growse

49 ms·

571.
by growse 3y ago
Conceptually, this is exactly how webauthn works. Except your identity is always per-site, and the site itself stores your per-site secret, encrypted by some mechanism you control (HSM or whatever).
572.
by growse 3y ago
Wow, it's been a while since I saw a genuine "my opinion is objectively right" in the wild.
573.
by growse 3y ago
> Yeah that’s what I expected. Not a bunch of silly questions, but actually ambiguous ones The fact that there's no clear consensus on most of the questions means they are ambiguous, no?
574.
by growse 3y ago
> Public universities. Who else is going to decide how they spend their money? They're part of the government. Small Government is as much about localism as it is about reducing the size of the government. So having a state-level le
575.
by growse 3y ago
> Scary. ... and entirely evidence-free!
576.
by growse 3y ago
It's because perception of intent matters. Someone actively pointing a camera at you is perceived as an aggressive, hostile thing. People get immediately defensive. A static CCTV camera wasn't installed to video you in particula
577.
by growse 3y ago
On this very website! https://news.ycombinator.com/item?id=33258684
578.
by growse 3y ago
For example: simply take a valid identity's public key, and use it as the secret to forge a token with alg=hs256. A service receiving this token will use its copy of the public key (by key id) to verify the signature, but because it&#x
579.
by growse 3y ago
The police department absolutely exercise discretion over what they choose to arrest people for and what they don't. The SEC is not deciding what is legal or not, they're deciding whether or not to bring an enforcement action. The
580.
by growse 3y ago
No, Congress creates the rules. The SEC decides how to enforce them. A court then decides who's right in any given action.
581.
by growse 3y ago
The existence of algorithm confusion attacks shows that it's not nearly as simple as just saying "Reject 'null'". It's a complete minefield, and the fact that the JWT scheme punts that complexity and "make
582.
by growse 3y ago
There's lots of laws that aren't "clear", but people don't phone the police up and ask them what they're going to do. They talk to a lawyer and get advice.
583.
by growse 3y ago
Why are people so desperate to seek legal advice from law enforcement?
584.
by growse 3y ago
It's perfectly reasonable that the Coinbase S1 doesn't include any descriptions of activities that are illegal, and for Coinbase to subsequently start doing illegal things. They even list this risk in the S1! The SEC saying your
585.
by growse 3y ago
Do you think that if the SEC thinks that Coinbase is operating some sort of unregulated securities exchange, that they should bring some sort of enforcement action?
586.
by growse 3y ago
> This is possible with anything, though. If your verification code trusts the input, that's bad. That's not a structural weakness of the JWT format. What's the purpose of the algorithm field in the header if clients shoul
587.
by growse 3y ago
Firstly, HFTs do not generate "massive profits". Not sure where that myth comes from. It's extraordinarily difficult to make profit as a market maker, let alone a "massive" one. Secondly, their income comes from the
588.
by growse 3y ago
Care to link to a major equity exchange's product page and/or sec declaration that details exactly how this works (ie, criteria for getting "first dibs", what that actually means etc)? Or are you talking about exchange h
589.
by growse 3y ago
> HFT firms neither enable customers to do things they can't accomplish on their own, nor do they save customers money by exploiting economies of scale. Study after study has shown this empirically the be false. It's uncontrove
590.
by growse 3y ago
> You do understand how that's different from HFT, right? HFTs provide liquidity , which by definition is providing what people want to buy/sell, when they want to trade it and it the desired quantity. > HFT is like hiring
591.
by growse 3y ago
> The point of the stock market is to be a market. And when possible I do like to buy from companies that sell their product directly. What if you're in the northern hemisphere and want to buy strawberries in December? Or you want a
592.
by growse 3y ago
> ...being a middle-man just skims off the top of things that are already happening. Presumably you buy all your goods directly from growers / manufacturers, rather than using retailers who are simply there to skim off the top? >
593.
by growse 3y ago
DNSSEC proves nothing about correctness, it just helps show that a record was published by someone with access to the private key pointed to in the DS record. What's "correct" or not is an entirely more nebulous thing.
594.
by growse 3y ago
> What an absurd statement. Yeah, some people have had issues. But most of those did not have a trained DNS team. Or even person. I ran DNSSEC for hundreds of TLDs as a one man team. I'm not particularly smart or special...most TLDs
595.
by growse 3y ago
What are "Signal's EU gateways"?
596.
by growse 3y ago
Where does signify fall short on these?
597.
by growse 3y ago
> They’re all data with some attributes, and pgp handles them nicely, if you can write the interface for it. This apparently almost wilful ignorance of the context of the "data with some attributes" is (specifically, how it&#
598.
by growse 3y ago
Following "Best practice" is doing what everyone else does, just because everyone else is doing it. "Best practice" is cargo culting. Everyone's got different requirements and constraints. If one thing is apparent,
599.
by growse 3y ago
> Passwords should always be kept as a valid authentication method Why? > If I don't have access to the private key (like I currently do with ssh) then it's dead in the water to me. You don't have 'access' to
600.
by growse 3y ago
Reading these, it strongly smells like they started with the answer and then worked backwards. It's not at all clear how you can start from the enumerated of rights and end up with "replace the crown with an elected policitian&quo

More ›