r00ty

joined 2 years ago
[–] r00ty@kbin.life 16 points 4 months ago (4 children)

I've not read the CVE but assuming it works on any IPv6 address including the privacy extensions addresses, it's a problem. Depending on what most routers do in terms of IPv6 firewalling.

My opinion is, IPv6 firewalls should, by default, offer similar levels of security to NAT. That is, no unsolicited incoming connections but allow outgoing ones freely.

In my experience, it's a bit hit-and-miss whether they do or not.

Now, if this works on privacy extension addresses, it's a problem because the IPv6 address could be harvested from outgoing connections and then attacked. If not, then scanning the IPv6 space is extremely hard and by default addresses are assigned randomly inside the /64 most people have assigned by their ISP means that the address space just within your own LAN is huge to scan.

If it doesn't work on privacy extension IPs, I would say the risk is very low, since the main IPv6 address is generally not exposed and would be very hard to find by chance.

Here's the big caveat, though. If these packets can be crafted as part of a response to an active outgoing TCP circuit/session. Then all bets are off. Because a popular web server could be hacked, adjusted to insert these packets on existing circuits/sessions in the normal response from the web server. Meaning, this could be exploited simply by visiting a website.

[–] r00ty@kbin.life 2 points 4 months ago

God damn it Lrrr. You just had to keep off it for two weeks, TWO WEEKS!

[–] r00ty@kbin.life 4 points 4 months ago (2 children)

What about Omicron Persei 8? Surely they got some medal in the human eating contest?

[–] r00ty@kbin.life 4 points 4 months ago

Sync process? The other comment was talking about the old receivers for the atomic clocks on SW/MW frequencies. It was a one way thing.

Now in theory if a receiver also had GPS they could account for the distance. But, then they'd get far more accurate time from the GPS receiver so..

[–] r00ty@kbin.life 4 points 4 months ago (5 children)

Yeah, but you need to factor in the distance to the transmitter. Going to add at least a few microseconds to your time accuracy!

[–] r00ty@kbin.life 5 points 4 months ago (7 children)

Right! Just to prove a point, I am going to make an NTP enabled rolex, and sync it to my microsecond accurate local NTP server! :P

[–] r00ty@kbin.life 22 points 4 months ago

Setting up online accounts and allowing login via online accounts is fine. Forcing the use of an online account to use an operating system is not OK. They are actively blocking workarounds people use to setup their machine with a local account only.

Providing an easy (perhaps upon installation or first login) method to enable full disk encryption is a good thing. Automatically doing it without user intervention is not.

I would say that enabling it by default and offering a way to disable it before it happens on a laptop makes sense. I have bitlocker enabled on my laptop. But I cannot see any real reason to put it on my desktop. The number of cases where bitlocker on my desktop makes sense are too few to bother with the potential for problems it brings.

The two things are also linked, I suspect they will tie in your bitlocker unlock keys to the microsoft account they force you to login with on computer/windows setup. Should you lose access through any means you could lose access to your account, you're one misclick/hardware change away from bricking your system.

I also wonder, say for example your Microsoft account becomes banned/deleted through some obscure TOS violation and your PC doesn't have any local accounts configured. Are you locked out of your PC?

I'm not anti microsoft. I'm anti a lot of their recent actions, and cynical about their overall intentions regarding them.

[–] r00ty@kbin.life 5 points 4 months ago

Also on the 7800X3D. I think I switched at just the right time. I've been on Intel since the Athlon XP. The next buy would have been 13/14th gen.

[–] r00ty@kbin.life 1 points 4 months ago

Hmm, the only issue I had was because it was using the DoH (which I don't have a local server for). Once I disabled that, it was fine.

[–] r00ty@kbin.life 2 points 4 months ago

Oh. Internal hosts, I just setup on my own DNS.. No need for that. Printer, can't say I've ever had a problem.

[–] r00ty@kbin.life 3 points 4 months ago (2 children)

Yeah, I don't really have a use at home for mDNS. None that I can think of, anyway. Pretty sure I was using it before MDNS was a thing.

[–] r00ty@kbin.life 1 points 4 months ago

They (the service that provides both web protection and logging) installs their own root certificate. Then creates certs for sites on demand, and it will route web traffic through their own proxy, yes.

It's why I don't do anything personal at all on the work laptop. I know they have logs of everything everyone does.

view more: ‹ prev next ›