d-z-m

13 ms·

121.
by d-z-m 3y ago
> chances are it will cause the decrypted plaintext to be gibberish with many invalid/unprintable ascii characters. Not necessarily. If the plaintext you're trying to modify is in the first ciphertext block(which in this scena
122.
by d-z-m 3y ago
> This blog post was accurate when we published it – head to monzo.com or your Monzo app for the most up to date information. I am on monzo.com
123.
by d-z-m 3y ago
DNS as a password manager is kind of an own-goal, as you give the attacker the means to mount an offline attack against your encrypted passwords at the outset. They can simply retrieve the encrypted blobs over the network, and begin. Putti
124.
by d-z-m 3y ago
Much work has gone into making Go GC pauses as quick as possible, so it might be in a better position relative to other GC'd languages. Also, you might be able to toggle the GC off, and invoke manually with runtime.GC() at opportune mo
125.
by d-z-m 3y ago
> but it is not immediately clear to me if posting a form cross domain will send cookies. As sibling comment says, this is what SameSite is for. If it's a POST form, SameSite=Lax or SameSite=Strict won't send the cookie. If it&
126.
by d-z-m 3y ago
> The point of JWT vs opaque tokens is that you can just inspect the token itself to derive permissions without hitting any sessions in DB, right? As I understand it, de-centralized verification isn't a necessary characteristic of a
127.
by d-z-m 3y ago
Not sure if I could bring myself to call JWT for website authentication the "gold standard". I'd give the title to HTTP Basic Auth first.
128.
by d-z-m 3y ago
> Modern web applications (so called single page applications) often utilize JSON Web tokens (JWTs) for session handling instead of cookies I had thought the main way JWTs are stored and transmitted in a web context is via Cookie/Se
129.
by d-z-m 3y ago
I don't think you're an optimist.
130.
by d-z-m 3y ago
> Anything that gets rid of the opening memorization thing would make it a vastly more fun game to play. Chess can still be fun even if you don't have much theory onboard. You don't have to play the Grünfeld. Just play "
131.
by d-z-m 3y ago
> I believe that people don’t understand that Data Scientists are full stack engineers. What do you mean by "full stack"? I'm sure there's a spectrum of ability, but frankly where I'm from, "Data Scientist&q
132.
by d-z-m 3y ago
What does your first sentence have to do with the rest of your comment?
133.
by d-z-m 3y ago
> Not in the sense that it's a bad language, but just that it's not used much anymore. What are you talking about? Go is a popular language. Many of the successful software projects released in recent years are written in Go.
134.
by d-z-m 3y ago
> Thanks for the comment, happy to elaborate. You're correct that the IVs are not reused. Perhaps you can elaborate a little more on this? For subsequent calls to the segment() function, holding the stream ID constant, how are IVs g
135.
by d-z-m 3y ago
ha, learn something new everyday. Hadn't run across the --compressed option before.
136.
by d-z-m 3y ago
I don't think it's anything nefarious. Can't pipe a brotli'd response into bash. My browser wasn't accepting the 'identity' encoding. If you alter your browser to accept 'identity', it will re
137.
by d-z-m 3y ago
> I suspect the encryption here is broken due to CTR mode AES with IV reuse. Try printing out the IV in the segment function. It's the same value across sessions. I think it's a little more subtle. IVs are being generated dete
138.
Fawkes Vendetta Blitz, Open Arena(lichess.org)
2 points by d-z-m 3y ago|0 comments
139.
by d-z-m 3y ago
Ouch, just tried posting my email obfuscation snippet in my profile into Phind, solved it with no problem. Thought it might be sophisticated enough to give it a little trouble, not the case. The snippet in question: me=$(echo 'd-
140.
by d-z-m 3y ago
My definition of a public intellectual is someone who is very bright and can "think in public" about a variety of issues. Weinstein definitely meets that bar for me, probably Jordan as well. Can't speak for the other two as
141.
by d-z-m 3y ago
Go for backend, HTML template files for frontend + Alpine.js for reactivity. Probably custom/classless CSS as I'm falling out of love w/ Tailwind. Probably would deploy on EC2. If I was trying to learn something new, I&#x27
142.
Tell HN: Nitter's TLS certificates have expired
1 points by d-z-m 3y ago|3 comments
143.
by d-z-m 3y ago
nitter.net's TLS certificates appear to have expired at Sun, 29 Oct 2023 04:52:28 GMT.
144.
by d-z-m 3y ago
> Seriously folks, if you don't already know this you shouldn't be designing any protocols. Datagram or stream-based. I find this kind of gatekeeping distasteful. Knowing about various ways network protocols can be exploited i
145.
by d-z-m 3y ago
> Literally EVERYONE said the cement base was a stupid idea and yet Elon had to trump his own experts. Do you have more information on this? My quick googling turned up nothing.
146.
by d-z-m 3y ago
You're right of course, I read TFA too quickly.
147.
by d-z-m 3y ago
[removed for irrelevance]
148.
by d-z-m 3y ago
> I want to go into the aws console and based on the primary domain (in the url bar) I want to allow all JS for that tab automatically, if that pre-condition is met. uBlock can do exactly this.
149.
by d-z-m 3y ago
> Is this really better than just keeping them? Depends what your priorities are. If you're more concerned about convenience, then keeping them is almost certainly better. If you're concerned about privacy, throwing away persi
150.
by d-z-m 3y ago
An important caveat of private mode in firefox is that you can't use service workers, so any app depending on those would break. > Disabling JavaScript is like the computer version of fasting. And enabling it is like deep frying all

More ›