agwa

36 ms·

451.
by agwa 5y ago
Note that vertically integrated smoke includes high-altitude smoke so it might not reflect air quality near the surface. Use near surface smoke to see how bad the air will be to breathe. Indeed, it looks like a sea breeze is currently kee
452.
by agwa 5y ago
OP here. Unless you work for a certificate authority or a web browser, this event will have zero impact on you. While this particular CT log has failed, there are many other CT logs, and certificates are required to be logged to 2-3 diffe
453.
by agwa 5y ago
> The goal is to be able to verify all signatures; whether we trust a signature or not is configured inside APT by specifying a list of trusted primary keys. Why is it a goal to be able to verify signatures from untrusted primary keys?
454.
by agwa 5y ago
Thanks for your reply. > Fundamentally, Identity makes it possible to choose how much of this data traverses / is stored on your servers, just as Stripe did with card numbers. There's a stark difference in how Stripe treats e
455.
by agwa 5y ago
You're probably right about KYC, but KYC is just one of the four use cases presented by Stripe, and their customer logos include Clubhouse and Discord, which I highly doubt have KYC requirements or any need to access the underlying evi
456.
by agwa 5y ago
I do agree the cases are very similar, which makes it all the more jarring how differently Stripe treats the data. If you want to export credit card numbers from Stripe, you can only have it transferred directly to another PCI DSS Level 1-c
457.
by agwa 5y ago
As I understood it at the time, alternatives required PCI compliance, which Stripe allowed you to sidestep thanks to tokenization, so I do believe that was a selling point. But this is besides the point I'm making, so I've edited
458.
by agwa 5y ago
Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your se
459.
by agwa 5y ago
> 1. Stripe has strict access controls—only those working on Identity/verifications can access the data. > rather than having individuals collect and verify your ID, Stripe will securely handle verification. The above statements
460.
by agwa 5y ago
> Specifically for Stripe, I trust them. So if I see that a new start-up is using them rather than rolling their own solution, that increases my trust Note that Stripe allows their customers access to the "captured images of the ID
461.
by agwa 5y ago
"Purpose" refers to the type of certificate, e.g. SSL/TLS certificate, S/MIME certificate, code signing certificate. Some roots in Mozilla's store are trusted for TLS only, some for S/MIME only, and some for bo
462.
by agwa 6y ago
A fair question. I've opened an issue in Go suggesting some documentation improvements: https://github.com/golang/go/issues/45726
463.
by agwa 6y ago
Public keys are 32 bytes long, and private keys are 64 bytes long. The Ed25519 functions check to make sure the key is the correct length before using them: https://github.com/golang/go/blob/d4bfe006155ea0d9c
464.
by agwa 6y ago
They actually aren't. RSA keys, for instance, are defined as a pair of integers (modulus and exponent)[1] and the algorithms are specified as taking these integers as input. ECDSA is similar. Therefore, to interchange RSA and ECDSA
465.
by agwa 6y ago
This is unnecessarily complicated. The beautiful thing about Ed25519 keys (private and public) is that they are simply opaque byte strings. Indeed, here is Go's definition of ed25519.PublicKey: type PublicKey []byte So if your
466.
by agwa 6y ago
The original behavior of disorderfs was to randomly shuffle directory entries, but we quickly realized that this meant that sometimes the shuffle wouldn't do anything, so I changed the default behavior to simply reverse the directory e
467.
by agwa 6y ago
You use disorderfs as part of a CI process. The CI builds the package once without disorderfs, and once with disorderfs. If they produce the same output, the package is reproducible (at least with respect to filesystem order). Otherwise,
468.
by agwa 6y ago
It's worse now because browser extensions auto-update which means that when a malicious actor buys an extension they gain access not only to future users but to all current users as well. Also, the Chrome Extension Store publicizes ho
469.
by agwa 6y ago
> Registrars not Registries are the real place to try and protect Registrants This makes zero sense. There is robust competition among registrars and since it's easy to change registrars, registrars have a disincentive to screw ove
470.
by agwa 6y ago
You should only use BearSSL when you control the server and the certificate that it uses, since BearSSL's certificate validation implementation is intentionally limited so that it can be more efficient on embedded devices at the cost o
471.
by agwa 6y ago
Read the Earlyname post. He is putting in the time to do those things.
472.
by agwa 6y ago
This is one of the most disappointing comments I've read on HN. The patronizing negativity is bad enough, but it's not even accurate. Read the article about Earlyname. The author absolutely understands marketing, advertising, and
473.
by agwa 6y ago
Then your problem is that you have a locked down device that isn't truly yours. App makers always had the ability to use a proprietary encrypted protocol to serve ads. DNS-over-HTTPS doesn't give them that ability. But it does
474.
by agwa 6y ago
Why would I need to do that? Banks can still intercept employee communication with QUIC: https://news.ycombinator.com/item?id=24712673
475.
by agwa 6y ago
Enterprises can still have all this stuff that is supposedly so important to them, like network interception and "compliance". But they might have to upgrade their software, insist that their vendors implement standards correctly
476.
by agwa 6y ago
Frankly, that would be your problem. Enterprise intransigence should not hold back the rest of the Internet.
477.
by agwa 6y ago
It's not. You could install a root certificate from the ISP and then they could man-in-the-middle your traffic. Encryption is what allows user choice rather than leaving you at the mercy of your ISP.
478.
by agwa 6y ago
Not my experience with open source at all. I get very few bugs and PRs about actual defects. By and large they are feature requests that are very important to the submitter but not necessarily to me or other users of the project. And the
479.
by agwa 6y ago
Now imagine how much worse it would be if some company decided to "help" infosec by giving away a free t-shirt for filing 4 "security reports" whether or not they were valid.
480.
by agwa 6y ago
Since project maintainers don't have to opt in to Hacktoberfest, there's no reason for them to know that the FAQ exists. Most maintainers are unaware of what's going on and will just close the spammy PRs without tagging them

More ›