noinsight

> don't connect it to WiFi or Ethernet

This is not sufficient (for some of these devices) - they will automatically connect to an unsecured hotspot.

The drives to read them (Blu-rays) will be the problem. Pioneer stopped manufacturing them in 2024, only LG drives are available now.

Coincidentally I just bought one, they’ve doubled in price now recently.

Also bought some M-Discs to try. They’re half the price in Japan (Amazon) compared to Germany.

It’s funny… In Finland they went with hightrust.id (Indonesia) too.

Like the fabulous Windows UAC dialog. Perhaps the worst dialog in history.

If you’re at all serious about security and not user convenience, you deploy BitLocker with a PIN instead of TPM only. And then a whole class of vulnerabilities goes away.

> Put the phone in their pocket and it felt a press and went into edit mode and edited the lock screen.

This is why I hate the flashlight and camera buttons on the lock screen - which you can activate without unlocking. When you have your hands in your pockets during cold weather you’ll suddenly be ”filming”… I never use the camera on my phone anyway. Thankfully at some point they added support for removing them.

> Kate

So install Kate? There's a Windows build.

It is preinstalled. Server 2025 (even Core Edition) and Windows 11 24H2 (or 25H2, not sure)...

> EDIT.COM becoming the new Notepad.

edit.exe[1,2] actually. And it runs on Linux too! Linux had a real lack of good text editors.

[1] https://github.com/microsoft/edit

[2] https://learn.microsoft.com/en-us/windows/edit/

> bypasses the TPM check

The caveat with this is that it will fail the check on subsequent version upgrades too and will refuse to upgrade.

Non-Enterprise editions are only supported for 2 years so your 25H2 (or whatever it is) installation will go sour in 2027.

This was probably added by/for Tuxera to increase Tuxera Fusion SMB performance.

Windows is not limited to accessing partitions through drive letters either, it's just the existing convention.

You can mount partitions under directories just like you can in Linux/Unix.

PowerShell has Add-PartitionAccessPath for this:

> mkdir C:\Disk

> Add-PartitionAccessPath -DiskNumber 1 -PartitionNumber 2 -AccessPath "C:\Disk"

> ls C:\Disk

It will persist through reboots too.

> We are also entering the age of "hey AI, take this repo, reimplement the same functionality".

Wouldn't you do this just against the/an API documentation? Interesting thought.

You can just use Unbound for DNS.

Bamboo isn’t even wood, it’s grass.

RIP Beefy Miracle...

https://beefymiracle.org/

Amazon/AWS Registrar. They're a reseller for Gandi, but of course everything is managed through AWS and the pricing is at-cost instead of the rip-off that Gandi is now.

Orchestrate the renewal with Ansible - renew on the "master" server remotely but pull the new key material to your orchestrator and then push them to your server fleet. That's what I do. It's not "clean" or "ideal" to my tastes, but it works.

It also occurred to me that there's nothing(?) preventing you from concurrently having n valid certificates for a particular hostname, so you could just enroll distinct certificates for each host. Provided the validation could be handled somehow.

The other option would maybe be doing DNS-based validation from a single orchestrator and then pushing that result onto the entire fleet.

> allow better network management

Yeah, this would definitely block that.

DNS-based (hostname) allowlisting is just starting to hit the market (see: Microsoft's "Zero Trust DNS" [1]) and this would kill that. Even traditional proxy-based access control is neutered by this and the nice thing about that is that it can be done without TLS interception.

If you're left with only path-based rules you're back to TLS interception if you want to control network access.

[1] https://techcommunity.microsoft.com/blog/networkingblog/anno...

> non US citizens whose data is stored in the US

They don't even care where it's stored...

See: CLOUD Act [1]

[1] https://en.wikipedia.org/wiki/CLOUD_Act

How do you make the Win7 binary run? Last I tried it doesn’t run if you just have the .exe?

No, you are right. On Linux you can look at AUID. To be fair, I have no idea about others than Linux.

> Unix was very much made for multi user environments. ... The biggest security concern was making sure that everyone who was logged in was billed correctly.

I don't know about that... It doesn't even support multiple administrators. And you can't even distinguish between actions performed by the system itself and the administrative user.

Yes I know about sudo.

What do you need to do and what do the (even audit) logs say about who performed an activity whenever administrative activity happens?

Finland did cross the old borders in parts, but we specifically didn’t participate in the Siege of Leningrad and refused all German demands for assistance.

Yeah, but what isn't ever(?) mentioned is, "other" ECC keys are (should be) impacted by this too, not just FIDO2, i.e. ECC smart card certificates if you're using those.

> UAC in practice

UAC is not a security boundary by design.

> It’s important to be aware that UAC elevations are conveniences and not security boundaries …

- Mark Russinovich, Microsoft Corporation [1]

[1] https://web.archive.org/web/20080101143433/http://www.micros...

Fix: JoinsNamespaceOf=

Windows hiding file name extensions by default - the gift that keeps on giving. This wouldn't work (as easily) without that.

You can already sandbox services very effectively when you run them under systemd.

It’s really nice to be able to harden things solely through systemd.

> But almost no one needs to write a policy.

But that's exactly what I would like to do! I've never seen a real guide for how to set up a policy for a custom daemon I wrote myself. Or when a specific software doesn't come with a policy.