Hacker News Reader

rodletteon Mitigating the Hetzner/Linode XMPP.ru MitM interception incident

See RFC5507: "Why Adding a New Resource Record Type Is the Preferred Solution"

DNS providers should support a wide range of RR types, and domain owners should vote with their NS records.

See https://github.com/StackExchange/dnscontrol/blob/master/docu... for a list of DNS providers that support CAA.

rodletteon Encrypted traffic interception on Hetzner and Linode targeting Jabber service

Consider including SSH known hosts in your cfgmgmt.

I have all my machines' public keys, and all major git forge's SSH keys in my git-managed cfgmgmt repo.

For NixOS users: https://search.nixos.org/options?channel=23.05&show=programs...

rodletteon Encrypted traffic interception on Hetzner and Linode targeting Jabber service

I agree with most of the mitigation suggestions.

For high risk targets, consider layering an additional auth mechanism that doesn't rely on trusted CAs: Tor onion services, SSH, or Wireguard.

> All issued SSL/TLS certificates are subject to certificate transparency.

+1. crt.sh has RSS feeds for this.

> Limit validation methods and set exact account identifiers

Using CAA is a good idea in general, but would it help in this case? The attacker would just request the exact cert configuration that is permitted by CAA. Maybe this helps if you can strengthen one validation method?

> Monitor SSL/TLS certificate changes on all your services using external service

+1. High-risk targets should be aware of what certs are valid at any time, and be checking for those.

> Monitor MAC address of default gateway for changes

A more sophisticated attack could preserve the MAC address.

> "Channel binding" is a feature in XMPP which can detect a MiTM even if the interceptor present a valid certificate.

TIL.

rodletteon "We have a thermal printer hooked up to the internet, you can send us a doodle"

I considered just writing them, but I was concerned that I'd make a mistake, or be too lazy to do regular test decryptions/restores.

rodletteon "We have a thermal printer hooked up to the internet, you can send us a doodle"

Good point. Thanks!

rodletteon "We have a thermal printer hooked up to the internet, you can send us a doodle"

For backup purposes, I'd like to print some encrypted secrets as QR codes.

I don't have much room for a typical printer.

Could a small thermal printer print a QR code that encodes 500-1000 bytes?

If not, anyone know of a decent, durable, low-volume alternative?

rodletteon Raspberry Pi 5 vs. Orange Pi 5 Plus vs. Rock 5 Model B

AFAIK, Pine64 the company don't do any (?) upstreaming.

Upstreaming for Pine64 devices is done by the community: https://lore.kernel.org/all/?q=pine64+rk3399+add

QuartzPro64 was recently mainlined by megous. I don't think he's employed or compensated by Pine64, but I'm not sure.

The SoCs are added by Rockchip, Collabora, and others.