cyphar

65 ms·

751.
by cyphar 6y ago
> Why would CloudFlare endorse this system if it was just "business as normal but you solve 1/30th of the captchas"? They don't just endorse it, they developed it. Their argument was that it allowed them to solve the
752.
by cyphar 6y ago
OTR also allows you to do key verification -- all encrypted chat systems support that. The point isn't that you cannot be sure who you're talking to, the point is that the communication transcript cannot be provided to a third par
753.
by cyphar 6y ago
Except the whole point of OTR-like messaging was that you can communicate with someone who you can't be entirely sure you trust in perpetuity (that's why messages in Signal and similar systems don't have non-repudiation -- ne
754.
by cyphar 6y ago
The recent Section 230 executive order[1] would be relevant here. Normally social networks have immunity from prosecution if they publish a defamatory or libelous statement (this is the so-called "magazine stand" model). But if th
755.
by cyphar 6y ago
The anti-fat push in the last few decades was the result of the sugar lobby actively pushing pseudoscience to argue that fats were responsible for the rising rates of heart disease rather than sugar[1]. This is somewhat reminiscent of the &
756.
by cyphar 6y ago
Keto is not a balanced diet -- by definition the goal is to place your body into ketosis (by removing carbohydrates from your diet). I'm not sure what definition of "balanced" you're using, but I wouldn't call remov
757.
by cyphar 6y ago
Mercury (or rather, Thiomersal) hasn't been used in the vast majority of vaccines since the 90s. It was completely safe as far as we know, but was removed as a precautionary measure during a push to remove all sources of mercury from f
758.
by cyphar 6y ago
> How? In Signal's design nobody ends up knowing this except the sender and recipient. The most obvious one is fairly basic traffic correlation using the IPs and timing information. You can figure out which IPs are communicating wit
759.
by cyphar 6y ago
I think you missed the point GP was making. To quote: > Unfortunately, just reading the FAQ a few red flags. It doesn’t allow importing encrypted keys . [emphasis added] To which you responded with: > Alternatively, you can import th
760.
by cyphar 6y ago
The proposal you linked is effectively a more formal version of the subkey PFS scheme I alluded to, though it looks like it tries to solve some of the issue with subkeys that make them not a good fit for PFS (though one issue I've had
761.
by cyphar 6y ago
For Signal, sealed sender in theory makes some progress towards fixing this problem[1] but given the service fundamentally uses a central server, you could pretty easily figure out who is messaging who. There was an experimental chat appl
762.
by cyphar 6y ago
No, as mentioned in the FAQ[1]. Though to be fair, this is because of the design of OpenPGP (it's almost anti-PFS by design). [1]: https://delta.chat/en/help#does-delta-chat-support-perfect-f...
763.
by cyphar 6y ago
While this does seem interesting (minus all the issues with PGP-encypted email), I did find this odd claim about PFS[1]: > No, OpenPGP doesn’t support Perfect Forward Secrecy. Perfect Forward Secrecy works session-oriented, but E-Mail is
764.
by cyphar 6y ago
Employers are presumably paying taxes, so funding it through taxes is not letting them off the hook. Additionally, what about people who are unemployed (which is now >20% by U6 in the US) or work in jobs that don't offer healthcare?
765.
by cyphar 6y ago
I didn't say that RAID5 and RAID10 are similar in terms of reliability (most of my comment said that RAID10 had many upsides over RAID5 in terms of reliability). I said they you should consider them to have the same level of redundancy
766.
by cyphar 6y ago
And similarly, in ZFS it'd be % zpool replace <pool> <bad-drive> <new-drive> And you can also set up hot spares in both systems so that replacing the drive happens automatically. One thing I would suggest is th
767.
by cyphar 6y ago
> And the drive that really should not fail is taxed during a rebuild. That is also true for RAID 5/6 (since all drives are stressed during a resilver of a RAID 5/6). > RAID6 is safer: any two drives can fail. RAID 10 can su
768.
by cyphar 6y ago
In my defense, it wasn't clear that's what you were saying in your original comment. "Mood" has become a filler word at this point -- hence why I omitted it from the quote -- and can mean anything from the traditional me
769.
by cyphar 6y ago
> MongoDB was that it used to be inconsistent and unreliable but they fixed most, if not all of those problems and they now have a stable product but bad word of mouth among developers. This report is 9 days old, and tests the latest sta
770.
by cyphar 6y ago
Well, that's because the "lxc" command-line tool manages LXD -- you can't use the "lxc" commands without using LXD. Arguably it should've been called "lxd-client" or "lxdc" but they pro
771.
by cyphar 6y ago
> LXD just feels like Ubuntu to LXC’s Debian. A bit of a funny thing to say, given that effectively the same group of developers work on LXD and LXC -- and most are employed by Canonical. LXD was never meant to replace LXC, it solves its
772.
by cyphar 6y ago
> Terrible performance. One of my engineers recently thought that 150ms was terrific for a HTTP request. Break out of the container and it was <10ms. YMMV. If you're not using Linux (presumably you're using MacOS), your &quo
773.
by cyphar 6y ago
That is what's actually happening behind the scenes (though note that the "recovery key" is actually incredibly important since it gives you access to your key backups -- which is something you absolutely want to enable if
774.
by cyphar 6y ago
They've been working on that for quite a while and just had a major update to Riot (Web/X on Android/iOS) -- E2EE is now on by default. Have you tried the latest version? Most of the issues with key verification have been res
775.
by cyphar 6y ago
What I do is that I have scripts to manage the configuration file, rather than manually editing it. So you never open the configuration file in a terminal in order to see the private key.
776.
by cyphar 6y ago
> I do wonder why there isn't an API for "lazy munmap()"... it would behave exactly like munmap(), except that the pages might remain accessible in other threads until the end of their timeslices, when the kernel can apply
777.
by cyphar 6y ago
Not everyone wants to (or is able to) to work on projects in their spare time.
778.
by cyphar 6y ago
You could do that (though one could argue that there's no real benefit to using containers in that case), but the issue is sadly more general than that. You cannot use pivot_root() if the current root is on initramfs. The reason is f
779.
by cyphar 6y ago
Which is ironic given that LXC long predates Docker (having been involved in the original discussions of the kernel APIs being used by containers today), and Docker used LXC for a long portion of its history.
780.
by cyphar 6y ago
This is true (though it's scoped per mount namespace), but it isn't the primary security reason container runtimes use pivot_root().

More ›