Gregory's ServerStarting a music streaming service that only implements SSL with 40-bit RC4 because it sounds warmer than modern TLS
|
12 posts total
"Linux would have prevented this!" literally true because my former colleague KP Singh wrote a kernel security module that lets EDR implementations load ebpf into the kernel to monitor and act on security hooks and Crowdstrike now uses that rather than requiring its own kernel module that would otherwise absolutely have allowed this to happen, so everyone please say thank you to him
Show previous comments
@mjg59 I find these recent takes by the Linux โMaster Raceโ / Community extremely toxic and damaging to the community. Open Source Software is not the answer and has shared itโs own number of recent controversies (ie XC, OpenSSL) but these seem to be forgotten about pretty quickly - just because itโs open doesnโt mean itโs secure. As a software developer and user of MacOS, Windows 11 and Debian 12, I find all 3 OSโs have their place, purpose and reason to co-exist The "Recall can't record DRMed video content" thing is because DRMed video content is entirely invisible to the OS. The OS passes the encrypted content to your GPU and tells it where to draw it, and the GPU decrypts it and displays it there. It's not a policy decision on the Recall side, it's just how computers work.
Show previous comments
  @mjg59 Interesting. So 'recall' still does the screen capture but the parts that are DRM'd just aren't visible?  @mjg59 It is a hardware design decision that tells you where their priorities lie and who they are willing to protect. Twitter just doing a "redirect links in tweets that go to x.com to twitter.com instead but accidentally do so for all domains that end x.com like eg spacex.com going to spacetwitter.com" is not absolutely the funniest thing I could imagine but it's high up there
Show previous comments
 sed -i s/elon/dipstick/Ig "Donald Trump's election deniers boosted by dispstick Musk" ๐ฏ "Donald Trump has been charged with multiple fdipstickies."๐ค  Since this change was designed with the use of only one brain cell it must have been made by that cat.  nation state actor maintenance of an open source project may introduce a lot of backdoors, but it also helps a lot of PRs get merged, so, it;s impossible to say if its bad or not,
Show previous comments
@mjg59@nondeterministic.computer itโs like encryption backdoors, only the good nation states are allowed to add or use them. Itโs fine. Forging digital artifacts is difficult - there's a huge number of moving parts and they keep changing and it all leaves traces. So here's a description of discrepancies between claims around evidence submitted in a court of law and the data hidden in that evidence: https://mjg59.dreamwidth.org/69507.html
Show previous comments
 @mjg59 I feel like faking that database would have required a VM or real hardware of correct vintage, a fitting OS, being isolated from the outside world, setting the date in BIOS setup before installing the OS, and then carefully, over several reboots while warping time again in setup, making those DB entries. And then the email problem would still have existed. I think the trickiest part there was the Gmail format change. Not insurmountable, but you'd need to be aware of the problem first.  If I had been Satoshi, the *real* Satoshi, I would have checked in my public PGP key with the source code. Then I could prove authorship if the need ever arose. https://mm.icann.org/pipermail/tz/2023-December/033317.html really feels like Old Internet (read the entire thread, it's amazing)
Show previous comments
 @mjg59 I need a dramatic reading of this whole thread on YouTube   @mjg59 that was so fun, thanks for sharing. Had the perfect background music playing to accompany that exchange too. PLEASE check your kids' Halloween candy. Just found an Okta admin access token in a Snickers bar.
Show previous comments
 I remember the one year I looked in the bag and there was Marcellus Wallaceโs soul. I remember it came from this weird house - Gump or Gimp, something like that on the address. And they were like weird and kept saying โLife is like a box of chocolates you never know what youโre gonna get.โ Then they chortled endlessly and one of them fired up an electric hand saw. How I skipped 10 releases of Fedora in one go - https://mjg59.dreamwidth.org/67126.html
Show previous comments
 This reminds me time when I upgraded from Ubuntu to Debian. On remote server. https://marcin.juszkiewicz.com.pl/2019/01/29/upgraded-system-on-my-server/ I am once again encouraging people to reject the idea that terms of service should have any legal significance whatsoever How the fuck do you apply terms of service to a service that allows people on other servers to read the data without agreeing to the ToS If you installed a Linux system with disk encryption more than a couple of years ago, there's a decent chance it's using a weak key derivation function and someone who cares enough would be in a position to brute-force it. https://mjg59.dreamwidth.org/66429.html has more details and instructions on how to update to a better KDF.
Show previous comments
Upgraded mine last year and also deleted an extra unused keyslot. I was kinda worried that I'd bork the system, so I went through all the issues re luks2 first ๐ but in the end it was pretty painless.  @mjg59 Yeah this partition right here has seen most of the Ubuntu LTSes of last decade.
Bard kept telling me that it understood it was better to say nothing than say something untrue, then gave me code samples that incorporated library functions it had already admitted didn't exist. It's now finally admitted to me "I am not able to write code" |
@mjg59 i tried out my buddy's airpods the other day
"nah, too cold"
@mjg59 make sure to use constant time primitives in your cryptography implementation, because it reduces audio jitter.
@mjg59 cc Andrew Robinson