cpach

Clickable link for the curious: https://www.cs.unm.edu/~ackley/

https://www.hornet.org/wikipedia-notes.txt seems to be notes related to a deleted Wikipedia page about the Hornet Archive. The wiki page itself seems to be mirrored at this URL: https://www.hornet.org/wikipedia-hornet.txt

Works fine for me. (Sweden, tried on my smartphone using LTE connection.)

FWIW, you might want to consider publishing your e-mail address in your HN profile or on your website. Otherwise it’s hard for people to get in touch with you.

Why does it matter?

Direct link to Hoot: https://spritely.institute/hoot/

Brother HL-L2350DW (monochrome). Those things are very reliable.

dupe: https://news.ycombinator.com/item?id=48660159

See also https://news.ycombinator.com/item?id=48660159 (1 comment so far)

Why is this on the front page? :)

Feel free to launch your own CA.

Interesting!

Reading, writing, cooking, child-rearing.

What’s the performance when you do that?

Dupe: https://news.ycombinator.com/item?id=48265498

Uhm… cryptography or cryptocurrency?

For those who can I would recommend upgrading to Wireguard.

If it was for personal use, surely there would be some kind of consumer organization or ombudsman one could contact for advice?

For B2B, I guess the local chamber of commerce might be able to advice.

Same here, zero plugins for me.

Regarding su…

  su -

might yield better results.

Does anyone know how to mitigate this one? Is it sufficient to disable the esp4/esp6/rxrpc modules?

Main discussion here: https://news.ycombinator.com/item?id=48058393

Welcome to Hacker News! Please write in English here. Thank you in advance from a long-time member :)

No, I haven’t.

My concern is to try to understand the mechanisms of the exploit.

Copy Fail is not simply ”hey, kernel, give me root”. I would say it’s more general than that. It’s rather: ”Hey, kernel, when you present file /foo to a process, make the contents of that file appear according to my wishes”. Which can be used (in various ways) to advance the attacker’s position.

That’s why I think it’s interesting to ponder if that power allows the attacker to simply sneak past security policies such as allowPrivilegeEscalation=false.

Many? No, I don’t agree.

Sure. But it would probably still be a good thing if the kernel maintainers could tear out AF_ALG.

That might make Copy Fail harder to exploit, but I still wouldn’t bet money on CF being impossible to use in that scenario.

How does allowPrivilegeEscalation=False help?

If so, I would look into applying a decent seccomp profile.

Other hardening solutions could be to run the workloads inside of a VM such as Firecracker, or gVisor. But that might be more work to implement compared to seccomp.

How?