dane-pgp

84 ms·

871.
by dane-pgp 4y ago
Any progress you can share on that sample project?
872.
by dane-pgp 4y ago
There's a big difference between allowing someone with an illness to naturally die by not donating your organ to them, and deliberately carrying out an abortion with the intent to kill a developing child. The law (and the field of ethi
873.
by dane-pgp 4y ago
That's a great summary, thank you. I'm certain that once governments (and people like Elon) realise that they can do age and ID verification for accessing sites, they will start demanding it. These devices (with their DRM-like rem
874.
by dane-pgp 4y ago
I'm glad Google has published an open source firmware, and I hope that people will be able to independently verify that the hardware they use is genuinely running that firmware. Then I hope that hardware with such guarantees is not di
875.
by dane-pgp 4y ago
> The NPM has yet to support mechanisms like package signing. Yes, but actually no. "To increase confidence in the npm public registry, we add our PGP signature to package metadata and publicize our public PGP key on Keybase."[
876.
by dane-pgp 4y ago
The section "Suspicious versioning" consists entirely of the following piece of advice: "Detect suspicious versioning patterns." I think it's fair to say that "solving supply chain attacks" is going to req
877.
by dane-pgp 4y ago
There are two areas which I think are actively being researched but are interesting and could probably be improved by a masters level project. One is the idea of separating multiple audio tracks. For example, if you have a MIDI file of two
878.
by dane-pgp 4y ago
> Deciding about one’s own body is. But deciding about an unborn child's body isn't. I really don't think your position is as incontrovertible as you're suggesting, which is why this issue doesn't have any easy
879.
by dane-pgp 4y ago
If you invite someone onto your submarine, and take them down to the bottom of the ocean, but then they suffer some accident and need to be taken back to the surface for medical attention, it isn't slavery for the law to force you to p
880.
by dane-pgp 4y ago
> In ADX, this data will live in Personal Data Repositories owned by the user,” the overview explains. I like that idea, and hopefully it is complementary to the models of data ownership that are being implemented in the Fediverse. It w
881.
by dane-pgp 4y ago
That's an absolutely valid addition on the topic of reducing the temperature of politics and allowing new compromises to be found. The only difference, fortunately, is that getting RCV (or other reforms) implemented for state elections
882.
by dane-pgp 4y ago
This is great, and hopefully they continue this momentum. > Sigstore was a key project in achieving SLSA level 2 status and getting a head start towards achieving SLSA level 3 compliance, which the Kubernetes community expects to reach t
883.
by dane-pgp 4y ago
That's already a long introduction, and I didn't want to extend it by discussing the issue of how the Commerce Clause is used by SCOTUS to justify arbitrary decisions. Enumerating the things which should (and shouldn't) be p
884.
by dane-pgp 4y ago
I would support an amendment like this.
885.
by dane-pgp 4y ago
I would not support any amendment like this.
886.
by dane-pgp 4y ago
I'm not a US citizen, but I would support it.
887.
by dane-pgp 4y ago
I'm not a US citizen, but I wouldn't support it.
888.
by dane-pgp 4y ago
For now. Even before the pandemic, "delivery-only" restaurants were replacing brick-and-mortar ones: https://www.forbes.com/sites/michelinemaynard/2017/03/28/as-...
889.
by dane-pgp 4y ago
I don't know what counts as a non-random internet page, but here[0] is an article published by the "European Data Protection Supervisor" titled "14 Misunderstandings With Regard To Biometric Identification And Authentica
890.
by dane-pgp 4y ago
> But “my employees must use a fips-certified key” (or “my customers must use a hardware key”) is reasonable and ultimately non-negotiable if you want people to use your protocol. I think this is the crux of where our disagreement lies.
891.
by dane-pgp 4y ago
You can do anything at Osmocom. Anything at all.
892.
by dane-pgp 4y ago
If your threat model is "China has backdoored your TPM" then making the TPM more opaque and unauditable doesn't improve the situation. How would you know if your TPM is lying and pretending to still have the original key whe
893.
by dane-pgp 4y ago
Well, he's certainly an expert at simulating intelligence.
894.
by dane-pgp 4y ago
> A given relying party can choose to use or not use attestation and, if they choose to use it, which certificates to trust. True, and a website could decide to issue its own certificates rather than get one from a CA trusted by browsers
895.
by dane-pgp 4y ago
Fortunately no one is claiming that it does solve all problems, and I wasn't arguing against that non-claim. My point was, what percentage of supply chain issues (since that 2017 research) would have been mitigated by this policy chan
896.
by dane-pgp 4y ago
You joke, but device attestation is the next step, and the NSA are publicly pushing for it.[0] It's already impossible to get a burger from McDonald's using their app if you're using an unlocked bootloader.[1] [0] https:&#x
897.
by dane-pgp 4y ago
When we all have Neuralink chips in our brains, they will be able to read the data from our taste buds to check that we are really drinking a genuine can of Doritos™ Mountain Dew™.
898.
by dane-pgp 4y ago
Are you saying that iPhone-maker Apple and Android-maker Google (and TPM-mandator Microsoft) might not be able to imagine a future where the whole world isn't dependent on them for identity?
899.
by dane-pgp 4y ago
This change would certainly have helped against the infamous "Gathering weak npm credentials" research[0] from 2017, but I think that most recent supply chain security issues (in NPM, at least) have been due to: 1) typosquatting,
900.
by dane-pgp 4y ago
> There isn't be a need for a phone. You might need an "EDIT3", I'm afraid, because "isn't be" doesn't make that sentence much more clear.

More ›