hdhzy

13 ms·

61.
by hdhzy 9y ago
I hope te EdDSA curve 25519 support in YubiHSM2 means we'll see the curve also in Yubikeys (e.g. OpenPGP applet). Currently Yubico's OpenPGP supports only RSA but there are already tokens supporting this modern crypto [0]. [0]: h
62.
by hdhzy 9y ago
Remember that Bitcoin is about distributed consensus and for the change to apply a vast majority of users need to approve. Take any other software and see how many people still use old versions (e.g. Microsoft Office). In Bitcoin that would
63.
by hdhzy 9y ago
>> It's thermodynamically sound > Due to the algorithms being inefficient This is by design, when the hardware gets better Bitcoin network starts requiring even more work, so being "efficient" is actually what is not
64.
by hdhzy 9y ago
Also relevant: Pict [0], a π-calculus programming language. [0]: http://www.cis.upenn.edu/~bcpierce/papers/pict/Html/Pict.htm...
65.
by hdhzy 9y ago
Actually Scott Helme (mentioned in the article) also came to the conclusion that HPKP does more harm than good: https://scotthelme.co.uk/the-death-knell-for-hpkp/
66.
by hdhzy 9y ago
The PDF slides are superb. I can't wait for the video. In the mean time: what an interesting times to live in, CPUs have hidden CPUs inside them, and these include a complete web servers and additionally can reimage your workstation ev
67.
by hdhzy 9y ago
It means it will look good in Thunderbird and Gmail for Android. Thunderbird will render custom CSS it won't load any external resources though (e.g. images). Maybe it's a nice idea to add preview to this tool how would it look li
68.
by hdhzy 9y ago
But isn't signing commits basically relying on SHA-1 values of tree and parent (this is what is signed ultimately [0])? That'd be the weakest link of the system. [0]: https://news.ycombinator.com/item?id=10353456
69.
by hdhzy 9y ago
Git's underlying data model is simple yet extremely flexible (see e.g. [0]), well just like OpenPGP I guess. As for the article you're welcome to post it yourself :) [0]: https://github.com/google/git-appraise
70.
by hdhzy 9y ago
I think I used the word vouch incorrectly. When you sign a commit you indicate that your changes can be applied only on that particular parent even if all files or diffs were bit for bit identical. If it didn't work like that someone c
71.
by hdhzy 9y ago
That's workflow similar to what Linux Kernel uses: http://www.vflare.org/2009/09/linux-kernel-workflow-with-git...
72.
by hdhzy 9y ago
Check out Notes Towards Detached Signatures in Git [0]. [0]: https://grimoire.ca/git/detached-sigs
73.
by hdhzy 9y ago
> When I'm signing a commit, I'm vouching that I am responsible for applying this set of changes to a given state of a repo. It says nothing about my belief in the validity of changes to the repo made before it. Then you should
74.
by hdhzy 9y ago
> With GPG, the only key that _has_ to be used for signing is the master key, the first key that appears in a user's key listing. For all other sub-keys, each key is explicitly marked as having a specific purpose. Well it's onl
75.
by hdhzy 9y ago
For reference for other people this is called Key Escrow [0]. [0]: https://en.wikipedia.org/wiki/Key_escrow
76.
by hdhzy 9y ago
> It kindof annoys me that the timestamp wasn't somehow worked into the signature itself (like as a sub-packet), Interesting, I took a sample signature from here [0], saved that to file and run `gpg --list-packets gitsig.asc`:
77.
by hdhzy 9y ago
Just out of curiosity do you somehow update the local keyring? So that one can update their key information (for example to add revocations and new keys).
78.
by hdhzy 9y ago
> I don't validate an entire codebase every time I commit. Linus' point is that you don't need to validate the entire code base, if you have one signed commit then everything that is "below" is also (implicitly)
79.
by hdhzy 9y ago
QArt is also worth mentioning: https://research.swtch.com/qart
80.
by hdhzy 9y ago
It's also worth noting that there are Keybase alternatives in the works, e.g. Linked Identities [0] for proofs about social accounts (Github, Twitter etc.) that just utilizes OpenPGP, and Key Transparency [1] for tracking changes in ke
81.
by hdhzy 9y ago
Signing new commit with new subkey on top of all others is a valid strategy to deal with this problem. Another would be creating new tag and signing it with the new subkey. For me it's not a problem that old commits are signed with rev
82.
by hdhzy 9y ago
That exactly how one can put multiple signatures on a commit.
83.
by hdhzy 9y ago
The default register is unnamed: > The unnamed register is the default and holds the most recently deleted or yanked text; it’s what’s called upon when you just type p without specifying a register. Source: https://pbrisbin.co
84.
by hdhzy 9y ago
You mean something like this? https://github.com/nitram509/macaroons.js/blob/master/lib/Cr...
85.
by hdhzy 9y ago
Wouldn't a simple timestamping of documents work in this case? Either standard RFC 3161 service or publishing document's hashes on Bitcoin (via OP_RETURN transactions).
86.
by hdhzy 9y ago
Very cool thanks for sharing! > Not super practical in terms of battery life Samsung avoided this problem by requiring that the phone is connected to the dock that is also charging it.
87.
by hdhzy 9y ago
I did not mention signing commits but signing push requests and that was a reference to: > All data you push is signed by your device's private key, which never leaves your device.
88.
by hdhzy 9y ago
Sounds intriguing but I'm missing the deep technical info on how it works. > All data you push is signed by your device's private key, which never leaves your device. For the reference git already supports signed pushes (git pu
89.
by hdhzy 9y ago
Contracts page on Bitcoin Wiki [0] is classic, unfortunately to understand most of it one has to know how script and various extensions (lock time etc.) work. Generally I'd advise reverse engineering how Bitcoin works, something like t
90.
by hdhzy 9y ago
> Promise.all will start all the promises so they run in parallel, while `for-of-await` executes them in series. Not true. Promises represents computation that is already started so both Promise.all and for-of will result in the same par

More ›