agwa

26 ms·

331.
by agwa 3y ago
> In principle, everybody who sees the log could agree that they see the same Merkle Tree head, thus the certificate really is logged. In practice the mechanisms to ensure this works, a Gossip protocol, do not exist and have never been d
332.
by agwa 3y ago
Browsers have leverage over CAs because CAs have to ask browsers to be included in the first place, and because distrusting a CA only temporarily breaks websites until they can switch to a new certificate. What kind of leverage do you think
333.
by agwa 3y ago
> We’ve had the X.509 certificate infrastructure for 30+ years, and it’s only recently become mostly safe and automated enough for people to deploy without risk. (This includes new risks, like accidentally sending HSTS headers with too l
334.
by agwa 3y ago
You should be fine as long as you don't try to disable DNSSEC or transfer your domain to a different DNS provider. You may find this blog post about Slack's DNSSEC-related outage useful: https://slack.engineering&#x2F
335.
by agwa 3y ago
CAs can issue certificates without logging them, but such certificates will lack receipts (SCTs) from CT logs, and will be rejected by major browsers.
336.
by agwa 3y ago
> A system as easy as ACME for domain holders to revoke any certificate. ACME in fact supports this, and I expect at some point CAs will be required to support it. In the meantime, I'm working on a tool that will take a certificate,
337.
by agwa 3y ago
It's not a completely nonsensical concern - Chrome relies on a reliable connection to Google in order to get log list updates and do SCT auditing. If an attacker can block log list updates for long enough, CT enforcement is disabled e
338.
by agwa 3y ago
> The people responsible for running the root stores do. And when CAs screw up, they are nuked from orbit--this has happened a few times The CAs that got the boot were detected because they issued certificates that were obviously invalid
339.
by agwa 3y ago
Nope. If Chrome sees a certificate with no SCTs, it rejects the certificate but doesn't report it to Google. (Except possibly for telemetry.) Google doesn't care if CAs issue certificates without SCTs; in fact, some CAs routine
340.
by agwa 3y ago
I'm not sure what you mean by "surveillance system for certificate misissuance". Chrome's SCT auditing has nothing to do with detecting certificate misissuance; just misbehaving logs.
341.
by agwa 3y ago
You are almost correct. The claims are called SCTs (precertificates are something else). The SCT is a promise by the log that they have (or will soon) publish the certificate. The promise could be lie. To detect that, the client is supp
342.
by agwa 3y ago
This is not an accurate description of how CT provides security. To begin with, CAs are allowed to operate logs themselves, so the minimum number of independent parties is 2, not 3. Second, CT log private keys are not particularly well-prot
343.
by agwa 3y ago
That is not true. CAs are not required to log their certificates. Instead, Chrome and Safari by default do not accept certificates unless they are accompanied by a signed receipt from a recognized log. If you don't need your certific
344.
by agwa 3y ago
The deadline is for US recipients: > • Effective July 5, 2023, all 10DLC phone numbers used to send SMS and MMS messages to U.S. phone numbers must be fully registered to an approved campaign under your brand. Messages sent using unregis
345.
by agwa 3y ago
Unfortunately, Twilio is no longer a viable option for sending SMS for personal use. If you want to send SMS you have to register a "campaign" and jump through a bunch of hoops that assume you're a company sending a large vo
346.
by agwa 3y ago
The quality of VoIP software tends to leave a lot to be desired, in my experience. None of the 4 VoIP providers I've worked with support IPv6 :-/
347.
by agwa 3y ago
There are two different reasons companies ask for your phone number, and it's worth distinguishing between them: The first is for sending a verification code during signup to prevent spammy/abusive signups. In my experience, this
348.
by agwa 3y ago
The SIP provider would also need to support IPv6 for this to do any good. voip.ms does not: https://wiki.voip.ms/article/FAQ#Do_you_Support_IPV6_with_SI...
349.
by agwa 3y ago
Nice article. Is there a benefit to using a queue for incoming calls instead of just dialing multiple extensions with the & operator?
350.
by agwa 3y ago
Not directly, but you can search for "Failed" on this page: https://sslmate.com/app/ctlogs
351.
by agwa 3y ago
There's no merging or rebuilding. You just nuke the bad log, and certificates continue to work because they are present in other logs. (If all the logs used by a certificate go bad, then you'll have a bad time. This hasn't h
352.
by agwa 3y ago
It appears to be hosted on AWS, which claims to use ECC memory.
353.
by agwa 4y ago
This was done by the Republicans' flagship tax bill, the Tax Cuts and Jobs Act of 2017. Voting records: House: https://clerk.house.gov/Votes/2017699 Senate: https://www.senate.gov/legislative/
354.
by agwa 4y ago
Except the purpose of the section is to say that R&E has to be amortized. So it seems pretty clear to me that software development costs have to be amortized.
355.
by agwa 4y ago
It's not a tax credit. The tax credit is still there. It's the deduction which has gone away. And yes, small businesses are hit hardest by it going away.
356.
by agwa 4y ago
Right. The bank can generally resell a repossessed building to recover the loan principal, but repossessed software may be worth literally anything, including zero in many cases. That makes loans for building software extremely risky, whic
357.
by agwa 4y ago
No, that's what's changing and it's why everyone is freaking out - software development is no longer a fully-deductible expense.
358.
by agwa 4y ago
We are not talking about a tax credit here, but a deduction.
359.
by agwa 4y ago
You are sadly mistaken. There are two different concepts at work here: 1. R&D credits (IRC 41 https://www.law.cornell.edu/uscode/text/26/41 ). Companies can choose whether or not to pursue R&D credits.
360.
by agwa 4y ago
Only if the company still exists in 5 years time.

More ›