jarrett

43 ms·

361.
by jarrett 13y ago
For me at least, this isn't the pain point. Granted, I'm an engineer, but all I've got for data is my own mind, so here's my anecdotal evidence. The concept of keypairs doesn't seem hard to me. And I think that can
362.
by jarrett 13y ago
> Are we really so javascript/web programming oriented now that "plug-in" connotes javascript? Yes, afraid so. > I am talking about an actual application level plugin. Think flash, and silverlight not greasemonky. This
363.
by jarrett 13y ago
My biggest hesitation here is that you're still trusting the server. Which, not coincidentally, has always been one of the biggest objections to JS crypto. That is, if the server is compromised, it can serve malicious JS, and it can ju
364.
by jarrett 13y ago
> generate ephemeral keypairs on the fly You're right--that would be a major boost to usability. One question though: Does this undermine the security of PGP in terms of identity verification? I mean, if I'm receiving an epheme
365.
by jarrett 13y ago
So yes, it's true that JS crypto provides a higher degree of security than no crypto. And security is always about degrees, not absolutes. But you also have to consider that a user may develop a false sense of security if they're
366.
by jarrett 13y ago
I've thought some more about S/MIME, and right now my biggest concern is the CAs. I don't like having that central point of trust/failure. Do you know if S/MIME can work on a distributed model? Also, what are the ad
367.
by jarrett 13y ago
Yes, very good point. I'd probably be in favor of having two ways of doing it: * Some kind of "sync" for people who hate dealing with files. * Copying a single file by whatever means you see fit, such as a USB stick. Many peo
368.
by jarrett 13y ago
Do you mean a browser plugin? Probably the biggest issue currently is that browser plugins tend to be written in JS. See this for why it's a problem: http://www.matasano.com/articles/javascript-cryptography/
369.
by jarrett 13y ago
Yes, that's a step in the right direction. (In terms of UX. I won't make any claims either way about its security.) In any case, I'd definitely want a solution that works on the desktop. I don't know if iPGP integrates w
370.
by jarrett 13y ago
Do you mean we should build a good UX around S/MIME? It seems clear to me that none currently exists. I'd be curious to hear from security specialists about S/MIME. How thoroughly studied is it? How are the libraries? I have
371.
by jarrett 13y ago
The issue is that plugins must generally be written in JavaScript. It's generally felt that, at least with the current state of technology, in-browser JavaScript interpreters haven't been sufficiently vetted to trust with crypto.
372.
by jarrett 13y ago
> The issue with security is that you're not competing with other secure solutions, but with the convenience of unsecured. True, but that doesn't mean the convenient and insecure apps have to totally dominate the market. I&#x27
373.
by jarrett 13y ago
I didn't find it to be a good user experience. The GUI is OK, but when I talk about UX, I'm talking about more than that. I'm talking about what it feels like to visit the product's site for the first time with no clue w
374.
by jarrett 13y ago
There have been several calls in recent weeks for a nice UX wrapping GPG. I'm thinking of what Cryptocat aims to be, but with a sound implementation resting on GPG. The crypto community seems supportive of this idea. I'm not sayin
375.
by jarrett 13y ago
Ah, good point. I see what you mean--if someone is just learning about PGP the first time, they might not know about issues surrounding key integrity, and the need for trusted 3rd-party signatures.
376.
by jarrett 13y ago
That's the purpose of key signing. The author--like almost all PGP users--has gotten his key signed by third parties. This means that its integrity can be verified. E.g., if a man in the middle were to intercept the HTTP response and c
377.
by jarrett 13y ago
There is a stark difference, though, between a law which merely (allegedly) distorts economic behavior, and one that affects privacy. The former is only vaguely addressed in the Constitution, in the form fo the 9th and 10th Amendments, and
378.
by jarrett 13y ago
I've never taken a law class, but I've read and understood many, many statutes and contracts. I'm sure you could too. Does that mean all legal drafting is clear? No. But much of it is sufficiently clear for a literate person
379.
by jarrett 13y ago
> Law is code. Why haven't we fixed this yet? Properly drafted English-language laws do read as code. It's like how you can describe formal logic in English: "All Americans wear hats. I am an American. Therefore I wear a h
380.
by jarrett 13y ago
Good point. It does make me wonder though: Does the time and money cost of purchasing more licenses outweigh the effect on employee morale resulting from night shifts?
381.
by jarrett 13y ago
This is probably true. Still, it seems like a red flag to me that on a project like the F-35, which presumably has adequate funding for office space and other such things, their only solution for providing offices for their own employees
382.
by jarrett 13y ago
So they're running low on office space? That's a bottleneck for the F-35?
383.
by jarrett 13y ago
For anyone who's unfamiliar with the term "Mythical Man Month," it's the title of a book which argues, amongst other things, that assigning more engineers to a late software project will make it even later. The book can
384.
by jarrett 13y ago
> On the other hand, it always, locally, makes sense not to challenge claims and let some other small company deal with it. I would argue in favor of fighting back in most cases, even from a local standpoint. "Millions for defense,
385.
by jarrett 13y ago
This article was on the HN front page some time ago: http://chronicle.com/article/I-Will-Ruin-Him/136693/ It sounds like your situation is similar, though perhaps less extreme.
386.
by jarrett 13y ago
> The government forcing me to carry your product =/= free market. Preserving a free market sometimes requires regulation of anticompetitive behavior. That necessarily impinges on the economic freedoms of the largest players. But th
387.
by jarrett 13y ago
No, sadly iOS doesn't work this way. Yes, there is a filesystem on an iOS device. But the user doesn't access it directly. Instead, the user must rely on some rather opaque abstractions called "syncing" that Apple has in
388.
by jarrett 13y ago
Your model seems easier at first. But it seems to depend on a simplified model of media consumption where the iTunes store is the only source of media. What if I buy audio from someone else? What if I acquire it via a regular web download?
389.
by jarrett 13y ago
> The File System is by far the most confusing aspect of computing My experience has been the complete opposite. I find the file system, far, far more intuitive than all the ad-hoc ways various applications attempt to manage my "co
390.
by jarrett 13y ago
I would draw the line between platforms on the one hand and 3rd party products and services on the other. Examples of platforms: A phone operating system, a desktop operating system, a browser. Examples of 3rd party products and services: A

More ›