• 7 Posts
  • 135 Comments
Joined 1 year ago
cake
Cake day: March 2nd, 2023

help-circle

  • Neat. I wish OpenSSH better support this use case. The instruction involve multiple moving parts on top of OpenSSH (s6-ipcserver, socat or custom scripts) and a number of extra options for the client. That probably adds overhead. It would probably be easier and more efficient if OpenSSH would directly support Unix sockets.



  • Don’t waste time trying to reason them. If you’re not able and willing and sue them to enforce the GPL license, the company won’t care.

    You should directly informe one of the organisations mentioned previously, they may have a lawyer and experience fighting this kind of fight.

    Best you can do youself is collect evidence that they’re distributing modified GPL software, and write a precise description of the issue, to help these organisations kickstart their investigation into the GPL violation.



  • Not surprising. If there’s a way for a non-admin user to use this, it means there’s probably a way for a non-admin process to access the data.

    Even if if were more secure, there’s probably plenty of ways for attackers to escalate privileges to admin.

    The bigger issue is Microsoft providing an official tool for snooping on user activity. Malware won’t have to install their own, and recall taking screenshots periodically won’t be considered anomalous behaviour since it’s an official Microsoft service.




  • That’s the solution I picked at work. Refused to install that Microsoft software on my personal phone, but instead provided a phone number.

    If you have a VoIP provider you could even try to the VoIP number for MFA instead of providing your real mobile number.

    If IT make a comment about you not having the app, ask if they intend to provide a company device for that.