hlandau

18 ms·

151.
Client certificates aren't universally more secure(devever.net)
3 points by hlandau 3y ago|0 comments
152.
by hlandau 3y ago
I believe the actual reason old IBM mainframe OSes is that computer programs originally weren't copyrightable. When the law was changed to make them copyrightable, this wasn't retroactive.
153.
by hlandau 3y ago
The AS/400 is, indeed, a truly weird system. Nowadays it runs as a VM guest on an IBM POWER system. Interestingly, it makes use of hardware tagged memory functionality in the IBM POWER CPUs. You can tinker with this stuff yourself if y
154.
by hlandau 3y ago
This cannot come soon enough. I like Postgres. I've used it in production in the past as a default choice. I want to like Postgres. But I find my enthusiasm for using Postgres again in the future severely dampened by just how bad Postg
155.
by hlandau 3y ago
I'll email you when I publish it. Until then you may enjoy: https://www.devever.net/~hl/auth
156.
Counters and Stones(kizu.dev)
2 points by hlandau 3y ago|0 comments
157.
by hlandau 3y ago
This assumes that a compromise of confidentiality is equally as undesirable as the ability to forge requests which change state. As I see it it's going to be fairly common to have applications where one of these things is much less des
158.
by hlandau 3y ago
Yeah. Of course, nowadays I believe you could replace <frameset> almost entirely with iframes and CSS layout. But it does occur to me that there was exactly one feature of frameset which you maybe can't replicate: the ability of
159.
by hlandau 3y ago
With a non-client-cert based authentication system, one can devise a common authentication scheme (AWS's v4 signatures being a good example), but then delegate implementation of that scheme to a centralised service (or a standardised l
160.
by hlandau 3y ago
Author here. There needn't be any cost for client certificates, since client certificates are frequently issued by custom in-house CAs for free. A more pertinent example of what you're talking about would be the use of S/MIME
161.
by hlandau 3y ago
Author here. "Secrets in the perimeter instead of the core" is an interesting point. To my mind it can just as equally be a disadvantage - I'd usually consider the core more trusted and less exposed. When deploying client cer
162.
by hlandau 3y ago
Author here - yes, ISINDEX is on my radar. ;) Taking other suggestions also - I'm sure my memory isn't exhaustive. At some point I may venture into the weird proprietary extensions IE had also.
163.
Memoirs from the old web: The KEYGEN element(devever.net)
7 points by hlandau 3y ago|2 comments
164.
Heterogenous vs. Homogenous Manufacturing(devever.net)
2 points by hlandau 3y ago|0 comments
165.
by hlandau 4y ago
I don't believe it is known to have any firmware.
166.
by hlandau 4y ago
They won't be leaked, though. With a large western coompany like NXP, especially being that it's one with crypto-related business units, it's basically guaranteed that the keys will be in an HSM. There's always a slight
167.
by hlandau 4y ago
Both HDMI and DisplayPort can use HDCP. The authors of the DisplayPort standard also invented their own clone of HDCP called DPCP, but you can also use HDCP over DP, and it seems like HDCP is a lot more popular(?). In any case the DRM impli
168.
by hlandau 4y ago
I've updated the article to clarify this. Thanks for the feedback!
169.
by hlandau 4y ago
Not sure what you're referring to. As I state in the article: >Therefore, it is impossible to ever replace the HDMI blob used by this device. The device could be used without this blob, but you then forego use of the HDMI (or Displa
170.
by hlandau 4y ago
Author here. Yes - the obvious way to wire up the internal display of the MNT Reform would have been to use eDP directly, but since that would require use of the blob, they used the i.MX8M's MIPI DSI interface instead and used a DSI to
171.
by hlandau 4y ago
Author here. MNT actually went out of their way to make sure you could use the device without this blob: rather than do the obvious thing and wire up HDMI or DP to the laptop's internal display (both of which require the blob), they us
172.
by hlandau 4y ago
Author here. As the comment above notes, it's a leak of the signing keys which would be needed to free this. The actual blob itself can be reversed and replaced with enough of someone's time. The only other prospect is a flaw in t
173.
by hlandau 4y ago
Author here. Not all HDMI/HDCP implementations work like this. Basically, the designer of the SoC (NXP) will have licenced an HDMI/HDCP IP block from some company selling such IP. It looks like NXP licenced their HDMI/HDCP IP
174.
On Numbering Hegemonies(devever.net)
2 points by hlandau 4y ago|0 comments
175.
Memoirs from the old web: server-side image maps(devever.net)
5 points by hlandau 4y ago|0 comments
176.
by hlandau 4y ago
It's completely broken if you don't have JavaScript enabled, for starters.
177.
by hlandau 4y ago
There is a variant of Opus called Opus Custom which is intended to support ultra low latency applications. Might be worth looking into. There is also this product by the Nullsoft guys, no idea if it's any good though: http:/&#x2
178.
by hlandau 4y ago
Author here. The fact that 'every major company' has implemented risk based security doesn't automatically make it a good or sensible thing. I'm against the premise of nondeterministic login processes in general, not jus
179.
by hlandau 4y ago
Thanks for responding, as this offers some interesting perspective. >Firstly, although I don't know exactly what they do these days back when the system was implemented adding 2FA would disable the risk based auth system and make lo
180.
by hlandau 4y ago
Author here. A bit confused by this comment since I make this exact point in the article. The requirements for 'consumer' and 'enterprise' authentication aren't the same, yet they're forced to use the same syst

More ›