Isn’t Ubuntu Pro basically just an extended support for a set of universe packages for their LTS versions and free for private use?

How is making enterprises pay for extended LTS because of corporate no-update-just-insert-coin mentalities even remotely close to ransomware?

Like I get everyone who doesn’t like Ubuntu for various reasons, but this sounds completely dumb to me.

NPM allows for code to be executed while you install the package which is different from maven or nuget and allows for easy exploitation paths

This is the winner. Combine that with a vastly bigger group of inexperienced developers (and I’m willing to die on that hill), and you have a lot of people running node / npm as an admin / root user, who have close to zero idea what they are doing, hitting their project with third party dependencies left and right for no particular reason (left-pad, is-number, ansi console and similar useless crap), and then your dependency management allows for code execution. Also, from my personal feeling, it seems that npm simply cannot properly audit the packages due to the sheer mass. From a technical standpoint it’s close to trivial to put your malware onto npm, and then you just need to get someone to install your package, which is way simpler than in other package managers

The smallest footprint for an actual scripting probably will be posix sh - since you already have it ready.

A slightly bigger footprint would be Python or Lua.

If you can drop your requirement for actual scripting and are willing to add a compile step, Go and it’s ecosystem is pretty dang powerful and it’s really easy to learn for small automation tasks.

Personally, with the requirement of not adding too much space for runtimes, I’d write it in go. You don’t need a runtime, you can compile it to a really small zero dependency lib and you have clean and readable code that you can extend, test and maintain easily.

haven’t actually proven to be effective at stopping cheaters

This is what OP said, and it’s completely correct. It’s not that much impact in comparison to “regular” anti cheat systems. And both of those only detect either cheap/bad or known hacks.

Server-sided and data based anti cheats is what would actually be a huge step up. You’re running a 8 K/D in a game where the best players are between 1-2? Banned. You just flicked two enemies within 100ms? Banned. Suspicious activity that’s not that blatant needs to be reviewed.

The thing is - that’s fucking expensive, complicated and needs to be done one a per-game basis, and since its just cheaper to throw you under the bus with a kernel anticheat and claim it’s the best one, that’s being done.

Read up on the dangers.

Anything is beatable, hackable and abusable given the time and resources, and it shouldn’t be my system because some idiotic management took the decision to enforce ring0 access anti cheat to ban some percent more hackers.

No one said that anti cheat efforts do not make an impact, but the impact of ring0 anti cheats is massively overrated

I’m very interested to hear what went wrong.

We’ll probably never know. Given the impact of this fuck up, the most that crowdstrike will probably publish is a lawyer-corpo-talk how they did an oopsie doopsie, how complicated, unforseen, and absolutely unavoidable this issue has been, and how they are absolutely not responsible for it, but because they are such a great company and such good guys, they will implement measures that this absolutely, never ever again will happen.

If they admit any smallest wrongdoing whatsoever they will be piledrived by more lawyers than even they’d be able to handle. That’s a lot of CEO yachts in compensations if they will be held responsible.

Right, completely forgot that locking exists in SVN, and I guess it definitely makes sense if you’re collaboratively editing unmergeable files.

Thanks!

Serious question, why do they use SVN, as in what does SVN better than Git for the department using it?

The third option is to use the native secret vault. MacOS has its Keychain, Windows has DPAPI, Linux has has non-standardized options available depending on your distro and setup.

Full disk encryption does not help you against data exfil, it only helps if an attacker gains physical access to your drive without your decryption key (e.g. stolen device or attempt to access it without your presence).

Even assuming that your device is compromised by an attacker, using safer storage mechanisms at least gives you time to react to the attack.

Yes, in your head, and in your second factor, if possible, keeping them always encrypted at rest, decrypting at the latest possible moment and not storing (decrypted) secrets in-memory for longer than absolutely necessary at use.

Been a few days since using electron, but AFAIK electron can’t be used as a wrapper for android apps, or can it? Or is their android app a web app wrapped into a “native” android app too?

Also, since this seems to be an issue since 2018, 6 years should be plenty to rewrite using a native secure storage…

Kinda expected the SSH key argument. The difference is the average user group.

The average dude with a SSH key that’s used for more than their RPi knows a bit about security, encryption and opsec. They would have a passphrase and/or hardening mechanisms for their system and network in place. They know their risks and potential attack vectors.

The average dude who downloads a desktop app for a messenger that advertises to be secure and E2EE encrypted probably won’t assume that any process might just wire tap their whole “encrypted” communications.

Let’s not forget that the threat model has changed by a lot in the last years, and a lot of effort went into providing additional security measures and best practices. Using a secure credential store, additional encryption and not storing plaintext secrets are a few simple ones of those. And sure, on Linux the SSH key is still a plaintext file. But it’s a deliberate decision of you to keep it as plaintext. You can at least encrypt with a passphrase. You can use the actual working file permission model of Linux and SSH will refuse to use your key with loose permissions. You would do the same on Windows and Mac and use a credential store and an agent to securely store and use your keys.

Just because your SSH key is a plaintext file and the presumption of a secure home dir, you still wouldn’t do a ~/passwords.txt.

How in the fuck are people actually defending signal for this, and with stupid arguments such as windows is compromised out of the box?

You. Don’t. Store. Secrets. In. Plaintext.

There is no circumstance where an app should store its secrets in plaintext, and there is no secret which should be stored in plaintext. Especially since this is not some random dudes random project, but a messenger claiming to be secure.

Check your blocklist and keep in mind that YouTube is testing server side ads muxed into the media streams, which will not be blocked by traditional adblocking techniques.

If you can not install anything, your only choice is probably to set up a pihole or something similar on your network.

Edit: Some models seem to have advanced settings, where you can change the DNS - you could try to use adguard dns servers, or any DNS adblocker you want to use.

Einige Dinge stehen noch nicht fest, wie: […]

• technische Betreuung (deren Admins und unsere?), […] Lasst euch von den 1200€ Kosten pro Monat, die von der Foundation angegeben werden, nicht erschrecken, wir erwarten Kosten im niedrigen 3-stelligen Bereich, zumal ihre Technik die Größe eines kleinen Rechenzentrums hat. Sie lassen ihre Instanzen auf Kubernetes-Clustern laufen, die nicht proportional zum Traffic kosten, dafür aber nicht ausgelastet sind und so höhere Kosten als nötig haben. […] Was haltet ihr von alldem?

Disclaimer: Ich habe keine Ahnung wie eure Absprachen konkret aussehen, und wer konkret mit welchem Skillset beteiligt ist. Ich arbeite selbst seit ~10 Jahren in der IT, und habe auch diverse Erfahrungen mit Kubernetes. Seht folgendes daher bitte nicht als Angriff, “Akchually” oder Klugscheißerei, sondern nur als food for thought. Wenn ihr diese Dinge bedacht habt, ist alles super.

Die technische Betreuung solltet ihr auf jeden Fall klären, bevor ihr dort startet. Was ich so mitbekommen habe ist lemmy zu hosten nicht gerade trivial, mit der potentiellen Komplexität von Kubernetes könnt ihr euch schnell noch zusätzliche Probleme einhandeln - hier sollte auf jeden Fall jemand parat sein der zumindest den Cluster voll im Griff hat - gerade wenn man im Plural von mehreren Clustern und einem eigenen Rechenzentrum spricht.

Auch beim Thema Kosten und eure Erwartung dazu, würde ich stark zur Vorsicht raten. Ressource Management ist eine der Komplexitäten von Kubernetes, und ist schon sehr vielen anderen zur Kostenfalle geworden. Hier wurde ich auch vor allem hellhörig das man 1.2k für nicht ausgelastete Cluster bezahlt, da hier auch die Stärke davon liegt, und ein pay-as-you-go Modell gut möglich und oft genutzt wird. Klar, das das auf einem eigenen Rechenzentrum nicht geht - klingt für mich aber dennoch ziemlich wild.

Falls euch das bewusst ist, und ihr diese Risiken tragen könnt - coole Sache.

Ansonsten Glückwunsch das es hier zu einer Kooperation und scheinbar einer deutlichen “Professionalisierung” kommt, und ich ziehe meinen Hut vor den Beteiligten die das alles aufgebaut haben.