gchambert

10 ms·

1.
by gchambert 5y ago
It's not 100% related but certificate pinning (HKPK) is only enforced for CA trusted by browser. It is ignored if the leaf certificate is signed by a user-imported CA (or deployed by enterprise policies). Maybe the same applies for SCT
2.
by gchambert 5y ago
Teams is still a joke. Everything is sooooo sloooooow in it. At least Skype can run on y computer without the fans covering my voice.
3.
by gchambert 5y ago
Yes of course. The dynamic part of your site will still need protection, though. And if you offload static assets to a third-party, you'll have smaller pipes for non-static data, thus you are less likely to handle a DDoS. So you'l
4.
by gchambert 5y ago
> Another option, if you're running at a larger scale, is to purchase mitigation appliances and just set up your own mitigation infrastructure. This will not be cheap and require some serious connectivity, but beyond a certain point
5.
by gchambert 6y ago
Processing PII doesn't need consent if it's necessary to provide the service. Keeping logs fits in this category: to run a website, you need the ability to debug problems, analyze frauds and attacks. Moreover, you have the respons
6.
by gchambert 6y ago
What is forbidden by GDPR isn't specifically cookie or IP, but but any tracking mechanism which allows to identify an individual uniquely with some amount of certainty, and without prior consent. What he is doing is illegal.
7.
by gchambert 6y ago
Who still believes in 2020 that technology isn't political? Have you never heard of the impact of Facebook or Twitter on our societies? Cambridge Analytica, anyone? It lead to Brexit & Trump... Any technology changes society, thus