agwa

65 ms·

751.
by agwa 11y ago
> If someone wants to make the point that they think licensing legalese sucks, and wants to license their work accordingly, then fair enough. As a protest license, it makes some sense, but I do not think that's what draws most peopl
752.
by agwa 11y ago
They don't approve of WTFPL either...
753.
by agwa 11y ago
This lawyer disagrees: https://news.ycombinator.com/item?id=8104407 He even points out that using it could get you sued due to the lack of a warranty disclaimer by default. I've heard other stories of companies refusin
754.
by agwa 11y ago
> So, with the openness, you can't beat the WTFPL ( http://www.wtfpl.net/ ). Please, please, please, do not use the WTFPL, especially if you say you care about "openness" and "kosher rules." The W
755.
by agwa 11y ago
> IIRC the federal government really doesn't offer plea bargains, right? Quite the contrary - in 2013, 97% of federal cases that weren't dismissed ended in a plea bargain: http://www.nybooks.com/articles/ar
756.
by agwa 11y ago
> That's correct the USSG pretty much makes plea agreements non-viable because it doesn't allow the prosecutor to offer any substantial leniency on sentencing, mandatory minimums on pretty much every federal crime also make ple
757.
by agwa 11y ago
You are wrong and don't understand how IPv6 works. With privacy extensions, hosts frequently regenerate their interface IDs, making IPv6 addresses no better at uniquely identifying hosts than the TCP port number does with NATed IPv4 c
758.
by agwa 11y ago
I'm extremely impressed you thought of checking for private IP addresses - everyone seems to forget that. But as you've described it, there's a time-of-check/time-of-use vulnerability: an attacker could set a really lo
759.
by agwa 11y ago
You're absolutely right. This draft tries to pull the wool over the reader's eyes by saying "UDP allows a single packet response from an application. TCP and SCTP operate differently. TCP has a three-way handshake..." I
760.
by agwa 11y ago
> Devs need to know udp is collateral damage in the ddos war Is it? Where's the citation to support the claim that UDP is widely rate-limited? Even if some network operators are daft enough to be indiscriminately rate-limiting all
761.
by agwa 11y ago
Actually, Boston's infamous Big Dig project used so called "fast track construction," wherein construction on earlier segments was started before the design of later segments was finished[1]. This required frequent modificat
762.
by agwa 11y ago
No, they did that in 5.1. The linked page is mostly about the overall 5.x series, with a tiny little section at the bottom about 5.2.
763.
by agwa 11y ago
It's worth noting that, due to GCC's new and esoteric version numbering scheme[1], this is a bugfix-only release on the 5.x branch. The bigger news was when GCC 5.1 (a major stable release) was released in April. That said, GCC
764.
by agwa 11y ago
He found problems with the identity binding where if even a short-term key was compromised, it would allow impersonation attacks in the future[1]. That's a poor way to handle failure (and it's fixed in CurveZMQ with the minor cha
765.
by agwa 11y ago
A rainbow table? The key space is 2^256. If you're talking about building a table containing the ciphertext of "HELO" with all possible keys, that's totally infeasible. As you correctly state, NaCl requires each nonce
766.
by agwa 11y ago
You wouldn't want to use this. The key exchange is vulnerable to replay and identity misbinding attacks. To fix the replay attack, you also need to sign a nonce from the peer (or its ephemeral public key) to prove that the message is
767.
by agwa 11y ago
> For example, they were talking about the debunked idea of solar panel roadways. If something like that took off in the future, literally every panel would require its own ipv6 address. Hardly a problem. According to [1], there is 64,2
768.
by agwa 11y ago
Root certificates are just one manifestation of a much larger problem, which could be described as follows: 1. Nobody checks the source code of the software installed on their machines (or that the binaries were actually built from the purp
769.
by agwa 11y ago
Check out SSLMate, which has been automating certificate issuance since early last year: https://sslmate.com We have both an API and a highly scriptable open source command line client.
770.
by agwa 11y ago
If you have your N private keys all stored on the same device (such as side-by-side in your ~/.ssh/keys directory, as in ryan-c's example upthread), under what scenario would just one of those keys get compromised? You only
771.
by agwa 11y ago
If you have experience with RSA key pairs, using ed25519 key pairs is easy. To generate a key pair just run: ssh-keygen -t ed25519 As with RSA, this command generates a public and private key file. Put the public key in the authorized_key
772.
by agwa 11y ago
That's not how the math works. First, 2048 bits is not 512 bits doubled twice, but rather doubled 1536 times (512 doubled twice would be 514). If this were a symmetric cipher, you could stop here and conclude that a 2048 bit key was 2
773.
by agwa 11y ago
Not much point in upgrading from 2048 bit RSA to 4096 bit RSA. Instead, you should plan to upgrade to ed25519 keys when your client and servers support them - faster and better security than RSA.
774.
by agwa 11y ago
> What, and linux isn't architecture-specific? I have no clue what point you're trying to make. > The counters don't need to be 64-bits: Programs don't need a random number in one process and the 4 billionth only.
775.
by agwa 11y ago
The algorithm works, though it doesn't distinguish between the parent and child - the first process to call check_fork() after the fork will return false, and the second process to call it will return true. (Note that upon returning t
776.
by agwa 11y ago
That's architecture-specific, which isn't nice. Also, the counters would need to be 64 bits so that wraparound isn't a concern. Do all architectures even have an atomic 64 bit increment?
777.
by agwa 11y ago
That doesn't work because there's a race condition - if both processes increment the MAP_SHARED counter at the same time, they could end up seeing the same value and not think that a fork has occurred.
778.
by agwa 11y ago
This is pure licensing FUD. First, as complicated as the licensing interactions around the GPL may be, the quite simple fact is that the (L)GPL's requirements only apply if you distribute code, so there is no more reason to take pause
779.
Why Chrome Thinks Your SHA-2 Certificate Chain Is “Affirmatively Insecure”(sslmate.com)
2 points by agwa 11y ago|0 comments
780.
by agwa 11y ago
I read the book last week - thank you for writing it! I really hope you reconsider your stance on the conversational tone, which made reading the book difficult at times. Being informal or conversational is not bad per se, but it leads to

More ›