• 0 Posts
  • 369 Comments
Joined 3 years ago
cake
Cake day: June 19th, 2023

help-circle






  • Setting the SSH service to a random high port doesn’t make security better and may make security worse. Linux has a restriction that low numbered ports require special permissions but high numbered ports do not. If an attacker manages to get low privilege code execution on your machine, they may manage to bind their service to the SSH port instead. If the server and client are configured correctly, this will cause a host key mismatch error. Continuing anyway could allow the attacker to take over your account on the server. It’s unlikely unless you are a high value target.






  • This problem has nothing to do with NPM. Checkmarx was compromised last month, and during that compromise there were malicious VS Code extensions published to Visual Studio Code Marketplace. A Bitwarden developer says that somebody ran one of those malicious extensions, and GitHub API keys were stolen which were used in publishing the malicious CLI package.

    It’s probably better that it happened on NPM. If the CLI were only downloadable from the Bitwarden website, it would have likely taken longer for somebody to notice something was wrong.







  • Is Bitcoin really a good idea? bitcoin.com says you shouldn’t worry because it would cost “hundreds of millions to over a billion dollars” to run a 51% attack on the Bitcoin network for an hour. The US government spends this kind of money on wars, and likely has the means to reduce that cost by forcing offline or compromising a large portion of the trustworthy Bitcoin network. This alone wouldn’t allow money to be seized, but it could be used to destroy the crypto market, making that money effectively worthless. You wouldn’t normally need to worry about an attack of this scale, but the it’s not beneath this government and there are a few AI companies that could use a government bailout in exchange for temporarily converting all their GPUs to Bitcoin miners.

    Does World War III involve different countries attacking and defending crypto currencies?