docs: refine cybersecurity and networking guidance - #458
Conversation
The glossary and networking reference both needed operational clarification before publication. The glossary now distinguishes actual RTLO characters from encoded telemetry representations, while the networking guide clarifies address ownership, permanent-address inspection, and transient versus profile-based MAC changes. Validation: nix develop path:. -c pre-commit run --files docs/csec/glossary.md docs/networking/README.md --hook-stage manual; nix develop path:. -c lychee --offline --no-progress docs/csec/glossary.md docs/networking/README.md; git diff --cached --check
Bad3r
added
area(docs)
ChatGPT Codex Connector
|
Claude finished @Bad3r's task in 5m 8s —— View job Review complete
Three inline findings posted, most severe first:
Verified and not flagged: all four intra-document anchors resolve ( Note on comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 441d5edd80
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
`nmcli connection modify` updates the saved profile, while an active NetworkManager connection keeps the old address until it is reactivated or reapplied. The reset example now brings the named profile up after clearing the cloned address and explains why link-down applies to Ethernet as well as Wi-Fi.
Feedback addressedImplemented in
Rejected with technical justification:
Decisions:
Consequential follow-on updates:
Reliability:
Validation passed:
|
`802-3-ethernet.cloned-mac-address` is persistent per-profile state, while `macchanger` is a temporary link operation. The docs now give the profile setting its own ownership entry and heading, and explain why Ethernet remains `IFF_UP` for carrier detection until the link is brought down.
ATT&CK v19 split the old Defense Evasion taxonomy, and current T1036 uses Stealth. The glossary now records the v19 and v18 classifications with both references so versioned readers can reconcile them.
Automated review follow-upThe second automated review round identified three enhancements, all implemented:
No additional user decision was needed. The same focused documentation validation passed again, including pre-commit, mdformat, offline lychee, and |
| nmcli connection modify "<profile name>" 802-3-ethernet.cloned-mac-address 02:00:00:00:00:01 | ||
| nmcli connection up "<profile name>" | ||
| nmcli connection modify "<profile name>" 802-3-ethernet.cloned-mac-address "" # clear the profile value | ||
| nmcli connection up "<profile name>" # apply the reset to the device |
There was a problem hiding this comment.
[ENHANCEMENT] This block is the only worked example under a heading that promises how to hold an address, but it ends by clearing the property and reactivating. A reader who copies the block — the normal way a four-line nmcli recipe gets used — ends with the profile back on the host-wide "stable" default and no fixed address, which is the opposite of what the section set out to do. The revert steps belong to the undo path, not the setup path; separate them so the setup sequence stands alone.
| nmcli connection modify "<profile name>" 802-3-ethernet.cloned-mac-address 02:00:00:00:00:01 | |
| nmcli connection up "<profile name>" | |
| nmcli connection modify "<profile name>" 802-3-ethernet.cloned-mac-address "" # clear the profile value | |
| nmcli connection up "<profile name>" # apply the reset to the device | |
| nmcli connection modify "<profile name>" 802-3-ethernet.cloned-mac-address 02:00:00:00:00:01 | |
| nmcli connection up "<profile name>" | |
| # Undo path, run only when reverting: `modify` rewrites the saved profile, so | |
| # the device keeps the address until this second activation. | |
| nmcli connection modify "<profile name>" 802-3-ethernet.cloned-mac-address "" | |
| nmcli connection up "<profile name>" |
| The RTLO sub-technique can be detected by inspecting filenames for the actual | ||
| `U+202E` character and, in logs or serialized telemetry, separately accounting | ||
| for escaped (`\u202E`), labeled (`[U+202E]`), and percent-encoded (`%E2%80%AE`) | ||
| representations. These representations are not interchangeable stored values; | ||
| search each according to the field's encoding. |
There was a problem hiding this comment.
[ENHANCEMENT] The three representations are given in a single fixed case, but the hex digits in both encodings are case-insensitive and lowercase is the common emission: Python's json.dumps writes ``, and urllib.parse.quote writes `%e2%80%ae`. An analyst who builds a literal search from this list — which is exactly what "search each according to the field's encoding" instructs — matches neither, and the miss is silent. State the case rule so the derived searches cover both.
| The RTLO sub-technique can be detected by inspecting filenames for the actual | |
| `U+202E` character and, in logs or serialized telemetry, separately accounting | |
| for escaped (`\u202E`), labeled (`[U+202E]`), and percent-encoded (`%E2%80%AE`) | |
| representations. These representations are not interchangeable stored values; | |
| search each according to the field's encoding. | |
| The RTLO sub-technique can be detected by inspecting filenames for the actual | |
| `U+202E` character and, in logs or serialized telemetry, separately accounting | |
| for escaped (``), labeled (`[U+202E]`), and percent-encoded (`%E2%80%AE`) | |
| representations. The hex digits in the escaped and percent-encoded forms are | |
| case-insensitive, and lowercase is what most serializers emit, so match | |
| `` and `%e2%80%ae` as well. These representations are not interchangeable | |
| stored values; search each according to the field's encoding. |
| The RTLO sub-technique can be detected by inspecting filenames for the actual | ||
| `U+202E` character and, in logs or serialized telemetry, separately accounting | ||
| for escaped (`\u202E`), labeled (`[U+202E]`), and percent-encoded (`%E2%80%AE`) | ||
| representations. These representations are not interchangeable stored values; | ||
| search each according to the field's encoding. |
There was a problem hiding this comment.
[ENHANCEMENT] Supersedes my sibling comment on these lines — that one had its escape sequences decoded into real U+202E characters in transit, so do not commit its suggestion. Corrected version below.
The three representations are listed in one fixed case, but the hex digits in both encodings are case-insensitive and lowercase is the common emission: Python's json.dumps writes `` and urllib.parse.quote writes `%e2%80%ae`. An analyst who builds a literal search from this list — exactly what "search each according to the field's encoding" instructs — matches neither, and the miss is silent.
| The RTLO sub-technique can be detected by inspecting filenames for the actual | |
| `U+202E` character and, in logs or serialized telemetry, separately accounting | |
| for escaped (`\u202E`), labeled (`[U+202E]`), and percent-encoded (`%E2%80%AE`) | |
| representations. These representations are not interchangeable stored values; | |
| search each according to the field's encoding. | |
| The RTLO sub-technique can be detected by inspecting filenames for the actual | |
| `U+202E` character and, in logs or serialized telemetry, separately accounting | |
| for escaped (``), labeled (`[U+202E]`), and percent-encoded (`%E2%80%AE`) | |
| representations. The hex digits in the escaped and percent-encoded forms are | |
| case-insensitive, and lowercase is what most serializers emit, so search for | |
| `` and `%e2%80%ae` as well. These representations are not interchangeable | |
| stored values; search each according to the field's encoding. |
| Both ends of the sequence matter. An unmanaged device runs no DHCP client, so | ||
| stopping after `macchanger` leaves a link that has carrier and no address, |
There was a problem hiding this comment.
[ENHANCEMENT] "address" means MAC address everywhere else on this page, and this sentence lands two lines after macchanger has just written one. "carrier and no address" reads as "the MAC assignment did not stick," which is the failure a reader running this procedure is already primed to look for; the intended meaning is that no DHCP lease exists. Name the layer.
| Both ends of the sequence matter. An unmanaged device runs no DHCP client, so | |
| stopping after `macchanger` leaves a link that has carrier and no address, | |
| Both ends of the sequence matter. An unmanaged device runs no DHCP client, so | |
| stopping after `macchanger` leaves a link that has carrier and no IP address, |
1 participant
Summary
macchangeruse, active-profile reset, and Ethernet link-down prerequisites.Test plan
nix --option eval-cache false develop path:. -c pre-commit run --files docs/csec/glossary.md docs/networking/README.md --hook-stage manualnix --option eval-cache false develop path:. -c mdformat --check docs/csec/glossary.md docs/networking/README.mdnix --option eval-cache false develop path:. -c lychee --offline --no-progress docs/csec/glossary.md docs/networking/README.mdgit diff --check -- docs/csec/glossary.md docs/networking/README.md