troed @ troed @fedia.io

HW/FW security researcher & Demoscene elder.

---

Read more

Posts

1

Comments

427

Joined

2 yr. ago

It's a reference to Trump going on about "groceries" - repeatedly. I think Jon Stewart had a bit on it.

Funny word, "grocery". A bit older, but some people still use it.

Still no. Here's the reasoning: A well known SSHd is the most secure codebase you'll find out there. With key-based login only, it's not possible to brute force entry. Thus, changing port or running fail2ban doesn't add anything to the security of your system, it just gets rid of bot login log entries and some - very minimal - resource usage.

If there's a public SSHd exploit out, attackers will portscan and and find your SSHd anyway. If there's a 0-day out it's the same.

(your points 4 and 5 are outside the scope of the SSH discussion)

Feel free to argue with facts. Hardening systems is my job.

This is not "the correct answer". There's absolutely nothing wrong with "exposing" SSH.

A few replies here give the correct advice. Others are just way off.

To those of you who wrote anything else than "disable passwords, use key based login only and you're good" - please spend more time learning the subject before offering up advice to others.

(fail2ban is nice to run in addition, I do so myself, but it's more for to stop wasting resources than having to do with security since no one is bruteforcing keys)

I don't remember this race just a few hours after having watched it

Breakfast is coffee and toast.

/Swede

I have for years thought Verstappen was a very good driver but also very much helped by having the best car.

I'm now starting to think he might be the best F1 driver ever.

Clearly hemorrhoids

It's a list from 2021 and as a cybersec researcher and Jellyfin user I didn't see anything that would make me say "do not expose Jellyfin to the Internet".

That's not to say there might be something not listed, or some exploit chain using parts of this list, but at least it's not something that has been abused over the last four years if so.

There are still server softwares our there that are going to be exposing people's private Mastodon posts.

You could've saved yourself a lot of typing there by just admitting to claiming things you actually didn't know.

If you know of other ActivityPub servers that expose private posts the same way I suggest you make a responsible disclosure to the developers.

I don't know of any, but you claim they exist so ...

You have absolutely no idea what "responsible" in "responsible disclosure" means :) It's completely irrelevant how Mastodon has implemented private posts when it comes to how Dansup handled the issue, knowing what the effects were.

You don't, when told of a vulnerability, handle it in a way that cause harm if it can be avoided.

Read more, post less. I've said nothing about any spec violation. That's not relevant.

hahahahaha

Watch and try again ;) I post under my real name.

https://www.cve.org/CVERecord?id=CVE-2024-44754

https://www.youtube.com/watch?v=ZbKLAjPYOEg

Feel free to post less and read more.

It has everything to do with ActivityPub since if you follow that protocol strictly you will cause this behavior. It still doesn't change that Dansup was told that this caused Bad Things(tm) and yet he didn't follow normal procedure in how you handle it.

Vulnerabilities don't need to be buffer overflows.

/cybersec researcher

Regardless whether you want to pretend that not caring about Mastodon is a valid defense when implementing software using the ActivityPub protocol, that still doesn't change anything regarding how Dansup handled the disclosure of the effects it had.

In Sweden a single Volkswagen EV model (ID.7) now sells as much as all the Tesla models together.

In the sense that it does use more of the fuel, like a breeder reactor, that's good. We need to stop claiming 95% good fuel to be "waste" that needs to be stored for a long time and instead just use it all up.