cjbprime

63 ms·

901.
by cjbprime 7y ago
I would try Zulip: https://zulipchat.com/ Where Slack encourages line-level chats in mostly static channels, Zulip encourages paragraph-level chats in lightweight and findable threads.
902.
by cjbprime 7y ago
The pilots probably screwed up. But just as a point of order, it's possible that they thought they weren't going to need to dump fuel at this time early on when ATC asked about it, but then the situation deteriorated on the way i
903.
by cjbprime 7y ago
Article from 2018.
904.
by cjbprime 7y ago
A non-story: some employees are temporarily locking their personal Twitter accounts, presumably to avoid harassment risks.
905.
by cjbprime 7y ago
the new Windows Terminal?
906.
by cjbprime 7y ago
It is better to use OS codesigning than hand-built codesigning because then the OS can enforce it -- e.g. App A can't overwrite App B. Anything you hand-roll can be unrolled by an attacker. I guess my preferred solution for be for Elec
907.
by cjbprime 7y ago
I've even switched to using the proportional Iosevka Aile for programming, here's someone else's screenshot from the last time it was mentioned on HN: https://i.imgur.com/LdzBmpx.png
908.
by cjbprime 7y ago
It would be cool to have a regression testsuite showing "insecure" code for each class of security problem, and showing that the problem is fixed by the template.
909.
by cjbprime 7y ago
It's tough due to platform limitations -- e.g. I think that macOS codesigning will only sign binaries, and your JS/ASAR files are not binaries.
910.
by cjbprime 7y ago
> Do we know that MS TLS implementation parses self-signed certs only after successful validation? It would be a contradiction in terms. You can't validate the semantic content of a file before you've parsed it!
911.
by cjbprime 7y ago
Oh yeah! So it's like: * client asks for cert * you give it to them * client tells you the page they want and their useragent * if you think they're vulnerable based on what you've learned about them, you add <img src=&qu
912.
by cjbprime 7y ago
Oh yes, that's true. (Though now I wonder if cert negotiation can be dependent on useragent under SNI. It could certainly be dependent on TCP fingerprint characteristics.) Agree with you that codesigning certs are a more likely problem
913.
by cjbprime 7y ago
> Imagine an actor like google running an intentionally-compromised TLS certificate on their web servers... perhaps even targeted at specific IP addresses or on certain schedules to avoid detection. For what it's worth, you should r
914.
by cjbprime 7y ago
There actually is regulation, though. As I understand it, in theory GDPR could now fine Microsoft 1% of revenue if they've behaved catastrophically negligently at keeping user secrets secure.
915.
by cjbprime 7y ago
> will see a problem immediately because it's untrusted which is weird You might be right, but I don't think your version of "immediately" matches up with the reality of code. How many cert library function calls do y
916.
by cjbprime 7y ago
Heartbleed was found (after the fact) by a simple fuzzer. The ability of fuzzers has massively increased in recent years.
917.
by cjbprime 7y ago
Wait, how do you know it's not an RCE? Memory safety flaws in a DLL become RCE all the time. > is there a way to turn a spoofed certificate into a single-click pwn? e.g. The victim clicks on a link to go to your website, their mach
918.
by cjbprime 7y ago
People reported similarly lame takeovers of minor US govt sites last week as a wartime cyberattack, so sure.
919.
by cjbprime 7y ago
Yes, fair enough. I think our immediate theories on seeing the video didn't try to establish the level of intentionality, but were still correct about the basic facts known so far ("uh, that plane looks like it got shot down by a
920.
by cjbprime 7y ago
Thanks, that looks like the one I was quoting. I'm surprised you say "she says not just that she was told by Epstein to proposition various people but that it happened" from that text, unless maybe by "it" you just
921.
by cjbprime 7y ago
> “Have you managed to talk to many of my friends?” > Epstein had been supplying me the phone numbers of important scientists and financiers and media figures. “Do you understand what an extraordinary group of people they are, what th
922.
by cjbprime 7y ago
It's interesting that for once, the immediate rumor take within an hour of the event (e.g. in the HN thread about the video) was simply correct.
923.
by cjbprime 7y ago
Could you check the page? Neither 204 of the PDF nor 204 in red at the top seems to be a deposition text page. I'm not imagining that Giuffre made anything up. I'm just trying to work out whether, after she propositioned Minsky as
924.
by cjbprime 7y ago
That's the Miami Herald misunderstanding the deposition, I believe. The actual deposition talks about her being directed to offer sex to these people, but doesn't say explicitly whether they accepted it. Example quote from the dep
925.
by cjbprime 7y ago
I don't think it's correct that the deposition says that sex happened -- I'd greatly appreciate a reference to that if you have one. The deposition contains questions like "Where were you and where was Ms. Maxwell when s
926.
by cjbprime 7y ago
Oops, I missed that extra clause, thanks.
927.
by cjbprime 7y ago
It looks similar to e.g. Quake 3's license, source is open but assets aren't.
928.
by cjbprime 7y ago
But such a statement wouldn't rule out anything. Catastrophic engine failures can be caused by missiles.
929.
by cjbprime 7y ago
And even then, "ATC, we have a catastrophic engine failure" from the pilots doesn't discount that the catastrophic engine failure was caused by a missile. The pilots don't magically get to know what caused the engine to
930.
by cjbprime 7y ago
Right, but the question is whether that's a reasonable conclusion for them to have made already.

More ›