With a DNS whitelist, all incoming packets are dropped unless the address is on the list. It is like ad block, but reversed. You are not blocking known ad servers, but all servers except those you actually want to connect to. It is a pain in the ass to look at logs and white list all the time. In reality, you only visit around a hundred sites or less that you actually need or want to connect to. Nothing gets in except what you want. That kills most vulnerabilities.

DNS whitelist firewall on a router. Deny everything that is not whitelisted by address and port.

Probably nothing helpful as you are already way past my understanding. Maybe look at the Darktable documentation or even the “green lantern” stuff (IIRC the name). GL or (something) Lantern is/was an open source software for Canon cameras that breaks out all DSLR features on nearly any Canon camera.

Nearly a decade ago, I had a makeshift product photography studio and messed with Macbeth color charts and profiles matched to a monitor. The tutorial guides I followed were from these two projects IIRC. GL.

OCR tool+ to autogen a suggested alt text. The path of least resistance needs to be lowered.

Alternatively, inverting the paradigm is likely to cause less issues and push back. Add the automated tool the the end user in need of the version. This obviously creates the issue of data quality and trust, but for the smaller group. What if there was a reply field silently posted to everyone’s notifications feed indicating anonymous instances of the tool being used to fill in the gaps for alt text? The message would need to be opt out or carefully presented. Perhaps it could be possible to modify the post itself via the tool? Better yet, make the alt text field a Wikipedia style affair anyone with an account can edit, but with a lock available to the OP. That would create much more healthy awareness of the need for alt text, as people posting the content will see the places where gaps are filled by an automated tool. It gives them the chance to edit. This does little to initially improve the experience of the most active alt text users, but it creates a strong cultural shift in awareness that should improve the situation greatly in the long term IMO.

Unrelated to the question or circumstance

No one reads hex as strings IRL.

Not necessarily. Turn this around. Let’s say I am working at somewhere like a chip foundry with tons of IP. I have no access to encryption tools, but I can easily shift characters to a hex range in bash and send emails.

These characters can use the control glyph, and so do not print or show up in any physical way except in hex.

This technique must be obfuscated at every serious organization from governments to industry.

I need to block a known threat actor already present on a system. Call it an exercise. I am interested in exploring and understanding it. This text obfuscation is a technique I discovered being used. This is a stage 3 threat model type of situation where every possible vector is in play.

This is not the theoretical, rtfm or read and trust the source situation.

It does not. It can be rendered as a control character.

It is non printing. It cannot be seen or scanned or highlighted. It looks like nothing, except the file size is large with more hex than should be in the binary.

That has the daemon running that podman avoids. Be carefully what you do with it or expose it to on the internet. Sorry for wasting the time of responding

The stuff outside is likely exported from the container, but is likely just a link to what is inside, made to look transparent from the host but is not real.

Containers create an overlay layer on top of the host. Some stuff on the host may still be linked directly.

The abstract concept to understand here is that the thing you want to put in a container is likely to need outdated or different library (code) dependencies than the host machine. If you installed this software on the host, the conflicting dependencies are a nightmare and are likely to break stuff over time. So the container is the solution. It is as likely to be as small of an overlay image as possible and contains the dependencies that would otherwise conflict, and keeps them separate from the host.

If you want to work with these, you must log into the container, and use the tools within. This will likely involve both the container and a Python venv layer, conda, or uv.

It is also likely that docker is just an alias for podman on a Linux machine.

Removed by mod

Removed by mod

Removed by mod

Removed by mod

Removed by mod

Removed by mod

Awesome. Now how would you strace/ptrace the active process correlated with the return packet?

This is way past my pay grade in the territory of edge-of-abstract – understanding.

See one of my problems is that the malicious software is running across Python, JavaScript, and a ton of dubious packages scattered throughout the machine. It is all interconnected and using unconventional operations. Right now I am just removing a package one and a time and seeing what breaks. I will likely miss how things are interconnected. I am not at all familiar with this type of thing, and learning as I go. The system used unshare, manually created no-label packets with all records obfuscated, used a hidden daemon function in systemd, and no-account to operate outside of namespaces.

Yeah, I could do it. The question is how to redirect a web address to do something useful locally. Like maybe setup an Apache server or something to capture and log any such attempts regardless of how the address is called.