Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)BI
Posts
0
Comments
212
Joined
2 yr. ago

  • I've worked with Windows environments from 2003 until still today migrating to azure. The biggest skills gap with technicians and engineers administrating Windows is actually networking. This single point connects every single service server and user and yet dns, dhcp, routing and it's protocols, link layer technologies like vlans interface configurations aggregation and more is so poorly understood that engineers and technicians often significantly mistake problems. Almost all issues happen around network layers 2-4 or layer 8 (the end user).

    It doesn't need to be first but no matter what os or component, networking is core and the single biggest return on investment for systems admin types.

    Sure other basic skills are required but just being able to test TCP by telnet or understand each hop, and is the server listening? What process ID is listening? Did someone configure rdp off 3389 and that's why it doesn't work? Was the host file edited and that's why it's resolving some old ip for this hostname? Why is it going out the wan interface of the router when it should be going over an ipsec tunnel?

    All this and more has nothing to do with Windows, and yet, anything that isn't just user training or show and tell about how to do something, there's a good chance it requires you to follow the networking layers to make sure behaviour is expected.

  • I don't know where you work but don't access your tailnet from a work device and ideally not their network.

    Speaking to roku, you could buy a cheap raspberri pi and usb network port. One port to the network the other to roku. The pi can have a tailscale advertised network to the roku, and the roku probably needs nothing since everything is upstream including private tailscale 100.x.y.z networks which will be captured by your device in the middle raspberri pi.

    I guess that'd cost like 40 ish dollars one time.

  • Permanently Deleted

    Jump
  • They could be, but I assume say like an apple device won't install a ccp root authority unconditionally. Huawei and xiamoi probably could be forced, but the browser too, like Chrome, Firefox and safari need to also accept the device certificates as trusted.

    But the pressure in Europe would likely be to trade within Europe, you must comply.

    It fundamentally destroys the whole trust of PKI if this did go ahead. We just need to hope it does not.

  • Permanently Deleted

    Jump
  • If your browser and device has a state sponsored CA certificate it's not trivial to bypass. Transparently all certificate traffic could be intercepted by an ISP. Look at Europe already trying. Once someone malicious (to you) is a trusted certificate issuer you no longer can verify either the destination nor the privacy of the content.

    Ssl based vpns are also decrypted. And vpns which use public key for identification would no longer be trusted.

    https://www.itnews.com.au/news/eu-row-over-certificate-authority-mandates-continues-ahead-of-rule-change-602062

  • Permanently Deleted

    Jump
  • A country for example could enact their mandatory certificate authority that they control. Then have ISPs who are in the middle use what was mandatory a trusted CA to act as the certificate issuer for a proxy. This already exists in enterprise, a router or proxy appliance is a mitm to inspect ssl traffic intercepting connections to a website say Google, but instead terminates that connection on itself, and creates a new connection to Google from itself. Since the Google certificate on the client side would be trusted from the proxy, all data would be decrypted on the proxy. to proxy data back to clients without a browser certificate trust issue, they use that already mandated CA that they control to create new certificates for the sites they're proxying the proxy reencrypts it back to the client with a trusted certificate and browsers accept them.

    It's actually less than theoretical, it's literally been proposed in Europe. This method is robust and is already what happens in practice in enterprise organisations on company devices with the organisations CA certificate (installed onto organisation computers by policy or at build time). I've deployed and maintained this setup on barracuda firewalls, Fortigate firewalls and now Palo alto firewalls.

    https://www.itnews.com.au/news/eu-row-over-certificate-authority-mandates-continues-ahead-of-rule-change-602062

  • Australia just hopes the countries who handle the waste from the uranium we sell don't you know make nuclear weapons with it. You know they're good allies they wouldn't do anything with that right? They certainly would never enrich the original..

  • If Microsoft named it, it's temporary. Let's check intune no wait endpoint manager, no wait, intune again. First I'll just make sure my login works in azure ad, no wait entra, no wait it'll be copilot by the end of the year. Not to be confused with copilot (office) copilot (github) or copilot (azure) or power platform no wait copilot?

  • Very polite. From the words only in that article, his consistency isn't there while I believe his teamate is. Regardless of total skill, which I might agree that lando has more of today, lando's the more risky driver.

    It's a good season to watch maclaren battle each other so close, while Ferrari and Redbull driver pairs have skill gaps, within the cars they drive. I think Mercedes surprisingly has a closer pairing.

    I hope this point gap stays small until the end of season, a dramatic battle at the end would be pretty fun.