agwa

6 ms·

61.
by agwa 10mo ago
The simple task of following a bug requires you to: 1. Send an empty email to a special address for the bug. 2. Wait 15-30 minutes for Debian's graylisting mail server to accept your email and reply with a confirmation email. 3. Reply
62.
by agwa 10mo ago
I can't find it now but I recently saw a graph of new Debian Developers joining the project over time and it has sharply declined in recent years. I was on track to becoming a Debian Developer (attended a couple DebConfs, got some pack
63.
by agwa 10mo ago
There are a couple things missing from this: 1. The monitoring client does not ensure that the checkpoint was created recently, so a malicious log can conceal malicious entries from monitors by serving an old checkpoint. 2. Though the age k
64.
by agwa 10mo ago
Does this support conditional PUT (If-Match / If-None-Match)?
65.
by agwa 10mo ago
There's an extension to static-ct-api, currently implemented by Sunlight logs, that provides a feed of just SANs and CNs: https://github.com/FiloSottile/sunlight/blob/main/names-tile... For example:
66.
by agwa 11mo ago
Now that AWS charges for public IPv4 addresses, is it still free if you need to access IPv4-only hosts?
67.
by agwa 11mo ago
I'll note that the overhead is only on the provider side; from the customer's perspective it's all the same. In contrast, OpenID Connect puts overhead onto the customer (in addition to the provider) which I find unfortunate s
68.
by agwa 11mo ago
Google said "general terms of service violation" or unspecified "abusive activities". Google is only involved in the publication of DNS records, not the deployment of certificates. Note that they didn't require us t
69.
by agwa 11mo ago
They probably shouldn't have suggested doing this in their own documentation then.
70.
by agwa 11mo ago
Right, and we will be ditching our Google Cloud account this time, but as explained in the post this will come at either a security or a usability cost for our customers, which is why I did not ditch after the first suspension.
71.
Google suspended my company's Google cloud account for the third time(agwa.name)
416 points by agwa 11mo ago|192 comments
72.
A Retrospective Survey of 2024/2025 Open Source Supply Chain Compromises(words.filippo.io)
13 points by agwa 1y ago|2 comments
73.
by agwa 1y ago
These passages are from the Secret Service's press release and are not quoted in the CNN article. Note that a 35 mile radius of the UN includes literally all of NYC and then some. CNN wisely chose to change that to "35 miles of Ne
74.
by agwa 1y ago
A "35-mile radius of the United Nations headquarters" includes literally all of New York City and then some, making the supposed connection to the UN meeting extremely tenuous. This looks exactly like a "SIM farm" oper
75.
by agwa 1y ago
That probably just means that some foreign states were among the customers of these SIM farms.
76.
by agwa 1y ago
We should clarify what type of sensors we're talking about. It seems to be easier to find accurate inexpensive sensors for particulate matter (PM) and CO2 than it is for VOCs.
77.
by agwa 1y ago
A CR box only removes particulates, not VOCs. To remove VOCs, you need a filter with many pounds of activated carbon.
78.
by agwa 1y ago
XML without DTDs is a very reasonable subset that eliminates significant complexity (no need for an HTTP client!) and security risks (no custom character entities that are infinitely recursive or read /etc/passwd!) and would proba
79.
by agwa 1y ago
I would suggest not requiring customers to write you for a refund. My company automatically refunds the most recent payment if the subscription is canceled within 7 days of renewal. The invoice email that we send when the subscription renew
80.
by agwa 1y ago
Thanks for the anecdotes!
81.
by agwa 1y ago
How many times has AWS refunded you a five figure bill? I've heard stories from people who got refunded but were told that it would be the first and last time they would get a refund.
82.
by agwa 1y ago
Those are not in fact limits: > There can be a delay between when you incur a charge and when you receive a notification from AWS Budgets for the charge. This is due to a delay between when an AWS resource is used and when that resource
83.
by agwa 1y ago
> There are parts of the SQL engine that are exposed to malicious file manipulation (the schema is stored as SQL DDL text) but that's not arbitrary SQL input. View and triggers can contain arbitrary SQL and can be defined by a mal
84.
by agwa 1y ago
If you're going to use SQLite as an application file format, you should: 1. Enable the secure_delete pragma < https://antonz.org/sqlite-secure-delete/ > so that when your user deletes something, the data is ac
85.
by agwa 1y ago
I would caution against generalizing from the actions of a CA that only Microsoft is willing to trust. This incident says way more about Microsoft's mismanagement of their root store than it does about the WebPKI security model. Also,
86.
by agwa 1y ago
It appears this was first discovered right here on Hacker News by user JXzVB0iA: https://news.ycombinator.com/item?id=45089708 Note that the CA which did this is trusted only by Microsoft. The other major root programs (M
87.
by agwa 1y ago
This CA is trusted only by Microsoft. I and others have reported problematic CAs to Microsoft in the past (though this particular one wasn't on my radar) only for our concerns to be ignored. Mozilla, Chrome, and Apple have actual sta
88.
by agwa 1y ago
The simplicity of SSH's public key authentication comes with a significant privacy downside: https://www.agwa.name/blog/post/whoarethey https://words.filippo.io/whoami-updated/ This isn&
89.
by agwa 1y ago
> OK, interesting, I think I see... So you are asking about if SQLite opens and finds a not-committed rollback journal that looks valid, then it rolls it back? Right. > Assuming fsync works on both the main database and the hot journa
90.
by agwa 1y ago
I found the documentation much harder to parse than the equivalent PostgreSQL docs ( https://www.postgresql.org/docs/current/wal-async-commit.htm... ). Also, even if I've understood the docs correctly, a number

More ›