Tag Archives: security

AWS CodeBuild 可以管 Secret 了...

Posted on September 23, 2017 by Gea-Suan Lin

AWS CodeBuild 可以管理 secret 了：「AWS CodeBuild Now Provides Ability To Manage Secrets」。 AWS CodeBuild now further enhances securing your build environment. CodeBuild can now store sensitive information as secrets, which can now get directly passed to your build jobs. This … Continue reading →

Posted in AWS, Cloud, Computer, Murmuring, Network, Security, Service | Tagged , , , , , , , , , , , | Leave a comment

Adobe Security Team 直接把 Private Key 貼到網誌上面...

Posted on September 23, 2017 by Gea-Suan Lin

Security Team 出這種包...：「In spectacular fail, Adobe security team posts private PGP key on blog」。 Oh shit Adobe pic.twitter.com/7rDL3LWVVz — Juho Nurminen (@jupenur) September 22, 2017 Adobe 這次的事情要怎麼說呢，hmmm...

Posted in Blog, Computer, Murmuring, Network, Privacy, Security | Tagged , , , , , , , , | Leave a comment

GitHub 明年關閉 SSH 上 SHA1 相關的 Kx (Key Exchange) 演算法

Posted on September 19, 2017 by Gea-Suan Lin

GitHub 定下落日條款了：「Weak cryptographic standards deprecation update」。 這次目標是 diffie-hellman-group1-sha1 與 diffie-hellman-group14-sha1，同時啟用了 diffie-hellman-group-exchange-sha256： Since the announcement, we have been focusing on the impact of disabling the diffie-hellman-group1-sha1 and diffie-hellman-group14-sha1 key exchanges for SSH. As of last week, we have enabled diffie-hellman-group-exchange-sha256. This … Continue reading →

Posted in Computer, Murmuring, Network, Programming, Security, Service | Tagged , , , , , , , , , | Leave a comment

Google Chrome 將 .dev 設為 HSTS Preload 名單

Posted on September 19, 2017 by Gea-Suan Lin

其實是兩件事情... 第一件是 Google Chrome 把 .dev 結尾的網域設為 HSTS Preload 名單：「Chrome to force .dev domains to HTTPS via preloaded HSTS」。 第二件事情是隨著第一件來的，HSTS Preload 必須由 domain 擁有人提出啊... 所以 .dev 是合法的 TLD (gTLD)？ 文章作者給了答案，是的，而且就是 Google 擁有的： Wait, there's a legit .dev gTLD? Yes, unfortunately. … Continue reading →

Posted in Computer, DNS, Murmuring, Network, Programming, Security, Service, WWW | Tagged , , , , , , , , , , , , , , , , | Leave a comment

Imgur 上 HTTPS

Posted on September 18, 2017 by Gea-Suan Lin

Imgur 宣佈 HTTPS 化：「HTTPS on Imgur」。 Today, we deployed HTTPS by default on Imgur. All traffic is now redirected to https:// and, as of now, HTTPS is the default on all Imgur URLs. 總算是上線了... 先前是靠 HTTPS Everywhere 做。

Posted in Computer, Murmuring, Network, Privacy, Security, Service, WWW | Tagged , , , , , , , | Leave a comment

Google 放棄對海外伺服器搜索票的抵抗了...

Posted on September 17, 2017 by Gea-Suan Lin

先前美國政府透過搜索票，要求各雲端廠商提供海外伺服器的資料而引起話題 (像是先前 Microsoft 往上打官司抵抗：「Does US have right to data on overseas servers? We’re about to find out」)，而現在看起來 Google 打算放棄掙扎了：「Google stops challenging most US warrants for data on overseas servers」。 Google has quietly stopped challenging most search warrants from US judges … Continue reading →

Posted in AWS, Cloud, Computer, GCP, Murmuring, Network, Privacy, Security | Tagged , , , , , , , , , , | Leave a comment

Google Chrome 對 Symantec 全系列憑證的不信任計畫

Posted on September 16, 2017 by Gea-Suan Lin

Google Chrome 前陣子整理了一份對 Symantec 憑證的不信任計畫：「Chrome’s Plan to Distrust Symantec Certificates」。 這包括了一卡車的品牌，像是 Thawte、VeriSign、GeoTrust、RapidSSL，不過 Equifax 跟 Symantec 的關係我沒查到...： Symantec’s PKI business, which operates a series of Certificate Authorities under various brand names, including Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL, had issued numerous … Continue reading →

Posted in Browser, Computer, GoogleChrome, Murmuring, Network, Security, Software, WWW | Tagged , , , , , , , , , , , , , , , , , , | 1 Comment

現有語音控制的安全性問題：使用聽不見的高頻下令

Posted on September 11, 2017 by Gea-Suan Lin

雖然相關的理論很早就有了，但上個禮拜放出來的論文完整實做出來，叫做 DolphinAttack，取自於海豚可以聽見人類所聽不到的聲音：「DolphinAtack: Inaudible Voice Commands」(這邊的錯字是作者造成的，submit 到 arXiv 的標題有錯，但論文內描述則是對的)。 無論是 Siri 或是 Google Now，或是其他的控制軟體，都設計成能接受多種不同語調的人，而這個部份目前放的都太寬，造成人類聽不到的區段也可以下令： 也可以看到成功機率很高： 應該會有些調整...

Posted in Computer, Murmuring, Science, Security, Software, Telephone | Tagged , , , , , | 1 Comment

AWS 裡 Security Group 的條件可以寫註解了...

Posted on September 1, 2017 by Gea-Suan Lin

AWS 裡 Security Group 的條件可以寫註解了：「New – Descriptions for Security Group Rules」。 這讓其他人比較好理解 (尤其不是常見的 port，或是有些特別的 IP address)，另外也讓容易失憶的自己知道當初在幹什麼 XDDD

Posted in AWS, Cloud, Computer, Murmuring, Network, Security | Tagged , , , , , , , , | Leave a comment

V8 對 Hash Flooding 的防禦措施

Posted on August 27, 2017 by Gea-Suan Lin

Hash Flooding 問題是指 Hash 這個資料結構是可以被預測 collision 所造成的問題，在隨機的情況下會是 的操作，在特定挑選故意讓他 collision 而變成 ，當有 個元素時，乘起來就會變成 。這算是一種阻斷攻擊 (DoS attack)。 在「About that hash flooding vulnerability in Node.js...」這邊提到了 V8 之前為了避免 Hash Flooding 的問題，關掉了 Startup snapshot 而造成的效能問題，以及後續的很多故事，最後找了長期的解法。 這個解法已經併入 Node.js 裡，預定下個包括的版本是 8.3.0： The patch to re-enable startup snapshot … Continue reading →

Posted in Computer, Murmuring, Programming, Security | Tagged , , , , , , , , , , , , | Leave a comment