Panino

31 ms·

301.
by Panino 10y ago
DNSSEC is not decentralized -- it follows a strict hierarchy from ICANN => TLDs (world governments) => you. DNS is distributed , not decentralized.
302.
by Panino 10y ago
Also, Verisign the CA works for Verisign, while Verisign the TLD operator (.com, .net, .gov) works for the US govt. And this conversation we're having about distrusting WoSign? We couldn't even have it about abandoning .com. Peop
303.
by Panino 10y ago
Yet another example of key size not being the only thing to consider. Also: OpenVPN's default cipher is blowfish? That would have been a great choice 20 years ago , but not now. It shouldn't even be supported in 2016.
304.
by Panino 10y ago
> With no real reaction after the NSA leaks I know where you're coming from but I don't think this is the case. There are too many examples to give but here are some nice ones: In 2013, there were only a small number of E2E en
305.
by Panino 10y ago
(Note: I do support AES-128-GCM, and don't recommend doing what the author of this article did.) That said: According to my webserver logs, I see <5% of traffic being TLS 1.0/1.1, so going TLS 1.2 only wouldn't (in my cas
306.
by Panino 10y ago
On OpenBSD, -P overwrites once. It used to be 3, like the author states, but was changed to one pass since multiple overwrites are pointless on mechanical disks. On SSDs you need ~20 passes of the entire drive to remove ~all data, so I d
307.
by Panino 10y ago
Schneier isn't involved in cryptography enough today to be able to write the kind of crypto book people would expect. For example he knows very little about ECC, and stream ciphers aren't really on his radar either. Also he said o
308.
by Panino 11y ago
Just to play devil's advocate for the sake of discussion I'll say, the main benefit is "education" for designers of actual secure messaging apps such as those from Open Whisper Systems. I remember Moxie writing about int
309.
by Panino 11y ago
A Spamhaus DNSBL alone drops 99% of spam with almost no FPs. Add DROP, fullbogons, and greylisting to increase the percentage further. None of these methods read the message body, and there are plenty of other options as well. I self-host
310.
by Panino 11y ago
Using Spamhaus alone will block (with a very low FP rate) about 99% of spam. Throw in a few other simple techniques and the inbox is pretty clean, all without even looking at the message body. Most spammers haven't caught up to tec
311.
by Panino 11y ago
Ad-hominem attacks usually say more about the sender than the receiver. "Coward" in particular has historically been most often employed against conscientious objectors and others who don't want to kill strangers in someone
312.
by Panino 11y ago
> I wish there was a DJB Linux/Unix. One is being developed by DJB and some colleagues and students, called Ethos. Among other interesting features (like their own PKI called SayI), its principal network transport will be MinimaLT,
313.
by Panino 11y ago
The definition you gave appears to be from Merriam Webster [0]. This is a good starting point, but it's crucial to note that the word "censorship" predates the modern web, with publicly read-write websites. So the word publ
314.
by Panino 11y ago
Lots of misuse of the word "censorship" here and any time this subject comes up generally, not just on this site but anywhere the topic is discussed. What is/are the root issue(s) of this mistaken belief? I typed a few possi
315.
by Panino 11y ago
> (Fully encrypted DNS can only fail in even more ways than dnssec.) The main reasons DNSSEC fails frequently are: * pre-computed signatures, rather than online signing * a demented, overly complex protocol * signatures that expi
316.
by Panino 11y ago
It must have been an exciting surprise for attendees. I'm glad Snowden said DNS should be encrypted. From the tweet stream provided by @conflictmedia, that was tied for 1st for most re-tweeted, along with making the Internet for users
317.
by Panino 11y ago
Nice story, especially about the company's beginnings. I encourage people to try their hand at making yogurt. It's a little time consuming (proper prep, timing, temperature monitoring, cleanup), but otherwise easy and the result i
318.
by Panino 11y ago
You and tptacek are both right, so how about the following to combine your positions: * Grade 'A' requires AES-GCM and ChaCha20Poly1305 * Allow CBC for 'A' iff it's a last resort option * Use nginx equivalent of &
319.
by Panino 11y ago
To expand on agwa's point, I recently received an A+ with a 3072-bit cert. The site config was TLS 1.2-only, with only 256-bit FS ciphers, and HSTS. But I re-enabled TLS 1/1.1 for better browser/crawler support, which dropped
320.
by Panino 12y ago
Consider the possibility that DNT does more harm than good: 1) Since it's not default, it makes browsers more unique and thus more trackable . 2) It gives many (perhaps even most?) non-technical users a false sense of security, making
321.
by Panino 12y ago
Can't think of a better response than this. I'm only mildly supportive of Certificate Transparency, but would definitely like it to "have its day in court." Hopefully CNNIC deploys CT and reapplies to Google for inclusi
322.
by Panino 12y ago
DNSSEC causes more problems than it solves. And even if it were reliable, it's still based on obsolete crypto and isn't even encrypted . But on top of that, it's an outage factory.
323.
by Panino 12y ago
Krakauer's arguments on this subject are based on conjecture and ignore facts. He conjectures that McCandless misidentified a plant he had been identifying for an extended time, for another plant. Unlikely. He makes claims without p
324.
by Panino 12y ago
> Most providers these days (including OpenDNS) redirect invalid queries to their own landing pages OpenDNS stopped doing this on June 6 2014: http://blog.opendns.com/2014/05/29/no-more-ads/
325.
by Panino 12y ago
I use the native OpenNTPD on OpenBSD and it works like a charm. No DDoS or buffer overflows, but it keeps me regular. Theo recently posted to the OpenBSD tech list stating that ntp.org has 66x the lines of code of OpenBSD's OpenNTPD:
326.
by Panino 12y ago
I think you've misunderstood what whyleyc wrote above. OP asked why GoGo doesn't just "blacklist" ie censor the mentioned sites via DNS, explicitly excluding a MITM attack: > Why are they even pulling this MITM
327.
by Panino 12y ago
Right, but the comment that prompted this sub-thread was: > Can't GoGo just "blacklist" streaming sites at a DNS level and deal with the problem before a connection is even made to a high-bandwith destination ? Clearly t
328.
by Panino 12y ago
DNSSEC offers no protection against censorship because it's not encrypted. All GoGo would have to do is drop the query or return SERVFAIL.
329.
by Panino 12y ago
> Even if I don't click the button, Facebook knows that it served me the script. You can stop a lot of trackers by minimizing referer leaks. Firefox has the config option network.http.sendRefererHeader which defaults to 2, &quo
330.
by Panino 12y ago
> I'm concerned that email content encryption would break basically all anti-spam technologies I've self-hosted mail for years and only received 2 or 3 spam messages in all this time. I ignore content analysis entirely, inst

More ›