UFO VPN claims zero-logs policy, leaks 20M user logs [resolved]

Post by zaszrespawned » Sat, Jul 18, 2020, 2:07 PM UTC

mattmein wrote: post #181

ayende wrote: post #180

Earlier quoted context omitted.

With RavenDB, you cannot setup a unsecured server unless you are _really_ trying. And we worked on getting secured setup to be a click through process with under 10 minutes to setup a whole cluster. You can see it here: https://www.youtube.com/watch?v=K-2iZ_lJVag That was done explicitly because of issues like that. Security isn't a feature, and the fact that your product keep leaking details is not the fault of the…

This is completely unrelated, but I remember your blog about dotnet development. I followed it about 10 years ago and remember when you started with RavenDb. I haven't done any dotnet development in about 7 years, but you taught me a lot about programming properly. Thanks. I'm glad RavenDb is still going well.

Post by jakear » Sat, Jul 18, 2020, 2:27 PM UTC

hkt wrote: post #183

jakear wrote: post #147

Earlier quoted context omitted.

Saw an article a while back (years) saying NSA/FBI is able to track TOR connections and won’t say how even if it means they’d forfeit some cases.. anyone remember this? Edit to add: Also, it’s public knowledge that TOR is funded by the DoD, it seems extremely feasible that they privately control a sizable chunk of nodes. Based on what I know of American 3 letter agencies, I don’t think one could resist designing a “s…

Most Tor nodes are actually in Germany. You can see a map of them https://tormap.void.gr/ The design of the system is resilient to some nodes being under hostile control, too.

Post by ThePowerOfFuet » Sat, Jul 18, 2020, 2:42 PM UTC

coronadisaster wrote: post #199

ffpip wrote: post #166

Earlier quoted context omitted.

As it should? You're on a call. You lock the phone. You expect the call to continue right? This bug is in their new browser. Its in a very early stage. So these bugs are expected

No, I dont expect the camera to stay ON (even for a video call) if I lock the phone.

Post by rantanplan » Sat, Jul 18, 2020, 2:53 PM UTC

dcow wrote: post #158

outworlder wrote: post #100

Unsecured Elasticsearch, once again. ( https://www.theregister.com/2020/07/17/ufo_vpn_database/ ) So ES has insecure defaults, I get that and it's been discussed to death. But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS. Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT…

What's the difference between a VPC and iptables? I agree that you shouldn't expose insecure services. But why do I need to introduce an entire private address space and cloud-managed SDN services to achieve that goal? If it weren't industry status quo, I'd almost call you a shill for the union of ops teams working to secure jobs for years to come. Almost.. (;

Post by rmrfrmrf » Sat, Jul 18, 2020, 4:24 PM UTC

fishywang wrote: post #67

rmrfrmrf wrote: post #31

Earlier quoted context omitted.

it's good for things like public wifi and other untrusted networks since your data is encrypted from your machine to the vpn server

it's 2020. if you're still relying on vpn connection to provide encryption, you are doing it wrong. (I understand there are certain cases you have to deal with unencrypted traffic, but those should be really rare now).