Sheogorath 🦊 @sheogorath@shivering-isles.com

Maybe you didn't know, but I run an IRC network called MadIRC.

It seems like it got quite famous among Tor users since we allow completely anonymous access via onion addresses.

Today I had to rework the channel ranks of the main darknet channel "#elite" after quite some abuse of power. Of course, the abusers are unhappy with this situation and declared it the end of the channel.

Feel free to prove them wrong:

Website: https://madirc.net
Tor direct tor web access: https://tor.madirc.net

Mhm, while sharing this article with someone (it's from 2017, but still interesting):

https://dataethics.eu/facebooks-data-collection-sharelab/

I started to wonder: Is there even a point where people decide to stop using Facebook(-owned) Services even when "their friends are there"? I mean, we have a lot of people on the Fediverse that deleted their account, but I wonder if some Facebook users are so dependent on it, that they decide "no matter what Facebook does, as long as they can 'hang out' with their friends it's fine".

Nice article about #DoH and it's pros and cons.

It's not very technical and still provides a reasonable insight into the problems and chances of DoH in the way it's currently rolled:

https://www.eff.org/deeplinks/2019/09/encrypted-dns-could-help-close-biggest-privacy-gap-internet-why-are-some-groups

#EFF #DNS #DNSoverHTTPS #privacy

If you are waiting for CentOS 8 since RHEL 8 came out in May, you might be interested in why it's still not there:

https://www.montanalinux.org/wherefore-art-thou-centos-8-20190911.html

TL;DR: There was RHEL7.7 which becomes CentOS 7.7 and since CentOS already has tons of active users, it's more important to ship CentOS 7.7 than CentOS 8.

#RHEL #RHEL8 #CentOS #linux #community

And also a follow up on my traefik story, where an upgrade of the go version dropped the defaults for TLS connections down to SSLv3, instead of TLS1.0.

The wonderful team around traefik solved the problem and released a new version within 2 days:

https://github.com/containous/traefik/releases/tag/v1.7.15

That's how things should work!

#traefik #infosec #security #TLS #SSL

Little follow up on my earlier statement about #Signal Desktop and the `--no-sandbox` argument they force on linux now.

I didn't just made noise on my social media but of course also (tried to) work with the upstream project. Sadly it seems like they don't care:

https://github.com/signalapp/Signal-Desktop/issues/3573

5 work days and no one even had a look at it. Great… Maybe I should write a PR this weekend in hope it gets more attention.

#infosec #electron #SignalDesktop

Hey developers,

it's time to support your Fedora Userbase as simple as possible.

Packit-as-a-service is here, which simply integrates with your upstream repository and allows builds on the latest version of Fedora, so all your project can be automatically picked up by latest Fedora release engineers and integrate it into the next version of the OS.

https://packit.dev/packit-as-a-service/

(More docs should follow soon)

#Fedora #developer #automated #packaging #RPM #packit

Seriously, verify your systems after an update. Only continuous monitoring of security features will make sure you don't expose people to insecure systems over time.

https://github.com/containous/traefik/issues/5335

This morning I had to notice that my traefik setup decided to downgrade its defaults to SSLv3 due to a bug in the go TLS library.

So yeah, if you run anything server-side that provides TLS and is build with go 1.12.x you might want to verify it.

#infosec #security #TLS #SSL #go #golang #traefik

For those who wonder about the article:

https://diode.io/distributed-infrastructure/Why-DNS-on-Blockchain-is-the-next-step-after-DNS-over-HTTPS-19231/

The problem with DNS is: It's so fundamental that you want humans to have a word in it. (So probably no blockchain)

And you also don't want in-memorable hashes as domain names, since you already have IPs for that. (So not like .onion addresses)

I'm open for ideas, feel free to have suggestions.

Huh, #DNS over #blockchain (or more general DNS that is based on cryptography)… It's an interesting idea especially for the root DNS servers, but there is a fundamental problem:

Key management.

The article I read used youtube.com as an example. What if an attacker obtains the private key for this domain? He can now control it or even transfer it.

Right now, you can get a court rule that undoes that. But with DoB this would mean everyone has to learn a new domain. Good luck with that…

If you wonder how I spend the last hour: Improving other people's container image build instructions.

https://github.com/Snawoot/postfix-mta-sts-resolver/pull/44/files

Providing postfix with MTA-STS is a nice thing. But when you do it, please do it not as root…

A container is no excuse to run software as root.

#infosec #container #security #bestPractices #email