ArcHound

6 ms·

61.
by ArcHound 5mo ago
Thank you for the kind words. DoH is a critical enabler of ECH, and getting it right isn't easy - especially dodging all of the free services provided by the giants.
62.
by ArcHound 5mo ago
In this article I take a look at the technical properties of Encrypted Client hello as well as some scenarios that are not really covered by the threat model proposed. I argue that to get any tangible benefit you have to use the big provide
63.
by ArcHound 5mo ago
Simply put, you'll need algebra, linear algebra, number theory. So a lot of math with various degrees of depth.
64.
Encrypted Client Hello Doesn't Help With Privacy(blog.miloslavhomer.cz)
6 points by ArcHound 5mo ago|7 comments
65.
by ArcHound 5mo ago
Oh this brings me back to my uni days. I suppose that since this is the basis of post-quantum crypto it is a good time to learn this. Seems to me that these lattices and error-correcting codes are very close to each other, but for some reas
66.
by ArcHound 5mo ago
Makes sense if you think about it: if all photons pass through you (invisible) then you can't capture them to get info (blind).
67.
by ArcHound 5mo ago
Pretty well if you consider the "bio" label, which is a set of practices not using all of the tech. They can ask for and usually get higher prices for the products. Granted, it's more about chemicals than tractors, but still
68.
by ArcHound 6mo ago
Ok, gotcha. So there's a demand for the additional features that are not bundled within git to be federated somehow. I'd say we have emails, mailing lists and bug trackers. Or maybe: what is the missing killer feature that needs f
69.
by ArcHound 6mo ago
But, there are? I can host a repo on GitHub, Codeberg and self host it too. Then I need to watch over main to keep it consistent between those. After that's established, I can do updates from wherever. Link'em in the README.
70.
by ArcHound 6mo ago
Hello. For what it's worth, I'm in a similar role (Security Architecture) in a different sector. It's the same here. The trick is to block your calendar with 30min slots to approx. 80% of capacity. If your calendar is private
71.
by ArcHound 6mo ago
You mean to tell me that companies that got rich by hoarding data are excited to hoard more data? Never would have guessed. Also, why wouldn't anyone want to have data about everyone? Seems like a valuable asset.
72.
by ArcHound 6mo ago
Please tell me more. I'm looking at the VIVA and I really don't get why would anybody contribute to the "internal linkedin" and other features. Where did it come from? Where does it go?
73.
Encrypted Client Hello: A Big Tech Privacy Fix(blog.miloslavhomer.cz)
1 points by ArcHound 6mo ago|0 comments
74.
by ArcHound 6mo ago
I think you're right on the luxury brands being less durable. To address the second airplane example, we really have to go through all that you're buying. Namely: more leg space, faster airport queue processing, more luggage, bett
75.
by ArcHound 6mo ago
The core point is of course solid. By not updating on day 0, maybe somebody else spend the effort to discover this and you didn't. But there are plenty of other benefits for not rolling with the newest and greatest versions enabled. I&
76.
by ArcHound 6mo ago
I see your point, I do. It seems like all external software is going in the SaaS direction, where the vendor is keeping all of the data, so they are available over an API. So there are genuinely solid cases for Chromebooks. The issue is how
77.
by ArcHound 6mo ago
I guess I should set up a monitor alerting me if the two backup diffs are larger than 80% of the data size. But yes, these are the practical problems we need to address.
78.
by ArcHound 6mo ago
Please don't. It's bad enough that companies running windows have all the data on win premises. Dumbing down what the users can do with their machines seems like the end of personal computing.
79.
by ArcHound 6mo ago
Well yes, if you get breached, you have problems. At least in good backups scenario you can continue to operate, so you have money incoming to fix this.
80.
by ArcHound 6mo ago
I don't think this helps anybody. There will always be some poor soul taking the blame for the crimes of the higher ups. And what exactly the crime would be? Using company money to pay an unspecified third party? Also pretty hard to en
81.
by ArcHound 6mo ago
AFAIK the idea is to have backups so good, that restoring them is just a minor inconvenience. Then you can just discard encrypted/infected data and move on with your business. Of course that's harder to achieve in practice.
82.
by ArcHound 6mo ago
I don't think you can enforce such a rule. I think it's a good approach too. Another issue is that not paying up and risking restore from underfunded ops dept. might be more expensive than paying up AND making a selected executive
83.
by ArcHound 6mo ago
Thanks, edited my comment to reflect this reply.
84.
by ArcHound 6mo ago
I can't believe the comments here. "I could have done it better, it's not a big deal, oh, they had women and non white people on board, what even is the shareholder value of this mission, oh it was almost done 50 years ago...
85.
by ArcHound 6mo ago
Yes, keep your dependencies low in numbers. No, don't turn off dependabot. Wait two weeks before updating. IIRC, there's a built-in feature for that.
86.
by ArcHound 7mo ago
This sounds like a nice principled stance, but you won't get any traffic with this approach. That's demotivating - to me blogging is a tight balance of exploration, learning, improving and feedback. I'm not able to write with
87.
by ArcHound 7mo ago
Actually, yes, they are the prime targets: https://en.wikipedia.org/wiki/Npm_left-pad_incident or seemingly https://en.wikipedia.org/wiki/XZ_Utils_backdoor as well.
88.
by ArcHound 7mo ago
Yes, that's why I recommend intentional updates. Planning at least a sprint later gives you a week or two, hoping the community catches such issues.
89.
by ArcHound 7mo ago
Let me rephrase - manual security verification is a velocity blocker. People won't do manual security verification of changes. I agree that npm.org requiring MFA is a good idea in general and in this case.
90.
by ArcHound 7mo ago
Hi, security here. We've tried, but the amount of people you need for this vs the amount of people you have trying to review and click the big button always means that this step will be a bottleneck. Thus this step will be eliminated.

More ›