X_Cli @x_cli@infosec.exchange

https://github.com/joelparkerhenderson/architecture-decision-record

> An architecture decision record (ADR) is a document that captures an important architecture decision made along with its context and consequences.

#TIL

```sh
# sysctl -a --pattern "net.ipv4.conf.*\.rp_filter"
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.eno1.rp_filter = 1
net.ipv4.conf.eno2.rp_filter = 1
# /lib/systemd/systemd-sysctl <(echo 'net.ipv4.conf.*.rp_filter=2')
# sysctl -a --pattern "net.ipv4.conf.*\.rp_filter"
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.eno1.rp_filter = 2
net.ipv4.conf.eno2.rp_filter = 2
```

1) You don't need grep to filter the output of sysctl

2) systemd-sysctl can use wildcards!

#Linux #Systemd

This is terrifying. If I understand this correctly, #Cilium is copying a binary from the image on the host, escapes the container to create a mountpoint of the host cgroup into the container thanks to that binary, then removes the binary from the host.

How am I gonna make this kind of shit work on a W^X system? I have no clue.

#K8S #Kubernetes

Oh, if you are interested in this kind of problems, we are hiring :)

Building a #Debian rootfs from an unprivileged user with deboostrap

https://broken-by-design.fr/posts/debootscrap/

#Security #UserNS #Fakeception

Damn, it took way too long but I finally got to create a debian rootfs using debootstrap from an unprivileged account and without fakechroot, which was breaking some symlinks.

The main problem is that debootstrap thinks that we cannot chroot if we cannot create nodes, and solves both issues using fakechroot and the fakechroot variant. Unfortunately, fakechroot has some documented limitations, and I found myself with links like /usr/sbin/init pointing to /$chroot_dir/usr/lib/systemd/systemd instead of /usr/lib/systemd/systemd.

Are you interested in reading more about this? Should I write a blog entry?

#Debian #container #hacking

Currently, my new phone is (simultaneously, depending on the website I visit):

* in the Netherlands (I live in France)
* waiting for collection (somewhere? but where? No info)
* delivered (if it is, it was not delivered to me)
* delayed.

Fuck you DHL.

DHL as a company should have been closed a long time ago. Not even once have I got a good experience with this company deliveries. If you ever are in position to select a transport company, please, please, please, never pick DHL. You would be making your recipients miserable.

https://developer.chrome.com/blog/removing-push/

Removing HTTP/2 Server Push from Chrome. Wow.

I am so sick of #Mattermost. One thing you would expect from a chat application, especially a centralized one, is for messages to be delivered in order. Yet, almost everyday, messages are delivered several minutes after they are sent. Mattermost just inserts them where they should have been originally. You just miss them because NOONE looks into the history for messages that would magically appear out of thin air! This creates tensions in teams "you ignored my question" "haven't you seen my message telling you exactly this?"

Mattermost is the worst chat app I've seen in a while. Sure, it is shiny etc. It just misses the core functionnality: delivering messages correctly.

#Chat #Signal #Matrix #Revolt #Whatever

#DNSSEC Downgrade Attacks

https://www.blackhat.com/us-22/briefings/schedule/index.html#dnssec-downgrade-attacks-27359

Some details in this thread:

https://mailarchive.ietf.org/arch/msg/dnsext/WwenohqNBBBYdv0TaaVbPt0tZMs/

#DNS #Security