-server.

Clients (both Windows and Linux) will prefer the DNS-server specified through IPv6 over the one from IPv4. Then you can spoof any DNS record and capture juicy NTLM hashes flying through the network or relay their authentication and get a free authenticated connection.

This is most effective in networks that were designed for only IPv4 and didn't consider IPv6 at all. But it is also effective in some networks that do use IPv6.

Mitigations? Either disable the IPv6-stack on all systems, or configure your switches to block the router advertisements and do not allow DHCPv6 traffic to the wrong systems.

FWIW, I'm typing this on my framework right now, and I'm in Europe (Netherlands). So it is available in parts of Europe. Don't remember them promising delivery in all of Europe though?

I'm from the Netherlands as well, and I'm very scared of the talks of permanent DST over here. Which means that the sun would rise at 9:45 if we permanently switch to DST. Our country would be better suited at UTC, instead of UTC+1. Keeping it permanently at UTC+2 would be a special form of hell for me.

As a pentester at a security company doing assessments for customers, I can say that this is definitely false.

We value our independence highly. It is what ultimately brings in business. It would be very bad business if one our customers gets hacked, when it was an easy vulnerability for us to find.

This is the same for the NCC group here. If in a few weeks the WhatsApp e2e encryption on backups was cracked, they would look like fools. And that is not good for business.

I have literally done this once with a friend of mine, transfer a file over netcat. It cost us about 10 minutes of figuring out the exact commands, and we were at the same LAN party, and thus had a direct network path to each others systems. With most consumer routers and their NAT this would be much more complicated. And this was with a friend with high unix knowledge, so not just the "I know how to paste commands from askubuntu" knowledge.

So yeah, just being able to copy curl commands from a website certainly has value over configuring complicated commands.

It doesn't expose a Google Cast device. It only allows streaming media from a Jellyfin instance to that device.

Part of his (reported) reasoning is really strange: because Bitcoin is doomed to crash, we have to take action, so the Netherlands should ban it. Causing it to crash earlier rather than later.

He also says that he isn't afraid that banning Bitcoin will fail, because a ban would lead to a crash.

Bicycles replace both walking and driving trips. In Dutch cities, most people walk or cycle to the grocery store, which is a great example of cycling replacing walking trips.

In smaller villages however, that are more spread out and usually only have one or two grocery stores, people usually take the car or their bike to the grocery store, because walking is too far. In this case, bikes do replace trips by car.

Also note that in general, Dutch cities are quite walkable and cycleable. If I visit a friend on the other side of the city I live in, I go by bike. Which is about as fast as going by car. Going by public transport also takes about the same time. This is a result of the Downs-Thomson paradox [1].

[1] https://en.wikipedia.org/wiki/Downs%E2%80%93Thomson_paradox

It is a great argument that non-immunocompromised people should get vaccinated. If non-immunocompromised people are vaccinated, the probability that immunocompromised people get infected gets smaller, thus causing less variants.

Within the EU, flights rarely get overbooked. Especially on cheap flights like with Ryanair, the reimbursement that the airline has to provide in case of overbooking can easily be more than 10x the ticket value.

Because a user could simply provide the cookie again on the next request. If you still see the JWT as valid even though you deleted the cookie, the user could stay logged in during that time.

Cookies are managed by the browser, hence they are ultimately controlled by the user.

I don't think we should count on the rich to not try to find loopholes anyway while keeping their taxes low. I'm pretty sure they would do so whether their taxes are low or not.

Trying to stay on their good side hoping they will "do the right thing and pay more taxes", won't really make that much of a difference.

What you do during pentesting is against the law, if you do not discuss this with your client. You're trying to gain access to a computer system that you should have no access to. The only reason this is OK, is that you have prior permission from the client to try these methods. Thus, it is important to discuss the methods used when you are executing a pentest.

With every pentesting engagement I've had, there always were rules of engagement, and what kind of things you are and are not allowed to do. They even depend on what kind of test you are doing. (for example: if you're testing bank software, it matters a lot if you test against their production environment or their testing environment)

In countries where assault rifles are banned, these things generally still are possible. With strict rules, for example you're only allowed to have your rifle and ammo at a shooting range, and psychological review of everyone involved.

Besides all that, it very much is a hobby for people. Much less a need than encryption, which is required to keep simple things like ordering something online secure.

The source you mention does not explicitly give a one in 30.000 figure, and it is not something that can be safely concluded from the data in the paper. The authors state that at the time 132,686 people had received their first AZ shot in Norway, of which five had developed thrombosis.

This is definitely not enough data to conclude a 1 in 30,000 figure. And neither does the cited paper conclude this.

On the other hand, these comments are only met with responses indicating that the source for that is an old whitepaper without any more information. While the person replying is the MobileCoin CEO. So they at least try to embellish the current situation in some way. Which doesn't tell me much good.

I'm not sure if they strictly need to be warned. Every ship of such size runs lots of radars already. They probably noticed the ship slowing down already, and adjusted their own speed.

I'm very aware of microG. They have done some amazing work. But unfortunately apps like banking apps require that you pass Google's SafetyNet. Which (understandably) is a lot more complicated to support in microG.

Which are both Android ROMs/distributions. Still requiring Google Play Services to do any of the things I want Android for. And they definitely do not have the same kind of hackability that full on Linux phones have.

LineageOS is what I'm currently using on my daily driver, as a compromise. I would very much prefer a Linux phone, but in the current state it can't even fulfill half my needs in a smartphone.

Yes, Anbox exists, and has done some amazing things. But can this run apps that require Google Play Services, such as WhatsApp, most banking apps, and governmental apps?

It is very unfortunate that so much of the Android ecosystem relies on a very proprietary and cloud-connected piece of software. Without it, most apps simply refuse to work. MicroG has done amazing things here, but unfortunately a lot of things still break when using it, to no fault of the MicroG developers.

Yes I want a Linux phone. But I also want one that has similar app support to Android and iOS.

The problem is not with the Linux phones that are out there, it is that no apps are and likely never will be compatible with (non-Android) Linux phones. Until that is solved, most people (like me) could not switch out their phone for a Linux phone as a daily driver, however much they would like.

Having Linux as an alternative for Windows is a lot easier than having Linux as an alternative for Android/iOS. A lot of the Windows applications we use can be replaced by opensource applications on Linux. And browser based applications already work on both.

However, apps on Android/iOS are mostly tied to cloud services. Unfortunately services that most people need in this age. Messaging systems like WhatsApp and Signal are usually tied to your phone, and going without them would result in social isolation for a lot of people. But also for banking and sometimes government services, you likely need to use their apps. And there will never be opensource alternatives for such apps.

Thanks Mozilla. This literally just directed me to this feature. Turned it on and actually feels quite good. Now I'll have to get back to make sure I don't get too used it before its taken away again.