rurcliped

It's common for outbound traffic to 127/8 to be blocked, at the application layer, to prevent SSRF. For example, in WordPress:

https://github.com/WordPress/WordPress/blob/9d4d3f8fba13be09...

This is covered in a Harvard class: https://www.youtube.com/watch?v=g9KFrFp_HZ0&t=110s

The paper says "all three of OpenSSL, LibreSSL, and BoringSSL have been gradually increasing in size since the 2014 fork, to the point where LibreSSL is now roughly the same size as OpenSSL was at Heartbleed's discovery." The authors then count CVEs. This won't yield a valid conclusion about vulnerabilities in the new code that's been added to Libre/Boring in 2014-2021. The OpenSSL project requires use of CVE numbers, but Libre/Boring don't. Nothing at https://www.libressl.org or https://boringssl.googlesource.com/boringssl talks about obtaining or listing CVEs (contrast to https://www.openssl.org/news/vulnerabilities.html https://www.openssl.org/policies/secpolicy.html etc,). OpenSSL Management Committee has a person on CVE's board https://www.openssl.org/community/omc.html https://cve.mitre.org/community/board (same Mark Cox). The authors say "the most widely used cryptographic library, OpenSSL" but don't say this means more users to report bugs/vulnerabilities to that project.

They say "Our case study of the LibreSSL and BoringSSL forks further demonstrates a linear correspondence between source code removal and vulnerability removal." Possibly a useful finding! But we still don't know what happens when you remove a ton of someone else's code, but then add a ton of your own unique code. To research that, they'd need competing projects that similarly care about vulnerability IDs (CVEs or other IDs), and have similar populations of potential bug reporters and/or similar opportunities for bug bounties.

I feel that it should have Feb. 2, 2000 - CERT publishes the first advisory about cross-site scripting https://web.archive.org/web/20000302105858/http://www.cert.o... (on the https://thehistoryoftheweb.com/timeline/?date_from=1997&date... page, of course)

Microsoft apparently doesn't want "log in" to be used, and favors "sign in" instead: https://docs.microsoft.com/en-us/style-guide/a-z-word-list-t...

maybe automatically switch from dark mode to light mode at sunrise in Uganda, and switch back at sunset?

That's AdSense, described here: https://support.google.com/adsense/answer/72857?hl=en

A brand deal occura when a video creator, or her management team, separately signs a contract with an advertiser. The advertisers in AdSense ads are chosen automatically by YouTube, not by the video creator. These ads interrupt the normal flow of the video. The advertising content from the brand deal is integrated directly into the main body of the video, usually by the video creator herself talking about the products. These have to be disclosed to the viewer (U.S. FTC regulations).

A single video can have both a brand deal and AdSense ads.

A brand deal appears like this:

https://www.youtube.com/watch?v=F9mPTQDF7Ok "This video is sponsored by Tempo."

https://www.youtube.com/watch?v=L0nTI-lwU1Q "This video is created in partnership with Nikon."

https://www.youtube.com/watch?v=FY8Yxw46TBQ "This is a Google-sponsored post"

They seem rare. Maybe only one in 2020.

There are also other potential income sources that weren't mentioned:

https://www.youtube.com/watch?v=rA9Ww5ffA3I "This is not a sponsored video, but I did use an affiliate link"

https://www.youtube.com/watch?v=J52T748MOI0 "This is not sponsored, but I did use an affiliate link!"

The ballot question is actually about the "Right to WebApp Development Competency." Voting yes means you believe that, after a "Such platform shall be directly accessible by the owner of the vehicle" law passes, webapp developers will MAGICALLY gain the competency needed to rapidly deploy a life-or-death-critical service for access by millions of unsecured client endpoints, and deploy it with no security-relevant design or implementation flaws.

There's at least some hope of delivering a secure service to dealerships. (I don't know whether this has succeeded.) There's also some hope of delivering a secure service to registered endpoints at independent shops that can be audited for client security practices. This is the correct next step. With the state of webapp security today, there is NO HOPE AT ALL of delivering a secure service to the general public.

See also https://news.ycombinator.com/item?id=22851998

I don't work in this field, but the authors seem to be suggesting that hydroxychloroquine makes some things significantly worse. Patients who took hydroxychloroquine were much more likely to "need" supplementary oxygen. However, the two groups of patients were in two different hospitals. The paper doesn't discuss whether each hospital used exactly the same definition of "need" and had staff policies/practices that assessed this need with exactly the same amount of diligence.

I'd expect that there's significant spread of COVID-19 by persons who go to a convenience store with the primary purpose of buying a lottery ticket. Public lotteries continue to have benefits but I believe that, on balance, we need an immediate nationwide ban on in-person purchases of lottery tickets.

> We are considering using other unused address ranges, including the otherwise wasted 0.x.x.x

0.x.x.x is currently incompatible with WordPress: https://github.com/WordPress/WordPress/blob/641c632b0c9fde4e...

To put it another way, 0.x.x.x and 100.x.x.x don't have equivalent properties in WordPress. 0.x.x.x is blocked in some cases to prevent SSRF attacks. 100.x.x.x is considered a "normal" IP address.

I believe this idea is extremely important for improving software through contributions from capable but disenfranchised persons. I just want to suggest one minor process change that could be valuable in many environments.

1. Everyone is encouraged to make an anonymous pull request.

2. Anonymous pull requests are immediately visible to everyone who would ordinarily be able to a read a pull request.

3. However, by convention, nobody should spend any significant time looking at an anonymous pull request until after review by a senior person. At this initial stage, the senior person's job isn't to assess the details of the change, but only to assess the risk that the pull request may be wrong for reasons that aren't apparent within any of the modified files. The senior person then flags the pull request as either OK_TO_REVIEW or CANNOT_BE_ANONYMOUS.

4. When a flagger has set CANNOT_BE_ANONYMOUS, this means that the pull request -- if it were from a person who is new to the overall architecture or goals -- may generate a lot of review work even though the contribution has little chance of ever being used. In other words, you can waste a lot of time and money by reviewing a contribution when you have no context about the contributor's stature. Anomalies that may be noticed by a flagger vary across projects, but might include:

a. The code changes operate on untrusted data as if it were trusted.

b. The code changes operate on trusted data as if it were untrusted.

c. The code changes add expensive computation to the critical path.

d. The code changes improve a deprecated feature.

e. It violates the primary rule of Office Space ("Is This Good for the COMPANY?"). For example, adding this feature to Product X would reduce sales of Product Y.

5. When there's a CANNOT_BE_ANONYMOUS flag, anyone can add a non-anonymous comment of the form "I am developer MyName who has previously contributed. I understand the architecture and goals, and believe the flagger is wrong." Then, the flagger and MyName should try to reach agreement.

When thinking about whether a company is environmentally responsible, I'd look for something like "We have regular independent audits of our business processes to ensure that any job that can be performed from home effectively is always performed from home. We regularly assess each manager's ability to lead remote teams, and address all deficiencies, even if this means terminating employment."

EFF is incorrect that there are "basic guidelines" for authentication to websites that are integrated with physical-security systems, in which "locking the account until the owner can be contacted" is reasonable. The legitimate owner of a Ring device may have a specific need to access Live View within seconds of providing the correct authentication data. (For most other categories of web sites, temporarily disrupting legitimate logons is often acceptable.) A sample attack scenario is:

1. The threat actor knows the device's physical location, and has software to perform a brute-force attack on the account of the device owner.

2. The device owner happens to be, for whatever reason, signed out of the Ring app.

3. A 14 year old child of the device owner is home alone.

4. The threat actor launches the brute-force attack and then attempts to visit the home.

5. The child sends a text to ask the parent to immediately interrogate the visitor over Live View.

6. The parent cannot immediately logon.

7. In most cases, the family is less safe than if "locking the account until the owner can be contacted" doesn't ever happen.

The problem often isn't ability to automate. It's that the workers closest to the problem have an overwhelming disincentive to automate.

Suppose I have a low-level job in Peloton operations. Our Phalange Team must ensure that, before a bike's in-home delivery date is confirmed, the delivery technician has placed an internal order for a left phalange. Each of us spends all day navigating between the Sales app and the Internal Order app.

My daughter tells me how I can automate this. But I never do it. Why?

1. Even if I were 100% sure the coding would be finished in one day, the daily metrics for the Phalange Team would still signal a problem.

2. It introduces uncertainty. I can tell my manager exactly how long the manual process takes, but I can't tell her how long it takes to write code.

3. It trades off the mean for the variance. Suppose it handles 99.44% of the cases but there's a rare bug where it never sends a delivery date if the Internal Order backend has a timeout error. On average, scheduling is 90% faster but some customers aren't scheduled at all. Not an acceptable outcome.

4. If I successfully automate it, all of my coworkers lose their jobs.

They're ignoring the truncation problem. If I tell someone to look at the https://w3.org/something/6287297 URL, is that really correct, or did I botch a copy/paste of the https://w3.org/something/62872975 URL? I understand that https://w3.org/something/62872975.xml isn't optimal because XML might die. Is there a future-proof AND truncation-resistant approach, like always using https://w3.org/something/62872975.end regardless of the content type?

There are some customers who have "pain points" and may deserve "empathy" but are much less likely to reveal this to your call centers. Persons with certain mental health concerns don't use Netflix streaming because there can be a trigger from a preview (or even a single picture) of an item they didn't select. These persons prefer DVD-by-mail.

You can fix this. Somewhere in your account preferences UI should be a streaming option (maybe with an innocuous name such as "manual") that provides this one key benefit of the DVD-by-mail experience. You don't need to promote this option (other communities can do that for you), and you can make it extremely unlikely to be enabled accidentally. You should have time for design and implementation before Mental Health Awareness Month (May of each year).

For example: when the customer initially selects manual, the screen could say "We get it! Netflix will not show anything about an item (such as a movie or TV show) unless you have entered its title." You'd need a reasonable similarity algorithm (e.g., "13 season bachelorette" matches "The Bachelorette Season 13" but doesn't match "13 Reasons Why"). It's OK for the UI to ask occasionally about moving away from the manual option (e.g., "Should Netflix suggest any movies or TV shows for you?").

I think PSAPs should release a list of the most common questions they ask 911 callers. My kids basically know how and when to call 911, but they definitely aren't trained on the best answer to the "is this a house or an apartment" question cited in this BBC story. (In our case, the relevant answer is "house" even though our mailing address includes an apartment number.) Maybe I'd create a poster so they remember what to do under stress, e.g.,

DO tell the 911 operator that we live in a house, not an apartment

DO tell the 911 operator that we have five people in our family (omit the detail that our foster child isn't biologically related)

DO NOT tell the 911 operator that, technically, our fish are "pets"

DO NOT attempt to negotiate a Creative Commons license for the recording of the 911 call

The coolest cybersecurity job that ever existed was the cartoonist for JVN iPedia. There were dozens of security alerts with these cartoons, although I think only from 2007 until 2010 - for example:

https://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000398.html https://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000034.html https://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000040.html

Perl is good for a competent coder who doesn't work as a developer, occasionally has a one-off coding task, and wants to incorporate a code excerpt from the web and immediately execute it (and then throw the code away). Languages with whitespace as syntax often fail the "immediately execute" requirement.

This didn't come up in https://news.ycombinator.com/item?id=20363705 earlier this month. That "FreeBSD - A lesson in poor defaults" post said FreeBSD's OpenSSH port has "The NONE cipher is somewhat of a misfeature, removing the encryption bits and only keeping the data integrity. It allows users to accidentally shoot themselves in the foot pretty easily. The trade-off in performance isn't really worth it either, as the bottlenecks one might experience have a lot more to do with the MAC than the actual encryption."

So, when someone uses 44.0.0.0/9 where encryption isn't allowed, and they don't want to create and maintain their own OpenSSH fork, this FreeBSD code might be exactly what they want.

WordPress doesn't allow 0.0.0.0/8 in some contexts, as an attempt to block some types of SSRF:

https://github.com/WordPress/WordPress/blob/abcbee954f4d8baa...

If allocations in 0.0.0.0/8 happen someday, users will probably see similar misfeatures in many applications.

Many people browse the web from an employer who has rules about what types of pages may be accessed. For example, a person applying for a job with my team may include a link to a web page about their job-related background -- portfolio.html or whatever. HR tells us to be sure we don't follow links to any other page that may be more personal in nature, such as a page that reveals the applicant's marital status (which can't legally be considered in hiring decisions here). HR doesn't want to deal with complications from cases where we reject an applicant but there's a log entry showing a visit to, say, family.html from our company's IP address block. We'd prefer that prefetching isn't a default.

There's also log analysis to identify the set of web pages visited by each employee during work hours, and an attempt to programmatically estimate the amount of non-work-related web browsing. This feeds into decisions about promotions/termination/etc. Prefetching won't get anyone automatically fired, but we'd still prefer it isn't a default.

I'd be happy to pay. I don't because I object to the NYT privacy policy: "we gather ... a history of the pages you view ... We automatically combine this collected log-information with other information we collect about you ... We have a legitimate interest in disclosing or transferring your personal information to a third party in the event of any reorganization, merger, sale, joint venture ...."

I'd pay double or triple their current price if they announced support for anonymous access backed by frictionless anonymous payment.

New hires have trouble understanding that, occasionally, we have a valid business reason that a piece of code simply must EXIST. Yes, almost always, we want the code to exist and also be correct, or maintainable, or have other desirable properties. But not always. Sometimes the customer, or our own upper management, is completely fixated on the distinction between THINGS THAT EXIST and THINGS THAT DON'T EXIST. The worst possible day is when I hear back from the programmer about their perceived "progress" in which they have "evaluated design alternatives" or "better understood the problem."

It's documented at https://www.nacacnet.org/globalassets/documents/advocacy-and... as "if a candidate has been admitted Early Decision, then the college may notify the candidate’s high school and other colleges of the candidate’s application status." This is linked from https://www.nacacnet.org/advocacy--ethics/SPGP-NACAC-Code-of... on the NACAC's website.

Is there a citation for EFF's claim that "Originally used only for government websites, .US is now open to anyone with a connection to the U.S."? RFC 1386 section 1.3 says "In the past, the computers registered in the US Domain were primarily owned by small companies or individuals with computers at home."

In my area, local journalism had a sharp decline as soon as the publisher began requiring Facebook authentication for comments on the online stories. Previously there had been at least a dozen comments on any major story and now there are always zero. Apparently throwaway accounts can be most critical when the audience is your closest neighbors, especially when a poster is associated with a local business.

(Admittedly, there had been some abuse of the online comments and the publisher did save money in the short term by dropping any moderator effort from the payroll costs.)