81–90 of 159 posts
How is the user agent set? I'm trying out the free demo (free.cloudbrowser.xyz), and two different browsers (Chrome and Firefox) produce different and consistent user agents.
BrowserGap recursion https://i.imgur.com/RRC5Eh6.png
Earlier quoted context omitted.
And, if you're interested, read on for more detail. It works by providing a thin client over the web that you connect your regular browser to. The thin client provides an interface to a remote browser that you interact with the browser the public internet. This is significant because the internet is a cesspool of attacks. Malware, ransomware, virii, tracking, exploited PDFs, ways to deliver device zero days over the…
Genuinely curious: who’s your customer base? I mean, in theory the web is a cesspool of malware, but with reasonably good content blocking (I’m not even in the completely-disable-JS crowd) and conscious avoidance of shady sites, I managed to pretty easily stay clear of all attacks so far, at least over the past decade. Those way more paranoid than me still have the option of using local VMs/containers without too muc…
It sounds like with reasonably good content blocking a person can avoid all attacks, and it looks like using local VMs/containers mean then the attack needs an exceptional exploit chain to escape all the way, and it's hard to imagine any target being caught in a drive-by.
I agree. Also, internet-based attacks are a real problem for many businesses and organizations. For example, in 2016 Singapore government mandated that RBI had to be used because of ongoing attacks.[0]
How can it both be true that most people avoid any attacks whatsoever (and therefore that most simple measures are sufficient) while at the same time, malware is a real industry inflicting real damage on organizations?
I think of malware as an "industry" and as a collection "criminal enterprises" and from that viewpoint the malware industry has certain goals and markets it seeks to penetrate. If you don't find yourself in one of those target groups, that's a good thing. If you do, then you probably are already exploring RBI or CBII to some extent.
So your logic is correct and it looks like you are simply not in the target group.
At the same time, I think categorizing the only victim of web-based malware that can benefit from RBI/CBII as "extremely high value targets" is misleading. Perhaps the finance department in a Fortune 500 company is an "EHVT", but there's a lot of web-based attacks that succeed at targeting businesses and organization units of many different sorts, and the costs inflicted are significant and important, not just to "EHVTs".
Your concern about trust and the cloud is valid, and perceptive, as is the solution you propose (self-hosting). Self-hosting is indeed the right choice for many. That's one reason I think OSS has a role to play in RBI/CBII.
[0]: https://secureview.cloudbrowser.xyz/uploads/file1uod.8tyb6vb...
Earlier quoted context omitted.
Genuinely curious: who’s your customer base? I mean, in theory the web is a cesspool of malware, but with reasonably good content blocking (I’m not even in the completely-disable-JS crowd) and conscious avoidance of shady sites, I managed to pretty easily stay clear of all attacks so far, at least over the past decade. Those way more paranoid than me still have the option of using local VMs/containers without too muc…
I'll tell you the value of this software. I can build software for non prod environments and allow my developers/testers access. for instance, with wordpress, domains are hardcoded into the database leaving you with risky sed commands against mysqldumps. With this I can launch wordpress into its own environment where www.foobar.com resolves but I can run all dev code there. I currently use a proxy and have instructio…
Would you like to email me cris@dosycorp.com and we can discuss something tailored towards this? :)
I'd be really happy to help you.
Earlier quoted context omitted.
That is a "feature" of ReCAPTCHA, and I believe there might even be a patent on it. The idea is that if you are sure it's a bot and want to deny them access you still waste their resources by making them solve impossible captchas.
It also happens if you have extensive anti-fingerprinting measures in place. It doesn't go on forever though. 1 minute of captachas or so.
It really fucks with you when you're on TOR, especially.
Someone else already mentioned being hit by Google captchas and the developer of this service said that he switched to DDG as the default search provider. Nevertheless I tried Google and kept working through 15 (yes, fifteen) captchas in a row and Google still wouldn't let me through, and then I gave up. What the hell? Surely even after 1 captcha, Google should be amply convinced that I'm not a robot and let me did a…
That is a "feature" of ReCAPTCHA, and I believe there might even be a patent on it. The idea is that if you are sure it's a bot and want to deny them access you still waste their resources by making them solve impossible captchas.
How is the user agent set? I'm trying out the free demo (free.cloudbrowser.xyz), and two different browsers (Chrome and Firefox) produce different and consistent user agents.
Both the user agent and navigator platform strings are mirrored from the client.
Someone else already mentioned being hit by Google captchas and the developer of this service said that he switched to DDG as the default search provider. Nevertheless I tried Google and kept working through 15 (yes, fifteen) captchas in a row and Google still wouldn't let me through, and then I gave up. What the hell? Surely even after 1 captcha, Google should be amply convinced that I'm not a robot and let me did a…
Just kiddin'. Sometimes, I end up having to do unreasonably more captchas. The reason is that the system verified I am human, and it wants me to cooperate with it for free in order to authenticate more captchas. Machine learning, they call it. I call it un(der)paid labour. Never had 15 in a row though, so I suppose the already mentioned reason is more plausible.
Earlier quoted context omitted.
I'll tell you the value of this software. I can build software for non prod environments and allow my developers/testers access. for instance, with wordpress, domains are hardcoded into the database leaving you with risky sed commands against mysqldumps. With this I can launch wordpress into its own environment where www.foobar.com resolves but I can run all dev code there. I currently use a proxy and have instructio…
Have you tried using this? When I said > sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. it’s very much an understatement... Pretty sure your devs/testers won’t appreciate the experience. Frontend devs in particular can’t possibly work with this. I fail to see why it’s hard for you to spin up (possibly gated) dev/staging instances; certainly much easier and much less resource…
Customer base is people and organizations who are having problems with malware and cyber attacks.
> Have you tried using this? When I said > sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc.
> it’s very much an understatement... Pretty sure your devs/testers won’t appreciate the experience. Frontend devs in particular can’t possibly work with this.
I totally agree the image quality can be much improved. So I'm really sorry you had this experience today trying it out!
Would you be unwilling to mail me cris@dosycorp.com and I can contact you if and when I have image improvements to share?
Initially, I used JPEG for all clients, then for clients with browsers that support WebP (chrome) I switch on WebP since the quality increase is a LOT (but WebP in FF looks pixelated, so I hope I can find a way around that), even tho the bandwidth is the same.
For Safari and iOS the quality is on JPEG. It sounds like it has sacrificed the ability ot interact with text, resolution, color accuracy and frame rate, etc. I'm really sorry about this.
Some people seem okay to roll RBI out in a test deployment, without the code being open-sourced. I can't speak directly for them, but I assume that Symantec (who bought FireGlass Browser), Menlo, WEBGAP, Light Point, Ericom, Authentic8, Citrix all have some customers even tho they are not OSS. I think that, often, as long as the contract provides the ability to examine the code if required (due diligence) even without publishing it openly, sales happen.
It sounds like you're unfamiliar with RBI, is that right? This is still an emerging industry so it makes sense to me that even if you are in security you are unfamiliar with RBI.