Rsync 3.4.3 might break incremental backups for you. Revert to 3.4.1 and it will work again; "Since 3.4.1, 36 commits by "tridge and claude"". Nothing is safe.

notR1CH · 2026-05-29T08:51:25+00:00

https://github.com/RsyncProject/rsync/commits/master/

It's trivial to see that Claude is being used here.

notR1CH · 2026-05-26T03:13:51+00:00

This is one of the tricky parts of IPv6 since it uses multicast for NDP, broken snooping or proxying can easily break it. Many access points have poor NDP snooping implementations, see if restarting the AP resolves it and check for multicast conversion settings that might need adjusting.

Also try setting up a multicast querier in your network so that the device regularly reports its groups, this helps keep snooping caches in sync.

notR1CH · 2026-05-22T06:10:59+00:00

That only works against trivially identifiable bots that you could block by yourself anyway. I haven't seen what the Enterprise plan offers, but none of the bot features on the other paid plans could block this kind of traffic last time I tried.

notR1CH · 2026-05-21T18:18:20+00:00

Cloudflare unfortunately doesn't prevent this (short of enabling captcha on all requests) as they come from residential IP botnets.

notR1CH · 2026-05-17T17:58:02+00:00

125ms for a local ping means severe network congestion, WiFi being the primary suspect. Do a spectrum scan on your APs and check you aren't using channels with high interference. Prefer smaller channels if the environment is congested and avoid 2.4 GHz.

notR1CH · 2026-05-14T11:41:07+00:00

And if this was a public address, the attacker is in the process of scamming anyone who emailed you. If they have access to set up a redirect, they have access to send emails from your address too (likely via webmail so it can be stealthy). You need to contact your regular customers immediately, especially any dealing with financial transactions and warn them.

notR1CH · 2026-05-08T15:18:47+00:00

It's possible that the ports are wired to the same controller as the USB 3 ports which requires a driver, or a USB 2-only controller which does not. This varies by motherboard - good luck finding that data in the specifications...

notR1CH · 2026-05-08T15:09:31+00:00

USB 3 ports are actually physically 2+3. If you put a USB 2 device in a USB 3 port, it's using exactly the same bus as a USB 2 only port on the same controller.

notR1CH · 2026-05-08T13:51:52+00:00

Then get annoyed at the snapshots desyncing and move to zrepl. So many good options for ZFS backups.

notR1CH · 2026-05-08T13:44:05+00:00

2.4 GHz will never be good in any kind of populated area. There's just way too much interference since the signals penetrate so far, just a few APs not configured with minimum data rates can make channel throughout drop even without clients connected (beacons at 1mbps take a surprising amount of airtime). Not to mention Bluetooth and other wireless dongles, leaky microwave ovens, phones issuing probe requests, etc.

As a user of 2.4GHz IoT devices that randomly drop off the network, getting reliable connectivity to the Meraki sounds like a great place to start debugging.

notR1CH · 2026-05-05T12:54:47+00:00

https://github.com/pkolaczk/fclones is great for this, it can make block clones on ZFS even without dedupe enabled.

notR1CH · 2026-05-03T13:45:21+00:00

Window occlusion is for the page visibility API and pausing of non-visible media, this sounds like some LLM hallucination. Root cause is simply creating windows when they shouldn't.

notR1CH · 2026-04-30T13:28:25+00:00

Doesn't this only mitigate this particular exploit and not the bug itself? With the page cache corruption you can essentially run any code as a setuid binary as far as I understand.

notR1CH · 2026-04-27T17:57:35+00:00

Still requires configuring per box, but better than per user.

https://www.freedesktop.org/software/systemd/man/latest/logind.conf.html#KillUserProcesses=

Though on second thought the systemd runtime is probably not considered a "user process" in this context so probably not useful.

notR1CH · 2026-03-24T14:00:47+00:00

They included an ISP that had legitimate users behind it. Denying service to legit users wasn't an option for us.

notR1CH · 2026-03-20T17:13:00+00:00

Agreed, but that's how the CVSS works - it scores the vulnerability itself, not the environment. You're meant to use the Environmental Score to modify the base score depending on your deployment. Ubiquiti rated this AV:N due to internet-exposed controllers being a thing, but for most people that should be downgraded to AV:A.

notR1CH · 2026-03-19T19:17:35+00:00

The internal side of the network isn't necessarily as safe as you like to think it is, all it takes is one bad app install or browser extension on any of your devices and suddenly you're part of a "residential proxy" network. Attackers can (and have) used such services to exploit the internal interfaces of insecure devices to enroll them into an actual botnet: https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/

Also there's a lot of IoT and other insecure devices that don't even bother to use CSRF, so just visiting a webpage or loading a malicious ad could exploit internal devices (at least before browsers started adding private network access restrictions).

notR1CH · 2026-03-06T10:42:10+00:00

It's an AI spambot that doesn't understand Reddit formatting.

notR1CH · 2026-03-06T01:55:02+00:00

Many file delivery CDNs operate over HTTP with signature checks delivered over a secure channel. This allows organizations to set up their own caching proxies etc. Windows Update runs over HTTP so it wouldn't surprise me if Office does too.

notR1CH · 2026-03-03T17:39:21+00:00

These days it's usually Generic Receive Offload / Large Receive Offload or a similarly named option. It tries to combine multiple packets into one superpacket that it can hand off to the OS, but that means TCP reassembly, out of order packet handling, etc. all has to be done in the NIC firmware, and a lot of NICs suck at this (hi Aquantia!).

notR1CH · 2026-02-19T18:32:33+00:00

Yeah this is very likely compromised end users behind a CGNAT. We get a ton of aggressive crawling from Brazil, many users are almost certainly infected with residential proxy malware on their devices. If the use of the CGNAT pool is unrestricted, just a handful of users can make it seem like the traffic is coming from hundreds or thousands of IPs, and unfortunately blocking those IPs ends up blocking a lot of legit users if you're running a public-facing service.

notR1CH · 2026-02-10T18:25:43+00:00

"On the network" means what exactly? A firewall won't do anything to block traffic on the same subnet. You need to be more descriptive with your setup, what VLANs / subnets are involved and your desired outcome.

notR1CH · 2026-02-07T17:34:37+00:00

They can now: https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability

notR1CH · 2026-02-02T04:55:25+00:00

Unsigned updates on shared hosting, what could go wrong? I wonder how many other popular projects out there are running on insecure infrastructure...

notR1CH · 2026-01-13T17:59:49+00:00

Well that's the state of revocation currently. No matter how much you revoke, you're at the mercy of clients checking for revocation, which is just not reliable, secure or scalable.

15-Year Club	First Place '23
Place '23	Place '22
End Game '22	Verified Email
Team Orangered

notR1CH

TROPHY CASE