Profile picture
Matthew Green
@matthew_d_green
, 3 tweets, 1 min read Read on Twitter
So my student is trying to install NGINX and this is the first instruction. So now instead of installing NGINX he’s giving security advice to NGINX.
NGINX has called him on the phone.
Explaining sudo and HTTPS to NGINX.
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Matthew Green
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @matthew_d_green see all

Profile picture
Matthew Green
@matthew_d_green
From the UK’s report on Huawei base station software analysis. assets.publishing.service.gov.uk/government/upl…
Also, this section on reproducing the build process is pretty bad. Nobody can even tell if the software running in the equipment was built from the reviewed source.
Many people are saying that other manufacturers probably have the same defects as Huawei. I bet they’re right. This isn’t really the point, though (short thread.)
Read 14 tweets
Profile picture
Matthew Green
@matthew_d_green
Scytl, the company that developed the broken @swisspost voting system, put out a misleading statement about what the problem in their system is. I think it’s worth unpacking.
The BG mix proof in their system has a “setup” phase in which the parameters for the proof are chosen. That means the parameters need to be chosen by a trusted party or a verifiable process, not chosen during the proving routine (as Scytl currently does.)
From an API perspective, the parameters should be an *input* to the Prove routine. Scytl didn’t realize this. They decided to put the Setup routine inside the Prove routine, which is the cryptographic equivalent of trying to walk through a glass door.
Read 7 tweets
Profile picture
Matthew Green
@matthew_d_green
So @SarahJamieLewis, @VTeagueAus and Olivier Periera have found a critical vulnerability in the @swisspost cryptographic voting system. In the worst case, it allows for massive and centralized election fraud. people.eng.unimelb.edu.au/vjteague/Swiss…
The problem occurs because the voting system implements a series of sophisticated cryptographic zero-knowledge proofs, in order to keep votes encrypted and untraceable while also preserving election integrity. At a critical place, one of the proofs is flawed.
Specifically, each voter sends their ballots in to a server in an encrypted form. The server later decrypts and tallies them. In between these two stages, to preserve privacy, a series of servers “mixes” the votes by re-encrypting and shuffling them.
Read 12 tweets

Related threads

Profile picture
DrlytleNG💉💊
@witzylytle
HOW TO TRACE A MISSING OR STOLEN PHONE

If you lose your mobile phone, you can trace it without going to the police.

Most of us always fear that our phones may be stolen at any time.

Each phone carries a unique
IMEI no. i.e. International Mobile Equipment Identity
No which can be used to track it anywhere in the world.

This is how it works:

1. Dial *#06# from your mobile.

2. Your mobile phone shows a unique 15 digit.

3. Note down this number at a secure place except in your mobile phone itself as this is the number which will help
trace your phone in case of theft.

4. Once stolen, just E-mail this 15 digit IMEI No. to cop@vsnl.net with details as stated below:

Your name:____________________
Address:______________________
Phone model:_________________
Make:_________________________
Read 5 tweets
Profile picture
The Mac
@TheMacAnon
Now, the Children of God were moulded by the Hand of God,
which is called Awen, and it manifested according to their desires. For all things that have life are moulded by Awen. The fox, shivering in the coldlands, longs for warmth and so its cubs have coats.
The owl, clumsy in the dark, longs to see its prey more clearly, and in generations of longing, the desire is granted. Awen makes everything what it is, for all things change under its law.
Men, too, are moulded by their desires, but unlike the beasts and birds, their yearnings are circumscribed by the laws of fate and destiny and the law of sowing and reaping.
Read 183 tweets
Profile picture
Veronica Lewis
@veron4ica
Instead of retweeting a photo taken without consent of a woman using a blindness cane and a phone, why not retweet this thread and learn about how people with vision impairments use phones to help with orientation and mobility? Here's how I use my phone as a blindness cane user
So what is orientation and mobility? Also known as O&M, it allows people to learn how to navigate their surroundings independently and with the use of different techniques. Many people who receive O&M services use blindness canes, but that isn’t the case for everyone.
Some examples of where people can request O&M services include:

College campuses
Public transportation systems
Conference orientations
Vision rehabilitation centers
State departments for vision impairment
Read 19 tweets
Profile picture
Chad Loder ❇️
@chadloder
This is the best thing on Twitter this morning. I see too many security products trying to *replace* human-to-human interaction - there’s a good chunk of security and privacy that’s about *people*.

Let’s make more products which help people STOP, collaborate, and listen 😝
Forgetting about the “people” part of security is why we’ve heard “GRC is dead” for the last 10 years. We’re on “GRC 4.0” now and it *still* sucks.

GRC tools like Archer are designed for Process and Technology but forget about the poor People who have to use that dumpster fire.
We still have new vendors trying to design single-pane-of-glass “CISO dashboards”, meanwhile *very* few security companies are truly focused on people (not just security people) inside of organizations.

@duosec is one of the few companies who has focused on people. @habitu8 too
Read 10 tweets
Profile picture
Chad Loder
@chadloder
We have a huge credibility problem in information security and it's time we addressed it. We #infosec experts spend too much time asking "How do we get users to care more about security?" - and not enough time asking "How do we get security to care more about users?"
We give security advice without considering the impact to users in terms of cost, time, complexity, and risk of harm. A perfect example is "Turn on #2FA everywhere". It's #2factortuesday, right? I'm a fan. We spend endless hours debating whether SMS-based 2FA should ever be used.
Meanwhile we've spent ZERO time educating users on the risks of harm with #2FA. Namely, the risk that they could lose access to their account. The recovery procedures for 2FA-protected accounts are nearly impossible for average users. How honest are we about this with users?
Read 8 tweets
Profile picture
Stealth Jeff
@drawandstrike
First, to get an idea of how Never Trump I was and why, read these:

drawandstrike.blogspot.com/2015/09/donald…

drawandstrike.blogspot.com/2016/01/fictio…

This was probably the best summation of my Never Trump position:

drawandstrike.blogspot.com/2016/04/restor…
I managed to distill my fears about Trump into one handy meme:
So, the Cliff's Notes version: I was afraid Trump would turn out to be Obama-On-Steroids, taking Obama's Constitutional abuses & lawless further and further.
Read 16 tweets

Trending hashtags

#aii #smartciities #MBep12 #ASGA18 #KarnatakaElections #8thref #NOW #LOL #Security #PeakTV #RecordStoreDay #KarnatakaCMRace #MBep14 #NGINX #Pray4PresidentTrump #dc #BeachFriends #MarchForOurLives #natsec #RecordStoreDay2019 #MBep17 #DisclosuresTribunal #MarmaladeBoy #MBep19 #opendata
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!