deepbreath

The knockee PoC should also be straightforward, can use socat + udp-listen + fork with a script that checks that input matches `sha1sum(secret||num)||num` and `num>previously_seen_num`, and if so, adds an iptables rule.

This should prevent against replays. Throw in some rate limits somewhere maybe to not get DDoSed, especially if you let socat `fork`.

Don't have to do anything too complicated. Here's the knocker code in a short Bash script, produced by GPT4:

~ % gpt4 'write a very short bash script that takes the number stored in ~/.ssh/knock_seq, increments it by 1 and saves it to the file. It then takes the new number and concatenates it with the value stored in the file ~/.ssh/secret. It pipes the resulting string to sha1sum, spitting out binary. It then takes both the resulting sha1sum and the number used and pipes their concatenation to "nc -u $host $(cat ~/.ssh/knocking_port)". be brief'

  knock_seq=$(cat ~/.ssh/knock_seq)
  let knock_seq++
  echo $knock_seq > ~/.ssh/knock_seq
  concat_seq_secret=$(echo -n "${knock_seq}$(cat ~/.ssh/secret)")
  sha1_output=$(echo -n $concat_seq_secret | sha1sum -b | awk '{print $1}')
  final_output="${sha1_output}${knock_seq}"
  host=localhost
  knocking_port=$(cat ~/.ssh/knocking_port)
  echo -n $final_output | nc -u $host $knocking_port

> At the point an attacker has remote code execution

The attacker doesn't have remote code execution in the xz case unless they can speak to your port 22. Port knocking prevents them from doing so, provided they don't know how to knock.

You're right, I guess it depends on what you choose A and B to be. For:

A = OP supports Mozilla making money from address bar ads

B = Mozilla is honest about making money from address bar ads

"B -> A" (OP supports Mozilla if Mozilla acts a certain way) makes sense. "A -> B" sounds confusing in a sentence, but its contrapositive, "!B -> !A", also makes sense.

However, for:

B = Mozilla decides to make money from address bar ads and is honest about reasons

"A -> B" no longer makes sense, since OP can support Mozilla having the address bar ads with an honest justification, but Mozilla can still decide to not have the address bar ads.

Except it's not used correctly here. "A iff B" means "A implies B and B implies A".

"I'd be willing to entertain, or even support, this way of them making money iff they spelled out honestly what they're doing and why" implies both of these:

- "If they spelled out honestly what they're doing and why, I'd be willing to entertain [...]"

- "If I'd be willing to entertain [..] then they will honestly spell what they're doing and why".

The second of which doesn't make sense to me, unless I'm missing something? He should have used "only if" rather than "iff" here.

Could you point what you believe to be the issues in the thread?

If nothing else, it significantly reduces the entropy of your IP when websites are fingerprinting you, especially if your ISP assigns you a static IP.

Even if you don't have a static IP, I suspect the entropy of your /24 (IPv4) is also a lot smaller when over VPN.

There are plenty of homeless people in London.

Honestly, your comments are pretty much an r/wowthanksimcured meme.

> (Hint: go ahead and start interviewing and have semi-serious job leads before this talk)

I think this bit of advice is at odds with OP's statement: "I don’t think I’d come across very well (or as sharp as I usually) in interviews at the moment without a break."

I was quite burned out at my previous job, as well, and decided (against most people's advice) to quit without an offer. I had similar "I'd rather give it a shot at being a bartender than write more code" thoughts. I was unemployed for a few months, but ultimately ended up with a few good offers. Leaving without a backup was definitely the right choice in my case.

Makes me think of the gradual increase of identity politics in mainstream media, politics and liberal circles, to the point it's driving me insane. Most people around me seem undisturbed by it though.

Not thinkpad x1 carbon