hlandau

18 ms·

181.
Against risk-based authentication (or, why I wouldn't trust Google Cloud)(devever.net)
240 points by hlandau 4y ago|113 comments
182.
by hlandau 4y ago
This is a good point. Latency tends to be the Achilles heel of any digital technology not specifically designed to keep latency low. In true "grow-up" vein Ethernet has had to try and improve in this regard with TSN, etc. The IETF
183.
by hlandau 4y ago
Author here. Honestly, this is true. In some ways, it reminds me of grow up technologies v. grow down technologies [1]; the highly-reliable high-cost technologies ("groow-down" technologies) tend to get out-competed by cheaper and
184.
by hlandau 4y ago
So, am I the only one who spent 99% of his time playing in Buy/Build mode rather than actually 'playing' the game? I'm not sure the 'game' part of the game ever really appealed to me, but as a house designer, I
185.
by hlandau 4y ago
That gets things down to 0.183s, which is certainly an improvement. But Python manages 0.033s and Guile manages 0.022s, neither of which need a precompile step. I feel like Racket needs to spend some time optimising this. My understanding i
186.
by hlandau 4y ago
I'd like to get into Racket as a Scheme user, but I have difficulty taking it seriously when its startup times are still so high: $ time racket -e '(display "hello")' hello real 0m0.721s user 0m0.598s sy
187.
by hlandau 4y ago
It's worth noting that IBM i has a kind of dependency on AIX. IBM i has an AIX binary compatibility environment called AIX. Think of it like WSL, but for AIX binaries and on IBM i. Of course if they created this compatibility layer tod
188.
Producing HTML using string templates has always been the wrong solution(devever.net)
3 points by hlandau 4y ago|0 comments
189.
Memoirs from the old web: The GateKeeper access control system(devever.net)
2 points by hlandau 4y ago|0 comments
190.
by hlandau 4y ago
As the author of the above article I saw Pushup the other day and thought it looked interesting. If people are being inspired to bring back this sort of approach to webdev that makes me happy. Good stuff! It's still a hard rule of mine
191.
by hlandau 4y ago
By NDAware, I mean chips that require NDAs to access datasheets and register manuals, and which are thus are of no interest to me. STM32 is vulnerable to glitching, as are MCUs specifically marketed for "secure" applications like
192.
by hlandau 4y ago
Yeah. I'm aware of these kinds of things. Since real SE chips tend to be all NDAware, or if they aren't are fixed-function, these open source designs invariably work around either using a COTS MCU and its readout protection functi
193.
by hlandau 4y ago
I'm aware of JavaCard (and those BASIC cards, which are even more absurd - why would anyone want to implement cryptography in BASIC?). But JavaCard (or BASIC) isn't the real CPU but a VM. So I guess I should have said, "I wan
194.
by hlandau 4y ago
OpenTitan looks interesting. I guess my main question though is, how does it support owner controlled applications, i.e. applications where the device owner (not the OEM) can provision and modify all code, rather than it being OEM-signed? I
195.
by hlandau 4y ago
Very interesting writeup - thanks for going into detail on this. So basically there will be a variant which isn't erasable unless you have the "OEM"'s key and a variant which is always erasable. Everything above makes se
196.
by hlandau 4y ago
As an aside, I've always wanted a device that supports trusted boot using something like the following model: - Secret generated inside the device in nonvolatile memory (e.g. during manufacturing) - During boot, a boot ROM reads the in
197.
by hlandau 4y ago
Very cool. Sounds like you have the right idea in terms of the requirements I discuss above and which people are mentioning elsewhere in this thread. I look forward to reading the datasheets when this is announced.
198.
by hlandau 4y ago
This is long overdue. I've long been intensely frustrated at the way the secure element industry keeps everything behind NDAs, even just basic datasheets. The SEs you can get without NDAs are invariably fixed-function models which you
199.
by hlandau 4y ago
It all got reversed eventually after massive negative press coverage. I don't think Microsoft took "ownership" of the domain, but simply got the court to make them the nameservers, though I may be wrong. I do feel like the on
200.
by hlandau 4y ago
Author here. If the sought action of the court case, and the outcome were, "the domain were taken down" that would be one thing. Domains get suspended by court cases all the time, that's not the issue. What makes the no-ip.or
201.
by hlandau 4y ago
Author here. A DNS challenge is equally vulnerable to MITM unless DNSSEC is used. The whole point here is that an entity which wants to MitM connections between a browser and website can obtain a certificate if they can MitM connections bet
202.
by hlandau 4y ago
The way this works is, the part of a CAA record in quotes can have parameters added to it. These have been little used until now so many may not be familiar with this syntax but it's always been in the CAA spec. The examples at the end
203.
Let's Encrypt now supports ACME-CAA: closing the DV loophole(devever.net)
8 points by hlandau 4y ago|0 comments
204.
by hlandau 4y ago
As the author of the relevant RFC it's great to see this finally getting turned on. To my knowledge this is the first production deployment. To Let's Encrypt, thanks for finally making this happen.
205.
by hlandau 4y ago
So if I'm understanding the description above correctly, the chain is: turn crank -> bootstrapping air compressor -> air tank 1 -> 1.5MW emergency generator -> bigger air compressor -> air tank 2 -> 7MW main gener
206.
by hlandau 4y ago
If only browsers would support it.
207.
by hlandau 4y ago
We can't distribute an entire game or animation as a single file which can be downloaded or embedded on a website. Think about things like Newgrounds. I mean I guess you could do something awful with base64 encoding assets into a giant
208.
by hlandau 4y ago
Author here; yes, the sole focus here is on the ISA-relevant parts. Obviously disk formats are out of scope. It's correct that IBM originally used custom IBM disk drives with 520-byte sectors. I believe 528 byte sectors were also seen
209.
by hlandau 4y ago
As far as I'm aware Pantone has always tried to claim copyright over their set of colours, despite this being an extremely questionable interpretation of copyright law. There have been web-based colour scheme designers who had to remov
210.
The Talos II, Blackbird POWER9 systems support tagged memory(devever.net)
125 points by hlandau 4y ago|20 comments

More ›