Fair enough. It’s just showing a test page right now. Guess they want us to know they're running Apache on CentOS. Actually I expect they’ll be serving the new app from this domain very soon.
They may end up using a different server when the site is launched. Right now they’re just showing us that this domain is responding. Plus it may be a reference to q drop #646
Yeah I get that. The programmer in me just cringed because its advertising the web server , version and os so that hackers can look into known exploits for those particular versions.
If it’s a q proof, cool but I hope they turn that off at some point. Bad secops
Well it’s maybe a “Q allusion” because it may be a reference to drop 646, but anyone could reference Apache so it isn’t proof of anything q related. Just a wink and a nod perhaps from the Site admins.
Another point: if your site security depends on attackers not knowing you tech stacks then you’re already screwed. In practice you should try to deny them any info, because there may be zero days you don’t know about (and always stay patched for known vulnerabilities), but in principle you’re supposed to assume that “the enemy knows the system.” Security cannot rely on the attacker’s ignorance of the particulars of your system. But point taken.
As to the question of validation, If Q were to return to the new platform he would have to demonstrate his bone fides somehow in a way which proves he is the same person as before, such as how he shared previously unshared pictures of North Korea as seen from AF1, from a previously shared sequence of photos, thereby establishing continuity without compromising his identity. That is how he did it before. But even if he doesn’t return, I believe we have more than we know and we can take up the mantle of maintaining the necessary vigilance for the cause of freedom.
view the rest of the comments →
20856366? ago
Last I heard, there's only one drop zone. I'll wait for Ron's tweet... or retweet. Just thinking.
20856410? ago
Fair enough. It’s just showing a test page right now. Guess they want us to know they're running Apache on CentOS. Actually I expect they’ll be serving the new app from this domain very soon.
20857713? ago
Security wise no one should know what it runs on because that’s how you find vulns.
20859368? ago
They may end up using a different server when the site is launched. Right now they’re just showing us that this domain is responding. Plus it may be a reference to q drop #646
20861763? ago
Yeah I get that. The programmer in me just cringed because its advertising the web server , version and os so that hackers can look into known exploits for those particular versions.
If it’s a q proof, cool but I hope they turn that off at some point. Bad secops
20863505? ago
Well it’s maybe a “Q allusion” because it may be a reference to drop 646, but anyone could reference Apache so it isn’t proof of anything q related. Just a wink and a nod perhaps from the Site admins.
Another point: if your site security depends on attackers not knowing you tech stacks then you’re already screwed. In practice you should try to deny them any info, because there may be zero days you don’t know about (and always stay patched for known vulnerabilities), but in principle you’re supposed to assume that “the enemy knows the system.” Security cannot rely on the attacker’s ignorance of the particulars of your system. But point taken.
As to the question of validation, If Q were to return to the new platform he would have to demonstrate his bone fides somehow in a way which proves he is the same person as before, such as how he shared previously unshared pictures of North Korea as seen from AF1, from a previously shared sequence of photos, thereby establishing continuity without compromising his identity. That is how he did it before. But even if he doesn’t return, I believe we have more than we know and we can take up the mantle of maintaining the necessary vigilance for the cause of freedom.