Computers, ssh and rock'n roll
It s the first of January 2025 and it s time for looking back on 2024. Up until 20th of October this year, it was probably the best year I ve had in a decade, and it s not an overstatement. Work The work part is going well. Business is going ok. I m getting better at focusing and doing Continue reading "Retrospective on 2024 and look forward"
Ce mercredi 5 juin, j ai eu l opportunité de présenter au SSTIC 2024 le résultat de mes recherches sur NSEC3, le sous-système de DNSSEC permettant de sécuriser certains aspects de DNS. J ai montré comment ce système peut être utilisé pour télécharger la liste des domaines hébergés par les TLD. https://www.sstic.org/2024/presentation/dig_com_axfr_dnssec__lister_linternet_grce__dnssec
The New Year s Eve 2024 has passed and I d take this opportunity to write down what s passing on my mind right now. 2023 has been a better year for me than every other year since 2017~2018, in that nothing really bad has happened 🤷. Here s some important points: Work Things are doing as usual at Continue reading "Looking back at 2023 and future"
StarNet (https://www.starnetastro.com/) has become the de-facto star reduction software of choice for astrophotography. Its purpose is to remove stars from the pictures, so you can focus on treating the background that require different settings than the stars. StarNet++ works pretty well on Linux (as a CLI application) but the executable does not support CUDA and Continue reading "Running…
Astrophotography is an awesome passion that s a mix of science, technology, history, art and dedication. I m writing this post to share on my journey, not as a way to teach you anything about astronomy, but to offer a window in my life and also show that it s possible to get started from zero in a Continue reading "My journey to astrophotography (part 1)"
The comments around the last OpenSSH issue (CVE 2016-0777, you must read excellent Qualys analysis if you re interested with the details), I noticed that many people were not aware of some basic features of OpenSSH. I will attempt to give a few advises, prioritized in feasibility order, and with graphical annotations: Very easy to set Continue reading "SSH: Best practices"
The challenge This challenge was one of the 25 (minus a few canceled ones) written and organized by TrendMicro for their TMCTF 2015. I played with the Swiss team On est pas contents and I won t disclose how badly we ranked 🙂 Some challenges were really boring (a crossword where half the solutions come from Continue reading "TrendMicro CTF 2015 : Poison Ivy (Defense 300) write-up"
In July, a blog post from Andrew Ayer described the new, unsafe behaviour of portable LibreSSL 2.0.1. While it is right to say that it s unsafe, it is still safer than baseline s OpenSSL and portable LibreSSL 2.0.2. That s what I ll explain in this blog post. OpenSSL During March 2014, I released two CVE on OpenSSL Continue reading "OpenSSL and LibreSSL PRNG, what s different?"
Dual_EC_DRBG backdoor: a proof of concept What s this ? Dual_EC_DRBG is an pseudo-random number generator promoted by NIST in NIST SP 800-90A and created by NSA. This algorithm is problematic because it has been made mandatory by the FIPS norm (and should be implemented in every FIPS approved software) and some vendors even promoted this Continue reading "Dual_Ec_Drbg backdoor: a proof of concept"
I noticed a while ago that many security professionals advise their customers to use autocomplete=off in the password fields of login screens. It also started to scratch an itch on me when my password manager never stored passwords for a few websites. And I started to look for opinions before forging my own. Websites advising Continue reading "The war against autocomplete=off: let my browser…