Seirdy

24 ms·

181.
by Seirdy 5y ago
One of the best mitigations against rubber-hose and similar attacks is a hardware key. If you leave it at home, you can't be compelled to decrypt unless an attacker also breaks into your home and searches the place. In a pinch, you mig
182.
by Seirdy 5y ago
Feedback is quite welcome; I hope to release v1.0.0 less than a day from now. This repository contains a Go library as well as a pair of CLI executables for measuring password strength and generating passwords. Unlike existing solutions I&#
183.
Show HN: MOAC: a physics-based approach to password generation and measurement(sr.ht)
1 points by Seirdy 5y ago|0 comments
184.
by Seirdy 5y ago
I wasn't aware; that is unfortunate.
185.
by Seirdy 5y ago
Depends on the ROM. AOSP barely has any Google on it compared to "stock" Android; it uses Google services for system resources like DNS, time synchronization, cert stores updates, etc. This is configurable. Of course, it uses Goog
186.
by Seirdy 5y ago
> I don't want to rely on Google to do this for me. I want the documents of the web to be semantically meaningful to the point where my browser can make opinionated decisions about how to style the information I'm downloading.
187.
by Seirdy 5y ago
Try out Nitter, a Twitter web frontend that doesn't require JS. Same content but way faster, leaner, and nonsense-free (excluding the tweets themselves).
188.
by Seirdy 5y ago
Regarding network location providers: sandboxed play services should do what you want.
189.
by Seirdy 5y ago
Boson's development has stalled but another similar project is going strong: https://sr.ht/~lattis/muon/
190.
by Seirdy 5y ago
None of this changes the fact that using it makes users fingerprintable.
191.
by Seirdy 5y ago
Extensions like this make users more fingerprintable so that kind of defeats half the stated purpose of using a commercial VPN. They also weaken the browser's security model, which is part of the reason why Tor users are told to never
192.
by Seirdy 5y ago
Not necessarily; it could simply connect to a tmux session.
193.
by Seirdy 5y ago
My interpretation of that quote is that if a language is so complex and unergonomic that it needs complex tooling for developers to be productive, then maybe the language is poorly designed. Advanced tooling should be a nice-to-have, not
194.
by Seirdy 5y ago
Adblockers are fully capable of blocking subdomains and individual scripts by name, as well as forbidding certain outbound connections. You'll probably have to use inline scripts and send data back bundled with actual data necessary fo
195.
by Seirdy 5y ago
Plenty of filter lists block several instances of Plausible. I welcome that; if I want to give feedback I'll do so myself. Analytics should not be opt-out.
196.
by Seirdy 5y ago
bubblewrap and/or selinux can prevent the terminal from making network connections. but yeah, this is better for bugs.
197.
by Seirdy 5y ago
"IDE features are language smells" -- Reg Braithwaite
198.
by Seirdy 5y ago
Imperfect, incomplete, yet useful measures I take including building with some of Clang's sanitizers and running the program through a bubblewrap wrapper for filesystem sandboxing paired with a seccomp filter that allows a limited list
199.
by Seirdy 5y ago
I described a good set of similar practices for text/article-centric websites: https://seirdy.one/2020/11/23/website-best-practices.html I don't expect anyone to follow it 100%, but the gist is that
200.
by Seirdy 5y ago
Hashes are generally much better than nonces, especially for static assets. They ensure that the contents of the allowed resource are exactly what they're supposed to be. They're quite trivial to generate for static resources, tho
201.
by Seirdy 5y ago
1. Remote fonts, first or third party, are still a massive attack surface. This is why the Tor Browser's Torbutton disables them. 2. Non-default fonts for text still create a suboptimal experience for users with reading impairments lik
202.
by Seirdy 5y ago
Would be nice to use it for a gopher(s)-to-https proxy.
203.
by Seirdy 5y ago
Check out https://godocs.io for a good alternative. Just replace the pkg.go.dev hostname with godocs.io and you're good to go. All that's missing is the amount of data present in pkg.go.dev's "imported by&quo
204.
by Seirdy 5y ago
There is a big difference between shipping a 192px PNG/WebP image and shipping a custom font. Most of the criticisms I mentioned don't apply to something as small and safe as a logo. Small PNGs with good alt text are not as unsafe
205.
by Seirdy 5y ago
- External fonts are blocked by security-conscious users (including every Tor Browser user who remembers to set the browser security level correctly) for a reason: they're a major attack vector - External fonts are often purely cosmeti
206.
by Seirdy 5y ago
I'm going to copy something I sent to a 13 year old to explain entropy in simple terms. It came up when we were talking about encryption. Reading forwards goes from dense/mathematical to conceptual; reading sections in reverse ord
207.
by Seirdy 5y ago
I wasn't necessarily referring to containers; I was referring to sandboxing tools like Bubblewrap and Minijail, which isolate many parts of the host system, the namespace, and filter syscalls. This approach combined with restrictive SE
208.
by Seirdy 5y ago
Be aware that poorly-configured mailing lists might not play well with DMARC.
209.
by Seirdy 5y ago
Static linking does not bundle the entire library into a binary. It only bundles what's necessary. When you load a shared library, you load an entire copy of the library into memory; when you load a statically linked binary, you load o
210.
by Seirdy 5y ago
The source code is under a FLOSS license, but it only works on Nvidia GPUs and uses proprietary Nvidia-specific technologies like CUDA. It's significantly closer to "nonfree" on the free-nonfree spectrum than it should be, an

More ›