VP

security. networks. scripting. systems. open source. distributed.

[VP @lupusporta]

@sama @nicdunz @sama So what's #3? ;)

[VP @lupusporta]

@TruthyMusic @SawyerMerritt Try at 40-50K with the way the battery has been worn on rentals. Most Hertz teslas < 12 months old have wear and tear from being left at 100% 24/7 that's the equivalent of 150K+ miles on regular Teslas.

[VP @lupusporta]

@AydenMMiller @SawyerMerritt Not at all actually. From the few I have rented (all < 12 months old), all had battery wear that was equivalent to 4-5 years due to being kept at 100% all the time. The cars were beaten to $hit. And all smelled like pot was used to paint them.

[VP @lupusporta]

“all good things must come to an end…the number of daily active users on Threads has been cut in half when compared to its launch week. The app has dropped from 49 million to 23.6 million daily active users in just one week.”

https://t.co/cC5WtFrbiX

[VP @lupusporta]

@StephenSpinks @JohnLegere @elonmusk Wondering the same thing!

[Bytebytego @bytebytego]

How does HTTPS work?

Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP.) HTTPS transmits encrypted data using Transport Layer Security (TLS.) If the data is hijacked online, all the hijacker gets is binary code.

How is the data encrypted and decrypted?

Step 1 - The client (browser) and the server establish a TCP connection.

Step 2 - The client sends a “client hello” to the server. The message contains a set of necessary encryption algorithms (cipher suites) and the latest TLS version it can support. The server responds with a “server hello” so the browser knows whether it can support the algorithms and TLS version.

The server then sends the SSL certificate to the client. The certificate contains the public key, hostname, expiry dates, etc. The client validates the certificate.

Step 3 - After validating the SSL certificate, the client generates a session key and encrypts it using the public key. The server receives the encrypted session key and decrypts it with the private key.

Step 4 - Now that both the client and the server hold the same session key (symmetric encryption), the encrypted data is transmitted in a secure bi-directional channel.

Why does HTTPS switch to symmetric encryption during data transmission? There are two main reasons:

1. Security: The asymmetric encryption goes only one way. This means that if the server tries to send the encrypted data back to the client, anyone can decrypt the data using the public key.

2. Server resources: The asymmetric encryption adds quite a lot of mathematical overhead. It is not suitable for data transmissions in long sessions.

Over to you: how much performance overhead does HTTPS add, compared to HTTP?

–-
Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): https://t.co/RibM5u7UxP

[gabsmashh @gabsmashh]

imagine falling in love with someone and then finding out that they don't use mfa

[VP @lupusporta]

@soini @soini So, what you want is a mac? :)

I think part of the beauty (and limitation) of the iPad is exactly that...it’s an iPad. This can be both great and frustrating, as is the case with most apple products.

[VP @lupusporta]

And Microsoft thinks Slack is insecure...

[Mr.Un1k0d3r @MrUn1k0d3r]

Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\

Then

%userprofile%\AppData\Local\Microsoft\Teams\Update.exe --processStart payload.exe --process-start-args "whatever args"

Trusted signed binary will run the payload for you 😊

#RedTeam #Pentesting

[VP @lupusporta]

@hoopylinz Quick, cough fast and yell “script”

[James Corden @JKCorden]

Oh my god. This is just sensational. Please watch and retweet.

[VP @lupusporta]

@iSkoog @ImMicahNelson @MakeYourselfNrd @SwiftOnSecurity Yes. This.

[VP @lupusporta]

Post 3/3: (Re: Amazon Lightsail ssh backdoor) This is completely ridiculous. I cannot believe this is happening by default. Is it a blatent oversight or intentional?

[VP @lupusporta]

Post 2/3: (Re: Amazon Lightsail ssh backdoor) Especially if you are providing a custom SSH key -- it should NEVER include a default key, which clearly amazon has the private key for.

[VP @lupusporta]

Post 1/3: Amazon Lightsail generates a default ssh key for each linux node which you cannot remove from the web console. That means every linux vm deployed by default has a backdoor. Sure enough, check /etc/ssh/sshd_config:

TrustedUserCAKeys /etc/ssh/lightsail_instance_ca.pub

[VP @lupusporta]

@pkaeding I thought the "feeling old" was because you still get movies via envelopes ;)

[soccpuppet 🦝 @soccpuppet]

what people think programming is vs. how it actually is

[VP @lupusporta]

https://t.co/NgP4l6QbeK

[Kelly Sommers @kellabyte]

I spent 4 hours debugging a multi-threaded lock contention bug in a CLI tool.

Then I watched 2 rockets land up right on their assigned landing pads at the exact same time after launching a vehicle in space.

I quit.