3 ms·

Nobody ever got fired for using djb-ware

by petesergeant 3y ago

xena 3y ago
Except for those in FIPS land
- deleted 3y ago
  [deleted]
- spacecadet 3y ago
  You dont have many options in FIPS land.
  - colmmacc 3y ago
    DJB's ed25519 has made it into NIST and FIPS now. ChaCha20 too, but only in the context of TLS.
    - wbl 3y ago
      The story is more complicated. EdDSA was removed from the OpenSSL certificate and ChaCha20 was never there.
    - thayne 3y ago
      > ChaCha20 too, but only in the context of TLS It isn't. And that's a problem, because that means an implementation can't be both FIPS compliant and compliant with the TLS 1.3 RFC.
fmajid 3y ago
That's because nobody was hacked for using djb-ware, unlike ISC BIND or Sendmail.
- forgetfreeman 3y ago
  Was anyone ever not hacked for using Sendmail? I lost count of the number of times the project included remote-code-execution-as-a-service in a point release.
sneak 3y ago
Why does nobody talk about Internet Mail 2000?
- giantrobot 3y ago
  The idea got renamed to ActivityPub at some point?
  - sneak 3y ago
    Then why is my media directory on my Mastodon instance 2TB despite my not having logged in to it in a couple months? I think you have confused AP's operation.
    - mschuster91 3y ago
      That's the one thing keeping me from operating my own Mastodon instance. All it takes for me to be in serious trouble is some troll tooting CSAM while mentioning my account... that causes my Mastodon instance to automatically download it, and so the troll can then report me to the authorities for hosting CSAM. Or Nazi content (which is banned in Germany for good reasons). Or piracy. The list of how one can shoot themselves in the groin by simply running a Mastodon server is pretty much endless, and it's not made easier by the fact that German prosecutors are so tone-deaf regarding anything Internet that it took years to get them to stop raid TOR exit-node operators. How people are running Mastodon servers out of Germany, or how there are people running Mastodon-as-a-service shops is frankly mind-blowing IMHO.
    - giantrobot 3y ago
      Your Mastodon instance is caching stuff locally. If you post something to your instance it lives there until another instance requests it. Then it lives on both instances. If your instance deleted the toot/content and I try to access it after the deletion I won't be able to get ahold of it. Same concept as IM2000. Note I'm not sour on the idea of IM2000. I genuinely think its ideas were used by ActivityPub.

Nobody ever got fired for using djb-ware

xena 3y ago

Except for those in FIPS land

deleted 3y ago
[deleted]
spacecadet 3y ago
You dont have many options in FIPS land.
- colmmacc 3y ago
  DJB's ed25519 has made it into NIST and FIPS now. ChaCha20 too, but only in the context of TLS.
  - wbl 3y ago
    The story is more complicated. EdDSA was removed from the OpenSSL certificate and ChaCha20 was never there.
  - thayne 3y ago
    > ChaCha20 too, but only in the context of TLS It isn't. And that's a problem, because that means an implementation can't be both FIPS compliant and compliant with the TLS 1.3 RFC.

fmajid 3y ago

That's because nobody was hacked for using djb-ware, unlike ISC BIND or Sendmail.

forgetfreeman 3y ago
Was anyone ever not hacked for using Sendmail? I lost count of the number of times the project included remote-code-execution-as-a-service in a point release.

sneak 3y ago

Why does nobody talk about Internet Mail 2000?

giantrobot 3y ago
The idea got renamed to ActivityPub at some point?
- sneak 3y ago
  Then why is my media directory on my Mastodon instance 2TB despite my not having logged in to it in a couple months? I think you have confused AP's operation.
  - mschuster91 3y ago
    That's the one thing keeping me from operating my own Mastodon instance. All it takes for me to be in serious trouble is some troll tooting CSAM while mentioning my account... that causes my Mastodon instance to automatically download it, and so the troll can then report me to the authorities for hosting CSAM. Or Nazi content (which is banned in Germany for good reasons). Or piracy. The list of how one can shoot themselves in the groin by simply running a Mastodon server is pretty much endless, and it's not made easier by the fact that German prosecutors are so tone-deaf regarding anything Internet that it took years to get them to stop raid TOR exit-node operators. How people are running Mastodon servers out of Germany, or how there are people running Mastodon-as-a-service shops is frankly mind-blowing IMHO.
  - giantrobot 3y ago
    Your Mastodon instance is caching stuff locally. If you post something to your instance it lives there until another instance requests it. Then it lives on both instances. If your instance deleted the toot/content and I try to access it after the deletion I won't be able to get ahold of it. Same concept as IM2000. Note I'm not sour on the idea of IM2000. I genuinely think its ideas were used by ActivityPub.