cyphar

20 ms·

301.
by cyphar 3y ago
While snaps are the more common way for people to install LXD, there are RPMs for LXD. I maintain the openSUSE ones and I believe there are ones for the RHEL/CentOS/Fedora family as well. Obviously, once incus is ready for packagi
302.
by cyphar 3y ago
That does indeed appear to be the case. :P
303.
by cyphar 3y ago
The HN article we are commenting on is about a PR to add a feature to KeePassXC.
304.
by cyphar 3y ago
Nitrokey has a free software implementation of their firmware. But ultimately you need to get some hardware _somehow_ which costs money, though some conferences give out free Yubikeys (or equivalent) and most enterprises would provide them
305.
by cyphar 3y ago
When I said "auto-fill", I was referring to auto-fill with a browser extension where the website is checked. Yes, the FIDO method is even nicer from a technical perspective, but from a security perspective they are similar. But of
306.
by cyphar 3y ago
If you don't need a proper second factor, just set up TOTP and store it in KeePassXC. There is little benefit to a WebAuthn/FIFO "key" stored in your password manager over a password manager with your TOTP stored in it -
307.
by cyphar 3y ago
Is "passkey" not another word for a WebAuthn/FIDO token?
308.
by cyphar 3y ago
Why would they bother trying to track you through a specification which is specifically designed to make it hard to track users? If you're using one of these software-based SSO lock-in "tokens" then they can get all the infor
309.
by cyphar 3y ago
It seems to me that is the same problem as Single Sign On, and I think there simply needs to be legislation to make it not possible to monopolise markets this way (or just enforce the existing legislation on the topic). WebAuthn/FIDO a
310.
by cyphar 3y ago
What you are describing is Single Sign On, not WebAuthn/FIDO. Every site that I've used that has WebAuthn self-hosts it (GitHub, Twitter, Google, Microsoft, etc).
311.
by cyphar 3y ago
But I don't see how passkeys factor into this discussion at all. Yes, large companies are unaccountable and they do harmful things to their users without recourse. This is unrelated to the method you use to log into microsoft.com. Web
312.
by cyphar 3y ago
I don't understand which part of FIDO/WebAuthn requires "trusting Google or Microsoft"?
313.
by cyphar 3y ago
I don't understand your point about vendor lock-in, on the devices side YubiCo, Feitian and NitroKey exist (as well as many others probably) and are none are "multinational corps" in the derogative sense (the replies make ref
314.
by cyphar 4y ago
It's still Anki's version of SM-2, with minor changes to its behaviour. You can see a list of the changes here[1]. [1]: https://faqs.ankiweb.net/the-2021-scheduler.html
315.
by cyphar 4y ago
It should be noted that Ebisu currently has a severe flaw that causes it to massively underestimate how well you know a card[1]. The author has been working on a rewrite to fix the issue for a year and a half, and is currently asking for co
316.
by cyphar 4y ago
Agreed, but GP was explicitly saying that this makes DNS challenges more secure. I was simply responding to that.
317.
by cyphar 4y ago
Sorry, I edited my comment to remove that aside before you posted your reply. Ultimately this does make the HTTP challenge more secure and I mixed up which CAA bits were already supported. My point was more about how this doesn't make
318.
by cyphar 4y ago
In that case, CAA doesn't help either because that record could also be faked. The answer of course is that you need DNSSEC in order for this to work, in which case the DNS challenge is already secure against spoofing without the need
319.
by cyphar 4y ago
Ah, my bad. I thought the post was a link to the other CGP Grey video about airports[1] because the video about airport codes does talk about airline codes (and GP implied it doesn't). I really shouldn't comment late at night...
320.
by cyphar 4y ago
Funnily enough, CGP Grey also made a video about that[1]. [1]: https://youtu.be/jfOUVYQnuhw
321.
by cyphar 4y ago
According to [1], North Korea stopped using it in the 80s. Apparently it is also used in Taiwan in conversation. [1]: https://en.m.wikipedia.org/wiki/East_Asian_age_reckoning
322.
by cyphar 4y ago
I think the best way to do this is to use a passphrase so that it's clear that it's not just gibberish but you have the benefit that it's random text. Obviously at the end of the day, it all comes down to the person on the ot
323.
by cyphar 4y ago
> Unfortunately google requires either their app or SMS. They dropped pure totp for some reason. I use TOTP with my Google Account all the time. If you have a phone registered with that Google Account it will default to the push notifica
324.
by cyphar 4y ago
This is technically still a work-around, but in container runtimes (specifically runc and LXC) we do this to defend against a class of attacks where the container can overwrite the host runc binary (meaning the next time some container oper
325.
by cyphar 4y ago
I think AI-Herzog is getting tired of AI-Žižek's shit: > OK, but there's something about this film that you cannot explain in the way you can with other films. Let's say, for example, that I were to take a knife and stab y
326.
by cyphar 4y ago
> The chilling effect of it is. What if they demand you give them information you do not have a way of accessing. (Eg Signal). How would you comply? Do you have to pre-empt whatever requests you MIGHT get and ensure you could back-door a
327.
by cyphar 4y ago
You're talking about creating new user namespaces inside a container, not running a container in a user namespace. Running a container in a user namespace is strictly a security improvement over running it in the host user namespace. A
328.
by cyphar 4y ago
You've been able to refer to specific versions for as long as vendoring has been used (Godep was first released in 2013 so at least that long, if not longer) and Go has supported it natively with Go modules since Go 1.11 (2019).
329.
by cyphar 4y ago
Maybe I'm missing a joke, but this is not the case unless you're using "one" as a way of referring to yourself. Saying "one could" to mean "someone could" is perfectly standard English.
330.
by cyphar 4y ago
Signal is also run by an American entity. > intelligence services are not interested in your nudes There is actually plenty of evidence they are[1]. [1]: https://www.theverge.com/2014/7/17/5912287/edwa

More ›