|
just got better. there's another bug I've been seeing for years where it detects the things in its own quarantine and loops on that so now the sig update loop is feeding the quarantine loop and it stopped responding to pings
|
#
?
Dec 1, 2017 23:09
|
|
|
|
| # ? May 22, 2024 12:31 |
|
|
BangersInMyKnickers posted:the sig update loop is feeding the quarantine loop and it stopped responding to pings perfect security
|
|
#
?
Dec 1, 2017 23:16
|
|
|
BangersInMyKnickers posted:just got better. there's another bug I've been seeing for years where it detects the things in its own quarantine and loops on that so now the sig update loop is feeding the quarantine loop and it stopped responding to pings
|
|
#
?
Dec 1, 2017 23:16
|
|
|
https://www.wired.com/story/macos-update-undoes-apple-root-bug-patch/quote:But now, multiple Mac users have confirmed to WIRED that Apple's fix for that problem has a serious glitch of its own. Those who had not yet upgraded their operating system from the original version of High Sierra, 10.13.0, to the most recent version, 10.13.1, but had downloaded the patch, say the "root" bug reappears when they install the most recent macOS system update. And worse, two of those Mac users say they've also tried re-installing Apple's security patch after that upgrade, only to find that the "root" problem still persists until they reboot their computer, with no warning that a reboot is necessary.
|
|
#
?
Dec 2, 2017 00:35
|
|
|
The ghost of stebe is angry.
|
|
#
?
Dec 2, 2017 00:37
|
|
|
Chris Knight posted:yeah it's good transmission-qt also very good
|
|
#
?
Dec 2, 2017 00:52
|
|
|
This is an automatically generated email, please do not reply. Dear customer, As you are surely aware, the browser makers distrusted StartCom around a year ago and therefore all the end entity certificates newly issued by StartCom are not trusted by default in browsers. The browsers imposed some conditions in order for the certificates to be re-accepted. While StartCom believes that these conditions have been met, it appears there are still certain difficulties forthcoming. Considering this situation, the owners of StartCom have decided to terminate the company as a Certification Authority as mentioned in Startcom´s website. StartCom will stop issuing new certificates starting from January 1st, 2018 and will provide only CRL and OCSP services for two more years. StartCom would like to thank you for your support during this difficult time. StartCom is contacting some other CAs to provide you with the certificates needed. In case you don´t want us to provide you an alternative, please, contact us at certmaster@startcomca.com Please let us know if you need any further assistance with the transition process. We deeply apologize for any inconveniences that this may cause. Best regards, StartCom Certification Authority
|
|
#
?
Dec 2, 2017 22:13
|
|
|
Wiggly Wayne DDS posted:Dear customer, And so dies approximately the only website on the public internet to use client certificates for authentication. Though I think I saw chromium propose removing support for them to reduce attack surface and a bunch of government people freaking out in response a couple years back.
|
|
#
?
Dec 2, 2017 22:18
|
|
|
Yeah I've worked at a number of places that used them for internal sites.
|
|
#
?
Dec 2, 2017 22:37
|
|
|
wait client cert auth is bad? i only used it to authenticate clients with servers that i control (a toy project) what's so bad about client cert auth?
|
|
#
?
Dec 2, 2017 22:40
|
|
|
for web services and the like its very good. for browser based auth it could lead to a user exposing information about themselves if they don't understand it. ex: user visits site, site has ad, ad server asks for client cert auth, user gets client cert prompt, user picks a cert w/ their name on it, now the ad server knows who the user is. The solution is to do like IE has been doing forever w/ windows auth and specify domains/urls where its allowed and deny its use elsewhere.
|
|
#
?
Dec 2, 2017 22:52
|
|
|
Shinku ABOOKEN posted:what's so bad about client cert auth? Eons ago my company used client certs to auth 3rd party companies into our extranet. But since each company often needed to grant multiple people access, they just copied the client cert file around internally like you might share your Netflix password with your close friends. Or they stored the cert files in a location easily accessed by thieves.
|
|
#
?
Dec 2, 2017 22:58
|
|
|
https://blog.chromium.org/2017/11/reducing-chrome-crashes-caused-by-third.html this is probably worth noting on the browser vs. antivirus front
|
|
#
?
Dec 3, 2017 03:22
|
|
|
Diva Cupcake posted:most the linknyc kiosks i walk past in midtown are just used by homeless people to play music. which is cool. They used to have web browsers, but they had to disable that. Homeless people kept watching porn on them and merchants nearby complained to the city about it until they switched the web browser off. The WiFi is crazy fast though. I've gotten like 150-220 mbps down, and 100+ mbps up from those things. Too bad you gotta basically be standing out on the street to use them though.
|
|
#
?
Dec 3, 2017 03:53
|
|
|
minato posted:Client certs are just fancy auth tokens wrapped up in a file, but their user-friendliness has the downside that they're more easily stolen. Not if the key store backing the certificate is a physical module on a smart card. Client certificates are how smart cards are used for website authentication by governments - that is why they freaked out.
|
|
#
?
Dec 3, 2017 04:04
|
|
|
minato posted:Client certs [...] user-friendliness hmm
|
|
#
?
Dec 3, 2017 04:38
|
|
|
just another day in the uk partliament: https://twitter.com/NadineDorries/status/937019367572803590 at least they're just using delegated access with audit trails: https://twitter.com/NadineDorries/status/937034384976302080 oh: https://twitter.com/NadineDorries/status/937043585454796801
|
|
#
?
Dec 3, 2017 11:45
|
|
|
|
|
#
?
Dec 3, 2017 14:29
|
|
|
non repudiation what’s that?
|
|
#
?
Dec 3, 2017 17:09
|
|
|
see, they need a block chain
|
|
#
?
Dec 3, 2017 17:12
|
|
|
But her emails! E: sadly despite being a tory dorris is pro hillary so no good emails! tweets to quote distortion park fucked around with this message at 21:44 on Dec 3, 2017 |
|
#
?
Dec 3, 2017 21:37
|
|
|
Wiggly Wayne DDS posted:just another day in the uk partliament: the ratio on that first tweet lmao
|
|
#
?
Dec 3, 2017 22:25
|
|
|
https://twitter.com/JamesClayton5/status/937395948535320576 Don't worry guys, everyone shares their password with their staff so it's totally fine and not newsworthy right?
|
|
#
?
Dec 3, 2017 22:56
|
|
|
Wiggly Wayne DDS posted:just another day in the uk partliament: green pos
|
|
#
?
Dec 3, 2017 23:26
|
|
|
Wiggly Wayne DDS posted:just another day in the uk partliament:
|
|
#
?
Dec 4, 2017 00:50
|
|
|
breaking news: politicians are as bad with security as their electorate
|
|
#
?
Dec 4, 2017 01:13
|
|
|
fun fact: canadian mp's offices are assigned a /29* on the house of commons network. by design every computer, printer, or device in the office is meant to be directly on the hoc network unsurprisingly, this does not really work *theoretically you can get a larger netblock if you can justify it, however they only seem to want to assign them at the beginning of a term
|
|
#
?
Dec 4, 2017 01:19
|
|
|
Why doesn’t it work? Just because that’s not enough address space? Or am I missing something?
|
|
#
?
Dec 4, 2017 06:59
|
|
|
8 statically assigned addresses for a modern office in an era where everyone expects wifi, mobile device access, etc. adding a nat device is unsupported and afaik not allowed, and in practice is like the first thing that happens e: to clarify, i'm talking about their constituent offices located in their ridings infernal machines fucked around with this message at 09:29 on Dec 4, 2017 |
|
#
?
Dec 4, 2017 07:02
|
|
|
cjs: senior management is really upset that their "genius" concept of account access recovery mechanism is being thrashed to poo poo 
|
|
#
?
Dec 4, 2017 09:27
|
|
|
Wiggly Wayne DDS posted:just another day in the uk partliament: love to admit to crimes on twitter
|
|
#
?
Dec 4, 2017 09:58
|
|
|
you all know that even if nadine dorries doesnt share her password everyone knows its dorries123
|
|
#
?
Dec 4, 2017 10:39
|
|
|
https://www.nytimes.com/2017/12/01/us/politics/nsa-nghia-pho-classified-information-stolen-guilty.html cant copy the text from firefox for some reason, cba to see what'st the fault. basically, ancient nsa superhacker greybeard took confidential info home, got it stolen from home pc by kaspersky antivirus - or so the case alleges
|
|
#
?
Dec 4, 2017 14:39
|
|
|
cinci zoo sniper posted:https://www.nytimes.com/2017/12/01/us/politics/nsa-nghia-pho-classified-information-stolen-guilty.html here: quote:BALTIMORE — A former National Security Agency employee admitted on Friday that he had illegally taken from the agency classified documents believed to have subsequently been stolen from his home computer by hackers working for Russian intelligence. bolded my favorite part 
|
|
#
?
Dec 4, 2017 15:40
|
|
|
infernal machines posted:8 statically assigned addresses for a modern office in an era where everyone expects wifi, mobile device access, etc. just use ipv6 I'm sure their infrastructure is ready for it
|
|
#
?
Dec 4, 2017 15:42
|
|
|
BangersInMyKnickers posted:just use ipv6 I'm sure their infrastructure is ready for it 
|
|
#
?
Dec 4, 2017 17:40
|
|
|
infernal machines posted:8 statically assigned addresses for a modern office in an era where everyone expects wifi, mobile device access, etc. infernal machines posted:
|
|
#
?
Dec 4, 2017 18:40
|
|
|
infernal machines posted:8 statically assigned addresses for a modern office in an era where everyone expects wifi, mobile device access, etc. in the 90s I worked with the team that set up the HoC network bridging, and it apparently hasn't advanced at all since then
|
|
#
?
Dec 4, 2017 19:00
|
|
|
https://twitter.com/msvisio/status/936005217346359296
|
|
#
?
Dec 4, 2017 19:01
|
|
|
|
| # ? May 22, 2024 12:31 |
|
|
Lmao
|
|
#
?
Dec 4, 2017 19:03
|
|