akerl_

12 ms·

181.
by akerl_ 5mo ago
It seems clear that the Bitbucket devs paid bribes to Gitlab to ban this user to drum up anti-GitHub sentiment.
182.
by akerl_ 5mo ago
It can’t, and it doesn’t. Section 230 has no concern with publishers making editorial decisions. GitHub can moderate user content on its site however it wants.
183.
by akerl_ 5mo ago
Outside of legally, I’m not aware of any framework where “creates an editorial responsibly” makes sense. Even beyond that… most business relationships wouldn’t involve an expectation that Microsoft does things for other entities that it doe
184.
by akerl_ 5mo ago
Thankfully OpenBSD did my work for me: https://www.openbsd.org/papers/bsdcan-signify.html
185.
by akerl_ 5mo ago
Why would taking this action have any implication for responsibility to take future actions against other accounts?
186.
by akerl_ 5mo ago
Do we have any evidence they did that other than the comment you replied to speculating?
187.
by akerl_ 5mo ago
> Okay so drop the IETF standard, web of trust, smartcard support, and external key discovery mechanisms to prove the whole keychain was not swapped out with a fake one, and just have everyone generate minisign keys exposed to system mem
188.
by akerl_ 5mo ago
Holy moving goalposts, Batman.
189.
by akerl_ 5mo ago
Yes, you’re misunderstanding me. I’m saying several things, but since you’re really focused on Linux package signing, I’m saying about that: PGP is a bunch of theatre there and distros should use minisign instead. Linux package signing is a
190.
by akerl_ 5mo ago
Some notes: Cryptography basically always explodes at the joinery. One of the guiding principles of modern cryptographic tools is designing implementations that do not have footguns, where the default behavior solves the default threat mode
191.
by akerl_ 5mo ago
There's like, a whole section on https://www.latacora.com/blog/2019/07/16/the-pgp-problem/#th... that's specifically recommendations. The only ones that are "corporate" are chat
192.
by akerl_ 5mo ago
And also everyone you interact with has to use an alternate implementation!
193.
by akerl_ 5mo ago
Is your pitch that the people who call out problems with PGP don’t have suggested replacements for workflows? Or that the replacements being aren’t as concerned as you are with the IETF process?
194.
by akerl_ 5mo ago
It's thankless because it's a bunch of folks at the county fair running around putting lipstick on all the pigs. Having a bunch of implementations of an omnibus package that tries to be a crypto swiss army knife, written almost ex
195.
by akerl_ 5mo ago
Based on the quote you provided, the CSR was very specific that what they don't use is merchant-provided evidence. They didn't say they don't leverage information about chargebacks or other disputes.
196.
by akerl_ 5mo ago
Stripe has a customer's bank saying "the customer says they didn't make this payment" and you saying "the customer told me they did make this purchase and got the item and they're making fun of me". They h
197.
by akerl_ 5mo ago
What would you like them to do? Even in the post you're wishy washy about what you want. They offer a product that does enhanced fraud detection but you don't like that. You correctly call out that there's major risks with ta
198.
by akerl_ 5mo ago
Yes, that would be the conundrum I was describing. If your plan were to work, the idea of a signer being "reputable" would be watered down into nothing.
199.
by akerl_ 5mo ago
Again, this works when your userbase is a small group of highly technical people who already have social connections to each other. But then again, so would just swapping Signal security numbers. It completely and totally collapses in the f
200.
by akerl_ 5mo ago
Why do I trust the people who are putting their reputations on the line? If they either screwed up or are malicious, I guess I'm just out of luck?
201.
by akerl_ 5mo ago
This is a fun kind of paradox. Right now it wouldn't scale well because signing parties are a niche nerd activity and having your identities signed by other GPG users doesn't really help with anything you'd want to do with a
202.
by akerl_ 5mo ago
If the measure here is "I met this person at an event and they were a human", and the protocol becomes actually important for proving personhood, what is the measure that stops somebody from turning up to a bunch of events and get
203.
by akerl_ 5mo ago
We’re in a thread about an Apple vulnerability, where the claim was made that they’d have found these if they’d properly run traditional tooling.
204.
by akerl_ 5mo ago
Apple has a massive information security organization that has pretty intense resources at their disposal. It seems borderline impossible that there's a tool that they feel would be beneficial but that they're classed out of using
205.
by akerl_ 5mo ago
Basically any DNS provider allows this (plus anybody can buy a domain and run their own DNS server). The defense against this has to happen either on the resource you want to protect or in the browser.
206.
by akerl_ 5mo ago
An example of what the parent commenter meant is more like: 1. You write a DRL that says “we do a disaster recovery test annually to ensure that we can restore a production backup”. 2. It takes you 20 tries in 2026 to do a successful restor
207.
by akerl_ 5mo ago
Last I checked, a VPN isn’t required by PCI (or really any other compliance regime). The parent commenter’s infrastructure had a VPN. And once you have a VPN and you’re showing it to the auditors as part of your in-scope infra for PCI, aski
208.
by akerl_ 5mo ago
The ideal flow here is: 1. Do good security and operations. 2. Overlap the minimum subset of your existing good security and operations as evidence for whatever compliance regimes help you get paid. 3. Get paid. Nobody is suggesting that yo
209.
by akerl_ 5mo ago
> Bullshit past findings were things like “your VPN server supports old encryption algorithms”. “But our clients don’t support them. They select the newer algorithms!” Given that downgrade attacks are a massive category of attacks for ne
210.
by akerl_ 5mo ago
A SOC auditor who tells you that you can’t use an nmap scan to meet SOC2 obligations is a bad SOC auditor, because they’re attempting to enforce a constraint on you that SOC2 does not. But the far more likely thing is that a medium SOC audi

More ›