dlitz

25 ms·

181.
by dlitz 13y ago
How does this interact with the effort to encourage the use of HTTPS everywhere?
182.
by dlitz 13y ago
No, I'd say it's a 4xx error. Have a look at https://en.wikipedia.org/wiki/List_of_HTTP_status_codes Usually, 5xx means that the client could retry the request at a later time, and have it succeed. 4xx mean
183.
by dlitz 13y ago
You can do it like this, though: set go-=T go-=r go-=L
184.
by dlitz 13y ago
> These political discussions on HN are awkward, and I wish they'd stop. I think "Worse is Better" applies here. Political discussions in online forums (or anywhere) aren't ideal, but I still think it's better t
185.
by dlitz 13y ago
As long as it's good enough , it could help pave the way for future phones that are better.
186.
by dlitz 13y ago
I wouldn't think too much of it. It could be a bit of wishful thinking, or an attempt to manipulate the price of Bitcoins by spreading rumors. Both are fairly popular among Bitcoin speculators.
187.
by dlitz 13y ago
> Unlike Snowden or Daniel Ellsberg, he was indiscriminate in his disclosure. Well, it was a lot of data, so he passed it to an organization that supposedly had people who could sift through it and post the relevant stuff in redacted for
188.
by dlitz 13y ago
Thanks!
189.
by dlitz 13y ago
Slide 28. What does "IR" mean?
190.
by dlitz 13y ago
I don't think they'd be much help. Even with client certificates, information will still leak via compression, and so an attacker will still be able to get CSRF tokens and then use them then forge requests via the user's own
191.
by dlitz 13y ago
BASIC does that, too.
192.
by dlitz 13y ago
They talk of "U.S. persons", not U.S. citizens: https://en.wikipedia.org/wiki/United_States_person
193.
by dlitz 13y ago
They mean he didn't have the "capability" to "collect" that data, which in NSA newspeak means he had the technical means, but not the legal authorization to do so.
194.
by dlitz 13y ago
Yes, I think so. IIUC, with this construction, the difficulty only increases linearly with the length of the output, rather than exponentially, as one might expect. I don't think there's a generically secure way to extend short h
195.
by dlitz 13y ago
As an aside, you can use PBKDF2 with an iteration count of 1 to extend the output of a hash function to arbitrary lengths: output = HMAC-SHA256("passphrase", "salt" + x"00000001") + HMAC-SHA256
196.
by dlitz 13y ago
> Why would anyone do that? Isn't "easy to understand and simple to implement" always a goal of everyone working on tech standards? Patents and "competitive advantage".
197.
by dlitz 13y ago
> It's been in place on TalkTalk's network for 2 years now...but it hasn't caused significant issues yet. Of course it hasn't; It's only been 2 years. You won't notice unless you're trying to build or
198.
by dlitz 13y ago
"Customers who do not want filtering still have their traffic routed through the system, but matches to Huawei's database are dismissed rather than acted upon." In other words, when they screw up the implementation and it bre
199.
by dlitz 13y ago
Cert pinning doesn't solve that problem. Cert pinning solves the problem of a compromised CA signing false certificates. If an attacker has the private key of the endpoint , cert pinning will do nothing.
200.
by dlitz 13y ago
If agent-forwarding wasn't implemented, more people would just copy their private keys to several machines. At least when you use agent forwarding, your key is only exposed while you're actually connected to the machine.
201.
by dlitz 13y ago
> The "private" key file includes both keys. It wouldn't need to, though. Given the private key (n,d), the public key is probably (n,65537).
202.
by dlitz 13y ago
> Usually, the keys are entirely symmetrical. You just name one public and the other private. Nice try, General Alexander. :P In DSA, the public key is (p,q,g,y) and the private key is (p,q,g,x). The public "y" is computed dir
203.
by dlitz 13y ago
> if there is a variable in an alias body, it will be evaluated once, on alias creation, and never again. Really? That's not true in bash: $ alias x='echo foo$A' $ x foo $ A=zball $ x foozball
204.
by dlitz 13y ago
I think it's important to do both. We can't solve political issues using only technology, but it can also be helpful to build our infrastructure in a way that would make it cost-prohibitive to outlaw these technologies. For exa
205.
by dlitz 13y ago
I wouldn't call this a weird rider. The NSA is a DoD agency, and the NDAA is one of the tools that Congress uses to regulate the DoD.
206.
by dlitz 13y ago
That's only true in a pure eavesdropping scenario. The keys would still allow MITM attacks.
207.
by dlitz 13y ago
Despite the catchy slogan, this isn't actually about defunding the entire NSA.
208.
by dlitz 13y ago
That's nothing. Ever wonder why GitHub Pages were moved from username.github.com to username.github.io, citing security concerns, but username.blogspot.com continues to be available? Ever wonder why www.example.co.uk can set cookies on
209.
by dlitz 13y ago
This isn't new, but I wonder if it's related: "All SIMs could reject OTA message without Digitial Signature (DS), but this is rarely done as it brings additional pain to gsm providers. Most of the SIMs are correctly secured.
210.
by dlitz 13y ago
How do you know that you've implemented 402 correctly?

More ›