Titanous

17 ms·

121.
by Titanous 11y ago
No PoC was released with the Heartbleed disclosure, but many were published within hours by others (including myself). And this was a good thing , without them admins would be unable to verify that their servers were patched successfully.
122.
by Titanous 11y ago
1) It helps admins verify that the patch was successfully applied. 2) It gives security researchers more surface area to evaluate when looking for similar bugs or bugs in the patch. 3) A PoC not existing provides a false sense of security.
123.
by Titanous 11y ago
Yes, and my argument is that providing a working PoC along with a patch has at least these immediate benefits: 1) It helps admins verify that the patch was successfully applied. 2) It gives security researchers more surface area to evaluate
124.
by Titanous 11y ago
Working exploits are useful to test and iterate on to ensure that everything is patched correctly (both for admins and researchers). /r/netsec has some good discussion: https://www.reddit.com/r/netsec/com
125.
by Titanous 11y ago
Here's the actual paper: http://dspace.mit.edu/bitstream/handle/1721.1/97690/MIT-CSAI...
126.
Keys Under Doormats: Mandating insecurity by requiring govt access to all data(dspace.mit.edu)
2 points by Titanous 11y ago|0 comments
127.
Code Specialists Oppose U.S. And British Access to Encrypted Communication(nytimes.com)
4 points by Titanous 11y ago|0 comments
128.
by Titanous 11y ago
GoGo is quite aggressive about variable pricing. An all-day pass is $16 if you buy it ahead of time, but if you buy it on the plane it can cost up to $50. They also do split testing of their prices and discriminate based on the user agent.
129.
by Titanous 11y ago
The cryptosystem behind it is called The Update Framework[0], and provides a lot more flexibility and protection than PGP (on top of using modern crypto). [0] http://theupdateframework.com/
130.
by Titanous 11y ago
I've also seen iMessage talk to services hosted on Azure at various points.
131.
by Titanous 11y ago
The fingerprints are included in the bugzilla ticket and the CRLs are signed with the certificates, so TLS doesn't technically add anything as long as you confirm the fingerprints (though it doesn't hurt anything either).
132.
Windows 95 in your browser(win95.ajf.me)
1 points by Titanous 11y ago|0 comments
133.
by Titanous 11y ago
OneRNG is basically the same thing, except it's open hardware: http://onerng.info/
134.
by Titanous 11y ago
Yeah, that's generally what "vendoring" means.
135.
by Titanous 11y ago
We currently use godep, and it breaks very easily due to tags and differing architectures and OSes (among other things). In addition to being unreliable, it's pretty slow. I'm not aware of any other tools that do import rewriting+
136.
by Titanous 11y ago
Vendoring works great for us, we keep everything in one big repo and it's open source. The problem is that the current tooling for managing this is horrible.
137.
by Titanous 12y ago
They explain use cases for testing without HTTPS, but make it clear that TLS is required for production use.
138.
by Titanous 12y ago
Since the page is loaded over plaintext, there's no easy way for a normal user to know that the credit card isn't being intercepted by a malicious script. It's not safe to serve a payment page over plaintext HTTP, even if it
139.
by Titanous 12y ago
Facebook makes RocksDB. The MySQL forked you linked is maintained by Facebook. The blog post is from a Facebook engineer who works on MySQL at Facebook. The tweet linked in the blog post is from a Parse engineer talking about using MongoDB
140.
by Titanous 12y ago
Oops, missed that. This is more complete: http://man.cat-v.org/plan_9/5/intro
141.
by Titanous 12y ago
The protocol itself is much cleaner, but I'm not aware of any recent benchmarks. Compare https://ericvh.github.io/9p-rfc/rfc9p2000.html vs https://tools.ietf.org/html/rfc5661
142.
by Titanous 12y ago
We use it to share filesystems into QEMU/KVM VMs, so far zero issues, but it's not a performance-constrained use case. I do have some plans to do benchmarks for another use case that's more performance intensive, but it'
143.
by Titanous 12y ago
9p is a better network filesystem protocol, and it's available on Linux.
144.
by Titanous 12y ago
Here are some shorter/alternative takes on the situation: http://freelawproject.org/2015/03/20/what-is-the-pacer-probl... http://qz.com/283772/why-pacer-should-and-should-not-be-like
145.
by Titanous 12y ago
Manta is part of SDC and implements a S3-like API (plus distributed map-reduce data processing).
146.
by Titanous 12y ago
I believe that CoreOS can use kexec to update the kernel. kexec basically looks the same as a reboot except instead of stopping fully, and going through the BIOS/bootloader again (which can take a long time on server-grade hardware), t
147.
by Titanous 12y ago
Hey, Flynn cofounder here. We merged the repos (there were a few dozen!) after encountering a ton of friction landing project-wide changes and managing the build system (vendoring dependencies in every repo got ridiculous). Contributors wer
148.
by Titanous 12y ago
Here are our current issues to date: https://github.com/flynn/flynn/issues?q=label%3Aupstream%2Ft... It would be a good blog post topic, I'll make a note of that.
149.
by Titanous 12y ago
Yeah, tup is neat. Much lower friction than the equivalent Makefiles as it can auto-detect dependencies and outputs in many cases. We've run into a couple issues, but for the most part it's been smooth sailing.
150.
Flynn (YC S14) Gamma and Meetup(flynn.io)
57 points by Titanous 12y ago|12 comments

More ›