51–60 of 196 posts
> More than a decade ago, this site published Krebs’s Three Rules for Online Safety, of which Rule #1 was, “If you didn’t go looking for it, don’t install it.” It’s nice to know that this technology-agnostic approach to online safety remains just as relevant today. Still a very good practice today.
Earlier quoted context omitted.
You're a web developer but your mental map of the web consists of "documents" on one end and "applications like a video game, video/audio/level/text editor(s)" on the other? You haven't in your career, stumbled across web (sites/apps) that sit somewhere on the spectrum between the extremes of "document" vs "app"? It strikes me that there's a fairly even distribution between those two points - even if we discount all…
> Progressive enhancement is a strategy in web design that puts emphasis on web content first, allowing everyone to access the basic content and functionality of a web page, whilst users with additional browser features or faster Internet access receive the enhanced version instead. Why isn't this still the norm?
> More than a decade ago, this site published Krebs’s Three Rules for Online Safety, of which Rule #1 was, “If you didn’t go looking for it, don’t install it.” It’s nice to know that this technology-agnostic approach to online safety remains just as relevant today. Still a very good practice today.
Easier to just remove local admin from end-users than hope they'll act intelligently.
I get that the angle of BNC here generates views (and outrage and haha blockchain bad). But the real story is "WordPress websites still hacked in masses". WordPress, somehow, cannot manage to turn themselves into a secure and tough system. It remains a prime target, it's installations get hacked by the thousands and it's causing real harm at that. (Yeah, yeah, I know the users, admins, plugins, themes and hosted are…
I have to host a few dozen WordPress sites for customers and the ones that got hacked were all backtracked to: enumerating usernames, and some had their password equal that. You could blame WordPress for not being more strict rejecting those per default.
Earlier quoted context omitted.
It’s been great for gambling, cybercrime, and enabling the drug trade practically since its inception.
I really think Monero in particular deserves way more criticism for their practice. Bitcoin is one thing, Monero is created for and marketed towards cybercriminals, you don't need to be a communications expert to get that premise. I haven't seen it used once for any legitimate purpose. Atleast with Bitcoin and Ethereum you can get buy some legitimate things like VPNs or NFTs https://arstechnica.com/information-techno…
Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…
I would argue that a world that didn't have JS would make these types of attacks more common, not less common. Because in that world, people would have to download desktop apps for everything, which would make people used to downloading desktop apps from random Web pages, which would make malware easier to distribute. In fact, we don't have to imagine that world: it was the world of the late 90s.
I get that the angle of BNC here generates views (and outrage and haha blockchain bad). But the real story is "WordPress websites still hacked in masses". WordPress, somehow, cannot manage to turn themselves into a secure and tough system. It remains a prime target, it's installations get hacked by the thousands and it's causing real harm at that. (Yeah, yeah, I know the users, admins, plugins, themes and hosted are…
Until developers are widely taught how to develop secure software, the problem will just keep moving around. We can't make software development environments where it's impossible to create a vulnerability, and we will never convince users to stop wanting new capabilities. Making things secure in the first place needs to be part of the solution.
> The company said all addresses associated with the spread of the malware have been blacklisted How does this work? Can a single entity really just blacklist certain addresses? How is this decentralized?
I am kinda surprised you haven't heard about this already. This has been used in the past to take down NFTs [0] and to make Bitcoins unspendable [1]
It's the famous "on chain only" caveat: all the decentralized systems are only decentralized in the ideal world, if nothing except the chain exists. Once practical reality comes in, there are plenty of levers for centralized control.
They could also use ipfs as there are many http proxies for it including cloudflare. All proxies would individually need to blacklist the address. In general it is going to be impossible to block content. We need to charge for bytes or something like that. But that produces other problems which could be worse
There will be occasional false positives and some people would complain, but most IPFS gateway operators would just choose the top blocklist for simplicity.
So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…
So long as there is uncensorable data anywhere, this will always remain possible.