dcbadacd

50 ms·

241.
by dcbadacd 8y ago
Fun fact, most of those break if you just close the connection when the client doesn't support SNI.
242.
by dcbadacd 8y ago
Less with HTTP2/TLSv1.3, endpoints are also hard to detect with ESNI.
243.
by dcbadacd 8y ago
This might also be the reason individual and small-group learning is more effective - there's less CO2.
244.
by dcbadacd 8y ago
They do, with 1024bit DSA with SHA1. Cryptographically weak and forbidden by the NIST.
245.
by dcbadacd 8y ago
I really do not agree with any arguments that are just saying "they're doing it, so may I".
246.
by dcbadacd 8y ago
They are signed with 1024bit DSA with SHA1, every piece of that combination is considered obsolete cryptography nowadays. Even the NIST dictates you shouldn't sign anything new with that. Signing also doesn't stop serving old-and-
247.
by dcbadacd 8y ago
Maybe the proper way to fund open-source is just governments, altruistic companies and users, not selling? To some extent all of those already happen but growing so slowly, funded open-source software % growth could be sped up.
248.
by dcbadacd 8y ago
It's super hard to ensure something with 100% confidence, but it doesn't mean there shouldn't be at least some basic integrity checks.
249.
by dcbadacd 8y ago
And that's how 2FA is supposed to be, if you put eggs into boxes and those boxes into one basket you still technically have all your eggs in one basket, which was what 2FA tries/d to fix.
250.
by dcbadacd 8y ago
Your ISP is usually in the same legal jurisdiction as you are, VPN might not be.
251.
by dcbadacd 8y ago
Neither does it exclude the possibility of any "time-bomb"-type of features or future OTA updates altering the software's behavior.
252.
by dcbadacd 8y ago
> There is little excuse to not set a strong CSP on your sites Can't use CSP if you want any ads on your page usually. If anyone here knows an ad provider that plays nice with CSP and pays okay then please do let me know, I'd l
253.
by dcbadacd 8y ago
It would be just like the cookie notices are, now that the data misuse is displayed with a banner, people rage and hate those. Websites haven't really removed third party/non-essential cookies.
254.
by dcbadacd 8y ago
I do not think current big centralized systems are a low bar, the attacks get more and more sophisticated, but mom&pop/volunteer/etc. systems still get exploited in the most banal ways possible.
255.
by dcbadacd 8y ago
This does not take into account potential riders, am I correct? This seems to be a common pitfall when planning new routes or systems.
256.
by dcbadacd 8y ago
> That can all be forged. And this is where a lot of the world is heavily behind say Estonia, Latvia (or other countries) that provide cryptographically secure signed documents tied to people, you practically can't forge those docum
257.
by dcbadacd 8y ago
Is HPKP Report Only also being deprecated?
258.
by dcbadacd 8y ago
This also fixes certificates lasting too long after domains change hands, allows faster deployment of certs with fixes and other new tech. There are many benefits to short expiry.
259.
by dcbadacd 8y ago
And the biggest issue of them all, keeping it absolutely secure while doing all that. It would be a killing blow to the venture if someone got their data stolen.
260.
by dcbadacd 8y ago
Reading the thread it seems this all happened a while ago: > The world of 2014 Linux graphics drivers was not a friendly place. We absolutely encountered issues where some driver revisions only worked on certain distros, and AFAIK we did
261.
by dcbadacd 8y ago
This sounds like complaining about users being able to report bugs.
262.
by dcbadacd 8y ago
https://en.wikipedia.org/wiki/Scunthorpe_problem
263.
by dcbadacd 8y ago
I don't doubt that Google employees are reading this thread and this might make the life of sight-impaired a bit worse.
264.
by dcbadacd 8y ago
The very least I'm well aware of what it does and it's not hiding it and it doesn't eat my laptop's battery with anything WebGL or video-related (and also does both without any glitches).
265.
by dcbadacd 8y ago
It literally went against the spirit of "decide what to share and when" if I check "never" and it does.
266.
by dcbadacd 8y ago
In addition to any software (especially semiconductor vendor's) being additional attack surface, if you already have connected your device to something it could have already cause damage (Nintendo Switch situation, USB Killers and etc.
267.
by dcbadacd 8y ago
Not OP, but sure, if I spend a few hours as a new Windows programmer I can finally make my native Windows application not flicker on resize, but that's most likely not it, there's probably a s tload of other things I have to spen
268.
by dcbadacd 8y ago
Client-side certificates are widely used among the Estonian population btw. It's basically the rest of the world that has caused the need for U2F/TOTP because they can't deploy smartcards with certs to users.
269.
by dcbadacd 8y ago
Estonian ID cards or Estonian Mobile ID is not hard to use. The currently working system is proof that TLS client certs can be easily used if provider just supported it.
270.
by dcbadacd 8y ago
Yeah, the "standard" markdown syntax. Facebook Messenger also supports it. Telegram also doesn't.

More ›