10 posts • joined Sunday 7th August 2011 19:46 GMT
It's not a new invention? We ran out computing tasks remotely before? Well I'll be damned!
I'm too lazy to actually read the specification, but why is it such a problem for major Linux distributors (Ubuntu, Redhat) to build secure bootloaders and sign them properly in the same way that Microsoft do with Windows?
I realize yhey would then sign kernels accordingly, and of course end users would never be able to build their own kernels (else malware could do the same), but most don't need to.
Not necessarily an approach popular with hardcore free software types, but on most of my desktop systems where I don't build my own kernels, I'd happily see my system made more secure by an Ubuntu signed secure kernel.
Just tested this...
and it seemed to work fine.
Further investigation reveals that they have been unable to block its IPv6 address because they don't offer IPv6 connectivity and so the connection was automagically tunnelled to another ISP...
Perhaps 2 wrongs do make a right?
Re: "until they get around to finally salting those hashes"
"Therefore if your passwords are hashed but not salted, a hash can only be added at the point the user changes their password."
Not totally true. You can rehash the password any time you have the plain text version which can be done the next time the user logs in. Of course, if the passwords have been leaked you should be asking them to change it when they log in anyway!
It's probably worth brute forcing those passwords themselves and invalidating the weak ones.
A company not to consider working for
The post is required, and must contain letters.
Re: PCI DSS anyone
If only PCI DSS covered points as sensible as this.
I'm totally confused as to why "up to" gets so much bad press, when it is both clear and true. Yet, at the same time 'unlimited' gets almost no coverage despite in many cases being a blatant lie.
Use the police
1) An application layer attack prevents the possibility of spoofing an IP address, so every source will be identifiable.
2) Ask the police to go and knock on the door of every location originating these attacks.
3) The police will meet one of 2 people: some kid's parents, or a Tor exit owner who might reconsider running their node if this is what it is being used for.
If the chance of the police showing up at your door were 50% instead of 0.001% then maybe they'd think twice. I'd never suggest that people be prosecuted because their network was being used illegally, but a visit from the police can be very persuasive.