Only if you accept using random 2 star github repo (that may come with free supply chain attack) instead of the maintainer supplied one with 60k.
C++ has lost touch with reality a few years ago. Modules, a feature 6 years old still only have partial support [1] and are nowhere to be seen in practical use. Good luck finding g a C++ library using modules. This may…
From my perspective zig doesn't have "big cleanup" upfront. It's removing older features as it goes. stdlib changes as it wants from version to version. So do language features. Since zig is pre-1.0, zig foundation…
Instead of debating for years (like other languages), zig just tries things out. Worst case you can always rollback changes. IMO best APIs and designs are those that are battle tested by end users, not won in an…
Except that many component manufacturers release their efi capsules signed with Microsoft PKI. So no, you can't fully remove them if you want to verify updates.
Both AMD and Google note, that Zen[1-4] are affected, but what changed about Zen5? According to the timeline, it released before Google notified AMD [1]. Is it using different keys, but same scheme (and could possibly…
Linux Local Privilege Escalation, but the attacker has to be in sudo group in the first place. Great read, but this feels like academic research. Technically correct, but impractical at best.
If you want to manage VMs, then you're probably using terraform + provider. However, SDN (Software Defined Networking) is not yet supported [1], which makes any kind of deployment with network separation not feasible…
Yes, loopix. https://www.usenix.org/conference/usenixsecurity17/technical...
GitHub is slowly rolling out feature over moe than a year [1], which will have positive impact on overall IT security. Spending 1 minute setting up 2FA is really not a big deal. [1]…
Depends how much patience you have. Firejail if you want ease of use (there are a lot of ready profiles to be used). Bubblewrap if you want more security, at the cost of having to do more manual work. TL;DR Firejail is…
Sounds like amazing material for a CCC talk.
While authelia is quite cool "infra-as-code" tool, since you have your entire configuration in yaml form, for those not willing to spend a few evenings configuring SSO, there is authentik [1] which features management…
When performing forensic analysis, metrics don't usually help that much. I'd rather sift 2PB of logs, knowing that information I'm looking for is in there, than sit at the usual "2 weeks of nginx access logs which roll…
From my experience, you either go full reproducible builds with nix, or none at all. Sitting in the middle results with additional downsides from modifying pipeline without core upsides of reproducible builds.
Just last week google CTF featured a reverse engineering challenge of a neo geo game! https://capturetheflag.withgoogle.com/challenges/rev-arcade Also, the neo geo development wiki is an absolute goldmine of technical…
The gotcha is that "global" args don't propagate automatically to all stages (thin includes 1 stage builds). I want this one arg in multiple stages, so I'll declare it above everything is the chain of thought.
For me it means: 1) don't expose it to public internet 2) don't give it untrusted input Which highly reduces the usability factor for me.
Only if you accept using random 2 star github repo (that may come with free supply chain attack) instead of the maintainer supplied one with 60k.
C++ has lost touch with reality a few years ago. Modules, a feature 6 years old still only have partial support [1] and are nowhere to be seen in practical use. Good luck finding g a C++ library using modules. This may…
From my perspective zig doesn't have "big cleanup" upfront. It's removing older features as it goes. stdlib changes as it wants from version to version. So do language features. Since zig is pre-1.0, zig foundation…
Instead of debating for years (like other languages), zig just tries things out. Worst case you can always rollback changes. IMO best APIs and designs are those that are battle tested by end users, not won in an…
Except that many component manufacturers release their efi capsules signed with Microsoft PKI. So no, you can't fully remove them if you want to verify updates.
Both AMD and Google note, that Zen[1-4] are affected, but what changed about Zen5? According to the timeline, it released before Google notified AMD [1]. Is it using different keys, but same scheme (and could possibly…
Linux Local Privilege Escalation, but the attacker has to be in sudo group in the first place. Great read, but this feels like academic research. Technically correct, but impractical at best.
If you want to manage VMs, then you're probably using terraform + provider. However, SDN (Software Defined Networking) is not yet supported [1], which makes any kind of deployment with network separation not feasible…
Yes, loopix. https://www.usenix.org/conference/usenixsecurity17/technical...
GitHub is slowly rolling out feature over moe than a year [1], which will have positive impact on overall IT security. Spending 1 minute setting up 2FA is really not a big deal. [1]…
Depends how much patience you have. Firejail if you want ease of use (there are a lot of ready profiles to be used). Bubblewrap if you want more security, at the cost of having to do more manual work. TL;DR Firejail is…
Sounds like amazing material for a CCC talk.
While authelia is quite cool "infra-as-code" tool, since you have your entire configuration in yaml form, for those not willing to spend a few evenings configuring SSO, there is authentik [1] which features management…
When performing forensic analysis, metrics don't usually help that much. I'd rather sift 2PB of logs, knowing that information I'm looking for is in there, than sit at the usual "2 weeks of nginx access logs which roll…
From my experience, you either go full reproducible builds with nix, or none at all. Sitting in the middle results with additional downsides from modifying pipeline without core upsides of reproducible builds.
Just last week google CTF featured a reverse engineering challenge of a neo geo game! https://capturetheflag.withgoogle.com/challenges/rev-arcade Also, the neo geo development wiki is an absolute goldmine of technical…
The gotcha is that "global" args don't propagate automatically to all stages (thin includes 1 stage builds). I want this one arg in multiple stages, so I'll declare it above everything is the chain of thought.
For me it means: 1) don't expose it to public internet 2) don't give it untrusted input Which highly reduces the usability factor for me.