back
user profile
Bender
68,554karma·24,252submissions·June 16, 2015
about
Σ I am not for everyone. To ignore me in uBlock Origin, add to "My filters":
news.ycombinator.com##tr.athing.comtr:has(a.hnuser):has-text(/\bBender\b/)
- For HN usage questions see [1] for HN tips not my repo
- Suggested Firefox add-on to replace or restore inflammatory words and phrases: Foxreplace [2]
[1] - https://github.com/minimaxir/hacker-news-undocumented
[2] - https://addons.mozilla.org/en-US/firefox/addon/foxreplace/
(\_/)
(='.'=)
(")_(")recent activity (24,252 total)
comment
I tried to create an account on GitLab.com. It said I needed to fill in the Captcha. There was no Captcha. Tried on Safari. I will try again later on Firefox.
comment
I support a ban on encryption. /s Any time something is banned, it becomes more prevalent and governments lose any semblance of control that they may have had on a thing. Such a ban would also …
comment
Strange as it may be, this virus will never be detected as a virus. That is why I am blaming the default settings in the tool.
comment
I wouldn't worry. Not every auditor will catch this.
comment
I don't recall even remotely suggesting the sky is falling. If nobody fixes this, it doesn't affect me. I have Multiplexing disabled everywhere that I care about. The constant news of comp…
comment
This didn't exist in 2000. It was created and made default on the server in OpenSSH 5. OpenSSH 5 did not make it into enterprise distros for quite some time. There are literally tens of thousan…
comment
I block all outbound traffic on several of my CentOS 7 boxes and have logging rules just before the reject rules. I get zero hits. This includes 2 workstations. In fairness, my /etc/resolv…
comment
Easiest way to see it on OSX is to install Little Snitch and disable all the default rules.
comment
There is a step where the auditor will observe you entering a correct and an incorrect password to enter the systems. If your org is depending on SSH key passphrases for this step and you get the wro…
comment
Some time soon I will put something up on github so you can test this methodology. It probably won't be tonight though.
comment
I agree with that. Folks are forced to create little isolated environments that are less likely to be patched or monitored, for fear of bringing more systems into PCI scope. That is slowly starting t…
comment
They are correct. You can't enforce passphrases (at all) on ssh keys, nor can you enforce key rotation unless you have a system that issues both the public and private keys. Even then, the user…
comment
OpenSSH allowing this behavior by default is in itself the vulnerability.
comment
Keylogger, perhaps. The multiplexing just makes it trivial to connect to everything with no logging and no authentication. I don't even have to modify the PATH or install a keylogger. I am alr…
comment
The reason that this involves SSH and is in no way related to the malware example you provided is, this is not malware and will never be detected as such. Very few things can actually block this and …
comment
You would think that is common sense, right? :-) I so wish more people thought like you. Get permission from your privacy and legal team before you do this of course. Write a small script in whatev…
comment
This was also being discussed here [1] [1] https://news.ycombinator.com/item?id=11049993 Apparently it will be obvious to folks that this has occurred.…
comment
The article didn't make mention multiplexing and MaxSessions defaults in OpenSSH. The default is 10 which means you auth once, and all subsequent logins are without auth and without syslog entri…
comment
Isn't this a similar argument made during WWII by the German scientists that were performing medical experiments on prisoners of war to benefit the greater good? Ethics aside, were they scientif…
comment
Good point. Would code review tools catch this? Gerrit, Crucible, et al? More specifically, how obvious would it be and would people question what they see?
comment
This is a good example of why git repos should be snapshot and archived to read-only media periodically. I like this! Thank you
comment
One must assume encrypted content will not be safe in the future. I would also be leery of anything that says "perfect". e.g. Perfect Forward Secrecy. In the future, we may be making fun…