kro

Yes, if it requires the user session (xss related), like the article, there is no problem.

I was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)

If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.

We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

Last time I gave that a try (without LLM assistance though) it was really hard as games DirectX calls cannot simply be glued to WebGL so performance was bad.

Out of curiosity: How?

They don't offload TLS to the kernel, do they? Most apps do it in userspace linked against openssl afaik.

Do you patch that lib? If ebpf "just" operates at network/packet level, I don't see how it can do more than Mitmproxy in regard to avoid DH-PFS/Pinning

It does not even require the PoW thing Anubis does. I've setup a simple logic that just:

Checks for existence of a specific static cookie, if it does not exist, output a small page that sets the cookie via JS and reloads. Sadly this kills Noscript, but it would be possible to add a form in <noscript> that when submitted sets the cookie serverside.

Is this trivial to bypass? Yes. It still keeps out 95% of unwanted bots. Reality is most do not target you specifically they just want to mass-scrape with low effort. Running headless browsers is way more expensive for their op

I've extended this with a FCRDNS checked exclusion for Googlebot.

Another quite effective measure I figured out was checking the existence of Sec-Fetch-Dest header if the User-Agent claims to be a modern browser. If you don't want to close down too much.

Also, I only apply these rules to routes that are not cheap and cached.

I understand that most people don't use it and indeed rely on tofu, but the statement is not absolutely correct.

ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers). And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls

Only 1.31.0 and 1.31.1 are affected.

I did that for a while because of compatibility issues with a newer laptop, it works but generally if there is no reason it's way easier to stay with the provided packages. Compiling weekly due to security patches becomes annoying over time for no real gain other than the version number

mysql/maria also lets you turn off/down the isolation level for queries if you know the guarantees aren't needed, to speed things up. I think postgres does not have that option.

I've been receiving loads of spam from google MX servers lately until blocking all mails with X-Google-Group-Id headers. I don't know how it's possible, the contents were 100% spammer controlled, no Google template

You are correct.

Reminds me, we once got a letter by a German government body requesting some data exports from our company, and to upload them on findrive-ni.de

It turned out to be legit, but it's neither a subdomain of the state of Niedersachsen domain nor referenced in their official sites.

That also often shoots you as when json_encoding it only becomes an array when ordered "correctly" (numeric 0-based keys without gaps), otherwise an object. So to be safe you generally need to array_values after filtering. If in your testdata you only remove elements from the end you don't catch that before production data hits.

To get the first element there also is reset().

I love PHP though.

Sounds good - which software supports this? Specifically I'd prefer if it would do a composite key derivation in-time rather than "just a pw prompt but TPM has the full key"