gnyman

Thanks the answer and letting me know what it’s called.

I’ll keep an eye out for that blog post, it sounds like there are some interesting challenges with using it.

I love the UI! It's so simple and clean.

I can't really put my finger on why I like it, maybe it's because it uses depth which in todays flat world feels really refreshing.

I'd love to know more about how you ended up with this design language?

(I don't have much feedback on the main app, I don't think I'm the target because I can't figure out when I'd need this vs a completely anonymous private discussion group.)

I definitely agree bots are underserved, I have a few things I do to keep them entertained, ssh bots are tar-pitted to keep them connected but busy, my hope is that I occupy at least one thread of not the whole process.

For wp-login bots I serve them a nice chunk of random (generated by a fuzzer) html in the hopes that 1. It wastes abit of their bandwidth/memory and 2. it crashes their parser

In reality I guess bots nowadays are sturdy enough to not get stuck or crash but who knows, feels good to do something :-)

Tarpit instructions https://nyman.re/super-simple-ssh-tarpit/

Wp-login page https://twitter.com/gnyman/status/1181652421841436672?s=20

And I remembered another nice trick which someone else came up with, zip bomb the bots :-)

https://blog.haschek.at/2017/how-to-defend-your-website-with...

Okay, makes sense, neither Shodan nor Cencys are very easy to work with. Both have a learning curve to figure out all the ssl: asn: filters to find everything from an org. Making things more easily discoverable will be a benefit to everyone.

Good luck. I'll check back later and see what you have discovered.

Congrats on launching.

I looked trough the site and tried a few searches (which returned nothing I guess the scanning is maybe in in it's infancy?)

From what I gathered, it seems to be a similar to services like Shodan and Censys, is that right? Is that a correct impression or if not, what do you do differently?

Yes, although so far I have not run in to being flagged for fraud, some have been very confused by it. So I have started doing short variations of it to make it less obvious, so The Tracor Supply Company would be something like trasu@s.domain.tld

And instead of having a catchall on my domain.tld I have it on a subdomain, like s.domain.tld , easy way to keep them separate.

+1 on the above

This looks super interesting, but before I understand exactly what this is I'm not ready to give it access to my twitter, so maybe allow the modal to be closed so I can check the webpage :-)

I have been thinking about ways to consume twitter in better ways, one idea I had was to feed each follow onto a RSS and there are a few services that can do that(I think). But the problem is that with the advent and heavy use of threads everything is backwards.

If this can make each follow into a separate rss feed and then group threads into posts (the feed can be delayed or update old posts when new comments are added, either would be fine).

According to comparitech[1] it is Yet Another Elastic database exposed.

I do wonder a bit how the people at Elastic continues to defend not having authentication enforced by default.

As of today, going to https://www.elastic.co/guide/en/elasticsearch/reference/curr... and following their guide for a self hosted ES instance is probably the fastest way to have a data breach. Especially if you had a firewall like ufw in place and relied on it to not expose everything (because of dockers continued insistence on bypassing it [2]).

[1] https://www.comparitech.com/blog/information-security/thai-t...

[2] https://github.com/docker/for-linux/issues/690

I guess they mean something like this, which I find useful at quickly iterating over jq

  fzf --print-query --preview-window wrap --no-clear --preview 'cat file.json | jq {q}'

you can also pipe a curl in the above, but that will mean a lot of (slow) requests, so I have this snippet saved for running fzf --preview with jq on something from a web service

  curl -L https://datahub.io/core/covid-19/r/worldwide-aggregate.json > /tmp/foo && echo '' | fzf --print-query --preview-window wrap --no-clear --preview 'cat /tmp/foo | jq {q}'

now if you write something like

  .[0]["Confirmed"]

you will get a live preview of the result as you type

I did not know about `jiq`, so thanks for that tip, it looks like it does the same or something similar, but without the extra cruft of storing a temp file

out of curiosity, why do you maintain a catch all? would it not be easier (and less of a privacy issue) to just reject them outright?

I recently came across XP4Q ( https://xpq4.sourceforge.io ) when I was looking for a long-term stable desktop with traditional look.

Tried it out on an old MacBook and the look was great, but then I got bogged down in the standard get-trackpad-and-wifi-working.

Not sure how far the "pixel perfectionism" goes, but the few hours I used it (before breaking X11) it felt good.

Yes you are 100 correct, I mixed up port and agent forwarding, I’ve needed both at different times and last time it was agent forwarding so got confused.

There is another issue for port forwarding https://github.com/mobile-shell/mosh/issues/337 but no PR that I’m aware of.

Regarding why it hasn’t been merged, there is a comment on the port forwarding issue which sums it up quite well I think https://github.com/mobile-shell/mosh/issues/337#issuecomment...

My understanding is that the maintainers prefer doing one thing well (and securely). Which to be honest is something I really appreciate even if it means I might have to figure out some agent and port forwarding workaround :-/ at least I don’t have to worry about if my version of mosh will work with whatever the server runs

there is a fork with port forwarding support https://github.com/rinne/mosh and a PR with a long discussion https://github.com/mobile-shell/mosh/pull/696 on why it's not merged

you can compile them yourself or if you want to skip the step I recently set up GitHub actions to compile linux binaries of this [1][2], tested by a sample of 1 so no guarantees it works, was planning on doing a tap PR/tap of it at some point

also the official developers have been involved a project to solve this while improving the whole-agent approval things also https://github.com/StanfordSNR/guardian-agent , but I couldn't get it to work which is why I tried the fork and got that working

[1] https://github.com/gnyman/mosh/actions/runs/1068715036 [2] https://github.com/gnyman/mosh/actions/runs/1068715035

Pet theory (disclaimer that I know very little about SEO) would be that the website with the cloned content loads fast and does not load 4 MiB of javascript, thus beating the original content in ranking mostly because of the speed, which is I believe a important factor in Google rankings (and getting more important).

And add to that the some link spam and preventing the visitors to return not get any bounce back...

Either way, I can't help to be a bit impressed by the SEO spammers outsmarting the people at Google. (Edit: and I don't mean to say they are smarter or anything, just that they only need to find one weakness in the algorithm while the people working to improve it needs to make it works for everything.)

I’d go as far as to say it’s very useful :-) I don’t know how many times I’ve sat trying to skip trough a video to find a certain phrase or fact. Also the name is great and easy to remember, definitely committing that to my memory.

I am curious, from a technical point of view, are you pulling down the YouTube transcription or doing your own? And does that rely on the YouTube api (thus costing money for you at some point?).

I am definitely not arguing users should not be responsible for what they do. My point is that companies (especially billion dollar companies) can, and should be (more) secure by default.

I am also making the observation that this does not seem to get fixed by itself, rather it seems it needs regulation, which includes GDPR.

I agree, there is a huge difference what one should expect from a early OS project and what one should be able to expect from billion dollar companies.

But it seems that without external pressure (regulatory?), it's not getting fixed at either end.

Yes if you publish a known insecure service like mongodb, on the standard port, on a well known VPS provider you can expect it to be automatically compromised within hours if not minutes.

As others commented, scanning the whole Internet is even not a problem so scanning a "limited" part where you are likely to see these services pop up is even less of a problem.

I think the takeaway is that you cannot hide in the masses on the Internet anymore, 10-20 years ago you could throw up a insecure server and it could be fine for a long time.

Nowadays you must assume someone will find and try to login to your service, even if you put it on a non-standard port.

Also, if it's a HTTPS service take note they when you get a certificate you will be announcing that domain to the whole world and publish it to a searchable database (for example https://crt.sh/ ).

Glad someone else highlighted this old ticket.

I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun.

Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1].

In my opinion it's as irresponsible as HW manufacturers shipping with default passwords, something which finally got the attention of regulators[2]. So I wouldn't be surprised if we at some point see some attempts to keep sw-developers accountable for what they give out.

I have for some time been using the data-oil analogy to describe where we are at. If data is the new oil, and a database is a tanker, then we are at the single hull tanker stage. We need double hulls, but just like the oil industry, the sw industry has little incentive to fix it themselves. I am hoping we get some regulation which improves the situation, because otherwise this will keep happening.

1: https://www.bleepingcomputer.com/news/security/new-meow-atta...

2: https://techcrunch.com/2018/10/05/california-passes-law-that...

And if you don't want to or can't install noscript, you can use my little hack https://noscript.it/ to view a page without javascript.

Note that it is a hack/poc and does not always work, especially the x-frame-detection is iffy so if you try it and just see a blank page try the "enable proxy" checkbox. I use it every now and then on iOS to get around some especially obnoxious JS, but if there were more users I would be more motivated to improve it (hint hint:-)

Thank you, jq is always driving me crazy. If I have to get used to lisp syntax to get away from it, then so be it :-)

Also.. the fzf --preview tip you had. Thank you, it's going to save so much time next time I need to iterate trough some jq/jql/sed/awk/grep...

And finally, > It may seem dead, but it's not. It's just finished

Glad to see a tool which is "done". It's a bit sad that it's something you have to state nowadays to not be considered "dead project".

I'm not site how a router would identify "mindless browsing", but turning off Internet at certain times is a feature many routers have built in, usually under parental control. Worth a look if you haven't checked.

Personally I ended up with a bit different solution, I wanted to do something similar, but needed it to work on my phone also so I ended up using nextdns to block part of the Internet (reddit and Facebook) after 10. Works reasonably well as trigger to stop my worst doomscrolling offenders.

I wrote up a short post on how to do it https://blog.nyman.re/2021/01/10/reduce-doomscrolling-with.h...

At the bottom of the article (I think added later but not sure) there is a part about being able to get signed originals. It looks like they are (as of right now) still available as that part is yet to be stricken trough.

Adding my thoughts from being a Turris Omnia user since the release (2016).

I think it's one of the better standalone WiFi router/AP's out there. If you want a long term supported open source/openwrt one it might be the best choice out there.

The original 3.11 release track has been super stable for many years, and is still being updated with security fixes. The 4.0 branch was a bit bumpy ride but since the 5.0 release early last year I've had zero issues.

Note that the default WiFi chipset is not the latest generation, and although the dev team is actively looking at the possibility to get some wifi6 working [1], I think it might be a while before that is out and stable.

As a bonus it has some cool features like built in support for CZ.nic's honeypot as a service [2] and lxc.

[1] https://forum.turris.cz/t/wifi-6-ax-adapter/10390/63 [2] https://haas.nic.cz/

Everyone has different priorities of course. But note that as long as you use a modern client TLS_FALLBACK_SCSV will ensure you won't be at risk of downgrade attacks or similar. Without that I also don't think I would run it.

I recently did the opposite and re-enabled 1.0 and 1.1

Wrote some thoughts on why here https://blog.nyman.re/2021/02/07/usability-security.html but in short, it's several magnitudes more likely someone will want to check out my blog using a old device vs someone trying to exploit vulnerabilities in the old protocols.

Google.com still allows TLS1.0/1.1 https://www.ssllabs.com/ssltest/analyze.html?d=google.com&s=...

I had a great experience with https://q4os.org/ (and its Windows skin).

It's feels like a modern Windows XP.

But I must admit I have not used it for much work, but the feeling of playing around with it was great.

Or the server only accepts modern ciphers or TLS.

I took a deep dive into this after I was unable to access my blog on my iOS 6 device. I concluded that I don't really need a ssllab's A. It is much more likely someone will try visiting my blog with a older device than someone will MITM one of the visitors.

https://blog.nyman.re/2021/02/07/usability-security.html

Re-read my comment and to be clear, the quote and the last paragraph are not related. The last sentence was meant to refer to the Erizo project as a nice single purpose high performing tool, not as a comment to the bug that made it slow.

Thank you for introducing me to the concept/term Ascetic programming. Not sure how widely used it is, but I find it more fitting for what I try to do than minimalistic or KISS.

Also, it is great to see someone write

  > I noticed that ASCII STL loading was really quite slow.
  > From startup to showing the window, it took over 1.8 seconds!

I always find pleasure seeing projects which highlight just how fast modern computers really are.