Hacker News: Bu9818

New comment by Bu9818 in "Tor: From the Dark Web to the Future of Privacy"

Bu9818 — Sat, 27 Apr 2024 15:07:53 +0000

The take away of that story is: don't post a message from Tor that gives out the network that you're entering Tor from.

New comment by Bu9818 in "12to11 – run Wayland applications on an X server"

Bu9818 — Sat, 27 Apr 2024 14:27:32 +0000

They're talking about the attack surface to get accidental code execution from opening files that try to exploit vim. Integrating shell commands with vim/less is a valid feature.

New comment by Bu9818 in "Backdoor in upstream xz/liblzma leading to SSH server compromise"

Bu9818 — Sat, 30 Mar 2024 09:34:41 +0000

>namespaces (which have been a frequent source of vulnerabilities)...

Unprivileged user namespaces sure, but I don't think that applies to namespaces in general (which without unprivileged user namespaces can only be created by root, and LPE is the concern with unprivileged userns due to increased attack surface). systemd doesn't need unprivileged userns to run.

New comment by Bu9818 in "Backdoor in upstream xz/liblzma leading to SSH server compromise"

Bu9818 — Sat, 30 Mar 2024 02:02:55 +0000

Yeah I was wrong about that, I confused it with socket-activation passing. The systemd-side socket is available from the process.

New comment by Bu9818 in "Backdoor in upstream xz/liblzma leading to SSH server compromise"

Bu9818 — Sat, 30 Mar 2024 00:39:18 +0000

Services may be in a different mount namespace from systemd for sandboxing or other reasons (also means you have to worry about filesystem permissions I suppose). Passing an fd from the parent (systemd) is a nice direct channel between the processes

New comment by Bu9818 in "Google ordered to identify who watched certain YouTube videos"

Bu9818 — Sat, 23 Mar 2024 07:05:06 +0000

Use Invidious, use RSS, use yt-dlp, use Tor.

New comment by Bu9818 in "CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()"

Bu9818 — Thu, 01 Feb 2024 09:58:53 +0000

The vast majority of services and user programs don't need to escalate privileges by invoking SUID/SGID binaries. no_new_privs should be used on them so that the "setuid with libc/LD programs" security boundary is avoided.

New comment by Bu9818 in "Sourcehut and Codeberg are both currently experiencing a DDoS attack"

Bu9818 — Fri, 12 Jan 2024 08:46:35 +0000

It could be a FOSS portable binary that runs outside of a web browser.

New comment by Bu9818 in "The right to use adblockers"

Bu9818 — Fri, 22 Dec 2023 02:10:00 +0000

They aren't preventing you from using a content filter nor are they making it difficult to scrape the site. The counter measures against this are the problem.

New comment by Bu9818 in "The right to use adblockers"

Bu9818 — Fri, 22 Dec 2023 01:39:36 +0000

I agree, I don't even care about ads in specific. I primarily use the tor browser which doesn't block ads due to fingerprinting (it's ok for casual browsing, though some sites are actually obnoxious and slow down the browser). More generally, I care about web scraping and being able to control the presentation of content: for internet archival, using a featureful video/music player (mpv) or library like a local imageboard, utilities like user scripts to add features/programatically do stuff, content blocking (filter rules for specific posts/users), creating RSS feeds for notifications if the site doesn't offer one, simpler/faster frontends like invidious/nitter, etc.

New comment by Bu9818 in "SSH3: SSHv2 using HTTP/3 and QUIC"

Bu9818 — Sun, 17 Dec 2023 02:23:13 +0000

For faster session establishment in OpenSSH consider ControlMaster in ssh_config(5), which multiplexes multiple sessions in one connection instead of creating a new connection for each session.

New comment by Bu9818 in "Firefox Is Going to Try and Ship with Wayland Enabled by Default"

Bu9818 — Wed, 15 Nov 2023 22:20:12 +0000

Lots of games won't ever be converted to Wayland (maybe some unofficially by replacing libraries with updated ones that still work with the game), we'll need some nested X server like xwayland in rootful mode once wayland compositors remove their xwm.

New comment by Bu9818 in "Bitwarden adds support for passkeys"

Bu9818 — Thu, 02 Nov 2023 04:07:04 +0000

Also, malicious code can be pushed to the website if you are logging in through that. You have to trust that their infrastructure is safe.

New comment by Bu9818 in "Bcachefs Merged into the Linux 6.7 Kernel"

Bu9818 — Wed, 01 Nov 2023 08:25:59 +0000

You can mark individual files as No_COW in btrfs, and No_COW + preallocation is a requirement for swapfiles anyway due to how the swap subsystem works.

New comment by Bu9818 in "Mitigating the Hetzner/Linode XMPP.ru MitM interception incident"

Bu9818 — Sat, 21 Oct 2023 01:59:43 +0000

>affected 100% of the connections to XMPP STARTTLS port 5222 (not 5223)

Why did they only target the STARTTLS port? On a related note, I would never use the STARTTLS port (opportunistic encryption) if I knew that the server had a regular TLS port...

New comment by Bu9818 in "Build your own BitTorrent"

Bu9818 — Thu, 19 Oct 2023 22:42:02 +0000

Instead of replacing the md5sum on the download page an attacker could replace the infohash/magnet link/.torrent file.

New comment by Bu9818 in "Build your own BitTorrent"

Bu9818 — Thu, 19 Oct 2023 22:38:17 +0000

There's at least some differences, such as HTTP/2 usage, or maybe algorithm usage/bugs in newer versions. Whether or not most tracker staff actually bother to attempt fingerprinting, IDK.

New comment by Bu9818 in "SSH-audit: SSH server and client security auditing"

Bu9818 — Mon, 16 Oct 2023 03:16:29 +0000

The article linked includes OOB verification as a scenario in TOFU. From the perspective of the ssh client it's TOFU (no CA chain for the client to perform a check), sure, that just means it's up to the user to do the work and use ssh safely (either the server has a site posting the fingerprints like GitHub/the AUR or you're setting up the machine and have physical access, or maybe you're using SSHFP).

>If no identifier exists yet for the endpoint, the client software will either prompt the user to confirm they have verified the purported identifier is authentic, or if manual verification is not assumed to be possible in the protocol, the client will simply trust the identifier which was given and record the trust relationship into its trust database.

New comment by Bu9818 in "Fcron Is the Best Cron"

Bu9818 — Sat, 14 Oct 2023 22:15:30 +0000

systemd.directives(7) is useful if you know what directive you want to read about but not in what manual it's in.

New comment by Bu9818 in "curl - SOCKS5 heap buffer overflow - CVE-2023-38545"

Bu9818 — Wed, 11 Oct 2023 07:42:50 +0000

I recommend programs using Tor to be run in an empty network namespace then set http/HTTPS/ALL_PROXY to a Unix domain socket created in torrc (or use socat to get it on the namespaces' 127.0.0.1 if not supported by the library), to avoid accidentally misconfiguring programs if their proxy settings are bad or you run a statically linked binary with torsocks.