Panino

30 ms·

271.
by Panino 9y ago
> Also at current rate it sounds like it’s going to take years to phase out TLS 1.1. It's already more or less phased out. On my webservers, TLS 1.1 accounts for 0.1% of traffic, and about half of that is junk requests like exploit
272.
by Panino 9y ago
> we can mandate them to implement DNSSEC This is a common theme in DNSSEC -- its main deployment tools are force and financial incentivization. Well those two, and shameless disinformation like DNSSEC is encrypted (DNSSEC is NOT encrypt
273.
by Panino 9y ago
Yeah, I'm hoping for a lightweight cipher competition but I know it would take tremendous resources. What do you think of GIMLI? Just speaking as a bystander, Hamburg's recent cryptanalysis seemed very strong especially given it
274.
by Panino 9y ago
If SIMON and/or SPECK are NOBUS-breakable, then NSA probably has an unknown cryptanalytic technique that would likely threaten other widely used ciphers. Certainly possible but unlikely. However, that's not the issue IMO. Instea
275.
by Panino 9y ago
Exactly. For some contrast: I use tinydns, which doesn't natively support CAA records. But I wanted them so I read the CAA spec and wrote a little tool to add support for these records using the generic record format. And I'm not
276.
by Panino 9y ago
I think the discussion you and tptacek are having relates, in a way, to how different people approach the criminal justice system. People generally want it to either punish the guilty (Watchmen's Rorschach) or protect the innocent (Sw
277.
by Panino 9y ago
Certainly. Is this the case with Medicare, and if so, does the US federal govt. know what medications my Grandpa takes?
278.
by Panino 9y ago
> also an aspect of a single-payer healthcare plan? Note: single payer healthcare systems are about who pays , not who provides -- it's even in the name. So here, hospitals and clinics provide healthcare while the government pay
279.
by Panino 9y ago
People who have created and then abandoned such sites are very unlikely to self-host on their own hardware or VPS. Their web hosts will simply get certs through Let's Encrypt or other and things will continue working fine.
280.
by Panino 9y ago
OpenELEC, OPNsense, CargOS, TrueOS, drupal.org, and bundled with h2o, plus what others have mentioned.
281.
by Panino 10y ago
The story that prompted this discussion is about BULLRUN, a government effort to backdoor crypto, which took place after Crypto Wars 1. And as we know, BULLRUN is just a small portion of what we've had to deal with since Crypto Wars 1
282.
by Panino 10y ago
Politicial solutions didn't work in the 1970s (Church Committee), the 1990s (Crypto Wars 1), or more recently. Hopefully it's just bad luck, because I think the best solution is for technical people to work on technical solutions
283.
by Panino 10y ago
> One look at the source code for most popular sites shows this isn't true Although I reject the idea that popular websites are representative of the web in general, let's investigate that anyway. Currently on the HN homepage:
284.
by Panino 10y ago
I think the root issue here is that most websites are now designed by people who don't even know HTML. ("You had one job!") From there, we get years of unoptimized, bloated websites made by people drawing pictures with HTML e
285.
by Panino 10y ago
> you can switch to GCC5 by typing "setarch x86" in any shell Awesome, that worked. Thanks! It's also great to hear that Haiku will eventually improve the security model. That is its biggest weakness IMO, and removing it
286.
by Panino 10y ago
I have Haiku running on an old Pentium 4 laptop. It's definitely worth a look! Just a few notes after booting it up just now: * Connected to my site via TLSv1.2/ECDHE-ECDSA-AES256-GCM-SHA384 * Played a Youtube video just f
287.
by Panino 10y ago
I don't mean to be off-topic (sorry!), but what's the best CGI/FastCGI library for Rust? My impression is that it's not ideal for webapps at the moment, and I'm comfortable with that. Putting all of Python into a
288.
by Panino 10y ago
vi, zopfli, gimp, optipng, jpegtran, rsync over ssh
289.
by Panino 10y ago
Thank you for doing this experiment! > [W]e did not find any unexpected impediment to deploying something like NewHope. There were no reported problems caused by enabling it. It's great to have this data. Minor question:
290.
by Panino 10y ago
The biggest criticism of Zcash is the Founder's Reward. Some people say it's greedy, that they should have given away their work for free. I disagree. I think it's great that they will get paid for their work, and it also gi
291.
by Panino 10y ago
All good changes. I'd also like to see the Handshake Simulation improved by splitting ancient clients out into their own section. Call it Obsolete or Legacy. Populate it with all the clients that don't support ECDHE or TLS 1.2.
292.
by Panino 10y ago
This reminds me of an attack in the late 1990s called Pulse, which was a low-bandwidth flood of RST packets against Cisco routers. With a T1 line (1.5mbps) you could bring down a T3 (45mbps).
293.
by Panino 10y ago
> It's never been clear to me why anyone would want to use a completely opaque and undiscoverable interface such as a commandline over a nice GUI for anything. The command line gives you both a larger learning curve (base) and great
294.
14 DNS Nerds Don't Control the Internet(sockpuppet.org)
5 points by Panino 10y ago|0 comments
295.
by Panino 10y ago
> With a DNSSEC signed root anyone can host their own copy of the root zone, and we can all cryptographically verify that it is the same root. If that's the best counterpoint, then I'm sorry to say that this has already been po
296.
by Panino 10y ago
Related: publicly funded research that leads to privately held patents results in a form of double taxation. The consumer pays taxes to create the product, then turns around and pays patent-level pricing to buy/use it.
297.
by Panino 10y ago
I use DNSCurve, which adds <1ms to latency. That's with X25519 and XSalsa20-Poly1305. Assuming a persistent connection, DNS-over-HTTPS might be similar with AES-NI or ChaCha20-Poly1305. The real speed issue is the number of round
298.
by Panino 10y ago
I use LibreSSL and just want to thank OpenBSD/LibreSSL devs for their great work. It makes running TLS a lot less stressful for me, so thank you. Also: thanks to Google for finding the bug, via honggfuzz.
299.
by Panino 10y ago
Poor wording. Verisign operates .com for the US government. So if Verisign's .com servers were to go down, then .com would go down with them. The author shouldn't have used the word "registrar" which makes people think o
300.
by Panino 10y ago
No. Just imagine the encryption we'd have in IPv4 -- none, and for multiple reasons: too expensive, public crypto was considered a "munition" when IPv4 was developed, etc. How about IPv6? We'd most likely have 40-bit ex

More ›