Viewing profile — banister

Ok. Well, the attack is so rare that i don't believe putting mitigations against the DoS is worth the effort. The mitigations are not that trivial (though it's arguable that just r…

Cool! glad we're on the same page finally :) Yeah, lots of cool stuff you can do with Linux. just wish that the other OSes were half as good, unfortunately most of them require ker…

Yes exactly. It becomes a "denial of service" against the option 121 pushed subnet routes. That's already discussed in the paper, i assumed you knew that already. There's nothing e…

Your examples are strange as you're using rfc1918 addresses (i.e private range) rather than public ips. So all your examples are very odd. 10.7.7.7 will get dropped. This is correc…

Read my reply to the other poster, i answer exactly this. Actually test it yourself. Stop theorizing. I tested it. It works exactly as I said. I think i know where you're confused.…

No, you're wrong again. I just tested this (simulating routes added by a DHCP option 121) and it works exactly as I said. C is what happens. But it doesn't happen the way you say a…

Let's walk through this step by step because there's a lot of confusion on your end. * Step one - You connect your computer to a network - yes you'll get a DHCP lease, and you'll g…

Well said. This is a nothing-burger for all VPNs except the ones that are likely heavily leaking already due to the absence of basic firewall rules. Their "side channel attack" als…

I'm talking about the specific side channel attack mentioned in their report. Not side channels generally ;)

Yes. I just provided simplified firewall rules in my answer. You also need to whitelist either the VPN endpoint itself (and add a route to that endpoint) or you need to whitelist t…

"closing specified programs" has to be the silliest thing i've ever heard. By the time you close it, it's probably already leaked thousands of packets. The leak of a SINGLE packet …

Mobile is an exception (but they already state android is immune), let's stick to desktop for the sake of discussion, the 3 major desktop platforms: mac, win, linux :) On mac - jus…

The side channel attack is silly and impractical. You know it's silly. I know it's silly. Let's quit pretending. The firewall rule is 100% sufficient to defend against this exploit…

They don't know what they're talking about. Kill switches are not "tripped" there is no "control channel". A kill switch is just a firewall rule that is ALWAYS engaged and all it d…

The "side channel" is silly. You assume someone is hitting the same endpoint over and over and over and with significantly high traffic that it rises above the noise. Did u even do…

Most decent VPNs are already protected against it. It's a simple firewall rule known as leak protection or a kill switch which blocks all off-VPN traffic including on option 121 ro…

I looked at this in detail. This exploit is a nothing-burger for most decent VPNs. A simple "leak protection" (aka Killswitch) firewall rule completely negates this attack. All dec…

Mullvad does not have split tunneling, so it's a no-go from me. Also their client looks like ass and is a RAM hungry electron app.

whose

Why are you talking about rape? I thought rape required penetrative sex, this is a sexual assault isn't it?

which features is pry missing?

``` If methods were first-class functions, this would work — > method_a would return method_b, which would then execute when x() was called. This doesn't work because Ruby methods …

REPL requires [binding_of_caller]( https://github.com/banister/binding_of_caller ) anyway, which i doubt rails would include any time soon ;)