Top
Best
New

Posted by zdw 2 days ago

When internal hostnames are leaked to the clown(rachelbythebay.com)
443 points | 250 commentspage 4
lsofzz 2 days ago|
[flagged]
zaptheimpaler 2 days ago||
Clueless lol. This is not about any of that. I run Plex on my local network at plex.domain.com. Plex sends logs to the internet with its local domain in the string. Leak. There is no easy way to solve this without deeply inspecting each packet a service sends outside your network, and even that doesn't work when services use SSL certificates and certificate pinning preventing MITMs.
lsofzz 2 days ago||
wtf are you allowing plex to initiate outbound connections to begin with?

and why is plex not in it's own VLAN with a egress FW rules to second with?

lastly, why aren't you running snort/suricata to inspect the packets originating at plex?

let me solve this problem for you - it probably doesn't bother you at all.

otherwise, you'd scratched your itch a long time ago.

> Clueless lol.

It's ok to be clueless. And, it's ok to be working for a FAANG and be clueless too.

imtringued 2 days ago|||
You sound so confident about this and yet you're listing a bunch of useless advice that doesn't work, because the analytics are integrated into the web interface and therefore executed inside the web browser. To guard against that, you'd have to block all outbound connections on your laptop and all other devices that could potentially access the web interface.
lsofzz 2 days ago||
[flagged]
lxgr 2 days ago||||
> It's ok to be clueless. And, it's ok to be working for a FAANG and be clueless too.

Glad you're not being too hard on yourself :)

zaptheimpaler 1 day ago|||
Its great to be clueless, thats how you learn! Just dont flex and demean other people like "Coming from someone who worked at FAANG, this is sub par post." if you're clueless. Again everything you've said does not really apply here or is impractical.
lsofzz 1 day ago||
> [ ... ] if you're clueless.

Done it. Therefore, I flex. I was talking about clueless folks like yourself.

> Again everything you've said does not really apply here or is impractical.

YMMV. Always.

bigibas123 2 days ago|||
Blocking dns leaks from the local network will not prevent sentry from sending them to the cloud. Blocking sentry from reaching the cloud (like said in the post) will.
jeroenhd 2 days ago|||
From the article:

> Around this time, you realize that the web interface for this thing has some stuff that phones home, and part of what it does is to send stack traces back to sentry.io. Yep, your browser is calling back to them, and it's telling them the hostname you use for your internal storage box. Then for some reason, they're making a TLS connection back to it, but they don't ever request anything. Curious, right?

Unless you actively block all potential trackers (good luck with that one lol), you're not going to prevent leaks if the web UI contains code that actively submits details like hostnames over an encrypted channel.

I suppose it's a good thing you only wasted 30 seconds on this.

lsofzz 2 days ago||
[flagged]
jraph 2 days ago||
Wow, just skip the "bad post", "took me 30 seconds", "Basic stuff" parts already, especially when you are completely missing the point and don't seem to realize it even after several people point it out.

Show some humility.

What's more, one doesn't really read Rachel for her potential technical solutions but because one likes her story telling.

lsofzz 2 days ago||
[flagged]
rini17 1 day ago||
Fancy web interfaces are road to hell. Do simplest thing that works. Plain apache or nginx with webdav, basic auth(proven code, minimal attack surface). Maybe firewall with ip_hashlimit on new connections. I have it set to 2/minute and for browser it's actually fine, while moronic bots make new connection for every request. When they improve, there's always fail2ban.

That the nas server incl. hostname is public does not bother me then.

renewiltord 2 days ago|
Haha, this obtuse way of speech is such a classic FAANG move. I wonder if it’s because of internal corporate style comms. Patio11 also talks like this. Maybe because Stripe is pretty much a private FAANG.