tblFlip

breaking news: researchers discover that network protocols work as intended. mindlessly connecting to an untrusted network is still a bad idea.

to quote the article: "Do not use untrusted networks if you need absolute confidentiality of your traffic" or use HTTPS and a SOCKS5 proxy

yup yup yup. didnt steam also have some "fun" rm -rf bug a few years ago? proper backups and sandboxing go a long way

ok, after reading that article fully, it does sound a lot less concerning than the headline would like me to believe. it is early in the morning (almost 13:00) and this is a great chance to expose how little i know about all that, so i will:

They believed SSH traffic was immune [...].

classic. we always think that something is perfectly safe until it breaks. also, looking at the article, the issue with RSA has been known since 1996. there had to be a useful application for this. such as TLS. and now some SSH implementations.

Last year, researchers found that [...] they were still able to passively observe faulty signatures that allowed them to compromise the RSA keys of [...] Baidu.com

no idea how this adds any value in a discussion about SSH, but i chuckled.
now the article also get to some more interesting stats.

5.2 billion SSH records. of that 590k with invalid signatures and 4.9k revealed factorization for a total of 189 unique private keys.

now i would very much prefer that last number to be a solid zero, but out of 590k faults, only 4.9k were usable for the attack. everyone that thinks "oh thats nothing. im safe." is still a fool, but it could be far worse. especially since this only target RSA and leaves ed25519 (and others) untouched.

but it just gets even better:

The researchers traced the keys they compromised to devices that used custom, closed-source SSH implementations that didn’t implement the countermeasures found in OpenSSH and other widely used open source code libraries.

if i was drinking something reading this, i would have spat it out laughing. i am that kind of fun at parties. this also partially explains why there are "only" 590k invalid signatures in over 5.2 billion records total. and judging by how good some companies and organizations handle updates (assuming there will be updates from cisco, zyxel, hillstone and mocana), this will still be enough to be used in some attacks five years from now.

yep. and i wouldnt be surprised if that was intentional. how quickly they backed off on that one very much smells like a classic door in the face tactic. this whole WEI thing is far from being over

i honestly have so much trust into the whole music industry, and especially UMG, that id bet my best guillotine on this ending up to be absolutely detrimental to artists. if you have generative AI and can generate music for you, why even pay artists? sure sounds like the first step in that direction

absolutely. a lot of currently in use public key schemes may be broken with those. more recently there have been a few newer algorithm such as kyber that do have a chance to hold. think NIST is also holding a bit of a competition, but dont quote me on that. i really dont know alot about post-quantum crypto

im honestly not really surprised anymore. i fully expect to see a lot more of these types of bugs in the coming years

and im already dreaming of the day all of those (sometimes really hard to work with) pseudocode "implementations" that are scattered across wikipedia will be replaced with immediately runnable, CC-0 licensed code. itll probably take years, but i do like the idea

hah. no. not on a platform where the lead thinks serving you a good dozen unskippable ads to test your patience is a fun little experiment. sure is the year of big platforms trying everything to get rid of users

In cases when viewers feel they have been falsely flagged as using an ad blocker, they can share this feedback by clicking on the link in the prompt.

and you can bet that ill (ab)use that. might as well make it just a bit harder for them

does look good. the more i get to use jebora, the more i honestly get annoyed with it. lots of rough edges. hope liftoff will be a worthy replacement

reading that just once again reminded me of how much requirements for those services can differ from person to person. especially that section about integrations. never threw money at spotify or youtube music fwiw