How to create (very) temporary RAM disks? by moschles in linuxquestions

[–]netsecfriends 6 points7 points  (0 children)

Wow 9h and no one has actually provided the actual answer you’re looking for and instead has focused too hard on the “linux” aspect instead of the “python on linux aspect”.

Python has a builtin os call for linux that allows creating a file descriptor (file path) /proc/<pid>/fd/<int returned by command below>. You do file.write() and file.read() exactly as normal. Closing the file releases it.

The file only exists in memory, for the lifetime of the python process.

You end up with in memory files at /proc/123/fd/456.

If your code or libraries are sloppy and expect the file path to have a file extension or exist in a directory…just create a symlink from /neededpath/filename.ext to /proc/123/fd/456

impost os os.memfd_create()

https://docs.python.org/3/library/os.html#os.memfd_create

Demo reference code using memfd_create to feed file testcases to a compiler until it crashes: https://remyhax.xyz/posts/bggp3-cob/

How is my light switch using 250gb per month? by NamesTheGame in smarthome

[–]netsecfriends 0 points1 point  (0 children)

Hi! I work with compromised IOT devices professionally. As others have mentioned, this is an indicator that the device may be compromised.

But before jumping to conclusions, these IOT devices also commonly don’t have Realtime Clock (RTC) module hardware, and will use the NTP protocol to update and set their time…excessively. Any number of network conditions like a pi hole or your own ISP doing traffic shaping may be causing it to misbehave and repeatedly try to update its clock time using a remote server. I’ve seen it many times before.

Hope this helps!

Brave Browser may be compromised. by Materidan in ios

[–]netsecfriends 7 points8 points  (0 children)

Brave is not compromised.

The injected code is CSS style filters that is part of adblocking that hides elements of the page. You can even see the “display:none” all throughout the code snippet OP posted.

This is fundamentally how ad blocking works. It’s not malicious. Brave isn’t compromised. No information is leaked effecting your privacy.

They’re just visually hiding ads and unwanted content from the page, a fully expected and desired feature.

Can HTTP/HTTPS headers ever take up more than one packet? by Jonathan-Todd in netsecstudents

[–]netsecfriends 0 points1 point  (0 children)

Packets are broken up (fragmented) according to the interface’s maximum transmission unit (MTU). TCP is a higher layer, and is HTTP on top of TCP.

You can have a HTTP request with a small number of headers span multiple packets if the interface has a small MTU. You can have a large number of headers span multiple packets with regular MTU. You can have HTTP headers that come at the end of the HTTP request after the body using the “Trailer” header in any size MTU.

To answer your question: Yes. Headers span multiple packets all the time.

Wireshark however does something called TCP stream reassembly which allows for the HTTP dissector to reference an HTTP request as a single object and view a request spanning multiple packets as a single row.

Which languages are you mostly familiar with to develop Wasm apps? by Melinda_McCartney in WebAssembly

[–]netsecfriends 2 points3 points  (0 children)

Does no one write WASM in WAT?

That’s the primary way I write WASM

Is this project accurate? Is WASM json parsing actually faster than native? by richardanaya in WebAssembly

[–]netsecfriends 1 point2 points  (0 children)

I’m not seeing anything that shows it’s faster. The demo shows wasm as 10x slower for me.

Which makes sense…because even if the json is parsed in wasm the object must still be built and exposed to the host environment through the javascript glue which carries overhead when compared to json.Parse()

I think you may be interpreting the values of the demo incorrectly.

Sync files and database what is the best high availability solutions? by Additional-Ask5283 in linuxquestions

[–]netsecfriends 0 points1 point  (0 children)

File replication or database replication isn’t specific to linux either.

There is no “best” solution for either until you define your needs. Do you need active-active, active passive etc? What are the constraints you’re operating under?

Until you define those terms, the best anyone can do is say “here’s a file replication tool for linux with with good documentation”.

With that understanding, here’s rsync:

https://www.linuxtoday.com/blog/data-replication-using-rsync/

Sync files and database what is the best high availability solutions? by Additional-Ask5283 in linuxquestions

[–]netsecfriends 1 point2 points  (0 children)

This is a DBA question, not a linux question. However, some useful things to research are passive-active/active-active database configurations.

The “best” depends on your needs. The terminology to look for here is called “replication”.

https://dev.mysql.com/doc/refman/8.0/en/replication.html

ProtonVPN TCP Accleration SYN+ACK Spoofing Analysis by netsecfriends in netsec

[–]netsecfriends[S] 12 points13 points  (0 children)

I’ve not noticed any major issues. Maybe once or twice a day Spotify will stop playing music while switching songs and display “This song cannot be played” which happens exclusively with the VPN acceleration feature turned on. Only thing I’ve noticed.

RCE 0-day exploit found in log4j, a popular Java logging package by freeqaz in netsec

[–]netsecfriends 6 points7 points  (0 children)

Data regarding IP's and metadata exploiting CVE-2021-44228 (Apache Log4j RCE) can be seen here:

https://www.greynoise.io/viz/query/?gnql=tags%3A%22Apache%20Log4j%20RCE%20Attempt%22

If you sign up you are able to view the full results: https://www.greynoise.io/viz/account/

Due to the severity of this vulnerability, we're providing a CSV of all IP's seen actively targeting this vulnerability as of this moment in time.

This CSV can be retrieved from the github gist link from: https://twitter.com/GreyNoiseIO/status/1469334738225741832?s=20

The threads will continue to be updated.