hdhzy

44 ms·

391.
by hdhzy 10y ago
This sounds just like RancherOS with strong security and focus on immutability. Are Linux kit truly and completely immutable? That means it's not good fit for a database host OS?
392.
by hdhzy 10y ago
Edge has Web Authentication support but only a draft version. The generated keypair is stored in TPM so after authentication credentials are basically bound to user's device. Web authentication is indeed quite cool. You can also drop p
393.
by hdhzy 10y ago
User name and password plus hardware token. Currently only U2F meets the requirements (supported in Chrome and Firefox with an extension) but soon enough Web Authentication [0] (successor of U2F) will be natively supported by all major brow
394.
by hdhzy 10y ago
The problem is even worse than it looks on the surface (from the client side). If you're implementing a library that holds native resources in .NET it's better to familiarize yourself with CriticalFinalizerObject [0], SafeHandles
395.
by hdhzy 10y ago
> They can just wait to see what works, then copy it and kill the startup that did it first. Well, if the only advantage is being first that's a big problem. The same goes for other startups: they can observe what works and deliver
396.
by hdhzy 10y ago
GPG would not guarantee Forward Secrecy. OMEMO [0] is better if XMPP would be considered. [0]: https://conversations.im/omemo/
397.
by hdhzy 10y ago
The algorithm for "var p = new Person" is roughly (ignoring prototypes): var p = {}; Person.call(p); // calls Person with p as this Remember that in js there are no "methods" just functions. The or
398.
SafeCurves: choosing safe curves for elliptic-curve cryptography(safecurves.cr.yp.to)
1 points by hdhzy 10y ago|0 comments
399.
by hdhzy 10y ago
U2F itself as a browser API is a dead-end and will be replaced with newer FIDO 2 WebAuthentication API, but fear not - it's supposed to be compatible with U2F tokens in use [0]. WebAuthentication will be supported in all major modern b
400.
by hdhzy 10y ago
Sometimes even one character can make a lot of difference: https://en.wikipedia.org/wiki/Mariner_1#.22The_most_expensiv...
401.
by hdhzy 10y ago
U2F has some interesting properties. It cannot be phished (browser sends origin to the token), binds the credentials to username (you can use one token multiple times), can be attested (e.g. server can trust tokens only from manufacturer X)
402.
by hdhzy 10y ago
It works! Thanks.
403.
by hdhzy 10y ago
Remember to add at least two U2F keys. It's easy to lock yourself out in case the only one or lost / broken.
404.
by hdhzy 10y ago
Only Chrome supports U2F. Firefox has experimental support of you enable special flags in about:config but I never got it to work. U2F will be superseded by Web Authentication [0] that includes U2F and will be supported by all major browser
405.
by hdhzy 10y ago
It changes when you input current code. You can scan it multiple times, print it, and then input the code from one of your devices.
406.
by hdhzy 10y ago
And browsers! Causing interesting bugs: https://bugs.chromium.org/p/chromium/issues/detail?id=669800
407.
by hdhzy 10y ago
Yes, but names starting with a trademark are a no-no. See [0] (bitcrazed works on WSL) and [1]. Also IANAL. [0]: https://news.ycombinator.com/item?id=13697918 [1]: https://www.andreas-jung.com/contents/
408.
by hdhzy 10y ago
At least you have SSO! Imagine what if you had different credentials to each of these services (even logins)! There are big companies that operate like that...
409.
by hdhzy 10y ago
From the github repo looks like raw public keys are supported but openpgp not : https://github.com/tlswg/tls13-spec/issues/929 https://github.com/tlswg/tls13-spec/issues/937
410.
by hdhzy 10y ago
Good post. > Sticking to HTTP/2 pretty much allows you to go back and use the long-polling tricks of the past before websockets was created. Interesting how things turned out. The old bad way is now a good way. Last time I've c
411.
by hdhzy 10y ago
FWIW there is an old spec draft for WebSockets over HTTP/2: https://tools.ietf.org/html/draft-hirano-httpbis-websocket-o...
412.
by hdhzy 10y ago
By JSON validation do you mean just checking if it's well formed or rather something like JSON Schema validation? The latter seems tricky. It's validation inside the application a bottleneck?
413.
by hdhzy 10y ago
No-meat diet is not 100% prion-proof according to Wikipedia: > When researchers fed hamsters grass that grew on ground where a deer that died with chronic wasting disease (CWD) was buried, the hamsters became ill with CWD, suggesting tha
414.
by hdhzy 10y ago
Is this only to check server identity or client as well? Why not use regular X 509 certs?
415.
by hdhzy 10y ago
Could you maybe share a screenshot?
416.
by hdhzy 10y ago
Just curious - what's the preferred way of passing secrets from the deployment process to the application? Environment variables? Simple to use and understand but can leak to child processes and crash reports. Files on disk? Usually ca
417.
by hdhzy 10y ago
Zero player game sounds interesting. Is this some kind of simulation?
418.
by hdhzy 10y ago
Very interesting analysis. Could you list business books that you like?
419.
by hdhzy 10y ago
I think that's a proverbial "nice problem to have". If you're big and generating revenue you can think about optimizing costs but when you're small and just starting getting your solution if front of potential custo
420.
by hdhzy 10y ago
Did anyone use OpenPGP for this? Seems interesting...

More ›