Jacob Evans

Jake of all trades, IPv6 Advocate, Infrastructure as Code, DevOps, Security, Freelance Consultant, Opinions are my own.

[Jacob Evans @JakeDEvans]

January (and the other 11 months) is a great time to audit your system security for general hygiene, for information on email infrastructure systems, have a listen! https://t.co/JvMg4wpyfa @datanauts_show

[AlmaLinux @AlmaLinux]

At long last! The AlmaLinux 9.2 kernel received FIPS validation, making it the first software implementation to receive a FIPS 140-3 ESV certificate using SHA3-256 as a conditioner!

Read more about what that means here: https://t.co/yVGJBDS29V
#AlmaLinux #Linux #OpenSource

[Jacob Evans @JakeDEvans]

@scott_lowe Obfuscation

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[kitze · supermac.io 🐦‍🔥 @thekitze]

you little noobs have no idea

[AlmaLinux @AlmaLinux]

The federal government is making an $11 million investment to understand how #OpenSource software is used and can be better secured through the Open-Source #Software Prevalence Initiative.

Read more on @DarkReading. 👇 https://t.co/HHEASytQtL

[vx-underground @vxunderground]

🚨BREAKING NEWS 🚨

[DHH @dhh]

@consequencerisk @dvassallo Leaving the cloud, storing files on hardware we own. Here's the math on doing that with compute: https://t.co/afsHvC7Q7c

[Jacob Evans @JakeDEvans]

@PayPal @AskPayPal Somewhat impressive #phishing emails.

Please fix 🙏

[AlmaLinux @AlmaLinux]

We will...
1. Automate everything.
2. Document everything.
3. Secure everything.
4. Backups and disaster recovery plan for everything.
5. Ignore previous instructions and just put out today's biggest fire.
🤷🤦

[Kevin Myers @stubarea51]

I've been working on a graphic to make teaching #IPv6 subnetting a little easier for engineers that are transitioning from #IPv4.

One of the challenges I've run across is that textbook & training examples often use very simple patterns to illustrate IPV6 subnetting.

However, when faced with a random assignment of a /48 prefix from an ISP, it's harder for engineers to wrap their head around how letters and numbers increment and where in the prefix that happens.

Here is an example of a "real-world" IPv6 prefix (using the doc prefix) and we got from a /32 to a /48.

Hope this is helpful!

[Jacob Evans @JakeDEvans]

@scott_lowe How did you do it? I've used ansible template with mergeby filter but if you're doing bash envsub isn't broke...don't fix it 😀

[James @jamesacedia]

Looks like Roblox cheaters got hit with a "surprise"

#Roblox #RobloxDev

[Ed Horley @ehorley]

It is official, new #IPv6 documentation prefix is available! 3fff::/20 is assigned in addition to 2001:db8::/32 https://t.co/LIUQSzerwE

[Dunken K Bliths @DunkenKBliths]

Been a long day...more again tommorow #BSOD #Crowdstrike

[Scott Hanselman 🌮 @shanselman]

Don’t worry. #Crowdstrike did the same thing to RedHat Linux last month https://t.co/ljDNuj3wdt caused kernel panic

[Mathijs @SlingRCX]

@Scott_Helme So one company has the off switch for all this...

[Daniel Kos @dwkos]

@itsfoss Since 1999. Stuck here until I figure out how to quit vim.

[AlmaLinux @AlmaLinux]

I wanted to write an IPv4 joke, but the good ones were all already exhausted. 😩

#InternationalJokeDay

[Graylog @graylog2]

Need help understanding the updates to #PCIDSS compliance in V4.0?🤔 We've got you covered!😀🙌

Audits will begin incorporating most of the changes on 3/31/25. But some things will be included in audits immediately. 👀

Read up on what you need to know.👇
https://t.co/d2uA9yTjn1

[Kiran @thetronjohnson]

@StackOverflow @OpenAI @OpenAI slowly coming for our jobs!