Panino

31 ms·

331.
by Panino 12y ago
Nice, this release switches from OpenSSL to LibreSSL. Also kernel 3.6.17, with the new getrandom(2) syscall. Good crypto improvements. One question I have is how LibreSSL allows them to drop both OpenSSL and GnuTLS -- why did they previou
332.
by Panino 12y ago
> Most teachers understand that what students learn in school is because the whole school has made an effort, not just some individual teachers. In the education systems that are high in international rankings, teachers feel that they a
333.
by Panino 12y ago
The Power of Now is at the top, for me. I'll also mention Vagabonding by Rolf Potts -- a great book that's as much about travel as about life.
334.
by Panino 12y ago
I don't mind if the bill is weak, because real solutions are happening outside of electoral politics. Curve25519 deployment is now massive, for example. LibreSSL is moving forward. RC4 has been ripped out of a lot of stuff and replac
335.
by Panino 12y ago
When Godaddy came out in support of SOPA, after a string of other obviously bad actions, I thought for sure it would harm their business. It didn't. Unfortunately I don't think this Uber story will be different. Most people don&
336.
by Panino 12y ago
To push the ball forward, major link aggregators like reddit could implement HTTPS Everywhere style code. The front page has numerous examples of linked content over plaintext http that is also offered over https.
337.
by Panino 12y ago
I'm about halfway through the Culture novels. The stories provide so much to consider/discuss and I highly recommend them. The thought Banks continually returns to in this interview is how as a species to overcome xenophobia. I
338.
by Panino 12y ago
Design by committee generally leads to poor results. A much better approach is the competition method, where e.g. the public is asked for proposals to secure DNS as in the AES, eSTREAM, PHC, and CAESAR competitions. DNSSEC was not "de
339.
by Panino 12y ago
I'm pretty sure they are exactly the same on many of the BSDs. * OpenBSD: /dev/random + /dev/urandom are the same and use ChaCha20. * FreeBSD: They are the same (via symlink) and use RC4. Soon will use ChaCha20. *
340.
by Panino 12y ago
Linux systems usually get their random numbers from /dev/\[u\]random. This interface, however, is vulnerable to file descriptor exhaustion attacks, where the attacker consumes all available file descriptors, and is inconvenient f
341.
by Panino 12y ago
Among the good and bad stories this year, so far, LibreSSL is the good story of the year. Also happy to hear a bit about the ressl API. To me it sounds like a focused, high-level API that makes it easy to get right and hard to get wrong.
342.
by Panino 12y ago
To add to what others have said here, I'll point you to the authors of TweetNaCl, which sort-of competes with Sodium: http://tweetnacl.cr.yp.to/papers.html Little is said, other than that TweetNaCl is smaller and thus
343.
by Panino 12y ago
85% of .GOV domains are DNSSEC-signed Which is funny because the US Congress passed a law mandating DNSSEC for .gov domains. Not to mention the many outages, plus non-deployments, where domains CNAME to a non-DNSSEC CDN. 34% of .NL doma
344.
by Panino 12y ago
Less than 1% of domains under .com are DNSSEC-signed, and many of them are long-term failing. At this point, 20 years after work began on DNSSEC, it's time to move on.
345.
by Panino 12y ago
DNSCurve + MinimaLT would completely stop these attacks. Based on public statements and hackathon reports I think MinimaLT will be released this semester (development is coordinated from rites.uic.edu). http://www.ethos-os.org&#
346.
by Panino 12y ago
I like nic.cz because they are utilising dnscurve. Unless I misunderstand you, unfortunately this is not the case. A quick way to check if a domain supports authoritative DNSCurve service is to do e.g. $ dig +short ns dnscurve.org You&#x
347.
by Panino 12y ago
I generally agree with tedu that OpenSSL and other TLS software should be used with great care, and not deployed without an understanding of the attack surface it adds. However, my approach to this problem seems to be different, at least b
348.
by Panino 12y ago
This is exactly the sort of issue that's supposed to be eliminated by DNSSEC validation. Emphasis on "supposed to be," because what DNSSEC brings to the table in practice is headaches and outages. You won't see storie