$ time openssl rand -base64 1000000000 | tr a-z n-za-m >/dev/null
real 0m1.073s
user 0m1.327s
sys 0m0.644s
$ time openssl rand -base64 1000000000 | rot13 >/dev/null
real 0m19.225s
user 0m20.101s
sys 0m0.747sobs4: https://github.com/Yawning/obfs4
obs4 in tor: https://support.torproject.org/glossary/obfs4/
I feel like the article missed out on mentioning one key thing: Using a deny-list doesn’t work. It’s much more viable to default block and allow the stuff you know you’ll allow. Defaulting to allow and blocking stuff you don’t want is how you end up being owned by rot13.
"The Six Dumbest Ideas in Computer Security"
> #1) Default Permit
> #2) Enumerating Badness
I wonder how you might encourage deeper introspection into software infrastructure security vulnerabilities, both from closed source companies and from obscure open source projects, without "spreading breadcrumbs for the roaches"
* http://www.dest-unreach.org/socat/doc/socat.html#ADDRESS_OPE...
* http://www.dest-unreach.org/socat/doc/socat.html#ADDRESS_OPE...
Just create a self-signed certificate:
openssl req -newkey rsa:2048 -nodes -keyout socat.key -x509 -days 1000 \
-subj '/CN=www.mydom.com/O=My Company Name LTD./C=US' -out socat.pem
Some companies mention in their employment contracts these type of circumvention activities, unless explicitly allowed, are a firing offense.
They are clearly already whitelisting connections, but still allow unidentified connections through?! What sort of logic is that?
I'm not a security expert but we had those kind of measures at a previous job and AFAIK they are there so that a lazy employee (me) doesn't just skip configuring their tools to go through Artifactory out of laziness and introduce a supply chain vulnerability. If "pip install XYZ" just worked out of the box, how likely would it be that all 10k devs in your organization would bother configuring it to avoid PYPI?
But if you do not control both ends, let's say you want many customers or even the public to connect to your server that's not an option.
cd /lib/firmware
( find -name '*.xz' -exec xzcat {} \; ; find -type f -a \! -name '*.xz' -a -exec cat {} \; ) |
rot13 |
grep -aEo '\w+' |
awk '{print length, $0 }' |
sort -nsru |
head -20
Edit: The sort -u option hides words of the same length. Removing that option (and the head command) gives more results, but nothing that interesting.