agwa

44 ms·

541.
by agwa 8y ago
Nice! Thanks for your response.
542.
by agwa 8y ago
> If your Worker makes requests to a third-party API that is also implemented as a Cloudflare Worker, this request doesn't even leave the machine. The other worker runs locally. Doesn't this undermine your assumption that exter
543.
by agwa 8y ago
Yes, renumbering is a PITA. NAT66 does exist and over time more software and hardware will support it. But you don't need NAT if you are using ULA; instead you would configure each system with both its ULA address and the global addre
544.
by agwa 8y ago
Using IPv4 internally becomes an issue as soon as you need to interconnect with someone else's internal network which uses overlapping IPv4 address space. The most famous example is probably Facebook's acquisition of Instagram, w
545.
by agwa 8y ago
Let's say you're a company with a serious PR problem about the working conditions in your warehouses. You set up 15 Twitter accounts claiming to be employees of your warehouses. You make sure the accounts are laughably bad at con
546.
by agwa 8y ago
> UPDATE: Before people ask the potential question how the researchers are supposed to get their proper credit - my consideration is the following: Each of the researchers signs the paper with their own "public" key of a public
547.
by agwa 8y ago
That is literally an ad hominem attack: https://en.wikipedia.org/wiki/Ad_hominem
548.
by agwa 8y ago
It's disappointing to see the top comment here condoning ad hominem attacks. But if you do believe that the identity of a speaker is more important than the arguments they make, note that the author of this blog post has a history of p
549.
by agwa 9y ago
That's Option 1. In Option 2, Moxie suggests using the Web PKI, with pinning. I agree with tialaramex that this advice has not aged well. Most Web PKI experts would now advise against pinning and point to Certificate Transparency in
550.
by agwa 9y ago
There's a proposal for 12-digit phone numbers in the NANP (US and Canada), but the current 10-digit numbering plan isn't expected to run out of numbers until 2044. https://en.wikipedia.org/wiki/North_American_
551.
by agwa 9y ago
This code is buggy because it assumes that a single write() will write out the entire file: https://gitlab.com/jeffreyrogers27/AtomicWrite/blob/8a40d050... In reality, write() may write a partial amount, so y
552.
by agwa 9y ago
But if it's not your credit card, it's your employer's, you've got a job to do, and you know there's an accounting department whose job it is to make sure the bank refunds the charges in the unlikely event there&#x2
553.
by agwa 9y ago
Thanks for the recommendation; that book looks amazing! And there's a revised 2014 edition in print: http://industrial-landscape.com/#/buy
554.
by agwa 9y ago
No, the screenshot shows a window containing the real Stripe overlapping a window containing Ian's site: https://cdn.arstechnica.net/wp-content/uploads/2017/12/safar... Ian was not impersonating the
555.
by agwa 9y ago
> On the one hand it's good to prevent these edge cases and keep things deterministic, but on the other it can cause availability issues for customers if Route 53 were to refuse to import a zone that probably loaded and "worked
556.
by agwa 9y ago
> Route 53 is a so-called "child centric" DNS server, in that it considers the child zone to be fully-authoritative for its own NS records. That's why the name servers for a parent zone reply with a referral, rather than i
557.
by agwa 9y ago
With the correct pin (as described in my linked comment), you can prevent systemd-as-PID1 from coming back. If you install certain desktop packages, then a package named "systemd" might come back, but systemd won't actually r
558.
by agwa 9y ago
glibc's actually pretty bad, and many people prefer alternatives such as musl. Ideally, it would be easier to use an alternative libc. Wherever possible we should encourage modularization and standards-compliance, not lock-in, so tha
559.
by agwa 9y ago
It's really easy to replace systemd with sysvinit on Debian: https://news.ycombinator.com/item?id=14581820 All my Debian systems run sysvinit, and they work great - certainly better than the one system I co-administer
560.
by agwa 9y ago
WIPEONFORK makes it possible to reliably detect forks. Without WIPEONFORK, it's impossible to reliably detect forks 100% of the time.
561.
by agwa 9y ago
The write function takes care of repeating it. See the complete source code in the blog post.
562.
by agwa 9y ago
The main function is egregiously overcomplicated. This is how I'd write it instead: fn main() { match env::args_os().nth(1) { None => write(b"y\n"), Some(arg) => {
563.
by agwa 9y ago
Are you able to preserve the original caller ID when forwarding SMS?
564.
by agwa 9y ago
The author of dnsmasq says it has to be a PTR lookup: https://twitter.com/SimonRKelley/status/914918747978305537 That's very good news. Edit: never mind, he says a CNAME answer to a A/AAAA query can trig
565.
by agwa 9y ago
Agreed, but such software rarely runs on a home network with a cheap router. dnsmasq is used elsewhere, of course, but those deployments are far more likely to receive security updates.
566.
by agwa 9y ago
Of the three RCEs, two of them are in the DHCP server subsystem, which means they can only be exploited by a device that successfully authenticates to your local network. The other RCE is in the DNS subsystem, and can apparently be exploite
567.
Mozilla to distrust PROCERT certificate authority(mail-archive.com)
3 points by agwa 9y ago|0 comments
568.
by agwa 9y ago
Exactly. And to be clear, the malfeasance by Symantec is voluminous and well-documented: https://wiki.mozilla.org/CA:Symantec_Issues Distrusting Symantec is not an arbitrary action as some people seem to believe.
569.
by agwa 9y ago
Unfortunately, if you want to use CAA your provider must support it. I recommend you use one of the DNS providers on the page I linked - there are quite a few to choose from.
570.
by agwa 9y ago
> Is it expected from all CAs that they obey CAA records, or is it something just made up by the community to crush the big CAs? CAA was made up by... drumroll.... Comodo. Yes, check the authors on the RFC: https://tools.ietf.

More ›