News for hackers. Stuff that matters.

jimsi

jimsi on Hacker News

Ask HN: How do you get security advisories?

Posted by jimsi on Friday April 01, 2022 @05:09AM
from the ask-hn dept.

Recently I was reading logs on production machine and have seen line"pdns-recursor[2169088]: PowerDNS Security Update Mandatory: Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-01.html"I do not have any automatics to get important stuff from my logs, but this is another big question.I have asked myself - is there any way to get security advisories...

( Read More... | 1 comment | 4 points | on HN )
Re:Paaster – Secure by default end to end encrypted pastebin on Friday March 18, 2022 @03:13AM (#30719402)
I think that providing API to be used by standalone clients is far more better approach
Re:Self-Hosting Dozens of Web Applications and Services on a Single Se... on Friday December 31, 2021 @10:18AM (#29748755)
I would recommend to use borgbackup - it is very convenient for security (it provides very flexible encryption options with safe defaults) and efficiency (deduplication)
Re:Ask HN: Are we entering a 0-click era? on Tuesday December 28, 2021 @02:45PM (#29717175)
I can't remember any recent good news about 0click mitigation
Re:LastPass users warned their master passwords are compromised on Tuesday December 28, 2021 @02:35PM (#29717071)
I use KeePassDX on Android and KeePassXC on a laptop, and they are synced with Syncthing. I have no issues with this setup
Re:Show HN: No PortScan on Wednesday November 17, 2021 @11:20AM (#29255031)
This might be a way better solution in terms of performance, but I cannot imagine way to run more complicated stuff rather only blocking IP in the firewall using iptables
Re:Show HN: No PortScan on Wednesday November 17, 2021 @10:48AM (#29254605)
This ratio is only applied if there are more than 1000 SYNs, forgot to mention that in the README (https://git.encryp.ch/g00g1/no-portscan/src/branch/master/cm...)

Ask HN: Complaint from Proton AG – what should I do?

Posted by jimsi on Monday November 01, 2021 @03:02AM
from the ask-hn dept.

Recently my domain register has received following abuse complaint. Honesty, I'm very shocked why they are even caring about 'groundless "facts"' and trying to take down such small amateur blog.What do you guys think regarding this situation?--- Dear Madam or Sir,Our Company, Proton AG, is a provider of secured Internet services, including ProtonMail, and end-to-end encrypted email service.We...

( Read More... | 15 comments | 49 points | on HN )
Re:AS13335 doing SSH scanning on Saturday September 25, 2021 @07:35AM (#28652295)
My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.
Re:AS13335 doing SSH scanning on Saturday September 25, 2021 @07:34AM (#28652290)
How did you discover this? Anyway thanks for additional information
Re:AS13335 doing SSH scanning on Saturday September 25, 2021 @07:32AM (#28652277)
I have asked Cloudflare about this traffic, but support says "Cloudflare helps protect sites, and accelerate them. We do not attack sites, and our network can't be used to generate attack traffic." They deny any malicious outgoing traffic, but after I have provided pcap dump they just ignoring me and do not reply anything. Very odd behaviour for researchers.
Re:AS13335 doing SSH scanning on Saturday September 25, 2021 @07:28AM (#28652259)
I think single SYN packet would be enough to know whether this port open or not, but they trying to gather full banner.
Re:AS13335 doing SSH scanning on Saturday September 25, 2021 @07:27AM (#28652254)
I expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.
Re:AS13335 doing SSH scanning on Saturday September 25, 2021 @07:24AM (#28652235)
Probably yes, but hey! Why do Cloudflare Worker would need SSH connection establishment? I do not asking Cloudflare to block 22/tcp entirely, but all this situation is very odd - I am seeing anomaly, reported abuse to them, but no explanation why this is happening.

About password authentication I totally agreeing with you, but this is a bit out of scope of this thread.

The only purpose of this article is to know the truth what is really happening. I have never seen such many connections to the SSH even from researchers.

Re:AS13335 doing SSH scanning on Saturday September 25, 2021 @07:11AM (#28652160)
Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses
Re:AS13335 doing SSH scanning on Saturday September 25, 2021 @06:55AM (#28652098)
Previously this post was named in such way, but post get flagged... So I removed its mentioning and replaced with ASN
Re:Authenticated Boot and Disk Encryption on Linux on Thursday September 23, 2021 @07:16AM (#28627669)
https://github.com/xmikos/cryptboot/blob/master/README.md
Re:Amazon SES and Postfix's no shared cipher warning on Sunday August 01, 2021 @12:05PM (#28027294)
> In addition to offer encrypted connections, each publicly available SMTP server must accept unencrypted connections according to RFC 2487 as well. So while Amazon SES should definitely support common ciphers, its current configuration shouldn't result in delays and delivery failures if there are no common ciphers between Amazon SES and another SMTP server. They also state that in their configuration:

Amazon tried unencrypted connection only 8 hours after, which is strange behaviour