S2E2: "Ayyy, I Took Your Job"

Posted 2017-03-13 03:59
Modified 2017-03-11 18:12
Comments 0

We talk about SHA1 collisions and robots TOOKin’ yer JERB.

• News
• Notes
• Sysbadministration Award
• Errata
• Music

News

• SHA1 has been officially BROKEN.
  • Webkit tried to implement a check for it, and broke their repo.
  • Linus Torvalds has addressed the use of SHA1 in git.
  • We talk about it more in the episode, and don’t explicitly mention the resolution in the show, but the topic of SHA1 use in GPG fingerprints has been brought up and has been addressed TL;DR: you’re still fine. A second pre-image attack for SHA1 would be required, and that has not been found- only a collision.
• A vulnerability was discovered in Cloudflare services.
  • Digital Ocean specifically mentions being affected.
• If you’re running a webserver on OpenBSD, you’d better patch
• Amazon had a pretty severe outage (Note: this report was not yet available when we recorded.)

Notes

Starts at 08m20s.

I was drinking Bulleitt bourbon. Paden was drinking the same Glenlivet. Jthan was drinking Johnny Walker Black.

• Paden installed LineageOS on his tablet (from vendor-supplied stock)! He talks a bit about the experience.

• We talk more about the SHA1 collision discovery. (10m48s)

• Could AI take over the role of a sysadmin? (20m05s)
  • The article Jthan references is here
  • If you haven’t seen robots actually try to walk, it’s hilarious.

• Dev vs. Prod- are mismatches/compromises in matching okay? (43m50s)
  • MariaDB, in my book, is 99.999% of the time a perfectly acceptable “mismatch” with MySQL, provided you version-match your dev to prod.
    • They even strictly document any possible incompatibilities between the two.

Sysbadministration Award

In this segment, we highlight system administration mistakes. Think of them as the IT equivalent of the Darwin Awards. (56m14s)

The RSA “security conference” attendees apparently don’t know the first thing about wireless security.

Errata

• The Wordpress vuln we mention is reported here
• At 33m31s i say “humans are not sentient”- I meant “machines are not sentient”. Ooops!
• For a *split*-second, I thought Jthan was talking about this. Nope. He was talking about the actual fish.

Music

Author r00t^2
Categories Season Two