brohee

73 ms·

841.
by brohee 12y ago
Yet it works with way over five nines confidence. Despite all its faults, the system works decently. I would myself prefer DANE being used, because it's IMHO sounder technically, but we'll possibly have the same issue with registr
842.
by brohee 12y ago
Have you reasons to believe the existing x509 certificates handling code handles properly an extension that is seldom used, and will do it in all cases? Validation of x509 certificates is ridiculously complex, and CA rightfully only use the
843.
by brohee 12y ago
Read the root certificate inclusion policy of your vendors. In the end it comes down to how much you trust the vendor to implement the policy faithfully and whether you agree with the policy itself. Google https://www.chromium.or
844.
by brohee 12y ago
https://tools.ietf.org/html/rfc5280#section-4.2.1.10 It does exist. Now do I trust the existing certificate validation code to do the right thing in all cases in presence of the extension? Not one second.
845.
by brohee 12y ago
The article author seems to ignore the existence of views. If you have confidential data query-able from the outside, it's a much bigger issue than wide open AXFR... Restricting AXFR is more cute than efficient, the information still l
846.
by brohee 12y ago
You were supposed to post at least 200 words. You're fired.
847.
by brohee 12y ago
> I mean if you checked any internal codebase written in C today you're likely to still find multiple places where the developer has shot themselves in the foot over memory management. This is absolutely nothing compared to the incr
848.
by brohee 12y ago
Intel added AES, SHA-1 and SHA-256 instruction. They also added the PCLMULQDQ instruction to efficiently implement ECC. Via Padlock also have AES and SHA, and instructions for Montgomery multiplication (RSA speedup). Plenty of ARM SoC vendo
849.
by brohee 12y ago
It's not so much the language itself the issue, as both C and PHP weren't made with safety in mind, it's the kind of programmers that the language encourage. IMHO, C cell defined semantics makes it simpler to master. PHP is a
850.
by brohee 12y ago
This quote is often misattributed. Actually by Laubardemont. https://fr.wikipedia.org/wiki/Jean_Martin_de_Laubardemont (no English wikipedia page). He's well known for the Loudun withcraft trials ( https:/&#x
851.
by brohee 12y ago
"I think about the rock itself, where it came from, how it was formed, how old it is, and it makes me really happy" While you're thinking, think about how it was mined and trafficked, and try to estimate the amount of blood i
852.
by brohee 12y ago
http://priceonomics.com/post/45768546804/diamonds-are-bullsh...
853.
by brohee 12y ago
It sill makes the idea that someone would pay billions (in cash) for Snapchat technology pretty funny. As how to value their users...
854.
by brohee 12y ago
Thanks, so his last tweet before nuking his account was: "Apologies for my discriminative job advert. It was totally wrong. Going forwards, we’re adopting a more ethical hiring procedure."
855.
by brohee 12y ago
@xiangyu_wu deleted his twitter account and Topsy doesn't seem to have the incriminating tweets, any other archive?
856.
by brohee 12y ago
You know OpenBSD has been built with stack protection since 2003? It was the first OS to integrate what was then the outside GCC patch ProPolice (it has since been interated in mainline gcc and is the standard -fstack-protector). Given that
857.
by brohee 12y ago
3) He could start using VMs like the rest of the world... physical access really isn't needed except for physical security (making sure the rack is locked and access is controlled), which data center employees can manage (Fairly e
858.
by brohee 12y ago
You need drivers for time sources for a start, there are enough of these to use full time devs for years...
859.
by brohee 12y ago
The infection is asymptomatic in most cases, the sentence clearly applies to people for which it is not, and during outbreaks...
860.
by brohee 12y ago
The DefCon "show us your tits" incident is pretty well documented... Feel free to donate the money to RAINN ( https://www.rainn.org/ )
861.
by brohee 12y ago
Sexual offenders tend to have lots of victims, so victims are likely clustered around them. A workplace with one must have quite a few victims, a workplace without one is full of people that never heard anything like this.
862.
by brohee 12y ago
Nothing like a demo to see its power, what about reverse engineering a mega hit everyone heard : https://www.youtube.com/watch?v=eU5Dn-WaElI
863.
by brohee 12y ago
It looks more like the Vietnamese NIC was compromised...
864.
by brohee 12y ago
From an attacker point of view, Privdog looks a lot better than Superfish since the traffic toward the specific ad network identifies people likely to have it installed. Much less chance to be caught red handed MitMing someone not vulnerabl
865.
by brohee 12y ago
And what should be the result of a divide by 0 in your magical totally ordered float type?
866.
by brohee 12y ago
You know you can use MAC and a NULL cipher right? Even in IPsec there is a whole mode, AH where messages are authenticated but not encrypted...
867.
by brohee 12y ago
It was obfuscated. The "product" uses an obfuscating executable packer. It was extracted from a memory dump not from reversing the program.
868.
by brohee 12y ago
90% of the time the desirable quality of TLS traffic is authentication of the server, not encryption. Encryption only really comes handy when confidential information and authentication credentials get exchanged. Now if you provide authenti
869.
by brohee 12y ago
You provided the incentive for me to read some of the French press of the time. Basically, it's not illegal (nor authorized) to enter a monument after opening hours. Nor is it restore an antique clock. The charge eventually used agains
870.
by brohee 12y ago
Since it won't be native code, they'll only be able to abuse a FF bug exposed by the JS plugin API, but should be in a very bad position to exploit a kernel bug... Same process isolation, but the JS plugin got a vastly reduced sur

More ›