hnlmorg

A request from authority isn’t a counter argument. And it doesn’t mean your opinions about this attack were correct.

Congratulations on knowing what a bastion server is though. But that’s extremely common knowledge and doesn’t prove your point either.

Perhaps you can share how a layer 7 inspection tool might mitigate a layer 4 attack an actual networking terms?

That would only work if OpenBSD is terminating that connection.

Firewalls do not operate at layer 7 nor do TLS termination.

What you’re thinking of is load balancers. Most of them will do TLS termination. But there’s also plenty of load balancing solutions out there that will forward the raw TCP traffic (AWS NLB, DNS based solutions, and so forth).

But it’s also worth noting that this vulnerability doesn’t explicitly need MPTCP. Just the POC exploit uses that.

> MPTCP port blocked

MPTCP doesn’t use any specific ports. It’s an OSI layer higher than that. It’s part of the TCP protocol itself. So if your firewall routes TCP traffic of a specific port (eg HTTP) already then it’ll route MPTCP along with it too.

I’ve taken entire systems offline because of unexpected command expansion.

My “favourite” was “admin”, which was used as the login user, was also short form for “administer-all-port-shutdown” (or words to that effect; it was a long time ago). So if you were distracted when logging in, you could easily soft-lock the entire device meaning you’d have to then run into the DC, find the hardware, and physically power cycle it.

Absolute madness.

I’ve used Cisco for decades too. And the competition caught up with Cisco a long time ago. These days Cisco is trading on their brand (and even there, it’s often not enough).

The last large scale networking project I did was more than 10 years ago and we went with HP.

Personally I don’t want direct console access. I want a modern DevOps pipeline with version controlled config. I’ve got too many battle scares from accidental typos in IOS. I have no intention or reliving that error prone way of network management again.

That’s a very uncharitable reading of my comment when I literally said it was canon.

The “exaggerated” bit is clearly meant to highlight that Lower Decks is written to be a comedy first. So certain parts of canon are amped up for comedic effect.

The rest of your post seemed to imply that I was unimpressed with Lower Decks, and Star Trek in general, when it has comedy episodes. Nothing about my comment suggested that. I actually think Lower Decks (post season 1) was the strongest spin off in new Trek. And I even loved the SNW / LD crossover episode too.

The Pakleds weren’t as dumb as they pretended.

Yeah Lower Decks played on their stupidity. But everything about Lower Decks was an exaggerated form of cannon.

But the actual behaviour of the Pakleds was to mislead people into thinking they were harmless through playing on their own stupidity.

Now I’m not saying they were a smart race comparable to (for example) the Romulans. But they weren’t as stupid as they portrayed themselves.

There’s two when that happens.

One where the season 2 doctor replaced Crusher (because apparently the producers didn’t like Gates McFadden even though the cast and viewers did) performed the operation.

And another where Q sent Picard back in time (kind of) to undo the incident that lead to his heart getting stabbed.

The latter episode hasn’t aged well because of one unnecessary romantic/sex scene. Which is a pity because it’s an otherwise fantastic episode.

But then the TOS has its fair share of cringeworthy moments for modern audiences that made total sense in the era it was aired.

So was Oracle and Microsoft Windows.

If history has taught us anything. It’s that the measure of a successful product is usually more to do with its sales people.

Ahh. Well character encoding is the easy part. It’s the ANSI escape parsing that’s problematic. You can think of it like HTML (in the sense that it’s inlined markup with the content) but with much weirder syntax, a tonne of edge cases, and even less consistency with comparability between client.

I honestly hate escape sequences. I even experimented with building entirely new control plains for the term I’d written. But then who’s going to use it if you don’t also support escape sequences. And so you’re back to original problem again.

The one good thing about these escape sequences was that they only controlled the display. Almost everything that controlled the window behaviour (bar the window title) had dropped out of favour. But things like OSC8 reintroduce behavioural changes that can surprise unexpected users and opens the terminal to whole new forms of abuse by misbehaving input.

If you think back to the HTML analogy; how many times have we seen exploits abuse mouse click events? And these browsers have several orders of magnitude more funding in development and security testing. So what hope do we have that hobby project terminals will even come close to the same level of security despite being used to manage arguably more sensitive systems?

> If you are struggling a lot with that, perhaps you are overthinking it or trying to shoehorn in too much detail?

The opposite problem to be honest. I maintain pretty complex projects so lean towards leaving most stuff out and linking to documentation outside the readme. But I frequently get accused of underselling the project.

But you’re right that I might be over thinking things.

> When you say something is minimal, you are implying that what little you provide will also work.

No you do not. You just saying it’s got very little code and/or very few features.

Support for older browsers might not be one of those features. Which means this minimal frameworks isn’t suited for the kind of projects where that kind of compatibility is a concern.

If you look outside of CSS (and particularly web development as a whole) you’ll find a plethora of minimal frameworks that intentionally make compatibility trade offs.

> Which in this case is clearly [does not work].

That’s a gross exaggeration and you know it.

> So such frameworks utterly failing on such browsers is hilarious, given that they market themselves as minimal.

Minimal is an entirely different property to backwards compatibility.

Seems pretty average to me. What is it you specifically like?

(Curious as someone who struggles to write readmes)

My issue with the last season was that it was all gimmick and no substance. Literally the whole series was made up of filler episodes.

It’s such lazy writing.

I actually didn’t mind Academy. Yeah it was flawed and had a lot of lazy tropes. But it had an identity to it and some substance to it. Not much substance, but still something. Whereas the latest season of Strange New Worlds? It wasn’t anything. It had no substance. It had no identity. It was as if someone made a silly clip show (like the Stargate 200th episode) but instead of lots of short parodies in one filler episode, they made an entire series with each episode being one very long joke. A singular punch line stretched out over nearly an hour.

I hated the first season of Discovery. But that was still better than the season 5 of SNW. I hates the first season of Enterprise. And that was also better than S5 for SNW. And I wasn’t much keen on the first season of Lower Decks either. And even that was less goofy than S5 of SNW. And what’s worse, all of those spin offs that I said had poor first seasons ended up with excellent 5th seasons. And yet SNW started of strong and fizzled out it shallow jokes.

It honestly feels like the writers had nothing.

Though in defence to Bashir, without him you wouldn’t have Garak, who is possibly one of the best written characters in all of SciFi.

And some of O'Brien‘s best performances were counterpointing Bashir too.

I think as a solo character, he’s a little shallow. But he works exceptionally well at being an anchor for other characters to play off.

Strange New Worlds started strong. But the last couple of series was so bad for the drama. In fact one episode was a literal soap opera.

For me, that’s the best part of the TOS era.

It’s nice to watch something that highlights the best of humanity in a future setting.

Almost everything else in SciFi is dystopian. But ST is a rarity. And it’s all the more beautiful for it.

Yeah. I’ve heard the writers hated it because they had to work so much harder to create drama.

But as you said, I think it ends up with a higher quality show.

Amusingly, Riker normally has one but there is an episode of DS9 with Rikers “evil twin” (Thomas the transporter accident) and in that he doesn’t have a goatee.

Basically the reverse of mirror universe meme.

He wasn’t Gene Roddenberrys first choice. In fact he had to get talked into casting Patrick Stewart by the other execs.

Roddenberry was after someone younger. There’s even a casting show reel of Stewart wearing a toupee and speaking with a very bad French accent.

Much less, but not none at all. Roddenberry refused to budge on his rule that the crew shouldn’t have grievances with one another. That why even scenes shared earlier still end in a positive outcome.

Whereas Voyager, which was written after Roddenberrys passing, leaned heavily into inter-crew disputes.

It vastly reduces what’s possible via social engineering exploits. And in memory safe languages, reduces the scope of what a parser bug might have access to.

I know you’re trying to disagree with me, but you’re ostensibly raising the same core concerns that I am. :)

I don’t think NetBSD and yourself are using the term in the same context.

By this I mean, a beginner to NetBSD is already a far more competent user than a beginner in many other contexts of OS users.

I’ll take a look at this. But it’s worth noting that NetBSDs goal was to have something small enough that it can be used in a recovery shell.

> In that case you will end up healthier after a Mcdonalds, too.

Depends on specific instance of malnutrition. If it’s lack of calories, then yes you’d be right. But that’s not what most people in the west suffer from.

> I think addition of some E coli or whatnot from screen prints makes a McD meal much worse but sure YMMV.

To be honest it was a flippant remark. I was expecting to get downvoted for elitism. Wasn’t expecting a genuine discussion about hygiene and nutrition.

But fair play, you’ve made some interesting points.

You do if you’re malnourished. ;)

But the point I was making clearly wasn’t about restaurants being healthy. It was about fast food joints being especially unhealthy.

Can’t be any worse than the contents of the food they’re ordering. I mean, nobody goes to McDonalds expecting to leave healthier than when they arrived.

Please do share those million reasons.

So far I can only think of 1: term vulnerabilities due to ANSI escape sequence parser bugs. And that’s exactly the reason I’m suggesting OSC8 should be off by default.