Re: Security questions: Login spoofing, X11 keylogging, and sandboxed apps

2024-03-30 Thread James Huddle
e mantra I developed, as my coworkers insisted on using (for instance) the React JS package that had "Exfil" as a dependency, was: "When in Rome." On Fri, Mar 29, 2024 at 4:44 PM wrote: > Luke A. Call writes: > > > > On 2024-03-29 09:01:07-0400, James Hu

Re: Security questions: Login spoofing, X11 keylogging, and sandboxed apps

2024-03-29 Thread James Huddle
Exfiltrator. There's an 11-letter word that starts with "ex". X11. On Thu, Mar 28, 2024 at 7:39 PM Luke A. Call wrote: > On 2024-03-28 17:28:56+0100, Jan Stary wrote: > > > (2) I've learned that X11 allows locally running malware to sniff the > > > keystrokes input to any other X11-using app

Re: Microsoft's war on plain text email in open source

2020-08-26 Thread James Huddle
She never really says how old her "partner" is. Perhaps he is a developer who has literally "...grown up in the last five or ten years..." On Wed, Aug 26, 2020 at 9:50 AM Rafael Possamai wrote: > >- Original message - > >From: Greg Thomas > > > >"... he had to set up an entirely new

Re: Question regarding server hardware

2019-09-10 Thread James Huddle
On 2019-09-07, James Huddle wrote: >> I recently purchased a Dell T-330 server that I had intended to >> install OpenBSD on and use as a serious web server. My goal was to >> have more control than would be (naturally) given with, say an AWS VM. >> And by control, I me

Question regarding server hardware

2019-09-07 Thread James Huddle
I recently purchased a Dell T-330 server that I had intended to install OpenBSD on and use as a serious web server. My goal was to have more control than would be (naturally) given with, say an AWS VM. And by control, I mean what is *not* running on the box - security-wise. Apparently, Dell

Re: PF firewall for desktop

2019-05-28 Thread James Huddle
Lots of miscommunications in these threads. The original poster here was talking about setting up a virtual firewall machine to deal with traffic on a single box. Most of the war stories are from sys admins protecting a corporate LAN (or larger) with lawyers and accountants weighing in. Of

Re: PF firewall for desktop

2019-05-27 Thread James Huddle
IP is a fairly high-order construct. Beneath it , the data link and physical layers remain almost unnoticed. One thought that came to mind would be to attack a machine on the same LAN, and then exploit an Ethernet vulnerability to listen to "the wire". Not sure how many (if any) Ethernet

Re: PF firewall for desktop

2019-05-25 Thread James Huddle
I like your suggestion! I am security paranoid to a fault. For me, a system is either rock solid or wide open. obsd is the closest I've found to rock solid, and frankly a virtualbox vm running on win7 feels wide open. But the more I thought about your idea, the more I liked it. Win7 w/o the

Re: single user question

2019-05-21 Thread James Huddle
Sorry. Stefan. Batting 1000. -Jim On Tue, May 21, 2019 at 1:20 PM James Huddle wrote: > Just a quick shout-out to Roderick: > Thank you for the paper reference. It's probably perfect for my needs, > but I've been a bit busy, as of late. So no papers, regardless of year > wr

Re: single user question

2019-05-21 Thread James Huddle
Just a quick shout-out to Roderick: Thank you for the paper reference. It's probably perfect for my needs, but I've been a bit busy, as of late. So no papers, regardless of year written. One of my favorite references is Thompson's "Reflections on Trusting Trust" so I'm hep to your SuperFly-Era

Re: single user question

2019-05-16 Thread James Huddle
First of all, I must say that it is with genuine gratitude that I read your responses! Moving on... On Wed, May 15, 2019 at 3:05 PM James Huddle wrote: >> What I am trying to do (thank you Troy Martin), is work through >> the standard answers and missteps toward a more secure OS,

Re: single user question

2019-05-15 Thread James Huddle
>What I"m saying is that it takes less work overall to subtract from a >system in a supportable way than it is to try and handcraft an >unsupportable system. If you know the supportable system well and your goal is only a slight variation of that that system does, then that makes perfect sense.

single user question

2019-05-09 Thread James Huddle
If the following questions trigger a sense of road rage, you may safely assume they are not directed to you. Is anyone running in single-user mode regularly? Is anyone running a web server, for instance, in single-user mode? Many thanks in advance. Shields up. -Jim

Re: Research and OpenBSD: How can I help?

2019-02-21 Thread James Huddle
Thank you, Mihai. I needed that. And honest, sincere thanks to Theo, for working hard, smart, and continuously for decades. You are unique. -Jim Huddle On Thu, Feb 21, 2019 at 8:31 AM Mihai Popescu wrote: > > Frankly, I'd settle for popping the BIOS out and replacing it > with a 1970's EPROM

Re: Research and OpenBSD: How can I help?

2019-02-21 Thread James Huddle
Feb 21, 2019 at 1:03 AM Frank Beuth wrote: > On Wed, Feb 20, 2019 at 09:16:04PM -0500, James Huddle wrote: > >Personally, I envision a sort of "open source BIOS" > >library in the distant future. Something we jack in on jtag > >if we have to. There is no harm in *s

Re: Research and OpenBSD: How can I help?

2019-02-20 Thread James Huddle
>An area that I am personally interested in is running >OpenBSD on fully open-source / binary-blob-free >hardware: hardware where there is no proprietary >firmware that could hide vendor backdoors, and >ideally where even the design of the chip is available >to the user for review. (Heck yes)^2

Re: wscons API question: input handling?

2019-02-20 Thread James Huddle
is ncurses too high-level for your needs? That might work. On Tue, Feb 19, 2019 at 1:27 PM Leonid Bobrov wrote: > On Tue, Feb 19, 2019 at 04:01:08PM +, tfrohw...@fastmail.com wrote: > > Is the package x11/xbindkeys what you are looking for? > > > > No, I need a direct access to keyboard