BTRFS is Toast | TechSNAP 331

chris

5 years ago

When a responsible person discovers a security issue, disclosing it properly is difficult
Uses Tesla’s policy as a good example of how companies should do this
“This is not hard stuff and it basically amounts to text on a page. Consider whether your own organisation has something to this effect and is actually ready to handle disclosure by those who attempt to do so ethically. Listen to these people and be thankful they exist; there’s a whole bunch of others out there who are far less charitable and by the time you hear from those guys, it’s already too late.”

The Btrfs file system has been in Technology Preview state since the initial release of Red Hat Enterprise Linux 6. Red Hat will not be moving Btrfs to a fully supported feature and it will be removed in a future major release of Red Hat Enterprise Linux.
The Btrfs file system did receive numerous updates from the upstream in Red Hat Enterprise Linux 7.4 and will remain available in the Red Hat Enterprise Linux 7 series. However, this is the last planned update to this feature.

NOTE: these are SHA-1 hashes, not the raw passwords: 320,335,236 to be precise
Password checking page – that same URL has links for downloading the hashes
To unzip the files, you need p7zip. Command to extract is: 7z x pwned-passwords-update-1.txt.7z
to generate a sha1 hash, Dan used: ‘sha1 -s TechSNAP’ – SHA1 (“TechSNAP”) = c6586a62febc8706d814fe28fe397e9dca146992. Use “tr ‘[a-z]’ ‘[A-Z]'” to upper case.
takes about 0.176ms to locate a hash on a PostgreSQL 9.6 database
Example query construction
Passwords Evolved: Authentication Guidance for the Modern Era
API for using Troy’s service
Troy’s donation page