dchest

40 ms·

511.
by dchest 8y ago
A computer is a masculine noun in two of the languages that I use.
512.
by dchest 8y ago
At worst you can ask a challenge question You can NOT verify anything by asking a challenge question. Man-in-the-middle attack means there's a "man in the middle". That is, the attacker can relay challenge question and answ
513.
by dchest 8y ago
GCM/Poly1305 require unique nonces, so if they are repeated, the authenticity is broken. HMAC doesn't need nonces, so authenticity is preserved as long as the key is secret.
514.
by dchest 8y ago
Not sure if they do this, but recommendations can be encrypted on your device and stored on their servers. They can't read it, but if you lost your device, they are still available.
515.
by dchest 8y ago
There's official GUI https://github.com/Tarsnap/tarsnap-gui
516.
by dchest 8y ago
Your description is very simplistic, but yes, you have to trust the code that's delivered to you. For example, no Android/iOS user would check every single update to E2EE apps they install for backdoors. However with web, there&#x
517.
by dchest 8y ago
Sure, but having access to encryption/decryption/key derivation is pretty much equivalent to having the key in most circumstances. Plus, JS generates the key and sets "extractable" flag.
518.
by dchest 8y ago
https://xkcd.com/1181/
519.
by dchest 8y ago
In a browser, the server serving the JS has an opportunity to access the keys.
520.
by dchest 8y ago
The are blocked by default from the latest two of three versions of macOS. You'll have to explain your users to right-click on the app icon and click Open to launch your app.
521.
by dchest 8y ago
Previous title had "...with Linux 5.0 compatibility". The significance of this is that 5.0 changed some interfaces used by ZFS to require GPL license, which ZoL can't call, which generated some discussion https://l
522.
by dchest 8y ago
There was such effort https://en.wikipedia.org/wiki/GIMPshop
523.
by dchest 8y ago
Ugh, your point is that if workers of one company don't mind building weapons, the workers of another company should also shut up and build weapons?
524.
by dchest 8y ago
Unfortunately, I've rarely seen such a simple thing as file saving implemented correctly by many developers. Missing fsync(), missing checking of errors on close(), in-place non-atomic data overwrites. One of the good things about usin
525.
by dchest 8y ago
Good points, just a small correction: Password Hashing Competition was arranged not by NIST, but by Jean-Philippe Aumasson (but we had a cryptographer from NIST on the panel).
526.
by dchest 8y ago
Surely, 10 min is a lower bound. If it takes more time, I guess, it's even better.
527.
by dchest 8y ago
There's also a recently released documentary about him: https://www.hustwit.com/rams/
528.
by dchest 8y ago
En banc, the 9th Circuit reversed the panel and found that Judge Alsup had applied the wrong standard and abused his discretion in finding that the government hadn’t acted in bad faith . . .
529.
by dchest 8y ago
QTWebKit (and experimental QtWebEngine based on Chromium)
530.
by dchest 8y ago
I agree with your point in general (regarding CSPRNG), but ULID turns out to be not suitable as opaque access token since it increments the random part if it's generated in the same millisecond range. So, if someone gets this token,
531.
by dchest 8y ago
The bridge itself is API stable. evaluateJavaScript:completionHandler: isn't going anywhere. Historically, this hasn't been the case. Apple loves to deprecate stuff (although, thankfully, they are a bit slower to remove it). B
532.
by dchest 8y ago
The tea plant.
533.
by dchest 8y ago
log.Print("Missing argument for files direcory, Exiting...") os.Exit(0) Exit code 0 is usually used for success. This is clearly an error. filePath + "/" + file.Name() There's path/f
534.
by dchest 8y ago
> It would be a good idea for Chrome to display an alert similar to the non-HTTPS resource loading if integrity checks are not present for externally loaded scripts. It would just teach users to ignore warnings. > The danger of ser
535.
by dchest 8y ago
If you didn't use third-party sellers, you could have published your software on your website and accepted payments via any of the "software registration" services or even PayPal. 5-15%.
536.
by dchest 8y ago
Any examples of successful companies that charge for support for their own free product?
537.
by dchest 8y ago
Then just store session ID there and get rid of JWT.
538.
by dchest 8y ago
Guardian article quoted by BBC (it also has a link to the paper): https://www.theguardian.com/science/2018/oct/10/stephen-hawk...
539.
by dchest 8y ago
No, because nobody really depends on DNSSEC, so nothing will break: - https://ianix.com/pub/dnssec-outages.html - https://twitter.com/tqbf/status/772103926258671618
540.
by dchest 8y ago
It looks like many of videos on Reddit are re-uploads from YouTube or other websites. It would be interesting to see how they'll deal with copyright laws.

More ›