unluckier

The thread that the title comes from is from a Twitter user that later stated about the issue: "And YES: I LOVE hyping the sh1t out of this stuff because apparently sensationalism is the only language that forces these people to fix. "

As such, every single thing about the topic should be taken with a grain of salt. Starting with systems affected (it's not all GNU/Linux) and also CVSS score (I score it as a 6.3 instead of 9.9). Use your imagination to decide how much of what was posted is based on fact as opposed to fantasy.

Disabling the firewall for testing is simple enough. If things work after turning off the firewall, then this is your problem.

It's easily reproducible with a fresh macOS install. Yes, ESET has its own issue. But this is a problem in and of itself. https://imgur.com/a/Nr7Gk6c

See: https://waclaw.blog/macos-firewall-blocking-web-browsing-aft...

If disabling the firewall (for testing) solves this problem, this is likely your issue.

Sequoia also breaks an application's ability to use DNS (or presumably anything UDP-based) if the macOS firewall is enabled, and an app is listed as "Block incoming connections". https://waclaw.blog/macos-firewall-blocking-web-browsing-aft...

So... two of the routers affected by the recent VPNFilter malware? Interesting choice.

No mention of ASLR. Helping to prevent memory corruption bugs apparently isn't on their radar?

If you're on BSD, that'll kill dd.

What version of IE is that dialog from? 6? Things have changed quite a bit since then.

Yes, SSL inspection is a security tradeoff. Whether the folks rolling it out realize this is another story.

Even done in the best way possible, SSL inspection puts end users at increased risk. In the real world, vendors make mistakes, which put them at even higher risk. https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-i...

"It desperately wants to just upgrade whenever it wants."

Do you think that it's better that operating systems get security updates or that they get left alone?

"Copy and paste is still a bit frustrating."

You really are just using SSH in a terminal, and FreeBSD apparently can't get that right? Copy/paste is pretty basic functionality, I'd think.

To each their own...

Or just turn off the web features. It's quite trivial to do so. http://www.howtogeek.com/224344/how-to-disable-spotlights-we...

It's the FreeBSD folks that didn't bother. Not you.

We all know that exploit mitigations aren't perfect. But to not even bother using them... that's just ridiculous. There are plenty of scenarios where ASLR helps prevent exploitation. And the fact that FreeBSD doesn't even have it is pretty damning.

I've heard the opposite. Although it's comparing to OpenBSD in this case, here's a good graphic that shows the exploit mitigations that FreeBSD provides by default: http://networkfilter.blogspot.com/2014/12/security-openbsd-v...

How's FreeBSD doing in the exploit mitigation department? Last I checked, they didn't even have ASLR.

http://networkfilter.blogspot.com/2014/12/security-openbsd-v...

You have to block outbound communication for "Search" in the Windows firewall. Regardless of whatever privacy settings you may have set.

If you have a proven technique for making Windows 10 not phone home, post the details here.

Did you install the CA certificate from whatever software you're using to MITM your machine?

At least for Android: https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w...

There are several banking-related apps listed here.

What do you mean "apps like this" ? The OP is talking about the Windows 10 OS, which uses the OS CA store.

It's pretty simple if the OS you're using allows you to install a trusted root CA certificate.

Is it really necessary to use a host that requires JavaScript to display an image?

Anyway, I've confirmed this. I've disabled web search and all of the other privacy options I've seen with Windows 10 during and after install. As soon as the first character is typed into the Windows 10 search box, the request goes out to www.bing.com. It doesn't say what you searched for (as the request happens before you complete the search), but it does send a lot of info to Microsoft about your platform, including a unique identifier.

He did use a JPEG...

See also: Idiocracy https://www.youtube.com/watch?v=hL1-340ODCM

And why exactly do they do this?

Neither of those links imply that PrivDog is bundled with those apps. It just mentions it as something you can download.

Edit : Just re-read the linked document. Yes, it does indicate that it's an install-time option. However, I've yet to see confirmation that Comodo software comes bundled with the SSL-intercepting version of PrivDog.

Daily short tests and weekly long tests seems reasonable. These drives show that they've gone thousands of hours since the last test.

None of those drives show evidence of regularly-scheduled self tests. They must not really care about them.