That explains why I hadn't heard of this yet. My current incarnation of my internal network dates from ~april 2024.

That leaves .home.arpa, which is very awkward and only a thing since 2018 (my home network's use of .lan definitely predates this). Especially as a non US citizen. It also seemed so far that .lan was the "unofficial" gTLD to be used, since much software like OpenWRT was already using it anyway.

Either way: making .lan internet routable seems entirely unhinged to me. LAN has always been the acronym for Local Area Network. Why would anyone sane think that it is a good idea to make this into a gTLD that can be internet routable? The only way I see forward to do this justice, is to only allow RFC 1918 and IPv6 addresses that are within the assigned prefix for your router.

This seems like a worse version of allowing .zip to be a gTLD. Remember the idea of downloading something from https://github.com/[...]@evil.zip?

You're still installing the program directly from github of course, instead of a source where hopefully a third party has also looked at it (like a package repository). But this is a lot better than the curl | sh pattern.

> Does this affect Prosody?

> Not directly. Let’s Encrypt is not the first CA to issue server-only certificates. Many years ago, we incorporated changes into Prosody which allow server-only certificates to be used for server-to-server connections, regardless of which server started the connection. [...]

We do suffer from many political parties not willing to cause short term pain to improve long term outcomes. There are a few urgent issues going on in politics at the moment. Stuff where a decision needs to be made now and action should be taken. But the political parties do not want to make those decisions because they would inflict short term pain to some voters but would also improve the long term quality of life and economics of the Netherlands.

The worst part is that those issues have been known for a long time, but decisions were postponed over and over again because politicians didn't want to make the decision. Making the issues worse and more urgent over time.

At the same time populism is clearly on the rise in the Netherlands. A famous thing happening in a debate before the previous elections was a populist saying "But this woman cannot wait for the costs to be decreased, she needs it now." about decreasing a specific part of healthcare costs for citizens. Of course when the same populist became the biggest party during the elections, they never introduced anything to decrease that part of the healthcare costs.

It also may not be worth it. Generally APT's want to stay under the radar while they are executing. But after the goals have been reached, most of the time it doesn't matter much if they get attributed. We have yet to see real consequences against any APT's. So paying your employees more to work night shifts, likely doesn't stack up against the consequences of attribution.

For learning how to do such things? Well, a general computer science or electrical engineering background is a great start already. Ideally you learn a bit about embedded systems and how electricity works on circuit boards. A great resource for this is Big Clive on Youtube [1] who reverse engineers many circuits on his channel.

Tinkering around with hardware at a lower level will also reward you with a lot of knowledge. For example just working with an ESP32 and some off-the-shelf sensors will help you get a feeling for how these things work. See if you can communicate with other systems as well this way. Try to do as much as possible using jumper wires and breadboards rather than premade cables, so you get to know how it works. Also get a multimeter (one that beeps) and get comfortable using it. If you're unsure which multimeter to get, Big Clive has a pretty good video about that.

One thing I recommend getting is a logic analyzer. You don't need to go for an expensive Saleae (you can find pretty cheap clones on your regular Chinese webshops for example). Then just use it to investigate things that you already have access to. Attach it to a UART port where you know data is sent over and see if you can obtain that using the logic analyzer.

Then you can probably step over to investigating things you don't know. Just figure out with a multimeter what the voltages are and see if maybe data is sent over the line.

[1]: https://www.youtube.com/@bigclivedotcom

Comments URL: https://news.ycombinator.com/item?id=42521630

Points: 35

# Comments: 4

https://github.com/example/project/releases/@example-project...

Due to everything in a URL before the @ being interpreted as a username for basic authentication, this would result in the user navigating to https://example-project-v1.zip instead of to github.

Edit: Fortunately it seems like browsers have caught on to this trick

Or that exe tries to connect to other services in the network to exploit a buffer overflow on another system. An example of such an exploit was EternalBlue.

So yes, you're probably right that from a purely external perspective, attackers are unlikely to gain initial access using exploits targeting memory safety. However, once they are in, there are all sorts of memory safety bugs that could be used.

Clients (both Windows and Linux) will prefer the DNS-server specified through IPv6 over the one from IPv4. Then you can spoof any DNS record and capture juicy NTLM hashes flying through the network or relay their authentication and get a free authenticated connection.

This is most effective in networks that were designed for only IPv4 and didn't consider IPv6 at all. But it is also effective in some networks that do use IPv6.

Mitigations? Either disable the IPv6-stack on all systems, or configure your switches to block the router advertisements and do not allow DHCPv6 traffic to the wrong systems.

We value our independence highly. It is what ultimately brings in business. It would be very bad business if one our customers gets hacked, when it was an easy vulnerability for us to find.

This is the same for the NCC group here. If in a few weeks the WhatsApp e2e encryption on backups was cracked, they would look like fools. And that is not good for business.

So yeah, just being able to copy curl commands from a website certainly has value over configuring complicated commands.

He also says that he isn't afraid that banning Bitcoin will fail, because a ban would lead to a crash.

In smaller villages however, that are more spread out and usually only have one or two grocery stores, people usually take the car or their bike to the grocery store, because walking is too far. In this case, bikes do replace trips by car.

Also note that in general, Dutch cities are quite walkable and cycleable. If I visit a friend on the other side of the city I live in, I go by bike. Which is about as fast as going by car. Going by public transport also takes about the same time. This is a result of the Downs-Thomson paradox [1].

[1]: https://en.wikipedia.org/wiki/Downs%E2%80%93Thomson_paradox