thomask

joined 1 year ago
 

The following summary from Debian's security list:

The Qualys Threat Research Unit (TRU) discovered that OpenSSH, an implementation of the SSH protocol suite, is prone to a signal handler race condition. If a client does not authenticate within LoginGraceTime seconds (120 by default), then sshd's SIGALRM handler is called asynchronously and calls various functions that are not async-signal-safe. A remote unauthenticated attacker can take advantage of this flaw to execute arbitrary code with root privileges. This flaw affects sshd in its default configuration.

[–] thomask@lemmy.sdf.org 2 points 10 months ago

I was comparing frozen diced veggies a couple of years back (in Australia) and noticed that the store-brand version was approximately 1/3 broccoli stems by volume, which certainly explained the cost difference.

[–] thomask@lemmy.sdf.org 3 points 1 year ago (1 children)

You're putting yourself in a tough position by asking for both E2EE and the ability to use from a browser. You have to trust the web app each time you open the page, and hope that they haven't altered the deal to simply grab your data after it's been decrypted by your password. I have no idea how likely it is that Standard Notes would do that but I'd reconsider the browser requirement specifically if E2EE is non-negotiable for you - an offline open source client program would be a much stronger position.

For my money, I use local text files and SyncThing but it's probably not spiffy enough for many people/purposes.

[–] thomask@lemmy.sdf.org 6 points 1 year ago

IME something like Signal is an easy sell since it's simple and works well. For all the fair criticism about relying on phone numbers it makes the onboarding easy. For other things compartmentalising helps, e.g., "okay we'll collaborate using this cloud file storage but I personally will be accessing it through the browser while keeping most of my files in a SyncThing over here". While I self-host certain things I don't volunteer to do that for family/friends because it will be too frustrating for everyone if/when I let them down.

In this kind of situation there's a fine line between someone who maximises their privacy through tech decisions and someone who makes their "correct" tech choices their self identity. If you drift into the latter, being asked to compromise can feel like an attack, leading to overreacting and coming across as insecure and annoying. Not to psychoanalyse anyone in particular but sometimes I think people need a reminder.