agl

23 ms·

211.
by agl 16y ago
There are several aspects of the web's transport security ecosystem which need to be improved, and the addition of DHE is one of them. The latency implications of DHE are a problem: it pretty much requires an extra round trip. As you mentio
212.
by agl 16y ago
If you can afford 4096-bit certs, or you need them, then you should use them. However, on my laptop, I can only handle 34 connections/second/core with a 4096-bit cert. Such performance is likely to be unacceptable for many uses.
213.
by agl 16y ago
RSA ciphersuites involve the client generating a random session key, encrypting it using the server's public key and sending it to the server. The session key is then used to key the MAC and bulk cipher. If an attacker records the traffic,
214.
by agl 16y ago
I'd be interested to know the manufacturer of these devices and how prevalent they are. (p.s. you're welcome to email me rather than do that in public: append @google.com to my username.) Cheers
215.
by agl 16y ago
Yes, sound on Linux is still using ALSA. The BSD work is all from contributions I believe. We have a 'media/audio/openbsd', but the contents appears to just be a stub.
216.
by agl 16y ago
You're welcome :)
217.
by agl 16y ago
SNI is currently supported by about 50% of browsers in the wild. The vast majority of the non-supporting population are IE users on XP or earlier. Since there's almost no chance that Microsoft will ever update XP, we'll probably have to wai
218.
by agl 16y ago
We (Google) are working hard to reduce the round trips needed for SSL/TLS. We hope to be publishing several draft specs in the next couple of months.
219.
by agl 16y ago
This is probably due to limitations in Blogspot, although that's just an excuse for an unfortunate compromise.
220.
by agl 16y ago
Poly1305 is a fundamentally different class of authenticator than HMAC-SHA256: the addition of an nonce into the function makes it unsuitable for some environments. But given Intel's new instructions, GCM is looking like a more attractive p
221.
by agl 17y ago
We (Google) will be publishing a paper with the results of our investigations, which includes the suggestion from the article of varying the initcwnd and measuring loss. Hopefully it will come out this side of the next IETF meeting in March
222.
by agl 17y ago
Chrome uses the system certificate store. On Windows, that means it's the same one as IE, so you can probably Google for instructions. I'm not familiar with Mac. On Linux, it uses the system NSS library. NSS is built with a set of root CAs
223.
by agl 17y ago
All incognito windows share a profile, so share cookies etc. It's not the case that each tab is a clean profile.
224.
by agl 17y ago
You can read the code for the precise details, but we'll be using both an HTTP upgrade and a TLS extension. But all this is still experimental.
225.
by agl 17y ago
We will.
226.
by agl 17y ago
Operator overloading has good points and bad points: we're erring on the side of simplicity for now. However, you can write "abc" + "def" in Go and it does what you expect.
227.
by agl 17y ago
Ken, iant and I have beards thank you :) Rob, gri, Russ and Kai are sadly lacking.
228.
by agl 17y ago
GC pauses are current unbounded, so I wouldn't use it for that sort of thing, no.
229.
by agl 17y ago
No macros indeed. Unions types will probably happen sooner rather than later.
230.
by agl 17y ago
We (the Go team) all work at Google :) See also http://www.youtube.com/watch?v=rKnDgT73v8s
231.
by agl 17y ago
It does have an iterator syntax: http://golang.org/doc/go_spec.html#RangeClause It just wasn't used in that example to keep the number of new constructs down.
232.
by agl 17y ago
Also, a more correct ASN.1 parser (at the CA, or in the client) could have saved them. The CN field is a PrintableString type which has a limited character set specified. NUL is not an allowed character in a PrintableString.
233.
by agl 17y ago
... and where are you based?
234.
by agl 17y ago
SNI (Server name indication)[1] is designed to fix this. It's a TLS extension which lets the server know the hostname that the client is expecting. It can then reply with the correct certificate. However, I note from the Wikipedia page that
235.
Ask HN: Why don't we see more HTTPS? Is CPU an issue?
26 points by agl 17y ago|31 comments
236.
by agl 17y ago
It's called Chromium - that ship sailed a long time ago. The distribution packages will probably call it chromium-browser. The official releases are google-chome. Since this isn't a distribution package, /opt is the correct place for it. Th
237.
by agl 17y ago
Having said that. It would be hilarious, so it might be an option :)
238.
by agl 17y ago
This issue with Chrome is that V8 is a 32-bit code generator. 64-bit support is coming and, as soon as it's ready, we'll have real 64-bit packages.
239.
by agl 17y ago
No we don't. Fitting in with different windows managers is probably going to be a case of distributions skinning Chromium based on their default WM. But we have bigger fish to fry for the moment.
240.
by agl 17y ago
Erm, yes you do. The assignment of tabs to processes is the same as on Windows.

More ›