jbri

24 ms·

181.
by jbri 15y ago
The difference is generally that higher-paying (i.e. first and business class) passengers get seated first (because having your higher-paying passengers wait for the lower-paying passengers is undesirable), and they're also generally seated
182.
by jbri 15y ago
Either the CA was complicit, or they weren't secure. Regardless of which it is, the CA's root certificate is not trustworthy . If they were hacked into, spoofed into giving out a certificate, or raided by special forces and had data physic
183.
by jbri 15y ago
And I disputed it, which is what lead us here. You are literally making a circular argument by trying to use your answer to support itself.
184.
by jbri 15y ago
Making important decisions based on stereotypes rather than facts tends to be frowned upon these days. And (at least in the US) it opens yourself up to huge discrimination suits if you base your discrimination on protected classes like gend
185.
by jbri 15y ago
From a user perspective, how would you identify "safely" encrypted elements, in a way that can't by spoofed by the page rendering a nonencrypted element with appropriate styling?
186.
by jbri 15y ago
The difference I guess is that rather than "referer" having only one setup (the way it's specced and the way it's implemented are identical), in this case there are two competing methods: The way browsers do it, and the way every other lang
187.
by jbri 15y ago
Well, it works 25% of the time you try it. And if it doesn't your modchip can full-reset and start over - statistically it already is "reliable", all it means is a longer (variable-length) boot cycle.
188.
by jbri 15y ago
So once again: > And this then brings us back to the earlier point, which is why not just use the plugin for crypto in the first place?
189.
by jbri 15y ago
> but the problem is that there exist many users who don't know how to review JavaScript and don't know what a CA is, and will just rely on what their browser tells them (which is where a plugin comes in handy.) > a plugin can be
190.
by jbri 15y ago
Why is a plugin trustworthy where the root CAs are not?
191.
by jbri 15y ago
The part you're missing is the bit where ad-hoc JS crypto takes longer to implement and is more expensive than turning on SSL.
192.
by jbri 15y ago
By whom? Do you trust them? If so, why not have them do the encryption rather than relying on untrusted code to do it?
193.
by jbri 15y ago
...and your trust of the network itself, unless you're using HTTPS in addition to your ad-hoc solution. And vulnerabilities in the trust chain are not HTTPS vulnerabilities - they are trust chain vulnerabilities. It's straightforward to a
194.
by jbri 15y ago
In fact, any "solution" that relies on the server giving you code to prevent the server from reading your data is inherently broken.
195.
by jbri 15y ago
TLS encryption can't be compromised by oppressive goverments. Only the CA-based authentication can. Trying to "fix" this by rolling your own ad-hoc encryption (while ignoring the authentication issue entirely) is completely missing the
196.
by jbri 15y ago
So your answer as to why JS+validator is better than a plugin doing crypto is that "it still appears to work fine even when the system is utterly broken". ... When it comes to security, that is actually a negative .
197.
by jbri 15y ago
> JS crypto remains better since there exists techniques to verify the crypto, and the server does not receive plaintext. You are giving the plaintext to code that has (at best) the same trust level as the server itself. What data is
198.
by jbri 15y ago
> What about the fact that CAs are being hacked left and right, and that governments such as China are known to produce fake certs to wiretap dissidents? This is an authentication and a trust issue. JS crypto does not solve this at all.
199.
by jbri 15y ago
Which would have been useless without a means to get a mark to open a malicious file in Excel.
200.
by jbri 15y ago
Exactly. The whole point of upvotes is to be able to express that "I found this funny/relevant/interesting/neat" idea without having to say so in a comment, which does nothing but dilute whatever's worthwhile in the thread without presentin
201.
by jbri 15y ago
So in other words, roll your own GUID implementation? Instead of using the built-in, highly-tested stuff?
202.
by jbri 15y ago
How are you ensuring global-uniqueness in your global id space when you have multiple systems that may not even be in contact with each other a lot of the time?
203.
by jbri 15y ago
What makes this any more secure than using the complete phrase?
204.
by jbri 15y ago
I'm not sure if you missed it, but this article is actually written by sonic. You know, the people providing 20+mbps without any cap.
205.
by jbri 15y ago
I also get a 403 trying to load what you've linked, but dosbox_13.nmf loads fine and so do the games. It determines the filename based on the major version number in the useragent - it would probably work fine if your browser reported chrom
206.
by jbri 15y ago
In what way is NaCl worse than webgl?
207.
by jbri 15y ago
That would be neat. But it's essentially impossible with a traditional LCD screen - the physics don't work that way. The way a backlit LCD works is that the backlight produces light, which goes straight into a polarizer. That polarizer abso
208.
by jbri 15y ago
Basically half the article is stating that generically cutting corporate taxes doesn't actually create jobs.
209.
by jbri 15y ago
No you can't (or rather, it's not very useful). Sure, you can set someone's password to something you know that way - but since you've already got write access to the database, you might as well do it directly. This is a flaw of any system
210.
by jbri 15y ago
Alternative attack: Change everyone's email address to one you control, get the system to send everyone a "you forgot your password" email.

More ›