Like everyone else with an email address, I’ve been receiving these bitcoin extortion messages for months. I’ve also observed with ever greater dissatisfaction as scammers raked in tens of bitcoins within a week. What especially annoys me is not so much that people are falling for this scam, but that email service providers are simply looking the other way.

Earlier this week I noticed a minor brute-force attack against our managed WordPress hosting. The attack lasted for 72 hours and deployed around 2000 unique bots. The botnet attempted on average 100 logins per hour while rotating bots to avoid triggering our automatic defense systems.

I was unaware that Facebook recently had started to add a unique click identifier to all outbound links on facebook.com. Coincidentally, one of the security measures of this server is to disallow query strings as part of the URL. Thus, any visitors coming over from Facebook were suddenly blocked and banned on sight.

The Android Oreo update has been rolled out to Honor 8 smartphones all over the world, but for some reason, mine got left behind. I feared it might be related to my effort with disabling Huawei and Google services on the phone, but as it turns out it was rather easy to correct.

A while back I lost access to the email address with which I had subscribed to the slackware-security mailing list. This does not please Bob, so today I logged into my webmail account and sent along a new request to join slackware-security and slackware-announce. The response I got in return gave me a good laugh and a swift feel of nostalgia.

Even though I really enjoy the new Gutenberg experience from a content creator’s point of view, I’ve come to the conclusion that it’s not the right editor for me. My dear Gutenberg, it’s not you, it’s me.

I’ve never really felt all that good about storing my passwords on the public cloud, but after we started using LastPass at work I somehow got lulled into adopting it for personal use as well.

Almost a year has passed since I bought a new domain name using the privacy-aware domain registration service from Njalla. Based on my experience with the service, I felt confident enough to go ahead and transfer my primary domain from Namecheap to Njalla.

So why is this release noteworthy? Well, I experienced an issue with the previous release (Tor 0.3.4.7) where I was unable to get sandboxing to work due to the following error:

The highly anticipated continuation of last year’s riveting tale of fear and loathing on the dark web. I hereby offer a full disclosure of attack patterns observed against my onion and my WordPress installation, respectively.

After the GhostProject started offering access to 1.4 billion credentials in the form of usernames with clear text passwords, I’ve seen an expected increase in attacks against customers e-mail accounts.

This week Google went ahead and removed support for HTTP Public Key Pinning (HPKP) from Chromium after some initial stumbles. The change was committed and tagged for Chromium 72.0.x and can now be observed by users of Chrome Canary.

Gentoo developers recently marked mod_security-2.9.1 and modsecurity-crs 3.0.2 as stable on amd64, thus allowing me to move on from the dormant ModSecurity 2.7.7 release. Good thing I got this update on a Sunday though as it turned out to be more than a simple drop in replacement.

Why on earth would there ever be a need to write such an article one might ask? Well, the current Outlook Office 365 version had me puzzled as I was unable to manually configure an IMAP account according to my preferences. Apparently, “set up your account manually” now translates to let Outlook autoconfigure the account.

PHP 7.2 just went stable on amd64 providing me with an opportunity to finally migrate away from PHP 7.0. Unlike the PHP 7.1 releases, PHP 7.2 offers significant performance improvements.

Gentoo recently marked Tor 0.3.4.7 as stable on amd64 so without further ado I’m launching my v3 onion. This hidden service is available at the following 56 bit long address: 4hpfzoj3tgyp2w7sbe3gnmphqiqpxwwyijyvotamrvojl7pkra7z7byd.onion

I recently got the opportunity to discover how long Google would keep showing my content on the search engine result pages when my web server was unavailable. Predictably, I only had a short window of time before my content got removed. And the first content to go was my top ranking pages.

So I had just implemented DomainKeys Identified Mail (DKIM) on a Postfix server and was confident that the signing process was correct, but on testing, the recipient’s SMTP server insisted that the message had failed authentication due to an invalid public key.

I have previously postponed the removal of my Google account from my Android phone as I expected it to be a troublesome and tedious process. However, last week I spent a day removing apps installed through Google Play and replaced them with free and open-source software alternatives as provided by F-Droid.

I’m currently experimenting with a few rule conditions to explicitly whitelist the resources I want clients to be able to retrieve on my server. The initial target for this exercise was my onion site which has an issue with misbehaving (poorly written) Tor bots, but I thought it would be fun to extend the experiment to paranoidpenguin.net.