kokx

> Introduced 29 July 2024; 2 years ago

That explains why I hadn't heard of this yet. My current incarnation of my internal network dates from ~april 2024.

Then why hasn't there been a gTLD reserved for local use? The only ones that are reserved are .local and .home.arpa. .local is out, since it is entirely for use with mDNS / Bonjour.

That leaves .home.arpa, which is very awkward and only a thing since 2018 (my home network's use of .lan definitely predates this). Especially as a non US citizen. It also seemed so far that .lan was the "unofficial" gTLD to be used, since much software like OpenWRT was already using it anyway.

Either way: making .lan internet routable seems entirely unhinged to me. LAN has always been the acronym for Local Area Network. Why would anyone sane think that it is a good idea to make this into a gTLD that can be internet routable? The only way I see forward to do this justice, is to only allow RFC 1918 and IPv6 addresses that are within the assigned prefix for your router.

This seems like a worse version of allowing .zip to be a gTLD. Remember the idea of downloading something from https://github.com/[...]@evil.zip?

It's not piped to a shell, but to the tar program with specific parameters to directly unpack the tar.

You're still installing the program directly from github of course, instead of a source where hopefully a third party has also looked at it (like a package repository). But this is a lot better than the curl | sh pattern.

The article literally talks about how one of the server implementations does exactly that:

> Does this affect Prosody?

> Not directly. Let’s Encrypt is not the first CA to issue server-only certificates. Many years ago, we incorporated changes into Prosody which allow server-only certificates to be used for server-to-server connections, regardless of which server started the connection. [...]

I wouldn't be surprised if this happened without JD Vance's knowledge. This sounds like a thing that Secret Service would make happen to make sure they can secure him at all times.

Our politics does have some good parts. The political system we have is reasonably good. We have many political parties due to the proportional representation system. A single party is also unlikely to get a majority in parliament on their own, so parties with different backgrounds will have to work together to form a functioning government.

We do suffer from many political parties not willing to cause short term pain to improve long term outcomes. There are a few urgent issues going on in politics at the moment. Stuff where a decision needs to be made now and action should be taken. But the political parties do not want to make those decisions because they would inflict short term pain to some voters but would also improve the long term quality of life and economics of the Netherlands.

The worst part is that those issues have been known for a long time, but decisions were postponed over and over again because politicians didn't want to make the decision. Making the issues worse and more urgent over time.

At the same time populism is clearly on the rise in the Netherlands. A famous thing happening in a debate before the previous elections was a populist saying "But this woman cannot wait for the costs to be decreased, she needs it now." about decreasing a specific part of healthcare costs for citizens. Of course when the same populist became the biggest party during the elections, they never introduced anything to decrease that part of the healthcare costs.

This depth you are never going to get in a college education anyway. Especially not since programming isn't (and shouldn't be) the only thing you learn in a Software Engineering / Computer Science bachelor.

The type of work the people working at an APT do, is mainly office work, while it still is very much "hands-on-keyboard" work (so you cannot set an action to automatically occur when nobody is checking the results in the middle of the night). You might want to try shuffling this up when you are in charge, but your (usually highly skilled and expensive) employees probably don't want to be working weird shifts all the time. Especially when they have families.

It also may not be worth it. Generally APT's want to stay under the radar while they are executing. But after the goals have been reached, most of the time it doesn't matter much if they get attributed. We have yet to see real consequences against any APT's. So paying your employees more to work night shifts, likely doesn't stack up against the consequences of attribution.

The biggest piece of advice I have is to not give up too easily. The writeup makes things seem a lot easier than they actually are. While working on this project I had many moments where I almost gave up. Pushing past such roadblocks can get you to great insights.

For learning how to do such things? Well, a general computer science or electrical engineering background is a great start already. Ideally you learn a bit about embedded systems and how electricity works on circuit boards. A great resource for this is Big Clive on Youtube [1] who reverse engineers many circuits on his channel.

Tinkering around with hardware at a lower level will also reward you with a lot of knowledge. For example just working with an ESP32 and some off-the-shelf sensors will help you get a feeling for how these things work. See if you can communicate with other systems as well this way. Try to do as much as possible using jumper wires and breadboards rather than premade cables, so you get to know how it works. Also get a multimeter (one that beeps) and get comfortable using it. If you're unsure which multimeter to get, Big Clive has a pretty good video about that.

One thing I recommend getting is a logic analyzer. You don't need to go for an expensive Saleae (you can find pretty cheap clones on your regular Chinese webshops for example). Then just use it to investigate things that you already have access to. Attach it to a UART port where you know data is sent over and see if you can obtain that using the logic analyzer.

Then you can probably step over to investigating things you don't know. Just figure out with a multimeter what the voltages are and see if maybe data is sent over the line.

[1]: https://www.youtube.com/@bigclivedotcom

With a little trickery with URL's you could construct something like:

https://github.com/example/project/releases/@example-project...

Due to everything in a URL before the @ being interpreted as a username for basic authentication, this would result in the user navigating to https://example-project-v1.zip instead of to github.

Edit: Fortunately it seems like browsers have caught on to this trick

Usually that CFO doesn't have admin privileges. However, the exe he ran could very easily make use of a privilege escalation exploit on a service that does run with admin privileges. An exploit that is a buffer overflow or otherwise an exploit that is possible due to memory safety issues.

Or that exe tries to connect to other services in the network to exploit a buffer overflow on another system. An example of such an exploit was EternalBlue.

So yes, you're probably right that from a purely external perspective, attackers are unlikely to gain initial access using exploits targeting memory safety. However, once they are in, there are all sorts of memory safety bugs that could be used.

As a pentester that did exactly this in many corporate networks: this is extremely effective. Just announce with a router advertisement that there is a DHCPv6 server and start handing out link-local IPv6 addresses while you specify your own system as DNS-server.

Clients (both Windows and Linux) will prefer the DNS-server specified through IPv6 over the one from IPv4. Then you can spoof any DNS record and capture juicy NTLM hashes flying through the network or relay their authentication and get a free authenticated connection.

This is most effective in networks that were designed for only IPv4 and didn't consider IPv6 at all. But it is also effective in some networks that do use IPv6.

Mitigations? Either disable the IPv6-stack on all systems, or configure your switches to block the router advertisements and do not allow DHCPv6 traffic to the wrong systems.

FWIW, I'm typing this on my framework right now, and I'm in Europe (Netherlands). So it is available in parts of Europe. Don't remember them promising delivery in all of Europe though?

I'm from the Netherlands as well, and I'm very scared of the talks of permanent DST over here. Which means that the sun would rise at 9:45 if we permanently switch to DST. Our country would be better suited at UTC, instead of UTC+1. Keeping it permanently at UTC+2 would be a special form of hell for me.

As a pentester at a security company doing assessments for customers, I can say that this is definitely false.

We value our independence highly. It is what ultimately brings in business. It would be very bad business if one our customers gets hacked, when it was an easy vulnerability for us to find.

This is the same for the NCC group here. If in a few weeks the WhatsApp e2e encryption on backups was cracked, they would look like fools. And that is not good for business.

I have literally done this once with a friend of mine, transfer a file over netcat. It cost us about 10 minutes of figuring out the exact commands, and we were at the same LAN party, and thus had a direct network path to each others systems. With most consumer routers and their NAT this would be much more complicated. And this was with a friend with high unix knowledge, so not just the "I know how to paste commands from askubuntu" knowledge.

So yeah, just being able to copy curl commands from a website certainly has value over configuring complicated commands.

It doesn't expose a Google Cast device. It only allows streaming media from a Jellyfin instance to that device.

Part of his (reported) reasoning is really strange: because Bitcoin is doomed to crash, we have to take action, so the Netherlands should ban it. Causing it to crash earlier rather than later.

He also says that he isn't afraid that banning Bitcoin will fail, because a ban would lead to a crash.

Bicycles replace both walking and driving trips. In Dutch cities, most people walk or cycle to the grocery store, which is a great example of cycling replacing walking trips.

In smaller villages however, that are more spread out and usually only have one or two grocery stores, people usually take the car or their bike to the grocery store, because walking is too far. In this case, bikes do replace trips by car.

Also note that in general, Dutch cities are quite walkable and cycleable. If I visit a friend on the other side of the city I live in, I go by bike. Which is about as fast as going by car. Going by public transport also takes about the same time. This is a result of the Downs-Thomson paradox [1].

[1]: https://en.wikipedia.org/wiki/Downs%E2%80%93Thomson_paradox

It is a great argument that non-immunocompromised people should get vaccinated. If non-immunocompromised people are vaccinated, the probability that immunocompromised people get infected gets smaller, thus causing less variants.

Within the EU, flights rarely get overbooked. Especially on cheap flights like with Ryanair, the reimbursement that the airline has to provide in case of overbooking can easily be more than 10x the ticket value.

Because a user could simply provide the cookie again on the next request. If you still see the JWT as valid even though you deleted the cookie, the user could stay logged in during that time.

Cookies are managed by the browser, hence they are ultimately controlled by the user.

I don't think we should count on the rich to not try to find loopholes anyway while keeping their taxes low. I'm pretty sure they would do so whether their taxes are low or not.

Trying to stay on their good side hoping they will "do the right thing and pay more taxes", won't really make that much of a difference.

What you do during pentesting is against the law, if you do not discuss this with your client. You're trying to gain access to a computer system that you should have no access to. The only reason this is OK, is that you have prior permission from the client to try these methods. Thus, it is important to discuss the methods used when you are executing a pentest.

With every pentesting engagement I've had, there always were rules of engagement, and what kind of things you are and are not allowed to do. They even depend on what kind of test you are doing. (for example: if you're testing bank software, it matters a lot if you test against their production environment or their testing environment)

In countries where assault rifles are banned, these things generally still are possible. With strict rules, for example you're only allowed to have your rifle and ammo at a shooting range, and psychological review of everyone involved.

Besides all that, it very much is a hobby for people. Much less a need than encryption, which is required to keep simple things like ordering something online secure.

The source you mention does not explicitly give a one in 30.000 figure, and it is not something that can be safely concluded from the data in the paper. The authors state that at the time 132,686 people had received their first AZ shot in Norway, of which five had developed thrombosis.

This is definitely not enough data to conclude a 1 in 30,000 figure. And neither does the cited paper conclude this.

On the other hand, these comments are only met with responses indicating that the source for that is an old whitepaper without any more information. While the person replying is the MobileCoin CEO. So they at least try to embellish the current situation in some way. Which doesn't tell me much good.

I'm not sure if they strictly need to be warned. Every ship of such size runs lots of radars already. They probably noticed the ship slowing down already, and adjusted their own speed.

I'm very aware of microG. They have done some amazing work. But unfortunately apps like banking apps require that you pass Google's SafetyNet. Which (understandably) is a lot more complicated to support in microG.