akerl_

15 ms·

421.
by akerl_ 9mo ago
No, you didn’t diagnose and fix an issue. You just temporarily mitigated it.
422.
by akerl_ 9mo ago
You may just be using a personalized definition of that word, that differs from what it means. https://en.wikipedia.org/wiki/Sandbox_(computer_security) Notably, a sandbox exists to separate one thing from other things
423.
by akerl_ 9mo ago
We do have to distrust the network, which is partly why TLS cert validation now includes a bunch of mitigations around validation from multiple network positions, certificate transparency logs, etc.
424.
by akerl_ 9mo ago
The molecules I’m aware of are all made of atoms.
425.
by akerl_ 10mo ago
A protocol that doesn’t enforce security and relies on clients to choose to implement it is a broken protocol, from a security standpoint. Even if secure email clients exist that always make right choices, because you can’t know what client
426.
by akerl_ 10mo ago
This feels almost too obvious to be worth saying, but “the rest of the industry” does not in fact have a uniform shared stance on this.
427.
by akerl_ 10mo ago
My memory of IPv6 is getting waves of support tickets from people who took their (already questionable) practice of blocking ICMP on IPv4, blocked ICMPv6, and then got confused when IPv6 stopped working.
428.
by akerl_ 10mo ago
> if companies like Apple really wanted to fund this work, I'm pretty sure they could figure something out A reminder that companies are not a hive mind. Many people at Apple surely would love to funnel piles of money to open source
429.
by akerl_ 10mo ago
Yea, here “we’re happy to pay for it” really means “we’re not happy to pay the price you’re charging, but maybe we’d pay if you fundamentally changed your prices or pricing model.”
430.
by akerl_ 10mo ago
I don’t know what you’re talking about. It’s a free tier.
431.
by akerl_ 10mo ago
Where are you seeing that? From what I can tell, the 10k message limit applies to "Mattermost Entry": > Mattermost Entry gives small, forward-leaning teams a free self-hosted Intelligent Mission Environment to get started on im
432.
by akerl_ 10mo ago
It's clear we're not going to agree on the technical discussion, but I do want to reply to the claim that I've been strawmanning you. I've been largely ignoring your sideline commentary about not trusting Meta and their
433.
by akerl_ 10mo ago
Just to be crystal clear about the goalposts: I said at the start of this chain that if somebody wants secure messaging, they should use Signal or WhatsApp. You raised concerns about lack of source availability, and I’ve been consistent in
434.
by akerl_ 10mo ago
No, we don’t agree. There are things that source code is good for, but validating the presence or absence of illicit data stealing code in apps delivered to consumers is not one of those things. For that, source code can show you obvious ma
435.
by akerl_ 10mo ago
Yes, that would be an example of LARPing security. The obviously indicator is that encrypting your message is entirely optional, per their own instructions. The less obvious bit is that even if you encrypt your message, anyone without GPG c
436.
by akerl_ 10mo ago
That’s not what they said. They’re saying you often want to give someone a specific file from a disk, rather than the whole set of files.
437.
by akerl_ 10mo ago
> but the solution to this problem isn't to say "and therefore source availability doesn't matter at all for anyone" Thankfully, I didn’t say that.
438.
by akerl_ 10mo ago
I’m very familiar with oss-security, a public mailing list that doesn’t really have anything to do with GPG-encrypted emails. Encrypting emails to a public mailing list, with GPG or otherwise, wouldn’t really make sense.
439.
by akerl_ 10mo ago
> but it doesn’t actually work as a serious communication tool. Say more. Plenty of people use Signal as a serious communication tool. > Openwall are certainly practicioners, and they use PGP-over-email: are they commiting malpractice
440.
by akerl_ 10mo ago
If the gateways are putting encryption in place and then stripping it, it’s not end-to-end. You’re just doing theatre over mandating TLS.
441.
by akerl_ 10mo ago
Can you give an example of an email provider or technology that’s doing GPG or SMIME at the gateway? I’ve never seen that configuration and it doesn’t seem like it would make sense. Either it’s just theatre, encrypting emails internally and
442.
by akerl_ 10mo ago
> Then we know where this stuff came from. I can’t figure out what you mean by this.
443.
by akerl_ 10mo ago
This may shock you, but plenty of cutting-edge application security analysis doesn't start with source code. There are many reasons, but one of them is that for the overwhelming majority of humans on the planet, their apps aren't
444.
by akerl_ 10mo ago
I stand by what I said.
445.
by akerl_ 10mo ago
I thought the whole unix philosophy was to have a bunch of tools that each do one thing well, and to compose them into the workflow you want.
446.
by akerl_ 10mo ago
I gave you the answer that exists: I'm not aware of any existing or likely-to-exist secure messaging solution that would be a viable recommendation. The available open-source options come nowhere close to the messaging security that Si
447.
by akerl_ 10mo ago
There's no future-proof suggestion that's immune to the government declaring it a crime. If you want a suggestion for secure messaging, it's Signal/WhatsApp. If you want to LARP at security with a handful of other folks,
448.
by akerl_ 10mo ago
So if we need a pre-established channel anyways, why would people recommending a replacement for GPG workflows need to solve for secure key distribution? This is a bit like looking at electric cars and saying ~"well you can't clai
449.
by akerl_ 10mo ago
I guess we'll have to live with you being unimpressed.
450.
by akerl_ 10mo ago
https://www.latacora.com/blog/2019/07/16/the-pgp-problem/#th...

More ›