c0l0

15 ms·

151.
by c0l0 3y ago
Actually running a CA, even if only for private purposes, without certain regret down the road involves more than creating an OpenSSL cnf file, creating a root cert/key, and running with it. That said, it's a starting point. If yo
152.
by c0l0 3y ago
Back in the early- to mid-2000s, I used to frequent a yearly recurring LAN party ("Hobslan") for up to some 100 people hosted in Germany, about 1300km away from my home. Of course, my midi tower PC that was specifically geared tow
153.
by c0l0 3y ago
War Is Peace. Freedom Is Slavery. Ignorance Is Strength. Ad Targeting Is Privacy.
154.
Remote Attestation is a WebAuthn first-class citizen(developer.mozilla.org)
5 points by c0l0 3y ago|1 comments
155.
by c0l0 3y ago
Over the past few months with Google/Chrome threatening the rollout of "Web Integrity API", Apple's "Private Access Tokens" having more or less silently been deployed, and Windows 11 effectively mandating a TPM
156.
by c0l0 3y ago
Maybe "commonly encountered Free Software desktop and server userspace components"? After all, much of that is what you will also find on BSDs et al., and will give you the same trouble (if any) there. The Linux kernel itself is i
157.
by c0l0 3y ago
That "rest of Linux" that you talk about is not Linux at all.
158.
The Agile Paradoxon [video](youtube.com)
2 points by c0l0 3y ago|0 comments
159.
by c0l0 3y ago
I am not sure I understand what they (the business behing "authentik") hope to gain from having their Open/Libre variant available under MIT instead of under GPLv3, when they do have a fully proprietary ("you may look at
160.
by c0l0 3y ago
Maybe (hopefully :)) also interesting for those who enjoyed this article: https://johannes.truschnigg.info/writing/2022-07_advanced_ss...
161.
by c0l0 3y ago
Let's just hope Apple will not alter the deal any further, right? [-:
162.
by c0l0 3y ago
In 2012, I interviewed at Google Ireland for an SRE position. I ended up not taking the job due to family issues, but I somewhat regretted having missed the opportunity to tackle Google-sized problems and make FAANG-sized money for a few ye
163.
by c0l0 3y ago
I'm sorry to say that I am not convinced. In recent years, Microsoft has introduced [Virtualisation-based Security]( https://learn.microsoft.com/en-us/windows-hardware/design/de... ) - funnily enough while
164.
by c0l0 3y ago
Unfortunately, that is only correct for the example cited in the article I linked to. The RFC being drafted contains attestation possibilities for both clients and servers, as per sections 4.1. (TLS Client as Attester) and 4.2. (TLS Se
165.
by c0l0 3y ago
I wanted to draw attention to this since it has strong "Web Integrity API" vibes, but works at a level that imho might be even more worrisome than what goes on between your browser and a web server - the TLS connection layer. The
166.
Remote Attestation TLS (RA-TLS)(confidentialcomputing.io)
47 points by c0l0 3y ago|34 comments
167.
by c0l0 3y ago
I feel like I have to repeat this, since so much is at stake here, where it is about the preservation of the web as we know it today, at the peril of having it turned into yet another walled garden: The only way around the dystopia this wil
168.
by c0l0 3y ago
Perfect is the enemy of good. If you postpone or skip using Firefox because of this reason/excuse, you are even more a part of the problem than you probably realize ;) Mozilla's opposition to such initiatives matters only because
169.
by c0l0 3y ago
"Yes."
170.
by c0l0 3y ago
That is not possible, because the User Agent (UA) does not return a simple boolean value to the endpoints that requests attestation.That endpoint requests a cryptographic proof that originates at a shared root of trust between that endpoint
171.
by c0l0 3y ago
The banking sector is EXACTLY where "cyber 'security'" and "compliance" will mandate for this to be implemented. When I worked a bank at $oldjob, compliance mandated we had a full-blown anti virus engine (from
172.
by c0l0 3y ago
Of course, that is the most obvious consequence of this whole mess.
173.
by c0l0 3y ago
I feel like I have to repeat this, since so much is at stake here, where it is about the preservation of the web as we know it today, at the peril of having it turned into yet another walled garden: The only way around the dystopia this wil
174.
by c0l0 3y ago
Debian GNU/Linux (a mix of stable and oldstable) on all my personal servers, the work desktop and laptop, and servers at work (I am responsible for that part of the compute env at $dayjob). Arch Linux on my personal desktop(s) and lapt
175.
by c0l0 3y ago
Called it, unfortunately: https://news.ycombinator.com/item?id=30104740 The only way around the dystopia this will lead to is to constantly and relentlessly shame and harass all those involved in helping create it. The scol
176.
by c0l0 3y ago
Congrats! I am certain you will enjoy it! :) It's a GREAT time to choose KDE Plasma 5 on Debian 12 - the desktop is at its peak in terms of polish after many years of incremental refinements, and the non-free-firmware-choice Debian mad
177.
by c0l0 3y ago
This looks like... an unconstrained amalgamation of YAML, python, and zsh/bash. Knowing all these building blocks quite well, I cannot say I find this attractive at all. Seems like it is bound to incur all the problems that having ever
178.
by c0l0 3y ago
This seems to have been written under the assumption that these "elaborate security implementations" discussed are designed to serve the interests of the owner (or, these days, let's better call that person the "user&quo
179.
by c0l0 3y ago
All I have to say from personal experience (some of it gained working for a big bank) is that if you want and seek compliance , you will get neither security , nor saftey - but you will get compliance . :) Whoever tells you otherwise h
180.
by c0l0 3y ago
Yet still correct. I am not a Red Hat user or customer (I've been living on Debian and using it at work for nearly 15 years now), but I can perfectly understand their decision to not play along so nicely with EL rebuilders any more. Lo

More ›