Salamander

  • 167 Posts
  • 536 Comments
Joined 4 years ago
cake
Cake day: December 19th, 2021

help-circle



  • Thanks a lot for the examples! I have been looking through these, and, as far as I can tell:

    1. In SSL stripping, the site would appear to your client as HTTP, not HTTPS. If that’s the case, I think SSL stripping is blocked when using ‘HTTPS-Only’ mode
    2. For DNS spoofing, the visited site would show up as insecure because they would not be able to generate a valid certificate for the target website

    I still have not had the chance to look into leaky metadata. But, generally, I think metadata issues can in part be addressed by not generating much metadata.

    Probably the biggest vulnerability is the captive portal. There is no way to verify you’re connecting to an official Starbucks router. I think that when connecting to a public router it is wise to assume that it is malicious.



  • By hand. We are only two people, and we usually clean after we cook/eat. When one is cleaning only 2 plates + a pot/pan at a time, it is easy to use little water. Spray of soap, metal scrub, sponge scrub, and then turn the tap on to rinse for a few seconds. Utensils get individually scrubbed and then all rinsed together for a few seconds.

    Maybe when we have kids a dish washer will make sense.






  • I do have a wall with similar boxes. From the image, I am not sure if they are the same size. I just measured one of my small drawers and it is 14 cm x 5.5 cm x 5 cm. Since I have many different tiny components, I quickly ran out of space when I tried to give each component its own drawer.

    But I think that I might be able to do a better job with these if I take everything out and start organizing again. I set the rules for how to place things before I started buying SMD components, and many of the through-hole components I can combine without problem. An improvement would be if I can find something like this but with many more and much smaller boxes.





  • For mander.xyz it has been bot scrapers. That time that you are mentioning it was scraping via the onion front end that I am hosting for easier access over Tor. Yesterday an army of bots scraping via Alibaba cloud servers made the server unusable for a few minutes. The instance would receive a bunch of requests from the same IP range (47.79.0.0/16), and denying that full IP range fixed the problem.

    Some instances implement anti-bot measures. For example, https://sopuli.xyz/ makes use of Anubis. I think that instances behind Cloudfare get some protection too. I am considering using Anubis for mander.xyz, but for now I have just been dealing with this manually as it does not happen too often.







  • I would take a portable CD player, place a CD with Rick Astley’s Never Gonna Give You Up on it playing backwards, hook up solar panels, remove the ability to shut it on/off, and set it up a circuit that will:

    • As the device solar charges, keep it off until some voltage threshold is exceeded
    • Once the voltage is high enough, start a random timer (8 - 100 hours), so that it is not immediately obvious that the sun activated the device
    • When the timer ends, turn the music on on repeat mode
    • Sometimes turn the music off at random, and then turn it on again at random after a long delay, so that in some cases you can have turn ‘ON’ events without the device being exposed to the sun
    • When the voltage drops below a low threshold, turn the device off until it is charged again