Monkey With A Shell

A deadline set by a government agency for government workers, NOT a ‘Google Pixel Deadline’. Stop writing alarmist headlines to make it sound like Google is gonna shut off your phone if you don’t comply. You should update, but knock this writing style off people.

I’m fairly sure if they took porn off the internet, there’d only be one website left, and it’d be called “Bring Back the Porn!”

Makes sense, I’m so accustomed to making virtual machines and such that it becomes just a thing but inevitably at some point admin access was required to create the hypervisor, the vnic, a virtual switch, etc. Without that restriction a piece of malware could readily exfiltrate data past a local protection by just making it’s own new pathway through on the fly or any number of other unpleasant things.

I recall using an app way back when I used to root and haxor all the mobiles that would do this. Kind of a virtualbox for the Nexus phones/tablets, but it needed root to do it. Will have to look into this, would be interesting if it can do so in user space somehow.

Edit: Damn, still needs root. Was a longshot to be able to hook into system resources without it but was hoping for some bridge function.

Not contracted monopolies or direct city run, but like ‘IAAS’ seems to work. Much like how you see some small cell companies providing unique offers riding on one of the big carriers networks. Often those small carriers provide better deals, particularly when the carriers they ride on are forced to sell wholesale access at reasonable rates.

The city selling wholesale access funds the infrastructure maintenance and the carriers are better able to compete with each other since all they really have to do is set up a router and pay the city’s access rate fees.

Not so far off, providing infrastructure locally then leaves a lot of the major transit to backbone carriers to make the interconnects. Those providers are largely transparent to the end users. Now nationalizing carriers like that would be a hefty lift, but if we can take the local service out of the ISPs hands it would let the municipal hosts negotiate those peering arrangements in bulk. How many towns are well equipped to handle that might be another matter though.

Pretty well every case I’ve read of municipal owned fiber nets has been a grand success, barring interference by the local carriers. Let the city own the infra and the carriers compete for access. Of course you get the whinging about ‘muh free market/choice’ but that’s the case for any public works really.

Hard to say, but with how few sizeable chunks of natural stone/metal meteors make it through it’s tough to expect some relatively fragile satellites would survive the trip down.

It can also be an awesome idea, depending on your perspective. Having an instance without all the cruft is a pristine peaceful thing at times. For a while I ran one of those subscriber bots on Lemmy and pretty quickly found it to be so full of shitposting spam as to be unusable. Just don’t start an instance and expect it to be a raging party and you won’t find it disappointing.

Long ago I used a system called hushmail that promised a lot of the same as proton. Eventually I set up my own but it still has the problem of having to relay outgoing external mail through another box because of all the restrictions on home based dynamic IPs, so it’s largely relegated to system alerts in house rather than general use.

It’s a balancing act to be sure. VPNs stop local ISP inspection in exchange for potential viewing by the VPN host. DNS filters can only filter known threats. Things like P2P private nets can be infiltrated by 3rd parties via the ‘6 degrees of separation’ premise or even tracking pixels.

Making the picture muddy is about the best we can do, but it’s always worth the effort to not be another data point in the profile machine.

Not so sure the difference ripping a disk would make unless you have a super insulated room, but CPU heat is very much a consideration. Each summer I keep contemplating moving my rack with ~100 cores to the basement only to be dissuaded by the dampness and cable runs.

I’ve been a user of GOG for a while principally because of the no-drm ability to download a copy of what you bought. When the library starts getting past a certain size though you start to wonder about those things like what if the producer has a falling out and wants to yank it from the platform, does it vanish from my library then too? Are there contracts that say ‘forever’ when they offer it? Would love to find some ‘download all’ option to take a full copy offline of the bought items at once but it’d probably overrun the monthly ISP limits even if they had one.

Seen too many things on Netflix or Spotify that I liked vanish because ‘fuck off, we can’ and although I never anticipated it being ‘bought’ in those cases it does give a lot of justification to find alternate means to reestablish that access.

Most mobile devices these days default to using a random spoofed MAC, so I have a hard time seeing how that’s effective unless it’s done as a whitelist only.

WiFi pineapples are fun that way. I’ve taken one out on a drive going to our cabin in scanning mode and picked up 100+ different SSIDs along the way. It can also respond as a wildcard to any request that comes by or just be obnoxious and advertise them all at one.

Never setting an ‘auto connect’ for unsecured WiFi is a must in that case. Secured not so much an issue unless the interceptor has the key for the network at least.

As useful as tile is ideal to me. Don’t allow for the global tracking but let’s me make my keys or wallet make a noise when I misplaced them.

It’s pretty much the same thing that ‘tile’ does, it’s scary that they do this as an opt-out though. Having that as a system level function effectively means they can enable or disable it at will without having to have a separate app.

One more bug to sort out with notifications and I’m full time onto GraphineOS.

It says right in there that they can’t see what you are sending or receiving, but seeing the SNI provides content on what you’re doing. Not seeing where it’s false at all.

Using that SNI header profile though if one was inclined and the site doesn’t enforce HSTS it would be simple enough to proxy traffic through their gateway, or to creating a phishing duplication of the site with a DNS redirect.

Discover/offer/request/acknowledge since it didn’t make a pretty picture for me.

Basically it’s just a case of who answers first. A DHCP discover is a broadcast message since the client doesn’t know where or even if there is a server on the net. Whoever gets back to the client first with an offer though will end up with the request/ack following up and get to provide whatever options they push along with the offer.

Claim: if you use HTTPS you are safe!

Overall a solid writeup, but this part could use some clarification. Assuming the VPN client doesn’t leak DNS this is only a concern after exploitation by DHCP option.

Another thing that might be noted, since this is a DHCP based issue the window for compromise is largely going to be at the time of connection unless the server has a particularly short lease time. If there are multiple DHCP servers on the same network answering requests it’s bound to raise some alarms if someone is watching the network so it makes 3rd person exploitation a very noisy method since you would have a race for who offered the lease first.

Edit: Really this attack isn’t just a problem for VPNs but could apply to any network connectivity. A rouge DHCP sever can cause all sorts of havoc. There used to be an single button APK called ‘firesheep’ that would do similar to this by presenting itself as the gateway, although that wouldn’t have allowed for the specific split routing config option push.

Short version of this attack, it involves split routing for the tunnels. A lot of clients will have a default route-all to send traffic through the VPN. There is however a limitation to this because the tunnel itself needs a route from the local nic to connect to the VPN endpoint and establish the tunnel, otherwise you end up with a chicken and egg where you can’t establish the VPN. By taking advantage of the DHCP option to set preferred routes (really anything more specific than 0.0.0.0/0) it can tell the host system to send the specified traffic through the local gateway rather than the tunnel’s virtual adapter.

One relatively simple fix if you happen to have a fancy router/firewall on the edge of the network that handles the VPN would be to use policy based routing rather than relying on the underlying network configuration. Static route tables would be possible too, but in theory that could be overridden by just sending a more specific route again than what was set statically.