brians

58 ms·

571.
by brians 11y ago
Yes! The legal precedent that allows them to insist on examining you hinges on then having no initial information about what you're carrying. If you cleanly pass through a metal detector, then refuse a pat-down, a court MIGHT say the
572.
by brians 11y ago
OCSP? Surely Chromium and Google servers use this. Edit: Ohhhh, just the protocol; stapling and parsing are fine.
573.
by brians 11y ago
Brilliant. Zulip has been a life-changing tool for us: it's the key technology supporting a change in social environment that lets us employ remote staff and collaborate effectively.
574.
by brians 11y ago
That's the idea that probably contributed to this problem: the model says that ring 0 is all powerful. But in a richer model, we might change who has ring 0—we might sell a machine, or get it infected and then want it clean. Root kits
575.
by brians 11y ago
Well, Google does have programs to take revenge porn out of many search results, and does (unsurprisingly) have programs to rate truth above falsehood: that's part of the search quality about which they're so passionate. The bit w
576.
by brians 11y ago
Thanks for your hard work and generosity. How should we think about the security story when sshing from a more trusted to a less trusted host?
577.
by brians 11y ago
It's a parody of the standard European article about America and guns. Nicely subtle.
578.
by brians 11y ago
Yes. But given a botnet can overwhelm your server anyway, Puzzles let you stay up for others with first class computers. It's not the right tradeoff every time, but it's a good tool to have for many deployments. Oh, and as to rev
579.
by brians 11y ago
OCaml doesn't either.
580.
by brians 11y ago
The "browser" half of the CAB forum is happy to accept new CAs that meet their standards. Non-profits and disruptive startups are finding that difficult, as they should—it's hard to run a CA safely. It's not hard like
581.
by brians 11y ago
You can learn to be better. You can practice being the person you want to be, and so more reliably be that person even when it's hard. Some things you can control. Some you can't. Your response to the things you can't cont
582.
by brians 11y ago
The US Navy, 20 years ago: http://haskell.cs.yale.edu/wp-content/uploads/2011/03/Haskel... Past that: all the correct systems I know were built using formal methods and a mix of functional languages and
583.
by brians 11y ago
I play defense. The system owners I work with have to manage many systems with complies relationships. They keep a list, and report to management that they have patched, say 98% of machines against the latest vulnerability. Great! The remai
584.
by brians 12y ago
I'm confused by the blurring of sha-2 on the CSR with the hash function used for the cert. The hash used in the CSR signature has nothing to do with the hash used to sign the certificate. I don't know of any CA that requires a s
585.
by brians 12y ago
Thanks for the reminder that this is coming. I think that sites whose sub-resources come under certs under long-lived SHA-1 intermediates may have problems—they'll be treated as "active mixed content."
586.
by brians 12y ago
That's a neat idea. What do you put in both? I see two options: 1) You copy the whole password, and use the whole password for both. Then an adversary can just attack the weaker, faster one. 2) You split the password; half goes in on
587.
by brians 12y ago
Debian. Postfix. Dovecot. What are you looking for relative to what Gmail offers? It lets you specify a domain and have instant 'everything' ready.
588.
by brians 12y ago
Who drives the train? The engineer. We've used "engineer" to refer to the person who operates a complex engine ever since Watt. The idea that engineers are planners and blueprint-drawers is more recent. I blame Kipling and
589.
by brians 12y ago
That might work! But I think you're dodging some of the load-balancing intelligence in Safari, and so missing one of the important feedback loops for stream performance. It might work---or you might find that reloading the page, you&#
590.
by brians 12y ago
I think you're remembering some papers from Dehnadi and Bornat, starting with http://www.eis.mdx.ac.uk/research/PhDArea/saeed/paper1.pdf
591.
by brians 12y ago
So that's where Bernstein comes from. This advice has a lot in common with his (& others) advice on how to write safe programs with a small trusted base---and the other elements seem a matter of shared taste.
592.
by brians 12y ago
Looks like a fine start. Compressing chunks together seems pretty dangerous; the ZIP file part is only safe if it doesn't compress.
593.
by brians 12y ago
It was quiet, and indeed uncertain, at that point. For myself, I'm extremely excited about the "Let's Encrypt" project's opportunities for experimentation: bringing the marginal cost of certificates to zero should
594.
by brians 12y ago
It's funny to hear this compared to Markdown. The reference implementation of Markdown uses regexes applied in order---an operationally defined language. Only niche implementations like the beautiful Pandoc---also by a philosopher---us
595.
by brians 12y ago
It's independently in others servers as well. No idea on clients yet.
596.
by brians 12y ago
There was a lot of Twitter traffic about SSL3 being bad. But TLS1 has very few differences from SSL3. In Heartbleed, we knew that it was introduced with a particular OpenSSL version. That had 12 changes; 8 were DTLS. Two were clearly not
597.
by brians 12y ago
Apparently independently discovered by Thomas Pornin with a few hours of work: http://chat.stackexchange.com/transcript/message/18151930#18... We saw this with Heartbleed too: given sure confidence that there is
598.
by brians 12y ago
Some FastCGI frameworks helpfully set up environment variables in the web app---you know, just in case you run a sub-process and want it to work the same way it would have from a CGI. See Per-Request Environment Variables at http:/&#x
599.
by brians 12y ago
Some web servers helpfully remove some sorts of white space, like newlines. '() \n{' will get past many filters, then hit some CGIs behind such servers. I would worry similarly about some mail headers being helpfully reassembled,
600.
by brians 12y ago
Can you show example code exploiting zsh? I haven't seen such, nor found such: » V='() { :; }; echo busted' zsh -c "echo hi" hi But: » V='() { :; }; echo busted' bash -c "echo hi"

More ›