foxtrottbravo

A beautiful typeface - unfortunately completely outside my financial range but a great typeface nonetheless.

I hope to seeing it in the wild sometime. Really, really beautiful

Yes I do strongly disagree with the wording (attack) here.

If publishing a package you control is considered an attack than the same could be said about the developer using the package or the admins deploying said package

I was hoping this might be a document to send to some colleagues who are trying to get their feet wet in the Linux world.

I cannot say if it is because the anti-adblock let's me read the page - so not interested - thank you.

You reminded me of a saying I've heard a while ago which May be roughly translated to "the mother of suckers is always pregnant"

Reminds me of the times I ran `killall` on a SCO machine only to learn that they take the name very literally...

Wow, thanks for breaking established standards then...

One idea I may find interesting enough to pursue is finding a solution that delivers an energy optimised experience for different display technologies:

- on ips displays, reduce dark greys in davor of black

- optimise Energy optimisations for different flavours of lcd

But I think there isn’t any straight forward browser API for that

First of all I agree with you, that we should compare solutions in a comparable manner and I went overboard.

So yes, if we want to be fair we have to compare an in-host defense system like portknocking (which has one job: secure sshd) to a in-host vpn setup more alike to like the often mentioned wireguard.

And in this "configuration" I completely agree. I still think it may be more likely for a VPN to expose security critical bugs than a bug in knockd - but as you said this should only allow access to your next layer of defense (namely sshd) and maybe (if you're a really valuable target) a three-letter-agency might throw all their resources at you and are willing to throw every weaponized exploit they have at you - yeah than you're even more correct because than they would have a far easier time just intercepting your port knock sequence and throwing all their quantum computation power against your sshd keys.

> The rest of your argument, if I'm understanding it correctly, is that you think people will get more lax with securing SSH on a box only reachable via VPN

The argument I was trying to make is that while a VPN is in in every way a really good idea (the way we described it here - as an in-host security layer) but I have yet to see it being rolled out in that way.

I come from a more traditional sysadmin setting, and of most sysadmins I worked with would find implementing this "correctly" to tedious and would either

a) terminate the vpn connection at the rack or co-location "border" and shove a bunch of servers down a single VPN connection b) terminating every servers vpn connection at a single vpn concentration point

Regardless of which, in virtually all cases that I know of never was there any thought given about intra-VPN firewall rules or allowing only certain ports on the VPN. Most of the time you get the servers that are somewhat related, shove them in a subnet expose that subnet via VPN and you're golden.

And so from my practical experience, I would think that a compromised VPN in my reality would be worse than a exploited knockd, but only because it isn't scoped to the same level.

On a sidenote: I'll guess that modern orchestration tools make it pretty easy to roll out knockd and / or wireguard pretty easily in the discussed fashion - it's just I don't get to play with those.

That was a lot of text, just to say I agree with you - but hey, I guess agreeing on something on the internet is somewhat nice so have a great day.

My daily bread and butter is VPNs, but I must admit that I think there may be a truth here.

While I fully agree that portknocking doesn’t provide the same layer of protection or flexibility a VPN does - but with the original article in mind: if your reason for deploying a VPN is because you fear to expose unknown bugs in sshd to the Internet the same could be said about every vpn solution.

Therefore portknocking is / (would be*) indeed more elegant because

- it makes no promises to be secure (as in as secure as a VPN) - one could argue: if you use it you know that portknocking is just an additional security layer - and maybe don’t get lazy as in a VPN - a misconfiguration or bug or an attacker might expose sshd on your hosts - a misconfigured VPN at least in a somewhat sizeable deployment can lead to countless attack surfaces

Having said that, that only will work if the rest of the sshd security is in check and your password isn’t hunter2

The Yubikey documentation recommends always buying them at least in pairs. And configure them both for access.

If you use either a Static Password an HMAC-SHA1 Challenge-Response or TOTP with the key you can easily backup the secret material used to program the key and replace the key if one fails.

Store backups safely.

Heck,

I'm know my tech and I can't figure out how to reliably get Safari on IOS to display the bar at the bottom.

Makes me crazy

In all honesty, no I'm not. Two weeks ago I went to my GP to diagnose a light swelling / discomfort in my left cheek.

He gave me two rounds of antibiotics and it seemed to get better. Then recovery stopped.

GP sent me to the ENT. ENT also isn't sure what it is but is sure that the first suspicion was incorrect.

Tomorrow I have an appointment in the hospital for a biopsy to make sure the change in tissue is not malignant.

So I'm unfortunately not OK, I'm shit scared for what is up ahead.

Thanks for asking, since I haven't had anybody to talk to since Wednesday where I got the news that it might be something way worse than what we expected.

Normally I do not care too much about comments marked as [dead]. But why is it that all comments in this submission that critique HackerOne are being killed?

I'm now somewhat curious is this comment will be hit with wathever hit the other (at the time of writing) four comments.

I know in the particular example that is something that's good advise and more or less easily done.

Do you think it would be good to extend said argument to say scp / ftp clients?

You mean, like Emoticons?

> This is the most time-efficient way to handle being stuck, and it's the most respectful of other people's time, too.

No it is not.

1. People have other things to do. "being stuck" just threw a wrench in the gears of someone who may have many other things to do. They did not plan on being stuck and have therefore not alloted time for it. Therefore it is the most time-efficient to hand the problem of to someone whose time has been alloted in that way (i.e. your support team) and who can probably solve the problem faster because he looks for these kinds of problems all the time.

2. It's the most respectful of your time, sure. But as a customer I could not care less about that. It's definitively not the most respectful of my time asking for that, and it is definitively not the most respectful of my customers time.