hdhzy

45 ms·

1. 421.▲
   by hdhzy 10y ago

   > Also, what stops governments to fully replace your domain with their own, including valid certs? The threat is doing this but only for a small number of people. That could go unnoticed if they could provision certs in the dns. If a CA
2. 422.▲
   by hdhzy 10y ago

   You can check that a new certificate was issued for your domain through Certificate Transparency. Maybe if DANE/TLSA certs would also have be submitted to CT logs and browsers required CT that'd provide stronger security that we h
3. 423.▲
   by hdhzy 10y ago

   Most of these changes seem to just disallow weak cipher suites and RTT-1/0 connections. Are there any other differences between modern TLS 1.2 setup and TLS 1.3?
4. 424.▲
   by hdhzy 10y ago

   The usual argument against certs in DNS is that nameserver owners can quietly issue valid certs. You have national domain? Your government can transparently create valid cert for your domain. For more details see https://www.impe
5. 425.▲
   by hdhzy 10y ago

   A simple screenshot of how this looks like would be fine.
6. 426.▲
   by hdhzy 10y ago

   Firefox for Android. Main site redirects to /fallback. Thrn you press back then it goes to the home page and... Redirects to /fallback. :(
7. 427.▲
   by hdhzy 10y ago

   Then sublime is just perfect for you looking at their release schedule...
8. 428.▲
   by hdhzy 10y ago

   Is there a screenshot somewhere to see how it looks like our am I missing something?
9. 429.▲
   by hdhzy 10y ago

   Glad I'm not the only one that'd be happy to have a proper api for their bank. In Europe to upcoming PSD2 directive basically requires banks to expose the api. In the mean time I'm abusing JSON/HTTP api my bank has built
10. 430.▲
    by hdhzy 10y ago

    I don't think so. Especially with HTTP 2 fetching resources from the same domain will be very fast. I guess the main audience of CDNs are huge sites that will see immediate benefits. For them SRI is good. But using CDN from day 1 seems
11. 431.▲
    by hdhzy 10y ago

    SRI may be a double edged sword. What if stripe fixes a bug and rolls a new version of their JS? Your page stops accepting payments. That's bad. If jQuery is compromised you'll detect it and download from different location but fo
12. 432.▲
    by hdhzy 10y ago

    I think the run-in referred to something different than the tweet. > After the run-in happened, I decided to lay low and focus on the job. I even stopped posting on Twitter, because the CEO already had questioned me about what I was writ
13. 433.▲
    by hdhzy 10y ago

    If a tweet like that can undermine their position then the tweet itself is the least of their problems.
14. 434.▲
    New Google issue tracker(issuetracker.google.com)

    2 points by hdhzy 10y ago|0 comments
15. 435.▲
    by hdhzy 10y ago

    Thanks. Google uses interesting approach to handling service accounts: JWT is used as user credential once to get the access token (session credentials) that is reused between requests. https://developers.google.com/identity
16. 436.▲
    by hdhzy 10y ago

    Token Binding achieves something simular to what you propose. See http://www.browserauth.net/token-binding
17. 437.▲
    by hdhzy 10y ago

    > One less DB query. This trait constantly appears in threads about JWT. But then how do you handle token invalidation? I wonder how big IT companies (Google, Microsoft, Amazon) are really doing it...
18. 438.▲
    by hdhzy 10y ago

    In my country is possible to withdraw money from most ATMs by typing 6 digit code from mobile banking app (generated randomly). The withdrawal then is confirmed in the app (you see the detailed address of the ATM). The only downside is that
19. 439.▲
    by hdhzy 10y ago

    Ha, I also use that alias. Simple operations can be done directly in gitk (moving branches etc.) but a real solution that'd make `git lg` editable would be an incredible boon.
20. 440.▲
    by hdhzy 10y ago

    It's still not clear to me what problem is Server Push solving. If it's early delivery of associated resources (css for html page) then the client could already have a cached copy of that CSS (e.g. previous visit). It's possi
21. 441.▲
    by hdhzy 10y ago

    I think it depends on the extension. For example browserpass [0] can be only invoked on button press in browser's Chrome (not via scripts on page) and while it runs native app via Native Messaging it just uses JSONs to communicate. [0]
22. 442.▲
    by hdhzy 10y ago

    Github webhooks also have data in headers. Some of it is security critical (X-Hub-Signature). See https://developer.github.com/webhooks/#delivery-headers
23. 443.▲
    by hdhzy 10y ago

    Yes, feature-wise Gajim is one of the best. Unfortunately the UX is pretty bad :(
24. 444.▲
    by hdhzy 10y ago

    I don't know why but I'm thinking about Symantec right now...
25. 445.▲
    by hdhzy 10y ago

    Good introduction to modern XMPP. Is there a cross platform, desktop client that strives to implement these XEPs? Something like Conversations.im for Android.
26. 446.▲
    by hdhzy 10y ago

    Yes, exactly. At least until suborigin header [0] becomes widely supported. [0]: https://w3c.github.io/webappsec-suborigins/
27. 447.▲
    by hdhzy 10y ago

    > I use pass[1], and I recommend it if you can stand copying and pasting. Try browserpass. It uses pass internally. https://github.com/dannyvankooten/browserpass
28. 448.▲
    by hdhzy 10y ago

    What's interesting is that all other alternatives listed here in comments also use stdin & stdout. Have we returned to CGI?
29. 449.▲
    by hdhzy 10y ago

    Sometimes I've got a service that won't send plain JSON but rather some data in query parameters and some in http headers. So it's rather for integration with others. AWS API Gateway makes it possible to build the input JSON
30. 450.▲
    by hdhzy 10y ago

    Wow, I was thinking about building something like that but this looks very good! Is there a way to map query parameters and / or http headers to input JSON? (a la API Gateway).