hannob

27 ms·

151.
by hannob 3y ago
Sorry, if that's your security process, it's broken. If you're microsoft and that's your security process, you have no excuse and should be embarrassed. However, I heard such stories about Microsoft's security proce
152.
by hannob 3y ago
It's wild that we're in 2024, and there's a security issue that is essentially "we parse data in an ad-hoc format with an ad-hoc parser based on regexps, and we got that wrong". And the solution is "we tweaked
153.
by hannob 3y ago
The key argument of the paper this is based on is that storing H2 is difficult if you don't have salt caverns. Then you need H2 pressure tanks, and that is expensive and also requires a lot of energy. And you don't have salt caver
154.
by hannob 3y ago
FWIW, I had also written about this paper: https://industrydecarbonization.com/news/should-we-burn-meth...
155.
by hannob 3y ago
Entirely reasonable to research it. Not reasonable to write an article that sounds like this is an actual problem, only to tell people in the third last paragraph that it is largely a hypothetical scenario and in all likelyhood not going to
156.
by hannob 3y ago
But it does not have a function to use libc-style password hashes, so that doesn't help.
157.
by hannob 3y ago
The PEP is not accurate, probably outdated. Linux distros are converging towards using libxcrypt with yescrypt, which is a modern password hashing function. If you have a crypt function that wires back to libxcrypt's crypt, you can use
158.
by hannob 3y ago
If your goal is "fun" then I guess that's fine. But don't pitch it as "defending" your website.
159.
by hannob 3y ago
No, ignore. WAFs that "block" "attacks" that ultimately should just cause a 404 error are part of the same mindset: That you think you "have to do something" about an attack that you should probably just ignore
160.
by hannob 3y ago
Can you tell me where in my words you read that I blamed victims? I think you're reading something into it that isn't there.
161.
by hannob 3y ago
People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve
162.
by hannob 3y ago
Not a service, but I can offer an opensource script to give a basic summary: https://github.com/hannob/rpter If there's demand, I could start a SaaS business for it :-)
163.
by hannob 3y ago
This is ultimately an application of the "robustness principle" or Poestel's law, which was how people build stuff in the early Internet. Plenty of people believe these days that this was never a wise guideline to begin with
164.
by hannob 3y ago
Yeah, sure. I mean "we don't do fraud detection, it's literally one of our design decisions that you can't do anything after fraud has happened, and also, fraud is kinda in our DNA" systems are totally well suited t
165.
by hannob 3y ago
The core of the problem is micro dependencies. It seems in the Javascript ecosystem, developers have no awareness of costs of complexity. When you wonder whether to add a dependency, you should ask yourself: What are the upsides and downsid
166.
by hannob 3y ago
I am pretty sure that is still the case in some areas. DB Navigator never covered all local tariffs.
167.
by hannob 3y ago
I don't have experience with InterRail, but the bad experience often starts with buying a ticket. The amount of "we cannot sell you that ticket, we can't even tell you the price" I have gotten when checking international
168.
by hannob 3y ago
The thing is: We have a binary definition of safety for cryptographic hash functions, and it works well. You can add a non-binary sense of safety to cryptographic hash functions, but it makes stuff a lot more complicated for no good reason.
169.
by hannob 3y ago
> Help us out by describing a time when this happened. Linus Torvalds saying that SHA-1 is okay for git, while it is used for Git signatures as well. Signatures are a classic "you need collission resistance to have safe signatures,
170.
by hannob 3y ago
> The article mentions the key detail: MD5 is broken for cryptography (collisions) but not for second preimage attacks. The problem with this argument is that people often don't properly understanding the security requirements of sy
171.
by hannob 3y ago
It appears to me that if you are part of a service where people can book you to say and advertise whatever they want, including scams, and you do absolutely no checking of what you say there, that sounds a lot like you are running a service
172.
by hannob 3y ago
These "constrained devices" come up so often in discussions about costs of cryptography, yet people rarely tell what exactly they are talking about. But given that cryptography is usually not very resource intensive to begin with
173.
by hannob 3y ago
This sentence also bothered me, however, later in the text he says that of course there's a complexity cost, but that he believes the costs are quite low. I think one can reasonably argue that. One sentence with unfortunately chosen wo
174.
by hannob 3y ago
One of these again... If you call yourself an "Open Source Company" and you are not an Open Source Company, then yeah, people will criticize you for it. No, that's not a sign that the world is evil to you or that Open Source
175.
by hannob 3y ago
FWIW, the "a week out from Christmas" is likely due to the 37C3 presentation. That does not excuse how they handled the disclosure to the opensource projects, which it appears they haven't handled well.
176.
by hannob 3y ago
FWIW, I've tried to understand this better, and have thrown together a quick test: https://github.com/hannob/smtpsmug This is very much work in progress, and not documented yet. But it does detect the postfix issu
177.
by hannob 3y ago
So how did it happen that GCM modes for SSH contained a fix, but ChaCha20-Poly1305 did not?
178.
by hannob 3y ago
I guess that means we will have another round of "this interesting result in basic research that has no relation to practical use of fusion energy shows that practical and commercially viable fusion energy is basically just around the
179.
The Trouble with European Green Electricity Certificates(industrydecarbonization.com)
2 points by hannob 3y ago|0 comments
180.
by hannob 3y ago
Is webp still relevant these days? You can use picture/source/srcset to provide different image formats depending on browser support. avif for modern browsers, jpg for maximum compatibility. Means people with old browsers will eit

More ›