dagenix

23 ms·

211.
by dagenix 7y ago
If you connect to a website behind a CDN hosting many websites, a passive observer can tell that you connected to the CDN, but has no idea which website you requested (let's pretend that they can't use a length fingerprinting atta
212.
Robots Exclusion Protocol(tools.ietf.org)
1 points by dagenix 7y ago|0 comments
213.
by dagenix 7y ago
If we have a reproducibility crisis in psychological research, it seems to me like one of the best things we can do to address it is to incentivize people to try reproduce other group's findings. It's not sexy and it won't ea
214.
by dagenix 7y ago
They published it. Clearly everyone didn't know that was nonsense or they knowingly published garbage because it would make for nice press and now they refuse to retract it. Either its shameful behavior in the past, or shameful behavio
215.
by dagenix 7y ago
From right at the top of the article, in the easiest place to find: "Date posted: Jul. 31, 2018"
216.
by dagenix 7y ago
I think "deceiving title choice" is a bit strong. Of course you can name your dog whatever you want. I highly doubt that anyone read this and actually thought that there was some sort of global law requiring this. > That's
217.
by dagenix 7y ago
There are a number of red flags with that article: * It uses the words "strong" and "tough" a lot - which really means nothing but sure sounds good. * It endorses taking away the driver's license of someone caught w
218.
by dagenix 7y ago
What is the difference between directly killing someone and taking an action that you know will result in someone's death? The end result is exactly the same.
219.
by dagenix 7y ago
Please explain. Is this a serious comment or a joke about Canada being cold?
220.
by dagenix 7y ago
I didn't say that it doesn't still happen today. All I'm saying, is that it doesn't make much difference if the government directly poisons alcohol, or, if it poisons chemicals that it knows people are going to drink. At
221.
by dagenix 7y ago
Quoting the referenced article, in turn quoting a Slate article: > To sell the stolen industrial alcohol, the liquor syndicates employed chemists to “renature” the products, returning them to a drinkable state. The bootleggers paid their
222.
by dagenix 7y ago
300% - 500% is indeed a bigger number than 20%. But, that is not proof that it doesn't "serve consumers' interests".
223.
by dagenix 7y ago
Netflix and Google definitely care about encoding time precisely because their scale is so big. A 1% increase in encoding time could mean a difference of a tremendous amount of computing time and thus money. Google and Twitch also care abou
224.
by dagenix 7y ago
Kik is being sued by the SEC for allegedly conducting an illegal securities offering. And it seems they clearly knew it was a securities offering, because they didn't sell to residents of their home country. They didn't disclose t
225.
by dagenix 7y ago
Name one
226.
by dagenix 7y ago
> An example would be if you don't have a certificate. Given that letsencrypt exists, I don't see why you wouldn't have a cert. > Maybe you just have a pre-shared secret or a kerberos ticket. The pre-shared secret could
227.
by dagenix 7y ago
That sounds like a reasonable goal, I'm just at a loss for what old applications or protocols will benefit. Many of those old applications get stuck running on old kernels which would prevent this type of change from helping them.
228.
by dagenix 7y ago
The thing is, you still need to validate the session id, if you want to know who you are talking to. And in order to do that, you probably need to do something like use x509 certs. And once you do that, you've basically re-arrived at t
229.
by dagenix 7y ago
> I'll take the imperfect security of forcing various agencies to expend resources to go after me personally (which is a small chance of happening) versus the ease of them simply vacuuming up all the bits. On the one hand: protectio
230.
by dagenix 7y ago
> They introduce a new IOCTL which you can use to discover the session id and then authenticate it however you like. > In particular, it is possible to use a zero knowledge protocol where a MITM attacker cannot determine if authentica
231.
by dagenix 7y ago
This seems to primarily only protect against passive listeners [1]. So, while I guess this could be useful to transparently increase security of unencrypted protocols, it seems like the use cases would be somewhat narrow and that TLS over T
232.
by dagenix 7y ago
Outside of it being impossible to move dependencies out of the standard library without breaking code, I think one major problem with the idea of moving features to Pypi libraries is that Python dependency management just doesn't have
233.
by dagenix 7y ago
He said to use Bcrypt or SHA-2. One of those algorithms was explicitly designed for password storage, the other was not. They aren't really the same class of algorithm. As such, it doesn't really make sense to suggest one as an al
234.
by dagenix 7y ago
PBKDF2 seems to have been specified in 2000 as part of RFC 2898 [1] and, IIRC, existed before then. Bcrypt is from 1999 [2]. Both of those algorithms were explicitly designed to be slow. My understanding is that PBKDF2 wasn't explicitl
235.
by dagenix 7y ago
If that were the case, his advice ought to have been something like "use libcrypt with SHA-2" or something like that. Just "use SHA-2" was kinda useless in 2007 and hasn't gotten more useful since then.
236.
by dagenix 7y ago
Salting was originally important as a defense against rainbow tables - which are more or less obsolete with GPUs that can crank through trillions of hashes per second. The real reason that bcrypt is a better way to store a password isn&#x27
237.
by dagenix 7y ago
> SHA-2 or Bcrypt would be a better choice. As the sibling comment points out, SHA-2 is worthless for storing passwords. A GPU can crank through an obscene number of SHA-2 hashes per second. Bcrypt is is intentionally much slower and har
238.
by dagenix 7y ago
> But if you use an alias (and only reveal your real name after the company agrees to interview you), then it's not a problem either! Do you do that? Do you know anyone that does? If so, how do people react to it?
239.
Google warns Bluetooth Titan security keys can be hijacked by nearby hackers(arstechnica.com)
8 points by dagenix 7y ago|2 comments
240.
by dagenix 7y ago
I take strong exception to your characterization of my comment as "hateful". I don't hate Terry Davis. He was brilliant. Fostering a diverse, inclusive, and welcoming environment is really important to me. Some of the things

More ›