cyberax

37 ms·

931.
by cyberax 8mo ago
It's set in the "SCP" universe. It's a collection of short stories ( https://scp-wiki.wikidot.com/ ), collaboratively written. Most of them are (as expected) crap. Some of them are really scary, and some
932.
by cyberax 8mo ago
Agreed. But I meant that in the world without LE but with DNSSEC+DANE this wouldn't be an issue.
933.
by cyberax 8mo ago
> I'm not sure I see the connection here. What I'm saying is that the benefit for sites to adopt DANE is very low because as long as there are a lot of non-DANE-using clients out there they still need to have a WebPKI cert. I f
934.
by cyberax 8mo ago
No? With DNSSEC, the public key is communicated to the top-level domain registry through out-of-band means. Presumably over a secure TLS link that can't be MITM-ed. The hash of the public key ("DS record") is, in turn, signed
935.
by cyberax 8mo ago
Any web server. Just imagine a worm getting onto a company's router and starting to transparently MITM traffic. Jabber.ru experienced such an attack, apparently.
936.
by cyberax 8mo ago
It does solve it. Unless you know my private key, you can't fake the DNSSEC signatures. The linking DS records in the TLD are presumably out of your control and in future can be audited through something like Certificate Transparency l
937.
by cyberax 8mo ago
The vast majority of Let's Encrypt installations don't use CAA records or anything in DNS. Or they host the DNS along with the HTTPS servers. So if the router between the web server and the Internet is compromised, it can just get
938.
by cyberax 8mo ago
> The TL;DR is that by the time DANE was created the WebPKI already existed and was universal and so adding DANE didn't buy you anything because you still were going to have to have a WebPKI certificate more or less in perpetuity. Y
939.
by cyberax 8mo ago
> I'm not sure precisely what you mean by "MITM on the server side". For the vast majority of Let's Encrypt certs, you only need to transiently MITM the plain HTTP traffic between the server and the rest of the net to
940.
by cyberax 8mo ago
DNSSEC can be trivially used with DANE to protect the entire session. The browser vendors quite consciously decided to NOT do that. > 2. People actually rely on TLS/HTTPS, and nobody relies on DNSSEC Sure. But I treat it as a failin
941.
by cyberax 8mo ago
> There's ample evidence that the cost/benefit math simply doesn't work out for DNSSEC. Why? What is the real difference between DNSSEC and HTTPS? I'd argue that the only difference is that browser vendors care about
942.
by cyberax 8mo ago
Your objections basically boil down to: DNS is dangerous, and DNSSEC _is_ DNS. This is fair, but the conclusion for me is that we need to make _DNS_ more reliable. Not to keep treating it as a fragile Ming Dynasty vase. In particular, the l
943.
by cyberax 8mo ago
> I don't think I'm out on a limb suggesting that random small domains should not enable DNSSEC. Why? I can see this argument for large domains that might be using things like anycast and/or geography-specific replies. But
944.
by cyberax 8mo ago
> DNSSEC mistakes take your entire domain off the Internet, as if it had never existed. DNS mistakes take your entire domain off the Internet, as if it had never existed. I'm preparing a proposal to add an advisory mode for DNSSEC.
945.
by cyberax 8mo ago
You can add multiple trust anchors to DNSSEC resolvers. Before the "." zone was signed, adding zone-specific anchors was the only way to get DNSSEC working.
946.
by cyberax 8mo ago
You can play around with a solenoid calculator like this one: https://www.getzenquery.com/tools/solenoid-force-calculator/ TLDR; is that you need high current, meaning a lot of ohmic heating. With non-negligible b
947.
by cyberax 8mo ago
I would love to pay for content. I'm _paying_ for YouTube Premium. But heck. Do I hate the YouTube interface, it degraded far past usability.
948.
by cyberax 8mo ago
This is a fundamental problem with GC-ed languages. You can't get predictable finalization, so IDisposable can never be implemented reliably.
949.
by cyberax 8mo ago
Nah. If anything, treating keywords as special sigils actually helps. Also, not all natural languages are suitable for programming languages. In highly inflected languages you often end up with grammatically incorrect forms. Or with stilted
950.
by cyberax 8mo ago
I'm using Claude in JetBrains, using the Zed editor's ACP connector. It's actually pretty slick. And you can expose the JetBrains inspections through its MCP server to the Claude agent. With all the usual JetBrains smarts and
951.
by cyberax 8mo ago
China has at least two startups that launched rockets into space. Zhuque-3 launch even almost landed a booster. It's the second-mover advantage. Once you know that something is possible, you can often avoid exploring all the dead ends.
952.
by cyberax 8mo ago
> China also had made industry espionage their way to go in these things. They're even espionaging from themselves in the future! Dude, have you ever _been_ in China? They don't need espionage, they're now way ahead of the
953.
by cyberax 8mo ago
Yes, why not? If they are a minority, then there's no issue. If they are a majority (or close to it), then perhaps they have a point.
954.
by cyberax 8mo ago
These devices are basically autotransformers. So they reduce the noise by providing inductive filtering. But they don't really protect against strong surges by themselves. So Tripp Lite uses a regular varistor for that, just like any o
955.
by cyberax 8mo ago
How does he compare with Nixon, who created the EPA?
956.
by cyberax 8mo ago
Everybody should be allowed to vote, except for people who don't want everyone to vote.
957.
by cyberax 8mo ago
I would guess that it can add one more DNS lookup?
958.
by cyberax 8mo ago
How much was built with the AI? An OS is definitely a fun project and the classic x86 is a pretty good platform for that!
959.
by cyberax 8mo ago
> Most of those unmanned narcosubs are cut-down speedboats hulls, to my knowledge. Some are now fully submersible: https://insightcrime.org/news/under-radar-what-hundreds-ofna... I think it is indeed more likely tha
960.
by cyberax 8mo ago
I think you're overestimating the complexity of small unmanned subs. Drug traffickers are building _manned_ subs now in South American jungles. You just need a body (plastic tube), batteries, motors, and a computer. Maybe with a "

More ›