sdeziel

`snap refresh --hold` will hold updates indefinitely

https://snapcraft.io/docs/keeping-snaps-up-to-date#heading--...

Nice article! However some numbers are a bit off:

The IPv4 overhead is normally 20 bytes but can reach 60 bytes with many options. For TCP, it's between 20 and 60 bytes as well.

Just ran a quick tcpdump on Linux and curl's TCP connection uses 32 bytes TCP headers (12 bytes of options).

> AES128 is weird too since 128-bit key ciphers are kind of deprecated unless your target is a fridge magnet.

Why is AES128 preferred over AES256 by browsers then?

https://www.ssllabs.com/ssltest/viewClient.html?name=Chrome&... https://www.ssllabs.com/ssltest/viewClient.html?name=Firefox...

> Why can't I select text on that page?

Enabling "reader mode" in Firefox did the trick.

From the article: "This drops all ICMP packets. ICMP is only used to ping a host to find out if it’s still alive."

Please stop this non-sense, there are too many ICMP blackholes already.

https://caniuse.com itself only supports TLS 1.0. They know about it https://github.com/Fyrd/caniuse/issues/4198

One can always go to about:config and set security.pki.distrust_ca_policy to "2" to distrust Symantec TLS certificates. Reference: https://blog.mozilla.org/security/2018/07/30/update-on-the-d...

1.1.1.1 uses anycast so it's effectively being served by any of Cloudflare's point of presences (152 data centers around the world).

3. Don't let your DB engine execute random executable like wget/dd (Apparmor/SELinux)

4. Don't let your DB host make outbound connections (iptables/ip6tables)

Yeah, I quoted the wrong line.

> * enforcing SSH key authentication

That cannot be enforced by the server because the key decryption occurs client-side. An alternative is to use Two Factor Authentication.

No, you just have to pin the current and future/backup intermediate CAs (X3 and X4) and be done with it.

That's why it's nice of Let's Encrypt to publish their current and backup intermediate CAs (X3 and X4) https://letsencrypt.org/certificates/. That's what I pin for my sites.

Apache httpd also supports some features that are not available with NGINX. (Easy) LDAP authentication is one of those.

LXC (with LXD) or OpenVZ containers are typically shipping full OS in the container. Docker is different in that it typically only have a few processes per containers.

> since hypervisors can share identical pages (e.g. the Linux kernel)

With ASLR, I'm now sure the gains are that substantial.

Unfortunately on Ubuntu, seccomp is opt-in only. Works well when enabled though.

I just wanted to mention that the path to modprobe is something reversible (containers aside) if the sysadmin wants autoloading. /proc/sys/kernel/modprobe is not writable from a container.

Disabling module loading is not reversible, you need to reboot.

No, /proc/sys/kernel/{modules_disabled,modprobe} are not writable from a container. Tested with LXD on Ubuntu 16.04.

root can undo that with echo /sbin/modprobe > /proc/sys/kernel/modprobe at any time so you are better off using:

echo 1 > /proc/sys/kernel/modules_disabled

OpenSSL is in "main" and as such, it is supported by Canonical for the whole lifetime of the LTS. Upstream dropping support doesn't change that, it simply means that Canonical security team will be backporting patches themselves.

https://people.canonical.com/~ubuntu-security/cve/pkg/openss...

Fortunately, Linode supports running custom kernels like those provided by the distro. That's how we run our Linode slices with the stock kernels from Ubuntu.

> the problem for the PC industry is that old PCs are good enough, hence people don't feel the need to upgrade.

Throwing away a working electronic device to replace it with a new one is really bad when you think of the ecological impact. I'm glad that some resist to the urge of buying shiny new stuff.

OSTIF are the ones that audited VeraCrypt

You can get an overview of the various CVEs affecting curl: https://people.canonical.com/~ubuntu-security/cve/pkg/curl.h...