Notices by rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de), page 9

rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Saturday, 03-Mar-2018 07:23:26 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
- Huggenknubbel :apache:
@hughenknubbel Lol, welche App oder was ist das?

In conversation Saturday, 03-Mar-2018 07:23:26 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Friday, 02-Mar-2018 14:57:26 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
- Simon Rupf
@elrido I've asked: https://discourse.janitor.technology/t/how-to-add-a-project/165
In conversation Friday, 02-Mar-2018 14:57:26 EST from gnusocial.de permalink
Attachments
1. How to add a project?
  
  from Janitor community forum
  
  How can one add a project? It is not clear to me and documenting might be useful.
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Thursday, 01-Mar-2018 17:08:29 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk

Want to contribute something to Firefox, Chromium, Rust and more big projects?

Try out https://janitor.technology/. It does take all the work of setting up your environment for you.

In conversation Thursday, 01-Mar-2018 17:08:29 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Thursday, 01-Mar-2018 16:29:31 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk

Nooooooooooo… #setenforce http://stopdisablingselinux.com/

@@mulander@bsd.network
https://gnusocial.de/notice/13809990

In conversation Thursday, 01-Mar-2018 16:29:31 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Thursday, 01-Mar-2018 16:29:13 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
- mulander
@mulander Nooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo… http://stopdisablingselinux.com/

In conversation Thursday, 01-Mar-2018 16:29:13 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Thursday, 01-Mar-2018 15:11:24 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
- jomo :verified:
@jomo You cannot solve the issue of PKI. The system itself, considering certificate transparency and stuff is already quite well for TLS. #Trustico's issue could be prevented by stopping (preventing) users from generating keys in websites. That has not much to do with PKI.

Currently there do not exists alternatives, which scale as well as the current PKI.

In conversation Thursday, 01-Mar-2018 15:11:24 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Thursday, 01-Mar-2018 15:02:24 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk

GitHub hit by most powerful #DDOS attack to date.

https://www.wired.com/story/github-ddos-memcached/
In conversation Thursday, 01-Mar-2018 15:02:24 EST from gnusocial.de permalink
Attachments
1. GitHub Survived the Biggest DDoS Attack Ever Recorded
  
  from WIRED
  
  On Wednesday, a 1.3Tbps DDoS attack pummeled GitHub for 15-20 minutes. Here's how it stayed online.
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Thursday, 01-Mar-2018 14:33:35 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk

RT @Manawyrm #Trustico https://gnusocial.de/attachment/4965679

In conversation Thursday, 01-Mar-2018 14:33:35 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Monday, 26-Feb-2018 18:10:22 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk

Seems to be black/white historic time at pocket right now…

https://gnusocial.de/attachment/4953218

In conversation Monday, 26-Feb-2018 18:10:22 EST from gnusocial.de permalink
jomo :verified: (jomo@mstdn.io)'s status on Monday, 26-Feb-2018 10:03:37 EST jomo :verified:
- hanno
RT @hanno
simple vulns are the best: turned out you can reset a facebook pw with a 6 digit code and that you could bruteforce on their beta instance which didn't have a rate limit https://medium.freecodecamp.org/responsible-disclosure-how-i-could-have-hacked-all-facebook-accounts-f47c0252ae4d

In conversation Monday, 26-Feb-2018 10:03:37 EST from mstdn.io permalink Repeated by rugk
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Sunday, 25-Feb-2018 17:13:18 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
- Thomas :Anoxinon:
@thomas Yeah, also consider that bad, but the develpers now use/"recommend"/link to OpenSuse's build service…Don't really like that, though…

In conversation Sunday, 25-Feb-2018 17:13:18 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Friday, 23-Feb-2018 19:41:24 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
- Jens Kubieziel
@qbi Eindeutig: https://emailselfdefense.fsf.org/de

(für standardmäßiges PGP, so was wie Mailvelope oder PeP würde ich immer noch als Alternative mit nennen, die lassen sich ja aber auch einfach einrichten)

In conversation Friday, 23-Feb-2018 19:41:24 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Friday, 23-Feb-2018 11:17:48 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk

Hooray! A #FLOSS fork of #MapsMe is available on F-Droid: https://f-droid.org/packages/com.github.axet.maps/

The original Maps.me is tracking and doing stupid things like showing notifications and annoying you to allow to download more data from the internet for POIs.

In conversation Friday, 23-Feb-2018 11:17:48 EST from gnusocial.de permalink
Nuntius (nuntius@mastodon.club)'s status on Friday, 23-Feb-2018 09:33:16 EST Nuntius

Right, I just discovered that there is open source cola.
Open source cola.
Whaaat?
https://en.wikipedia.org/wiki/Open-source_cola

In conversation Friday, 23-Feb-2018 09:33:16 EST from mastodon.club permalink Repeated by rugk
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Friday, 23-Feb-2018 11:17:07 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
- Nuntius
@nuntius But they did something wrong: They only used GPL. They should have chosen the AGPL, because when I now use the recipe on my server and deliver the result to the user, they would not have the right to get the source, would they? 😂

In conversation Friday, 23-Feb-2018 11:17:07 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Wednesday, 21-Feb-2018 15:04:15 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk

Yeah, #StreetComplete v4.0 is out! With a lot of new quests, big features like photo attachments and an own mapstyle! 🎉

https://github.com/westnordost/StreetComplete/releases/tag/v4.0
In conversation Wednesday, 21-Feb-2018 15:04:15 EST from gnusocial.de permalink
Attachments
1. westnordost/StreetComplete
  
  from GitHub
  
  StreetComplete - Surveyor app for Android
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Wednesday, 21-Feb-2018 12:26:37 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk

What HTTPS does *not* fix…

https://textslashplain.com/2018/02/14/understanding-the-limitations-of-https/
In conversation Wednesday, 21-Feb-2018 12:26:37 EST from gnusocial.de permalink
Attachments
1. Understanding the Limitations of HTTPS
  
  By ericlaw from text/plain
  A colleague recently forwarded me an article about the hazards of browsing on public WiFi with the question: “Doesn’t HTTPS fix this?” And the answer is, “Yes, generally.” As with most interesting questions, however, the complete answer is a bit more complicated.
  
  HTTPS is a powerful technology for helping secure the web; all websites should be using it for all traffic.
  
  If you’re not comfortable with nitty-gritty detail, stop reading here. If your takeaway upon reading the rest of this post is “HTTPS doesn’t solve anything, so don’t bother using it!” you are mistaken, and you should read the post again until you understand why.
  
  HTTPS is a necessary condition for secure browsing, but it is not a sufficient condition.
  
  There are limits to the benefits HTTPS provides, even when deployed properly. This post explores those limits.
  
  Deployment Limitations
  
  HTTPS only works if you use it.
  
  In practice, the most common “exploit against HTTPS” is failing to use it everywhere.
  
  Specify HTTPS:// on every URL, including URLs in documentation, email, advertisements, and everything else. Use Strict-Transport-Security (preload!) and Content-Security-Policy’s Upgrade-Insecure-Requests directive (and optionally Block-All-Mixed-Content) to help mitigate failures to properly set URLs to HTTPS.
  
  Mixed Content – By default, browsers will block non-secure scripts and CSS (called “Active Mixed Content”) from secure pages. However, images and other “Passive Mixed Content” are requested and displayed; the page’s lock icon is silently hidden.
  
  Non-secure Links – While browsers have special code to deal with Active and Passive mixed content, most browsers do nothing at all for Latent Mixed Content, where a secure page contains a link to a non-secure resource. Email trackers are the worst.
  
  Privacy Limitations
  
  SNI / IP-Address – When you connect to a server over HTTPS, the URL you’re requesting is encrypted and invisible to network observers. However, observers can see both the IP address you’re connecting to, and the hostname you’re requesting on that server (via the Server Name Indication ClientHello extension).
  
  TLS 1.3 proposes a means of SNI-encryption, but (unless you’re using something like Tor) an observer is likely to be able to guess which server you’re visiting using only the target IP address. In most cases, a network observer will also see the plaintext of the hostname when your client looks up its IP address via the DNS protocol (maybe fixed someday).
  
  Data Length – When you connect to a server over HTTPS, the data you send and receive is encrypted. However, in the majority of cases, no attempt is made to mask the length of data sent or received, meaning that an attacker with knowledge of the site may be able to determine what content you’re browsing on that site. Protocols like HTTP/2 offer built-in options to generate padding frames to mask payload length, and sites can undertake efforts (Twitter manually pads avatar graphics to fixed byte lengths) to help protect privacy. More generally, traffic analysis attacks make use of numerous characteristics of your traffic to attempt to determine what you’re up to; these are used by real-world attackers like the Great Firewall of China. Attacks like BREACH make use of the fact that when compression is in use, leaking just the size of data can also reveal the content of the data.
  
  Ticket Linking – TLS tickets can be used to identify the client. (Addressed in TLS1.3)
  
  Referer Header – By default, browsers send a page’s URL via the Referer header (also exposed as the document.referrer DOM property) when navigating or making resource requests from one HTTPS site to another. HTTPS sites wishing to control leakage of their URLs should use Referrer Policy.
  
  Server Identity Limitations
  
  Certificate Verification – During the HTTPS handshake, the server proves its identity by presenting a certificate. Most certificates these days are issued after what’s called “Domain Validation”, a process by which the requestor proves that they are in control of the domain name listed in the certificate.
  
  This means, however, that a bad guy can usually easily get a certificate for a domain name that “looks like” a legitimate site. While an attacker shouldn’t be able to get a certificate for https://paypal.com, there’s little to stop them from getting a certificate for https://paypal.co.com. Bad guys abuse this.
  
  Some sites try to help users notice illegitimate sites by deploying Extended Validation (EV) certificates and relying upon users to notice if the site they’re visiting has not undergone that higher-level of vetting. Sadly, a number of product decisions and abysmal real-world deployment choices mean that EV certificates are of questionable value in the real-world.
  
  Even more often, attackers rely on the fact that users don’t understand URLs at all, and are willing to enter their data into any page containing the expected logos:
  
  One Hop – TLS often protects traffic for only one “hop.” For instance, when you connect to my https://fiddlerbook.com, you’ll see that it’s using HTTPS. Hooray!
  
  What you didn’t know is that this domain is fronted by Cloudflare CDN’s free tier. While your communication with the Content Delivery Network is secure, the request from the CDN to my server (http://fiddlerbook.com) is over plain HTTP. A well-positioned attacker could interfere with your connection to the backend site by abusing that non-secure hop. Overall, using Cloudflare for HTTPS fronting improves security in my site’s scenario (protecting against some attackers), but browser UI limits mean that the protection probably isn’t as good as you expected. Here’s a nice video on this.
  
  Multi-hop scenarios exist beyond CDNs; for instance, a HTTPS server might pull in a HTTP web service or use a non-secure connection to a remote database on the backend.
  
  DOM Mixing – When you establish a connection to https://example.com, you can have a level of confidence that the top-level page was delivered unmolested from the example.com server. However, returned HTML pages often pull in third-party resources from other servers, whose certificates are typically not user-visible. This is especially interesting in cases where the top-level page has an EV certificate (“lighting up the green bar”), but scripts or other resources are pulled from a third-party with a domain-validated certificate.
  
  Sadly, in many cases, third-parties are not worthy of the high-level of trust they are granted by inclusion in a first-party page.
  
  Server Compromise – HTTPS only aims to protect the bytes in transit. If a server has been compromised due to a bug or a configuration error, HTTPS does not help (and might even hinder detection of the compromised content, in environments where HTTP traffic is scanned for malware by gateway appliances, for instance). HTTPS does not stop malware.
  
  Server Bugs – Even when not compromised, HTTPS doesn’t make server code magically secure. In visual form:
  
  Client Identity Limitations
  
  Client Authentication – HTTPS supports a mode whereby the client proves their identity to the server by presenting a certificate during the HTTPS handshake; this is called “Client Authentication.” In practice, this feature is little used.
  
  Client Tampering – Some developers assume that using HTTPS means that the bytes sent by the client have not been manipulated in any way. In practice, it’s trivial for a user to manipulate the outbound traffic from a browser or application, despite the use of HTTPS.
  
  Features like Certificate Pinning could have made it slightly harder for a user to execute a man-in-the-middle attack against their own traffic, but browser clients like Firefox and Chrome automatically disable Certificate Pinning checks when the received certificate chains to a user-installed root certificate. This is not a bug.
  
  In some cases, the human user is not a party to the attack. HTTPS aims to protect bytes in transit, but does not protect those bytes after they’re loaded in the client application. A man-in-the-browser attack occurs when the client application has been compromised by malware, such that tampering or data leaks are performed before encryption or after decryption.
  
  Real-world Implementation Limitations
  
  Early Termination Detection – The TLS specification offers a means for detecting when a data stream was terminated early to prevent truncation attacks. In practice, clients do not typically implement this feature and will often accept truncated content silently, without any notice to the user.
  
  Validation Error Overrides – HTTPS deployment errors are so common that most user-agents allow the user to override errors reported during the certificate validation process (expired certificates, name mismatches, even untrusted CAs etc). Clients range in quality as to how well they present the details of the error and how effectively they dissuade users from making mistakes.
  
  Further Reading
  
  HTTPS Not a Magic Bullet
  
  TOR and HTTPS
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Wednesday, 14-Feb-2018 19:06:45 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
in reply to
- rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
And BTW for everyone who has noticed: Yes, when in many timezones I am too late now, I am sorry, but that writeups needed some time. :)

In conversation Wednesday, 14-Feb-2018 19:06:45 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Wednesday, 14-Feb-2018 19:01:45 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
in reply to
- I love Free Software
- rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
My second !ilovefs thanks goes to #AFWall+, as one project, you may easily forget, because it runs so flawless in the background. Let it stand for all the projects, which we never thanks, because we do not notice them.

https://www.thankyouopensource.com/letter/272/A-small-piece-of-software-you-might-easily-forget/

In conversation Wednesday, 14-Feb-2018 19:01:45 EST from gnusocial.de permalink
rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de)'s status on Wednesday, 14-Feb-2018 18:40:43 EST rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk
- I love Free Software
My !ilovefs "winners" for this year are chosen! After last year had one big winner, I am back at two smaller projects, which were nonetheless not less important!

So number one is #StreetComplete by #westnordost. It's in many ways and wesome project and much more than a simple app! Find my whole write-up here (https://github.com/westnordost/StreetComplete/issues/866 ). https://gnusocial.de/attachment/4902495

In conversation Wednesday, 14-Feb-2018 18:40:43 EST from gnusocial.de permalink

After
Before

Public

Notices by rugk -> ⚠️ Follow me at https://social.wiuwiu.de/@rugk (rugk@gnusocial.de), page 9