aj3

LEO and TLA need vendors with constant supply of exploits.

Cutting down things that are unnecessarily complex would be a good start. I.e. most websites out there could be easily replaced by static code generators. Webauthn and client certificates can be used to protect admin interfaces. Technology is here but there is no demand for it because making things less secure is way cheaper.

Your second link mentions sellers avoiding liability by selling product (that can be inspected in stores) "as-is". It could be argued that open source falls in the same category. You have an opportunity to inspect it before using and if you don't like it or don't feel qualified to pass judgement, no one is forcing you to use it.

Initial vulnerability is OOB read, but it can be leveraged to gain arbitrary r/w.

EDIT: source: https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/

Apple is asking for "a reasonably reliable exploit" for full bounty payment: https://developer.apple.com/security-bounty/

Well, some people want to have root access to study iOS internals, debug software, look for forensic artefacts and unknown vulnerabilities.

Password hashes. /etc/shadow isn’t world readable in Linux dither

That link just points to whole thread.

You're entitled to your opinion and so do they. I don't really see how there's basis for bad faith accusations. Their stance and actions seems reasonable and consistent, even if other people would have acted differently.

Meh, that's not a death threat, they're just looking for extra-judicial settlement.

I get the activism aspect and I agree that copyright laws are outdated, but how entitled do you need to be to expect preferential treatment because of your political beliefs? If you're in a foreign country and hasn't settled yet, just create a fake persona and disassociate from controversial activities.

World problems are here to stay, they'll still be around for you to solve once you get a citizenship.

Article summed up: there’s this thing called cargo cult programming and it’s bad.

This seems like a very uncharitable reading of that quote.

Btw, what is organisation meant to do in this situation? Sue the person they believe is infringing on their rights without regard to humanity? Ignore the issue altogether?

Eh, the issue was found by a random (Chinese) guy on the internet. And it was reported to Microsoft in the beginning of January. It got leaked and once you have the exploit chain - yeah, pretty much any random guy on the internet could use it for hacking. A few days after MS disclosure there were in fact independently produced exploits by other random guys.

Not the same thing. Solarwinds saga (the one Russians are blamed for) was 1) extremely targeted and 2) extremely sophisticated. Exchange attacks on the other hand were indiscriminate (not targeting any single country or infrastructure, just unpatched Exchange servers) and very simple (they used 0day chain, but it was three months old and likely somehow leaked as multiple groups got access to it at the same time).

You obviously haven't met Chinese infosec researchers, have no knowledge about Chinese underground and are simply speaking from your biases.

What you're missing is that these attacks weren't targeted. They scanned internet and processed pretty much all accessible Exchange servers in the same manner. There were a few crews operating in parallel by the way which had access to same exploit chain but different exploits.

Some had certain variables hardcoded, e.g. Administrator user's name and their exploits worked with higher success rate in anglosphere, but failed in localized environments. Others had more advanced exploits which queried parameters instead of assuming them - those where more successful around the globe.

Another nuance missing from popular press is that most groups in China (and Russia) are operating independently, but share tradecraft among them and occasionally engage with politicized missions (either working on explicit orders from government handlers or simply defending their beliefs hacktivist-style). This is what FireEye means by "affiliation with Chinese government", NOT "operates strictly on government orders".

To my knowledge this is the first attack of this sort (shadily) attributed to China, but they have been implicated in much more important attacks, such as OPM breach ( https://en.wikipedia.org/wiki/Office_of_Personnel_Management... ).

All the good mechanical bluetooth keyboards I know are almost as heavy as this console. Is there anything actually portable in this form factor?

I'd much prefer reading and reviewing code on an ipad, if only Apple wasn't so restrictive about their software.

And it boosts Linux stats among Steam users.

Can't imagine coding without a good keyboard though. And mobile mechanical keyboards are too heavy to carry around.

It should be great for debugging random server problems while on vacation though.

You just keep talking straight past my points without even trying to understand them. Why bother writing answers at all?

I'm not advocating for installing a fresh OS on an exploited hardware and calling it a day, no matter how hard you try to present my words this way.

The point is to keep any single environment around only for a short period of time so that adversaries don't have enough time for replicating your systems and crafting a targeted exploit chain.

It is not meant to be the only line of defense. You would still harden every system you own, putting particular focus on tamper & intrusion detection (including retrospective analysis).

Couple that with strong compartmentalization (e.g. using different hardware for different purposes, Qubes OS style virtualization approaches) and defense in depth (exploit mitigations, traffic anonymization).

Here, I have spelled it out for you. Feel free to outline how you would approach attacking such individual adversary, even with NSA level team at your disposal. Silent assumptions being that 1) if person's physical location is known, CIA is a cheaper option than NSA and 2) failed offensive operation leaving attributable evidence is considered by NSA worse than missed opportunity.

Please, stop low effort ad hominem attacks.

You pose the questions but do not answer them. Assuming distros are selected purposefully you do get quite a lot of variability. Recompiling the kernel with different hardening options alone makes many exploits impractical.

The threat modeling that you see in this thread is laughable. Nobody has infinite resources, not even NSA. They can't throw all their capability at you alone. In fact they are not even interested in any one individual. They might be interested in some groups of people like "terrorist leadership" but even in that case they don't have the need to hack all people matching that group. So at every step of the decision making process there is a cost benefit analysis. And in the end NSA will only hack some terrorist leaders, the ones deemed sufficiently significant but not any more risky then is necessary.

The amount of meetings and paperwork required for carrying out offensive action is significant and everyone involved is very risk averse. Getting superiors to sign up for an operation against an individual capable of detecting attack and thus risking attribution would only be possible if the proposed techniques can be shown to be extraordinarily stealthy. That requires replicating the system in the lab and rigorously testing methodology beforehand.

Yeah, it is hard to protect organizations from nation states. Because all sufficiently complex systems have bugs and given long enough time persistent attackers will find & exploit these bugs. But that's because organizations have other real-world priorities besides fighting NSA. These organizations can't change protocols overnight and replace core systems just for fun of it.

Individuals actually have an advantage here because they can rotate systems at will and have much higher control over their personal lives than any CEO/CTO/CISO has over their organization. As a result, yes you can raise the cost of an attack against you high enough that NSA won't bother hacking you - either because there are other people who are less protected but hacking them would fulfill the same objective or because your ass gets handed to another agency which is able to present more cost-effective solution.

Your link demonstrates this dichotomy between options that NSA has available for hacking organizations vs individuals. Individuals rarely have well documented procurement processes available for third party auditing you know.

Standards don't provide such filtering functionality and telcos operate their equipment as a black box, so they don't have ability to implement additional features, especially when there is no business case for that and it could open them to new liability (undermining safe harbor arrangement).

Assuming that time travel is impossible, NSA can't break into something that does not exist anymore. Hence the idea when facing such adversary is to provide them a constantly moving target. Although NSA might be able to break any full disc encryption given enough time, they aren't able to decrypt something that no longer exists.

This principle isn't scalable to every computer system out there and will definitely go against other requirements in most organizations, but if you are an individual, it's not hard to pull it off.

That seems to be about stopping spamming over SMS. AFAIK censoring SMS between unknown individuals isn't even technically possible.

Buddy, I'm not gonna follow this thread anymore because you seem to be baiting me to read you a lecture on OPSEC, security in depth and compartmentalization.

That would be very unusual (unorthodox) definition of Pi though.

You're definitely commenting on your own experience in high school and it's not universal. We were mostly doing analysis in high school with some analytical geometry thrown in.

Euclidian geometry would be the same in any universe though, as it does not depend on objective physical reality.

In case you're genuinely curious, 'NSA-proof' is a portmanteau from NSA and 'idiot-proof'. Distrohopping is when people change (usually GNU/Linux) distributions once a month or so (which is an allusion at tongue-in-cheek conjecture that one can change distributions faster than NSA can break them). Have a good day, fellow human.