Reputation
406
Top tag
Next privilege 500 Rep.
Access review queues
Badges
1 4 13
Newest
 Yearling
Impact
~28k people reached

  • 0 posts edited
  • 3 helpful flags
  • 133 votes cast
18h
awarded  Yearling
Mar
17
answered Do you consider PWGen safe to use?
Mar
17
comment Do you consider PWGen safe to use?
pwgen reads from /dev/random, or /dev/urandom, which is going to be partially seeded by your activity, like moving the mouse. Are you worried about something other than the seeding of the RNG?
Mar
2
comment Is the action of accepting a pull request on Github vulnerable to race conditions?
Not sure the problem @shelvacu is really about the 'pull requests', which as you said aren't specific to github. Rather the he seems interested in the how exactly the 'web based merge feature' of github' behaves. Anyway, it sure seems like it would be pretty easy to build a test. Create, a spare account, fork your a test project on a main account, send the PR, then make changes. See if the PR is linked to a specific commit, or just a specific branch. If it is linked to a specific commit, it doesn't seem like it should be possible to change and have the same commit hash.
Feb
12
awarded  Famous Question
Dec
18
comment What is happening now with the Grub backspace key security vulnerability?
Exploiting this vulnerability requires physical access to the computer during startup - Not necessarily. For a while I had linux boxes attached to a serial console server, that was accessible via dialup modem for OOB. If an attacker was able to bypass the console server authentication, and then wait for a reboot, or force one, they could exploit things remotely. There are also KVM over IP setups that, if improperly configured might permit remote console access without any other physical access. Anyway, this type of setup, is very uncommon these days.
Dec
10
comment Downloaded file checksums
@MikeOunsworth Interesting idea. I suspect if there was real demand we could modify the html spec to permit it. Perhaps add a checksum attribute to the <a> tag or something. Where the value check something would include the hash type, and hash value. So something like <a checksum="sha256:ewjRWqj34h..." href="downloadliso">link</a>
Dec
10
answered Downloaded file checksums
Dec
10
comment Somebody hacked my router and changed my wifi SSID
Is this 'router' provided by the ISP, or something you purchased? If it is your equipment, then a full reset + reconfigure would be a good idea. If it is ISP owned, I would contact your ISP and ask them for help doing a full reset+reconfigure.
Nov
5
comment How should we set up domain administrators?
people that are 100% trustworthy- AFAIK nobody like that exists in reality. Trust, but verify. So you should have some kind of auditing system in place they cannot easily subvert or something similar.
Oct
21
awarded  Nice Question
Sep
14
comment Securely encrypt drive, able to be decrypted independently of the OS
Truecrypt was the most cross-platform option. I haven't used any of the forks to see if the compatibility is being maintained.
Aug
10
awarded  Nice Answer
Nov
14
awarded  Notable Question
Nov
4
revised OpenVPN dhparam
edited tags
Nov
4
comment Pros/Cons to OpenVPN vs “VPN over OpenSSH”
Creating a tunnel over SSH (TCP) has some negative performance implications because of how TCP works. See: sites.inka.de/~W1011/devel/tcp-tcp.html
Oct
31
comment Is using self-signed certificates an option for this m2m scenario
How are you remotely managing these devices? I would be strongly tempted to manage them with puppet, which also happens to include a CA infrastructure and creates per-computer certs on every client. With that in place you simply need to trust your Puppet CA.
Oct
29
comment Clear EFS Cache at Set Interval
So, EFS works. However, he also wants the user to be prompted for their certificate password - Why? What type of attack does he think this would help in defending against? Making things pointlessly complex does not make the system more secure.
Sep
17
comment Download Torrents on University network without detection
I can do to prevent them from knowing? - Pay for your own internet connection.
Aug
19
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
I don't use username+foo@gmail.com only for spam prevention. It is also very useful for building rules within my mailbox. It is very effective for automatically sorting and filtering legitimate messages.