Partitioning is one of those obsolete Unixisms that is best left in the 90s. Only exception is dual booting, but even there partitioning isn’t really very important anymore

“YOU NEED A COMPUTER AND DEVELOPER OPTIONS ENABLED FOR THIS TO WORK. DEVELOPER OPTIONS CAN BE ENABLED ON THE PARENT APP.”

So is this just a case where if you have a privileged user i.e. developer options, you can do things like change the time? Maybe i’m misunderstanding the way time-based features work, but surely they can be trivially bypassed by the child in a myriad number of ways if they have privileged access already?

Where the hell is the “meta” key and why does every command tutorial online talk about it.

This is fundamentally true. However it is possible to limit the bandwidth of data the employee can exfiltrate.

Assuming a privileged employee suddenly becomes a bad actor. Private-keys/certs are compromised, any kind of shared password/login is compromised.

In my case I have a legit access to my company’s web-certs as well as service account ssh-key’s, etc. If I were determined to undermine my company, I could absolutely get access to our HSM-stored software signing keys too. Or more accurately I’d be able to use that key to compile and sign an arbitrary binary at least once.

But I couldn’t for example download our entire customer database, I could get a specific record, I could maybe social engineer access to all the records of a specific customer, but there is no way I’d be able to extract all of our customers via an analog loophole or any standard way. The data set is too big.

I also wouldn’t be able to download our companies software source code in it’s entirety. Obviously I could intelligently pick a few key modules etc, but the whole thing would be impossible.

And this is what you are trying to limit. If you trust your employees (some you have to), you can’t stop them from copying the keys to the kingdom, but you can limit the damage that they can do, and also ensure they can’t copy ALL the crown jewels.

You are disappointed because it doesn’t have to be this way.

Don’t listen to this guy at all.

I don’t know about the history of the project, but it sounds like those blobs have been there for quite some time. When in reality, the PR that added the blobs in the first place shouldn’t ever have been approved.

Actually just checked 3+ years.

This isn’t a knock against opensource programming, but there shouldn’t ever be precompiled blobs in the repo unless they are the official builds for the various OS’s and if you want to build from source, the pre-compiled blobs shouldn’t be part of that, otherwise you can’t really claim you are opensource.

Hey guys open source is great you can look at all the code and therefore there are no security backdoors etc. Also here are a bunch of pre-compiled blobs in the repo, don’t worry about those, but they are required to run the program.

Seems novel. But from a security aspect, if OpenSSH has security vulnerability that allows an unauthenticated user to login, via whatever means, once you are in the system as a non-privileged user, you are now free to use the same vulnerability to get root.

Basically this exercise is like using two locks that have the same key to open them. If the same key opens them, then a weakness in one, is now a weakness in the other so why bother with two identical locks?

hahaah. Ok sure you win. Linux TTY’s are absolutely not terminals. Sure they are called terminals, they are for all intents and purposes modern-day terminals with a long and storied history that directly links them to terminals from the 70’s but since they aren’t a physical piece of hardware that electro-mechanically connects to a mainframe, obviously they aren’t really terminals and they should be be called something else.

Do you know what a terminal is?

Where is the ctrl+alt+del function defined? I just want to see what made that sequence work. I’d also be interested in where ctrl+break is defined.

When my calculator app in windows is suspended, but has locked 29 threads and is using 60megs of ram. Not that those two values are significant, but why is my caluclator-app “suspended” when I closed it a few days ago since the last time I used it? Shouldn’t it just be closed and not showing up at all.

We’ve all been there right? You paid for a game, it required an active internet connection and a couple of years later the publisher decided they’re done with it and shut it down leaving you with a broken game.

I actually haven’t been there, because I correctly never bought a single player game that requires an internet connection.

i absolutely support the idea of banning internet connectivity for single player games though.

Why is a communication platform responsible for the content on it?

Dotted Decimal is just a human convention. IPs are just 32 bit numbers meaning binary digit, and octal, dotted decimal and Hex are all valid representations of that same number. Subnet masks work via binary math.

Almost every single thing you would use an IP address for, you can substitute dotted decimal for octal or hex representations.

Yes, as long as you never connect your TV to the internet, then it is for all intents and purposes a “dumb tv.”

Right but if you want to start doing application level blocking, then the proper tool for the job is a stateful firewall and even better, a RADIUS/Kerberos system that authenticates every connection between servers.

Basically I use ACLs to prevent spoofing attacks from originating out of my network, and also to lock down the management plane of my network devices to specific subnets. In all other cases a stateful firewall should be used exclusively.

In any other case ACLs provide the illusion of security and create a huge amount of operational friction especially in a dynamic environment.

Only if you assume IP Addresses act as authentication for what that host is. But since they don’t, I see ACLs as a security blanket.
I can change the IP of a server I control and bypass any ACL easily. If I have control of my network as well, then no ACL you apply can stop any of my servers from hitting whatever server you have allowed any of my servers to hit. So why not just allow my entire network block?