Jauder Ho jauderho

This is free and unencumbered software released into the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or distribute this software, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means.

In jurisdictions that recognize copyright laws, the author or authors of this software dedicate any and all copyright interest in the software to the public domain. We make this dedication for the benefit

Currently, there is an explosion of tools that aim to manage secrets for automated, cloud native infrastructure management. Daniel Somerfield did some work classifying the various approaches, but (as far as I know) no one has made a recent effort to summarize the various tools.

This is an attempt to give a quick overview of what can be found out there. The list is alphabetical. There will be tools that are missing, and some of the facts might be wrong--I welcome your corrections. For the purpose, I can be reached via @maxvt on Twitter, or just leave me a comment here.

There is a companion feature matrix of various tools. Comments are welcome in the same manner.

Most VPN Services are Terrible

Short version: I strongly do not recommend using any of these providers. You are, of course, free to use whatever you like. My TL;DR advice: Roll your own and use Algo or Streisand. For messaging & voice, use Signal. For increased anonymity, use Tor for desktop (though recognize that doing so may actually put you at greater risk), and Onion Browser for mobile.

This mini-rant came on the heels of an interesting twitter discussion: https://twitter.com/kennwhite/status/591074055018582016

Getting u-blox MAX-7C GPS to work with Assisted A-GPS

So you got your u-blox GPS and wired it up only to look at it struggling to get a valid fix? Under less than ideal conditions, it can take a better part of half an hour. That's because unlike your smartphone GPS, it doesn't have the luxury of having downloaded all the auxiliary navigation data (almanacs and the lot) out-of-band, via fast mobile connection. Instead it relies on the satellite's signal itself, which is being transmitted to you at meager 50 bits per second (I'm not missing "kilo" there, it's three orders of magnitude slower than your 2G GPRS connection).

Luckily, the u-blox receivers are fitted with what the company calls "AssistNow" capability and it does exactly the same thing your iPhone does - feeds the GPS with pre-downloaded almanacs, speeding up the acquisition process to mere seconds.

In principle, the process looks easy enough - we just need to download the data, and then push them to the receiver. Sadly, the AssistNow documentat

	#!/usr/bin/perl

	use NetAddr::IP;
	use POSIX qw(strftime);

	my $dnsmasq_leases_path = '/var/run/dnsmasq-dhcp.leases';
	my $dhcpd_leases_path = '/var/run/dhcpd.leases';
	my $network_names_path = '/opt/vyatta/config/active/service/dhcp-server/shared-network-name';

	my %networks_by_subnet;

	Chrome 39 (released 2014-11-18):
	Leaf certs expiring >= 2017-01-01 with SHA-1 sig in chain -> UI "secure, but with minor errors" [chrome-1]

	Chrome 40 (released 2015-01-20):
	Leaf certs expiring (2016-06-01 - 2016-12-31) with SHA-1 sig in chain -> UI "secure, but with minor errors";
	Leaf certs expiring >= 2017-01-01 with SHA-1 sign in chain -> UI "neutral, lacking security" [chrome-1]

	Chrome 42 (released 2015-04-14):
	Leaf certs expiring (2016-01-01 - 2016-12-16) with SHA-1 sig in chain -> UI "secure, but with minor errors";
	Leaf certs expiring >= 2017-01-01 with SHA-1 sign in chain -> UI "affirmatively insecure" [chrome-1][filippo]

	#!/bin/bash

	# This is a draft but it works

	# FIRST (I don't even know if it works but we'll assume yes)
	# sudo launchctl list
	# sudo launchctl disable system/netbiosd
	# sudo launchctl disable system/parsecd
	# sudo launchctl disable system/parentalcontrols.check
	# sudo launchctl disable system/airportd

	# Install dependencies
	#
	# * checkinstall: package the .deb
	# * libpcre3, libpcre3-dev: required for HTTP rewrite module
	# * zlib1g zlib1g-dbg zlib1g-dev: required for HTTP gzip module
	apt-get install checkinstall libpcre3 libpcre3-dev zlib1g zlib1g-dbg zlib1g-dev && \

	mkdir -p ~/sources/ && \

	# Compile against OpenSSL to enable NPN. I updated this block to get the latest 1.0.2h release. It's critical that OpenSSL be up to date.

	Function Get-SSLThumbprint {
	param(
	[Parameter(
	Position=0,
	Mandatory=$true,
	ValueFromPipeline=$true,
	ValueFromPipelineByPropertyName=$true)
	]
	[Alias('FullName')]
	[String]$URL

	###
	###
	### UPDATE: For Win 11, I recommend using this tool in place of this script:
	### https://christitus.com/windows-tool/
	### https://github.com/ChrisTitusTech/winutil
	### https://www.youtube.com/watch?v=6UQZ5oQg8XA
	### iwr -useb https://christitus.com/win \| iex
	###
	### OR take a look at
	### https://github.com/HotCakeX/Harden-Windows-Security