Boulth

32 ms·

301.
by Boulth 8y ago
Yes, that's what I did but instead of copying the subkey via QR I put it on a Yubikey. Actually it's more convenient that way as it's possible to use it on any computer. But from my perspective if you keep your master key sup
302.
by Boulth 8y ago
If you rotate your signing subkey then this would work as expected. Rotating primary/master keys is a problem in OpenPGP in general (not just Github).
303.
by Boulth 8y ago
Thank you!
304.
by Boulth 8y ago
> Citation very much needed for this claim that (publicly trusted) Certificate Authorities are "regularly compromised" while some random guy's PGP keys on his laptop are "much more secure". Actually X.509 keys ev
305.
by Boulth 8y ago
If the keys are referenced by the key fingerprint they don't strictly need to be fetched over HTTPS. But the page that says "here's our fingerprint: xyz" would better be served over secure connection (assuming someone is
306.
by Boulth 8y ago
> I trust Alpine Linux, not Alpine Linux's certificate authority. Did you check and sign Alpine's maintainers key yourself or do you rely on the Web of Trust to create a path between you two? In the latter case every person in
307.
by Boulth 8y ago
> Production branches should be identified and configured: > ... > Require all commits to be GPG signed, using keys known in advance. Is it possible to configure "all commits gpg signed" on Github? I haven't seen
308.
by Boulth 8y ago
If only HTTP supported SRV records so people could use bare domain (google.com) in the UI while serving content transparently from other hosts. Many protocols use that (e.g. XMPP). But no, it seems to be easier to stick to www CNAME "h
309.
by Boulth 8y ago
> I also believed they would be docked to become full featured PCs This looks like a good description of Samsung DeX.
310.
by Boulth 8y ago
> Since the U2F model assumes that the browser is trustworthy, any browser in the OS is able to access any key stored on the U2F token. The user has no way to know which keys have been accessed by which browsers for which services. Note
311.
by Boulth 8y ago
People migrating from GCM to FCM need to be aware that in FCM analytics are turned on by default: https://github.com/siacs/Conversations/issues/3041
312.
by Boulth 8y ago
Good if you set up DMARC. Quarantine setting guarantee that fake email goes to spam. Reject setting drops the fake email altogether.
313.
by Boulth 8y ago
https://jdebp.eu/FGA/dns-srv-record-use-by-clients.html Browsers don't use SRV records for HTTP. With them one wouldn't need www subdomain CNAME hacks.
314.
by Boulth 8y ago
Fortunately microcode updates are not persistent and need to be applied on every boot.
315.
by Boulth 8y ago
Do you get that many benefits from ZFS? I was thinking of using it for backup via zfs send/receive and snapshotting before pacman updates but the sheer amount of work made me stay with ext4 and luks setup. Too bad as I'd really wa
316.
by Boulth 8y ago
Glad to hear it works well for you! > I have it set up with 18.04 with the root on ZFS. I was thinking about using ZFS too. Unfortunately it's not so easy to setup correctly (full disk encryption etc.) on Arch as it is on Ubuntu...
317.
by Boulth 8y ago
Which version did you buy? I bought 9350 (Skylake) when that came out and this really scared me away from XPSes (multiple issues, motherboards replaced, the worst thing being Thunderbolt integration with the TB16 dock). I generally like qui
318.
by Boulth 8y ago
Not the OP but the touch screen worked out of the box for me on Arch, Dell 9350 and Gnome, just like on Windows. I don't have pen to test this though.
319.
by Boulth 8y ago
Sometimes you can't even reinstall Windows easily, for example Dell has set SSD mode to Intel RAID by default (can be switched to AHCI) but Windows installation media doesn't come with Intel RAID driver by default. Installer doesn
320.
by Boulth 8y ago
Note that the GPG encryption itself is notoriously hard to configure unless one knows to just use gpgme backend (it should be configured by default!). Even then there is a lot of outdated code related to GPG in general (e.g. PKA, no way to
321.
by Boulth 8y ago
I wouldn't recommend Macaroons so lightly. I spent 2 months researching them for internal use, reimplemening them from the paper and comparing with existing implementations. There are numerous practical issues with Macaroons: the cavea
322.
by Boulth 8y ago
Have you seen this: https://wiki.mozilla.org/Security/Binary_Transparency ?
323.
by Boulth 8y ago
> And I wouldn't call it 'really secure', I'd say it's just as secure as any other client side secret. Only if you store the cert in a file, but you can store it on a smartcard (e.g. Yubikey) or a TPM.
324.
by Boulth 8y ago
Because they have a lot of complexity that, for a code they runs a part of auth logic, is really dangerous. For example, verification of third party Macaroons requires building a directed graph, that needs cycle detection. No implementation
325.
by Boulth 8y ago
And their support for OpenPGP encrypted email.
326.
by Boulth 8y ago
> Replicating FCM's functionality inside apps leads to a significant increase in battery drain. Are there any tests that can be referenced on this subject? I've heard a completely different story from people that run Conversati
327.
by Boulth 8y ago
If you mean "federated" like DNS there is one interesting trick: if you specify the signing key in gpg using email (e.g. gpg -u example@domain.com --sign) GnuPG will insert the email as Signer's UID packet [0]. You can inspec
328.
by Boulth 8y ago
Have you considered using Web Key Directory [0] for initial key lookup? Usually someone wants a key for a given email address (e.g. example@firstlook.media) and WKD solves just that. This is natively supported by GnuPG and some email client
329.
by Boulth 8y ago
Yep, now I see this vague explanation on https://commonsclause.com : > Why not AGPL? > The AGPL was drafted in a different era where Cloud ecosystem was not nearly as well-developed. After deep legal analysis, many of the
330.
by Boulth 8y ago
That why dual licensing exists. AGPL or commercial license. Sidekiq does that [0]. [0]: https://sidekiq.org/products/pro.html

More ›