Viewing profile — ckuehl

Purely a guess, but I've sometimes been able to work backwards from the content length (very often included in HTTP server logs) to figure out what the body had to be.

The authors of The Expanse published an article last year acknowledging and paying tribute to the mission ("How a NASA robot messed up our science fiction"): https://www.nationalge…

Also keep in mind that if you use IP-based whitelisting, an attacker can register their own CF/Fastly account and target your origin server with whatever CDN settings they want (as…

Another thing that isn't perfect but could help is doing a search of package contents of a large distro, e.g. here's a search of Debian for packages that provide a file called "nod…

This is a somewhat dangerous pattern for picking temporary files (from #8): $ NEWFILE=/tmp/newfile_${RANDOM} $ touch $NEWFILE The problem is that any user on the box can create fil…

From the Spectre paper: > As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process …

There are some amusing notes about the /bin/true copyright claim here: http://trillian.mit.edu/~jc/humor/ATT_Copyright_true.html

I've been using my packaged version pretty extensively (mostly in virtualenvs) and haven't encountered any issues yet myself, but would definitely be interested to hear (either on …

Chris Lamb, the current Debian Project Leader, has said that it will not be in stretch but could potentially be available in stretch-backports: > If someone puts in the work, sure …

I agree. Looks like I only noticed the apt-get install line and incorrectly assumed that's what you were referring to.

A benefit of installing using your system package manager is that you can rely on your distro to manage the security of the package. If you just `pip install` it, you need to perso…

Totally agreed they have the right to monitor your network traffic, but I still think in most cases employees should try to push back on this. At least from my view, it's not so mu…

I found interesting djb's blog post about a theoretical scenario where mixing entropy can actually be dangerous: https://blog.cr.yp.to/20140205-entropy.html

ISPs usually use the designated block (100.64.0.0/10) for this to avoid collisions with home networks: https://tools.ietf.org/html/rfc6598#section-7 Webpass is an example of a "goo…

Most operating systems have started detecting captive portals and presenting a notification. All of the modern consumer ones (OS X, Windows, Android, iOS) appear to have this detec…

BART doesn't have that type of ticket. You tag your Clipper card (or insert your BART ticket, if you're not a frequent rider) upon entering a station, and again when exiting at you…

For what it's worth, ISPs are definitely shaping traffic to try to game results on public speed tests. I had an issue with Comcast last year where I would have large latency spikes…

Just keep in mind that unstable is not guaranteed to get security fixes promptly, either. The Debian Security Team only handles supported releases. The Security Team FAQ is a good …

Just want to emphasize (and this is not directed specifically at you): you almost certainly shouldn't run Debian testing on anything that is public-facing. Packages get migrated to…

Just be very careful which direction you point those arrows :-) I've have similar nightmares about typoing `if` and `of` when using dd.

Good question! The problem is trying to signal it from outside the Docker container. If your container has a process tree like PID 1: /bin/sh +--- PID 2: then if you use `docker si…

Yup, tini is really really similar and looks pretty cool! They're solving much of the same problem. It's unfortunate that we didn't find tini before we went and wrote dumb-init. Th…

> From my own experience with docker in production, I'm yet to see any of the described scenarios crop up. Has anyone else, or is this solving an extreme edge case? The biggest iss…