hannob

36 ms·

451.
Show HN: Badkeys.info – checking cryptographic keys for known vulnerabilities(badkeys.info)
6 points by hannob 5y ago|3 comments
452.
by hannob 5y ago
Storage isn't the only reason to invest in green H2. It is e.g. the most plausible path for decarbonization of many industry sectors, including steel and chemicals. And these are often technologies that are in early stages. I don'
453.
by hannob 5y ago
Often said, but questionable if you want to have strict emission standards. The existing "blue h2" projects are abysmally bad, they only capture a small fraction of the emissions produced (see e.g. [1]). That you can run cheap blu
454.
by hannob 5y ago
In Europe a lot is happening, some companies are investing big into production capacities, see e.g.: https://blog.topsoe.com/haldor-topsoe-to-build-large-scale-s... https://www.westkueste100.de/en/orste
455.
by hannob 5y ago
I honestly never understood what people expect who want tech "without politics". Technology is a crucial development impacting society. Of course discussing tech is political. How could it not be?
456.
by hannob 5y ago
Aedes Aegypti isn't even a species that's native to the US. It's been brought there by humans. Even if you're convinced by arguments of naturalness (which I'm not), in this case it makes no sense, because you'r
457.
by hannob 5y ago
> Yet we are still able to get experimental results supporting talk therapy and no one complains, right? Wrong. https://blogs.bmj.com/bmjebmspotlight/2020/10/07/seeing-is-b... I think this is a proble
458.
by hannob 5y ago
This is somewhat related to the "robustness principle" that was guiding internet development in the early days. It wasn't about programming languages, but about protocol data, but the issue is similar. Yet it turned out that
459.
by hannob 5y ago
Bit more than 6 billion. And yes, it's quite challenging. It would be a nice service to the community if someone would host downloadable dumps of CT logs.
460.
by hannob 5y ago
I would claim that I'm quite familiar with the TLS and certificate ecosystem, and up until this news item I didn't know Google runs a CT search engine. Everyone uses either crt.sh or to a lesser extend Censys. I think this space i
461.
by hannob 5y ago
I am a novice as well, but as far as I understand, "Dark Matter" ultimately is really just a term for "there's a phenomena we don't understand yet, and we call it Dark Matter".
462.
by hannob 5y ago
Quite the contrary. The browsers people use are largely based upon open source engines. The cloud applications people used are built upon ecosystems of highly successful open source projects. Basically every major web development framework
463.
by hannob 5y ago
Do you have any policy regarding collaboration with the fossil fuel industry? (I'm asking because most past carbon capture projects are actually enhanced oil recovery projects, and the accounting they do for co2 avoided is... sometimes
464.
by hannob 5y ago
This is so obvious the real question is why this isn't the default everywhere. Heating is one of the bigger challenges regarding the energy transition, and a big user of fossil gas (and sometimes oil, coal and talking about Finland eve
465.
by hannob 5y ago
I don't really see the connection between cgi and http basic auth. These seem orthogonal issues. (And fwiw the usecase I have does not have any authentication and doesn't need any. It's taking a POST var and doing things with
466.
by hannob 5y ago
what's the major glaring security issue of cgi that you would consider a dealbreaker for a simple http-based service? (this is an honest question, because when I saw this list I actually have a python script running on an apache web
467.
Fermat Attack on RSA(fermatattack.secvuln.info)
51 points by hannob 5y ago|12 comments
468.
by hannob 5y ago
It's really not. Not many things rely on DNSSEC. Things that do rely on DNSSEC usually tend to have their own verifying resolver. (Because the idea of "we need signed DNS records, but we'll let google check that and maybe not
469.
by hannob 5y ago
Here's the big catch: MPEG-LA can't make any money with it.
470.
by hannob 5y ago
I cook a lot. I don't even have a very efficient stove (it's on my todo-list to get an induction stove, but we're in a rented flat, so it's a bit complicated). I still have a really, really tiny electricity bill. Cooking
471.
by hannob 5y ago
I have no idea why this comment got downvoted. It points precisely to the point: Many current climate scenarios have already negative emissions "priced in". We absolutely need to have research to better understand what that means,
472.
by hannob 5y ago
I'm not sure there's that much difference in browser security. There were tiny nits where Chrome was somewhat stricter that I was aware of (e.g. handling of nosniff header), but most of that has been fixed at some point. Mozilla w
473.
by hannob 5y ago
Not OSI approved.
474.
by hannob 5y ago
Fails on criterion 4, and I think that's a real issue. Github is the de-facto default sourcecode plattform. If it isn't a standard option on Github then it doesn't feel like a standard license.
475.
by hannob 5y ago
I wish people would get together to agree upon a public domain alike software license that everyone finds acceptable. That'd mean: * OSI approves it * FSF approves it * Google and other companies with large stakes in FOSS find it accep
476.
by hannob 5y ago
> How could anyone design TA (i.e application whose whole point is security and hence it runs in the secure mode) and allow user to set IV in the API? I mean... TLS did the same (in 1.2, it was fixed in 1.3). I co-authored a paper about
477.
by hannob 5y ago
It's much better. There are processes to enforce good behavior, these are very transparent (basically everything is happening on public mailing lists, the mozilla bugtracker and wiki), and in extreme cases CAs get distrusted for real.
478.
by hannob 5y ago
CAs with a dubious track record are a far bigger problem in terms of practical security than weak cryptographic keys.
479.
A planned EU regulation about website certificates is causing concern(feistyduck.com)
156 points by hannob 5y ago|145 comments
480.
by hannob 5y ago
Rainbow is a signature scheme. Generally it seems the encryption side of post quantum is a bit easier than the signature side. All signature schemes proposed have significant downsides. (though this result raises very serious questions abou

More ›