dchest

57 ms·

721.
by dchest 10y ago
https://bugs.chromium.org/p/chromium/issues/detail?id=675596...
722.
by dchest 10y ago
5th comment in the bug report explains why this is an issue even when the website is not trying to prevent downloads: https://bugs.chromium.org/p/chromium/issues/detail?id=675596...
723.
by dchest 10y ago
Seriously, I just don't understand how can you described the benefits of CBOR and claim that they are its drawbacks. Yes, you have to read the documentation of your encoder/decoder to understand what tag values it maps to your pro
724.
by dchest 10y ago
BearSSL is my favourite crypto software of 2016, however it's still in alpha stages of development and is not production ready, Ikea couldn't use it for this product: https://www.bearssl.org/todo.html
725.
by dchest 10y ago
Native programming features the OS provides are also not free: it's still similar code drawing things on the screen, making sure they are properly aligned. HTML/CSS is a pretty flexible, and it indeed has some overhead compared to
726.
by dchest 10y ago
Wait, since when do you have to have the consent of the creator of one serialization format to create another? Tagged values are useful! Because of the simplicity of CBOR (compared to MessagePack), it's about 3 lines of code to impleme
727.
by dchest 10y ago
Yeah, I skipped all the drama, read the spec and implemented an encoder/decoder. CBOR is just how MessagePack-like format should have been done from the beginning: it's technically superior in a sense that it's neat and simpl
728.
by dchest 10y ago
Indeed. MessagePack should be replaced with CBOR in new protocols, as CBOR is a very nicely designed format.
729.
by dchest 10y ago
Press Alt?
730.
by dchest 10y ago
Contrary opinion from a former Apple employee: "The music industry didn't go DRM free because they hated DRM; they went DRM free because they were fearful of the leverage Apple was gaining with their iTunes + FairPlay + iPod comb
731.
by dchest 10y ago
I'm a long time fan of Fossil and contributed a bit to its development (in particular, TLS support and some protections against timing attacks). I'm not sure where you found provocative language, but let me try to explain it here
732.
by dchest 10y ago
As far as I understood the linked post, that's an incomplete tl;dr. You missed these important parts: 1) In the words of Buffet, "there would be no chance that a deal would be announced and that the buyer would then back off or st
733.
by dchest 10y ago
Airship has most paranoid auto-update system I've ever seen. You can read about it here: https://paragonie.com/blog/2016/05/keyggdrasil-continuum-cry... It also convers the "external code integrity
734.
by dchest 10y ago
Then you can use them: src: local('Font Name'),
735.
by dchest 10y ago
Obligatory: https://hillbrad.github.io/sri-addressable-caching/sri-addre... (List of problems you need to solve to introduce hash-addressable caching to Web)
736.
by dchest 10y ago
Looks like "spamming" completely lost its meaning.
737.
by dchest 10y ago
What you said is true of many websites, but this threat isn't relevant to the threat discussed in this thread: finding IP addresses in server logs.
738.
by dchest 10y ago
This would make sense if it created those directories, but IMHO it should fail to start if the path exists and isn't owned by www process. The function that does chown() is even called ngx_create_paths().
739.
by dchest 10y ago
Huh, why does nginx even change permissions?
740.
by dchest 10y ago
From @lattera on Twitter: here's a couple lost pages found by the grsecurity folks: https://grsecurity.net/~spender/pics/lost_selinux_coloring_b... https://grsecurity.net/~spender/pics&#x
741.
by dchest 10y ago
resulting in them clicking through blindly In the proposed scheme, they are ALWAYS clicking though blindly. There's no way for a user to know when he gets the original public key or someone else's. How is a user supposed to veri
742.
by dchest 10y ago
There's a new Name Constraints TLS extension to implement it: https://tools.ietf.org/html/rfc5280#section-4.2.1.10 See also https://wiki.mozilla.org/CA:NameConstraints
743.
by dchest 10y ago
Related: Norway is first country to turn off FM radio and go digital-only https://www.newscientist.com/article/2117569-norway-is-first...
744.
by dchest 10y ago
Nothing surprising: they are comparing popular, well-known brands. Of course, there are many other, lesser-known VPS providers with better prices. Additionally, www.time4vps.eu can't be really compared to DO/Vultr/Amazon, sin
745.
by dchest 10y ago
It's not some "not-a-real-RFC", it's https://en.wikipedia.org/wiki/Internet_Draft
746.
by dchest 10y ago
ECC (error-correcting codes) don't completely eliminate errors — they reduce probability of them happening — so even with ECC memory you're still accepting that it's perfectly OK that 0 is sometimes 1, just a lot less likely.
747.
BSD Now: The Cantrillogy(jupiterbroadcasting.com)
3 points by dchest 10y ago|1 comments
748.
by dchest 10y ago
Fun fact: the icon for my macOS application is about twice as large as the binary.
749.
Four Questions For: Jean-Philippe Aumasson(gigaom.com)
1 points by dchest 10y ago|0 comments
750.
by dchest 10y ago
Even worse: users of TweetNaCl can easily switch over to the real deal (performance-wise) — NaCl or libsodium — without changing anything, while with this library they'll have to grab pieces of optimized code from various sources, and

More ›