[-] drwho@beehaw.org 74 points 10 months ago

Outfits that haven't installed patches since February are getting popped in May by a vuln that was published in January.

[-] drwho@beehaw.org 33 points 10 months ago

Unable to decrypt message

Unable to decrypt message

Unable to decrypt message

Unable to decrypt message

Unable to decrypt message

Unable to decrypt message

...

[-] drwho@beehaw.org 36 points 11 months ago

For non-profits (like 501(c)(3)'s) that's not unusual. Non-profits are more like specialized tools for the board of directors than like companies.

Source: First ten years of my career were at non-profits.

[-] drwho@beehaw.org 31 points 1 year ago

Destination port 123/udp isn't Tor. That's NTP.

[-] drwho@beehaw.org 30 points 1 year ago

Wow. That's certainly a creative take on things.

[-] drwho@beehaw.org 40 points 2 years ago

Oh, for fuck's sake... no. It isn't. And I find myself pondering whether or not the article's authors are themselves sapient.

[-] drwho@beehaw.org 77 points 2 years ago

You might want to reconsider patronizing Sticker Mule, especially if you're family.

[-] drwho@beehaw.org 59 points 2 years ago

Publishing everything on a blockchain means that everybody who's running a node has access to a copy. If confidentiality of communications is an issue, this may as well be a data breach with a few more steps. Also, how does giving everybody running a part of or monitoring the blockchain equate with "control over personal data?"

Centralized control: Only one entity can see it. Blockchain: Lots of third parties run a node, so every node can see it.

Each channel has a separate ledger: That makes surveillance of a particular communications channel much easier. Thanks. Also, each user has to have a keypair; great for pseudnonymity, lousy for repudiability.

Messages cannot be altered but they can be audited to prove their metadata. Did they learn nothing from the Obama administration? At this point in the paper I can't shake the feeling that this is a deliberate effort to invert all of the properties of privacy.

Smart contract: Yay, more deliberately memory unsafe programming. I guess they never played with Core Wars as kids, either.

An attacker would be unable to breach the network: An attacker would just have to stand up a node. If channels are side ledgers on a blockchain, and the network assumes that nodes can come and go (which they all do, as far back as bitcoind), any node can join, say "Hey, I'd like to join this channel," and get at the very least a pointer to the side ledger for that channel.

Long-term storage of communications is dangerous, mm'kay?

[-] drwho@beehaw.org 30 points 2 years ago

It's Apple.

What's the catch?

[-] drwho@beehaw.org 31 points 2 years ago

Oracle doesn't have customers, it has hostages.

[-] drwho@beehaw.org 32 points 2 years ago

More and more, companies are giving their sysadmins and coders Macbooks rather than Wintel laptops. It's been an upward trend in last eight or nine years. I've always thought it was to head 'em off at the pass so they won't install un-remotely managed and un-monitored Linux distros on company equipment. At any rate, a lot of proprietary stuff winds up on corporate Macbooks, which means targets worth going after. As for availability of exploits for OSX, folks have been hoarding them for this kind of situation. These days, you wait for an optimum target environment before you unleash your 0-days.

[-] drwho@beehaw.org 57 points 2 years ago

I'm going on professional year 24 of clients requiring that IPv6 be deactivated on every device in their network. Whee.

view more: next ›

drwho

joined 2 years ago