Ayesh

79 ms·

901.
by Ayesh 8y ago
This looks quite opinionated and I didn't honestly like the subtle ad for the password manager.
902.
by Ayesh 8y ago
Bitwarden is far better than every password manager I've tried. Open source and free of charge.
903.
by Ayesh 8y ago
There is a DNS SSHFP record type that the history can publish the host keys. I wrote about them some time back: https://ayesh.me/sshfp-verification For servers without a domain pointed to it, I suppose you can still verify
904.
by Ayesh 8y ago
PayPal's 2FA is prwcticqlly broken for anyone who travels often. There is no support for TOTP apps.
905.
by Ayesh 8y ago
It's pretty weird for an API to ask for a client certificate. We have a client certificate authentication in one of our projects. We hold the root CA key (self-signed), and this key is used to sign intermediate certificates, whose root
906.
by Ayesh 8y ago
I don't think any service can beat Hetzner's €3 server with 1vCPU 2GB 20TB specs.
907.
by Ayesh 8y ago
Yep, this is some kind of weird _feature_ in it. You can pay $5 to get "stealth" domains that others cannot register sub domains of.
908.
by Ayesh 8y ago
A happy NameSilo user and a former NameCheap user here. NameSilo is awesome! Their UI will remind you of 2012 but it's functional and has all features you'd expect to be there.
909.
by Ayesh 8y ago
Location: Everywhere (traveling throughout the year) Remote: Yes, preferred. Willing to relocate: Yes, but I suppose this will be diffocult because I'd need a visa to US/EU. Technologies: Netsec, PHP, JS, RDBMS Email: ayesh+hn@aye
910.
by Ayesh 8y ago
I didn't watch the 35c3 presentation, but it certainly looks like it's an absurd attack. Kudos to Ledger people for constructively replying to it. Some talks in 35c3, defcon, etc remind me of the rubber hose security ( https:&#x2F
911.
by Ayesh 8y ago
Thanks, yep I should've double checked for typos.
912.
by Ayesh 8y ago
Not only they are free of charge, but Let's Encrypt certificates are some of the most technically featured ones too. - Embedded SCTs, so you don't have to worry about certificate transparency. - Must-stable flag support. - ECDSA l
913.
by Ayesh 8y ago
It doesn't cost that much to run a DNS server, even with DoH/DoT. You can easily serve a few million users with a milisecond latency off a cheap instance with 2GB instance. That's not to say the cost is zero, but with with mu
914.
by Ayesh 8y ago
For me, the biggest advantage of big country programs is the ease of reporting something. Not every software has a direct security report procedure documented. For those who wish to get credit for them, those bug country sites help too.
915.
by Ayesh 8y ago
SameSite cookies can eliminate threats from cross domain requests. The strict mode is good enough to even block cross domain regular GET requests too. However, I wouldn't throw other anti-CSRF measures away because if the attacker can
916.
by Ayesh 8y ago
I wrote/research a lot about http/2, and even has a small tool for it ( https://http2.pro ). Among many things you get from http/2, it cannot eliminate round trip time. Sure, you can keep a connection alive but that
917.
by Ayesh 8y ago
Firefox is my main browser and I love it, but I totally see what you mean. Chrome looks just right out of the box, but even a small line in Firefox UI makes it irritating. I have several userChrome CSS changes to make it look exactly as I
918.
by Ayesh 8y ago
Simple Tab Groups add-on (with latest updates) works wonders and I'd even say better than old Tab Groups.
919.
by Ayesh 8y ago
You can easily fix the low quality PR issue with a CI setup. Setup a Travis job to fail often (build, lint, test, coverage, etc), so you pressure them PR author to complete it. This will make the entry barrier massive, but helps you focus y
920.
by Ayesh 8y ago
If someone's determined, they can always create a legit looking GitHub account, submit a few PRs (they did, in this case), gain trust, and _then_ deliver the malicious code. It just takes time. But this trust part seems to work pretty
921.
by Ayesh 8y ago
You publish the packages from a directory. While npm supports VCSs, it's not a requirement.
922.
by Ayesh 8y ago
I suppose this is hard in NPM. For example of I have a project with 5 dependencies, this explodes to hundreds of tiny projects. These individual projects are almost always just a few lines of code, and there's no way anyone's goin
923.
by Ayesh 8y ago
It is not.
924.
by Ayesh 8y ago
GitHub has a Read Only option, and package managers of most languages have a way to convey that the project is abandoned or provided security fixes only. You don't have to feel guilty to abandon the projects. Most us do it, every day.
925.
by Ayesh 8y ago
This is good maintainership right here! For outsiders, it looks like the maintainer is greedy to keep the project to themselves. The bug reports pile up, and dozens of people are offerring to maintain. And then insults start to come up, bec
926.
by Ayesh 8y ago
Expensive, but yes, anycast solves it.
927.
by Ayesh 8y ago
Saving money with an automatic fund transfer. I setup an automatic fund transfer from one account to the other (in the same bank), and that account is not linked to any ATM. I often reward myself by making the same transfer more than once i
928.
Chromium: Notifying users of unclear subscription pages(blog.chromium.org)
3 points by Ayesh 8y ago|0 comments
929.
by Ayesh 8y ago
I'm think if you can reasonate with a hosting provider (big name ones), you can have a /24 block for yourself. You better have a great reason, and be prepared to pay ~$3/ IP.
930.
by Ayesh 8y ago
IP Address purchases one-time purchases, you don't pay annual fees. There is another comment here that said Amazon paid ~18/IP. They won't pay this next year.

More ›