ademarre

32 ms·

91.
by ademarre 10y ago
Personally I prefer sign in over log in . Partially because to sign seems to carry a stronger connection to the intended meaning, to authenticate , than to log does.
92.
by ademarre 10y ago
You sound like you know more about this than I do, but I find login as a verb distasteful and believe such usage should be avoided. What would you do for the past tense? You'll decompose the word to its natural verb, log , and write
93.
SHA-1 certificate error on Google.com(twitter.com)
15 points by ademarre 10y ago|4 comments
94.
by ademarre 10y ago
No, it is not a flaw in the OAuth core logic. From the paper's intro: > "the OAuth2.0 standard does not cover or define the critical security requirements and protocol details to govern the interactions between the 3rd-party (
95.
by ademarre 10y ago
These are implementation flaws, not flaws of the OAuth or OpenID Connect protocols themselves. But the prevalence of implementation flaws indicates a bigger problem. We need better tools and libraries for app developers. Too many people are
96.
by ademarre 10y ago
Suppose Western Union brought back its telegram service together with a mobile app for requesting telegraph transmissions. Would they not be allowed to use the word telegram ? ADD: What about Telegram Messenger? Does Instagram have beef wi
97.
by ademarre 10y ago
Sure. But they also say, understandably: > It is worth noting that we are unlikely to share all details of the attack and our mitigation efforts to preserve future defenses.
98.
by ademarre 10y ago
I was hoping to read a more detailed account of the attack and specific mitigation strategies. Have such details emerged anywhere?
99.
by ademarre 10y ago
Is this like the approach you have in mind? https://www.amazon.com/gp/product/052171916X/
100.
by ademarre 10y ago
Or this WatchGuard HTTPS proxy config: http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content...
101.
by ademarre 10y ago
What an awful overreach. Firewalls should not ship with defaults that break the internet, and such presumptuous header filtering can actually weaken security.
102.
by ademarre 10y ago
I suppose it could also be implemented with DTLS [0] over UDP [1]. (Checking Wikipedia...) A 2013 paper [2] published some vulnerabilities; mostly implementation flaws, but it raised some questions about the core spec as well. However you i
103.
by ademarre 10y ago
I presume this change doesn't quell any criticisms toward DANE?
104.
by ademarre 10y ago
I still don't grok the dos and don'ts of NSLs and canaries, but that document establishes the origin of the range 0–249, which is expressly permitted. See also: https://canarywatch.org/faq.html I suspect they woul
105.
by ademarre 10y ago
0–249 National Security Orders received? > "we are not even allowed to say if we've received zero of these reports—we can only report information about these types of requests in broad ranges" Interesting. What are they
106.
by ademarre 10y ago
Right. I'm glad he spoke publicly because it shines more light on how ridiculous his position is. He actually tries to justify (or deflect) stealing the Let's Encrypt trademark by claiming LE stole the concept of a 90-day cycle. R
107.
by ademarre 10y ago
> Why should you trust me if you have never met me? If you like what I do, trust me, and please give me money. What if a customer who trusts you returns to your site, but ends up on an impostor's site instead? He was no way to dis
108.
by ademarre 10y ago
Why is the online advertising industry so slow to address performance problems? Doing so is clearly in their best interest. Don't give people a reason to hate your product, especially when it's in your power to make it better.
109.
by ademarre 10y ago
To revoke with a revocation list, you need to know the ID of the token being revoked. That only works if (a) the token is present at the event that triggered the revocation, or (b) you are tracking all tokens, in which case there's p
110.
by ademarre 10y ago
There are some good observations here. I believe a large part of the interface problem is that people try to design interfaces that make tools easy to use , but it's usually better to design interfaces that make tools easy to underst
111.
by ademarre 10y ago
> At the worst, it doesn't hurt I do agree with the article, but at its worst, obscurity can hurt. Obscurity can add complexity, and it's said that "complexity is the enemy of security". For example, sysadmins and
112.
by ademarre 10y ago
You should push for them to change that practice. If your e-mail address isn't permanent, you probably shouldn't register it with other sites, or else track every site that uses it for authentication (account recovery) so you can
113.
How the Textbook Industry Tries to Hook Professors(wired.com)
28 points by ademarre 10y ago|11 comments
114.
by ademarre 10y ago
Works for me, but is it possible there was an incorrect HSTS configuration at some point? Possibly even the parent domain with includeSubdomains.
115.
by ademarre 10y ago
I've not yet used any of these, but I think InfluxDB stores discrete events. In fact, your description sounds very similar to this comparison of Prometheus and InfluxDB[0]: > InfluxDB is better geared towards the following use case
116.
by ademarre 10y ago
How does this compare to something like InfluxDB and other time-series databases?
117.
by ademarre 10y ago
You're failing to see the charm here. Social engineering is a confidence trick that exploits gaps in someone's personal trust system. Surely you are right that when he presented the challenge he had something different in mind. Bu
118.
by ademarre 11y ago
From the same Google Webmasters blog (2014): https://webmasters.googleblog.com/2014/02/infinite-scroll-se...
119.
by ademarre 11y ago
One explanation I've heard uses analogy with other communication mediums. "Your voice sounds familiar. Have we spoken on the Telephone before?" "No, but I used to be on the Radio."
120.
by ademarre 11y ago
I would say that what's most harmful is using code coverage as the primary measure of quality of your tests. It's that mindset that puts coders in a mode where they write tests which upon failure mean nothing significant (unless

More ›