castillar76

10 ms·

61.
by castillar76 4y ago
In addition to the bug issue, OpenSSL has been around a long time and has accumulated a great deal of extra bits and bobs due to it being the Swiss-Army Knife of encryption on a lot of systems. If you’re writing a webserver, you’re unlikely
62.
by castillar76 4y ago
Looks interesting, and potentially something I wouldn’t mind paying for if it works well. However, there’s a steep price differential there because you require “20 users minimum” for your $5/user/month plan. So the price goes from
63.
by castillar76 4y ago
> People don't realize that all ACME/Let's Encrypt certificates are published in transparency logs that get scanned constantly, giving attackers a shiny target. FWIW, this is true of all public certificates right now, rega
64.
by castillar76 4y ago
Very true, and important to note that ‘rubber hose cryptography’ doesn’t have to mean violence—it can take the form of ‘open your phone and let us dump your data or you don’t get to enter/leave the country’.
65.
by castillar76 4y ago
They build them in NC and we live there, so they literally drove them over to us on a truck and deposited them in our yard. I'm not sure what their shipping range is, but given that they're just driving it, I would imagine they co
66.
by castillar76 4y ago
This is a good writeup! A couple random thoughts that occurred to me while reading through it: - It would be really nice to be able to disable Lockdown Mode for specific people in iMessage the way you can for specific websites in Safari. I&
67.
by castillar76 4y ago
We bought two of them during the pandemic! One is my office and the other is my wife’s music studio; they’re about 12’x16’ each, with a storage loft above the door. The company we bought them from in NC has a website that lets you design th
68.
by castillar76 4y ago
> While the results are usually workable - professional musicians are very good at their jobs - they're not great. The Orpheus Chamber Orchestra ( https://en.wikipedia.org/wiki/Orpheus_Chamber_Orchestra ), perfor
69.
by castillar76 4y ago
It's for this reason I've been moving a great deal of my stuff over to a private ZeroTier network (Tailscale is also getting good reviews and on my list to look at). The stuff I trust is part of the ZT network and can access thing
70.
by castillar76 4y ago
Would love to see this as a ubiquitous feature—it would solve so many problems. Just for starters, it would fix the “here, install this root CA to join our mobile device management system/campus wireless network—oh oops, looks like t
71.
by castillar76 4y ago
To answer the first question, the list of trusted CAs is set by the browser/OS root store. They start from standards like the CA/Browser Forum Baseline Requirements (cf. https://cabforum.org ) and then apply their own c
72.
by castillar76 5y ago
The problem is that lots of things don’t do automated cert management still. Network devices, ILO boards, older servers, Tomcat servers, all kinds of stuff still has to have certs manually managed, which means monitoring and renewing them b
73.
by castillar76 5y ago
Yes! And then the rubric should actually define the pieces of the assignment you care about them getting right. I have this debate a lot when we’re designing assignments for an intro to Python class (which, sadly, we have to do very regular
74.
by castillar76 5y ago
I tend to divide "monitoring" into two pieces: alerting ("tell me when XYZ is down or failed") and metrics ("tell me what's going on right now so I can look for patterns and bottlenecks"). Those are closel
75.
by castillar76 5y ago
At least with the CAs we've worked with, the EV certs are required to either be issued in a CA-provided hardware token or you have to demonstrate positively that you have the key in an Hardware Security Module. That's the piece of
76.
by castillar76 5y ago
I kind of agree, although I find them useful for different things. Markdown is terrific for casual text entry that needs a little bit of markup—being able to add italics or bold or a formatted link inside of comments or discussions is reall
77.
by castillar76 5y ago
Wouldn't be the first time someone's put ultra-sensitive equipment in a glass box so they could "show it off to all the executives who come through". :)
78.
by castillar76 5y ago
It really is puzzling to me that there aren't more and better options in this space. On the one side of the fence you have things like SharePoint or some of the Google bits that are fine for synchronous collaboration on a page or docum
79.
by castillar76 5y ago
We're having this struggle right now trying to replace Confluence thanks to Atlassian's "no more Server licenses" foot-gun. The other wiki software that's out there just hasn't impressed me so far. This one is
80.
by castillar76 5y ago
This is something my team is struggling with at the moment. Gitlab issues (and Github issues, and similar) are fine if what you're doing is only software development . The problem is that Jira works really well for tracking all the t
81.
by castillar76 5y ago
They do get credit for having a really cool company name. However—and I know this is picky—if I see the word “authentification” multiple times on the site map it does not fill me with confidence.
82.
by castillar76 5y ago
I felt this: I have way too many tabs open on every platform I own. One way to combat the “but I want to look at that later!” feeling was to start being aggressive about filing them in either Instapaper (for things to read) or Raindrop.io (
83.
by castillar76 5y ago
I think you’ve got it there: it’s the “click here to sign this” thing that they’ve packaged into something a non-IT-focused company can use. It was relatively useful for them before, but with the pandemic you have tons of companies looking
84.
by castillar76 5y ago
I’ve started digging into Alfred (alfredapp.com) automations recently and have had similar experiences. It’s pretty easy to create simple automations using their workflow interface, and I was pleased to discover they made it really simple t
85.
by castillar76 5y ago
If you have the sort of system that has automated key issuance and low interactivity on hosts, I agree that makes sense. But then, that's exactly the 'ssh as yourself and then sudo to root' model, just abstracted in a differe
86.
by castillar76 5y ago
Basing things on source IP is really inexact and easily muddied, though. For instance, the source IP is a workstation or a laptop—now we have to go through DHCP logs to figure out who had that IP address at the time the incident occurred. O
87.
by castillar76 5y ago
There's a real back-and-forth struggle for me with spreadsheets. I find people very frequently reach for them for things that they do really well: data slicing and dicing, ordering and sorting, formulae that cross-reference cells, and
88.
by castillar76 5y ago
Be aware that the "fully encrypted on our server" path is still not going to satisfy many customers. At the least, many of them (like my employer) would want to insist on a "bring your own key" ability, and would ask a l
89.
by castillar76 5y ago
As someone who's spent the last several years maintaining a couple large, vaguely complex documents (CP-CPS documents for certificate authorities), AsciiDoc has been a winner. It's simple enough to be readable in git diffs and be
90.
by castillar76 5y ago
Had this for a year and it's a huge pain in the neck. Mercifully, my levels dropped to zero after a year and I was declared clear, but I'm now ultra-paranoid about ticks when going outside. I nearly died from it while discovering

More ›