agwa

44 ms·

511.
by agwa 7y ago
Read the article. Unlike Mozilla's approach, Microsoft's DoH rollout is intentionally designed to not bypass DNS-based filtering. ISPA shouldn't have any problem with what Microsoft is doing.
512.
by agwa 7y ago
The Chromecast has always been a locked-down device. I suppose it's frustrating if unsecured DNS was the one way that you could exert some control over a device that isn't truly yours, but that's just not a battle than can
513.
by agwa 7y ago
You'll still be able to run your own resolver that applies DNS filters and configure your client to use it, just like today. The difference will be that connections between the client and the resolver will be secured with HTTPS, so yo
514.
by agwa 7y ago
Chrome is doing literally the same thing as Microsoft: https://www.chromium.org/developers/dns-over-https
515.
by agwa 7y ago
> As a personal user, I consider 1Password the GitHub of password management Ah, GitHub. The company which was bootstrapped and profitable like 1Password, but then took venture capital, became unprofitable, and had to sell to Microsoft.
516.
by agwa 7y ago
If the developer's terminal is owned the attacker can always find a way to piggyback the session, such as by attaching a debugger to ssh and injecting malicious commands as if the user had typed them (and hiding the echo so the user do
517.
by agwa 7y ago
Server-side MitM detection doesn't work. It tries to compare the attributes of the TLS connection (ciphersuites, etc.) with the expected attributes of the client software as determined by the User-Agent header. So you'll get false
518.
by agwa 7y ago
The original title ("Don't use VPN services") is appropriate. The article talks about more than just anonymity - it also explains why you shouldn't use VPN services for greater privacy or security. The article does say
519.
by agwa 7y ago
Here's a variation of the example which I like a bit better: type CopyFile string func (src CopyFile) To(dest string) error { // copy file here } func main() { CopyFile("presentation.md")
520.
by agwa 7y ago
Go already lets you recover from panics in a way similar to Java exceptions. For example, the standard library's HTTP server recovers from panics so if a request handler has an out-of-bound array access (or other panic-inducing error)
521.
by agwa 7y ago
See also https://openinframap.org/ which pulls from OpenStreetMap. (I'm one of the contributors to the mapping of the Bay Area's electrical infrastructure.)
522.
by agwa 7y ago
The Camp Fire was started because a transmission tower failed in an area which had a history of transmission towers failing during high winds. PG&E knew that the towers in this area weren't sufficient for the weather conditions and
523.
by agwa 7y ago
The 16 9's are for durability , not availability. AWS is not saying S3 will never go down; they're saying it will rarely lose your data.
524.
by agwa 7y ago
https://blog.cloudflare.com/introducing-certificate-transpar... is a very good overview of Certificate Transparency. I've written my own Certificate Transparency monitor called Cert Spotter. I use both the standalone
525.
by agwa 7y ago
It's unclear what Huston means by "real time", but in the comments section he cites the fact that it took 6 months for the misissued Symantec certificates for example.com to be noticed. That's because the owner of exampl
526.
by agwa 7y ago
Theodore Ts'o is responsible for perpetuating the myth that entropy/randomness can run out, leading systemd (and other software) to do crazy things, such as trying to use RDRAND, to avoid "drain[ing] randomness from the kerne
527.
by agwa 7y ago
This currently works, but considering their crackdown on domain fronting last year, I don't expect it to work for much longer.
528.
by agwa 8y ago
> What sites currently let me authenticate with WebAuthn? (Github still uses U2F, it seems.) https://login.gov
529.
by agwa 8y ago
To be clear, the failure here is not that DigiCert issued for .arpa, which is not forbidden, but that they gave the reporter, Cynthia Revström, the ability to issue for all of in-addr.arpa even though she had only demonstrated control over
530.
by agwa 8y ago
If your laptop's compromised the attacker can just steal your cookies and it doesn't matter how you're doing 2FA. In general, an actively compromised device is not a threat you can effectively defend against.
531.
by agwa 8y ago
> The tweet you linked to is making false claims about dnssec. It doesn't "blow up the sizes of dns requests" If you aren't explicitly looking up dnssec signatures, a signed zone's responses will be the same leng
532.
by agwa 8y ago
I'm afraid that's unlikely to protect you from BGP attacks. In theory , the Baseline Requirements require CAs to honor DNSSEC when checking CAA records. However, in practice, there are too many terrible DNS servers, and looking
533.
by agwa 8y ago
I did see Colm's Tweet last week. I'm just not sure what the attacker gains from the lockout being cryptographic, as opposed to being based on old-fashioned DNS caching. If the attacker gets an A record pointing to a bogus IP addr
534.
by agwa 8y ago
An attacker could certainly do that, but they could also advertise bogus records (e.g. the MX record in mit.edu's case) with long TTLs so I don't think DNSSEC makes the worst-case recovery time any longer.
535.
by agwa 8y ago
> And, for bonus points, had they done so, they likely would have been able to lock out MIT of regaining control of the domain for longer than it actually took. How would DNSSEC have made it take longer?
536.
by agwa 8y ago
> 2. Are there any negative consequences for the people whose property a displaced marker ends up on? That's definitely plausible: https://splinternews.com/how-an-internet-mapping-glitch-turn...
537.
by agwa 8y ago
Is the pseudo-random number generator cryptographically secure?
538.
by agwa 8y ago
Even if you were right about that, Firefox doesn't really have a say. Chrome is intent on rapidly adding more Web features. If Firefox doesn't keep up with the pace, websites will stop working in Firefox because they use the new
539.
by agwa 8y ago
It's already phoning home to retrieve vital security updates, without which your privacy would be at much greater risk than Mozilla learning that a certain IP address uses Firefox.
540.
by agwa 8y ago
Is there anything to suggest that this violated people's privacy? If not, I see no reason why privacy advocates should have a problem with it.

More ›