elithrar

22 ms·

181.
by elithrar 8y ago
And short of PRNG issues / bias in those keys, telling hashcat to “guess” 20-byte keys is not really an attack given how infeasible it is. This just isn’t practical.
182.
by elithrar 8y ago
What gives you that impression? There are no ads in any of the Discord clients.
183.
by elithrar 8y ago
> ... understanding is that the workers are limited to 128MB of ram and that they may be 'restarted' at any time. Datasets for accurate browser detection would be really tight in fitting into that amount of RA I think you might
184.
by elithrar 8y ago
It's compelling to you, but managing email infrastructure is a huge burden - users actively spamming, compromised users spamming, RBLs, security, myriad email clients - there seems to be little synergy here with the rest of Cloudflar
185.
by elithrar 8y ago
That's not quite true. Some of their products (Argo; their virtual backbone service) bills on GB; others on requests. That's still going to apply, and it's also going to apply for larger customers on contract.
186.
by elithrar 8y ago
You would get zero egress from Backblaze, but Cloudflare (or whomever is the eyeball facing provider) will still meter your bandwidth/requests/etc at their edge -> client.
187.
by elithrar 8y ago
On this topic, and as a co-maintainer (but not original author) of gorilla/securecookie, which is mentioned in this article: - Setting Secure and HttpOnly attributes are exactly what I do by default in gorilla/csrf - you have to e
188.
by elithrar 8y ago
Correct; the same goes for Path, which is often a fun bug for many newer web programmers when they set the cookie on '/login' and then wonder why the cookie isn't being passed on '/store' or even '&#x
189.
by elithrar 8y ago
HipChat had an on-prem (self-hosted) release, but it's been near-abandoned for quite some time.
190.
by elithrar 8y ago
> the third line is not really introducing a new variable, since err is still in scope... or is it? The "if" block creates a new scope.
191.
by elithrar 8y ago
Sure, but Blackberry - specifically, the BBM service - had no qualms about setting up intercepting proxies with governments when pressured.
192.
by elithrar 8y ago
Sure, but in a single-player, local context: do what you want and experiment. League of Legends is a multi-player game, and a competitive one at that: you having fun by cheating is likely leading to another player not having fun, which is b
193.
by elithrar 8y ago
This is certainly uncharitable. They seem to care a fair bit about accessibility; but certainly can’t chase down every possible issue on every possible configuration when it comes to browser compatibility. Their service is currently free. Y
194.
by elithrar 8y ago
Note that the article states: > Narongsak explained that the divers had fixed rope lines along the passageway and distributed oxygen tanks along their route, allowing them to advance through the exceptionally narrow passageway unencumber
195.
by elithrar 8y ago
The “fulfilled” by distinction catches many an unawares shopper; legitimate merchants/manufacturers are also suffering revenue & brand damage too. I recently came across a case[1] where a set of Marshall headphones that usually ret
196.
by elithrar 8y ago
I no longer work at CF, but the team were always OK with raising the limit on-asking: I’d suggest opening a new ticket and asking for a review. (I kicked off the lengthy internal FAQ that covers this exact point...)
197.
by elithrar 8y ago
> How would you (or a company like Zerodium) differentiate between a "one off" RCE exploit vs. the kind they would pay out for? In the GAE case, Google can patch all deployments of their service on the same day, which is an &q
198.
by elithrar 8y ago
For those wanting the extra context around this decision: There's a really important reason for not sending the Via header in the request: it disables compression, by default, in most major web-servers! · nginx defaults gzip_proxied
199.
by elithrar 9y ago
Note that Enterprise customers can have multiple scripts-per-domain, allowing you to run specify a specific script per route (or routes). Additional matching logic (e.g. headers, cookies, response codes) can then be done within the Worker i
200.
by elithrar 9y ago
Correct - as well as choose from "best replacement", "replace with specific item", and "don't replace". Since Instacart remembers these choices across orders, I've found this useful for making sure I
201.
by elithrar 9y ago
Hey Julia - feel free to email me (msilverlock @ cloudflare) so I can look into this. If you can share the API calls you’re making it’d be useful too!
202.
Windows Subsystem for Linux with Zsh, Tmux and Docker(elithrar.github.io)
2 points by elithrar 9y ago|0 comments
203.
by elithrar 9y ago
Agree. In fact, I strongly prefer the Flex environment as it doesn't require you to use any proprietary libs or services: your applications get deployed as containers, can auto-scale, and are health checked. This has always been one
204.
by elithrar 9y ago
Flagged, as a click-bait headline. I'd rephrase to "macOS 10.13.2 update enforces 2048-bit SSH keys; smaller keys forcibly unsupported." (or something along those lines). RSA key sizes < 2048 have not been recommended for
205.
Windows Subsystem for Linux with zsh and tmux(elithrar.github.io)
3 points by elithrar 9y ago|0 comments
206.
The Evolution of Security at Riot(engineering.riotgames.com)
3 points by elithrar 9y ago|0 comments
207.
by elithrar 9y ago
You're both sort-of correct. AO kicks in on specific 5xx error codes: 502, 504, and then Cloudflare's 52x codes. It doesn't kick in on 500 or 503, or 4xx errors. Ref: https://support.cloudflare.com/hc/en-
208.
by elithrar 9y ago
Sure, but the % of users with 8TB drives—and the connectivity to push that in the first place—would be low enough to still work out favorably for them.
209.
by elithrar 9y ago
> If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious. Given they provide a VPN service, trusting the binaries is only going to take you so far.
210.
by elithrar 9y ago
> last I checked Chrome on iOS also does not support service workers, so you're just helping Android users. All browsers on iOS are wrappers around WKWebView (Safari, for the most part). You can’t release a browser app for iOS that

More ›