jedbrown

24 ms·

181.
by jedbrown 13y ago
Everything about this comment is wrong. Commits are never signed [EDIT: it is possible since 2011, but rarely used; thanks zobzu]. Annotated tags can be signed via PGP (not SSH keys), but the public key is not stored in the repository (
182.
by jedbrown 13y ago
I do the same with btrfs. I actually tried bup first, but had a series of problems (see mailing list) and switched to btrfs snapshots. My main disk is also btrfs so I send incremental snapshots ("btrfs send -p"; faster than rsyn
183.
by jedbrown 13y ago
Transfer between servers is over SMTP, which is not encrypted by default and almost always subject to degradation attacks (the MITM can claim not to support STARTTLS). In any case, the user cannot verify or demand that STARTTLS be used and
184.
by jedbrown 13y ago
So convergence.io is only available over HTTP, yet it offers the plugin for download. It seems an ironically bad practice to install security software over an untrusted connection. Meanwhile, https://convergence.io yields a ce
185.
by jedbrown 13y ago
We use Bitbucket as primary host for open source projects to avoid fragmenting access control. Proposal repositories need to be private and most coauthors prefer journal article repositories to be private. GitHub's pricing model woul
186.
by jedbrown 13y ago
I asked about this just the other day because I use full-disk encryption, but rarely shut the machine down (just sleep with screen lock). The responder was fairly confident that this was not a concern, but Inception does not require an imp
187.
by jedbrown 13y ago
Do you seriously think upvotes on HN have any impact on Google's motivation to get Gmail back up?
188.
by jedbrown 13y ago
I use full-disk encryption and encrypt backups, but I only reboot my computer once a month or so to upgrade the kernel. So in almost all vectors by which my computer could be stolen, it will just be sleeping. How worried should I be that
189.
by jedbrown 13y ago
Arresting everyone is expensive and requires lots of people on the ground. This is worse because it instantly marks every participant (that brought a cell phone), and there's no telling how those people will be discriminated against i
190.
by jedbrown 13y ago
Population bias? It sounds like you currently have a sizeable population of anonymous users that evidently have found value in the site because they keep coming back. They are easy to convert now, but may have written the site off had you
191.
by jedbrown 13y ago
> Received August 7, 2010 It seems likely that at least one of the authors or reviewers saw the OkCupid post, possibly to the extent of influencing the research itself. Yet not being published in an peer-reviewed journal, it's not
192.
by jedbrown 13y ago
Heh, and here I was wondering what the style had to do with climbing ropework. https://en.wikipedia.org/wiki/M%C3%BCnter_hitch
193.
by jedbrown 13y ago
When you open this page with NoScript, all the alerts are shown. * Thanks for Signing We've sent you an email. Please check your inbox to complete the process. * We've already got a signature for your email. Thanks * You appear to
194.
by jedbrown 13y ago
The difference is that between the time of the fraudulent charge and its resolution, your money is not in your account . With a credit card, it never makes it that far.
195.
by jedbrown 13y ago
I have run either Linux or FreeBSD (briefly) on every laptop I have owned since my first one in 2002. I have never once booted into Windows since the first thing I do is wipe the disk. However, despite switching vendors several times, eve
196.
by jedbrown 13y ago
Uh, where can you use "head"? $ git show head fatal: ambiguous argument 'head': unknown revision or path not in the working tree. Use '--' to separate paths from revisions, like this: '
197.
by jedbrown 13y ago
Only command-line, and only in well-announced ways, such as push.default=simple (which you can set now) and "git add -u" run from a subdirectory being applied globally.
198.
by jedbrown 13y ago
Grad students are primarily motivated to graduate so that they can be treated well and paid commensurate with their expertise. That is accomplished via the usual academic channels. Grad students that want to found companies are better off
199.
by jedbrown 13y ago
Let's take the intent of patents at face value, ignoring the perverse incentives and broken review process that may jeopardize their utility even in the private sector. Patents claim to benefit the public by providing incentive to (a)
200.
by jedbrown 13y ago
"""It's worth reiterating that for all the obvious destructive power of sustained wind speeds of almost 200mph, it was the associated storm surge – the rush of water into coastal areas – which caused the worst damage in
201.
by jedbrown 13y ago
$ git bundle create one-file.git --all That creates a single file containing all branches in the repository. It's a plain file so you can copy that around with any protocol you like. Open it with $ git clone one-file.
202.
by jedbrown 13y ago
Is a pneumatic squirt gun with integrated pump really a huge innovation? If you gave an engineer a task of building a hand-held water gun that shoots more than 50 feet, how many wouldn't think of something similar? The first patent
203.
by jedbrown 13y ago
If you are using topic branches, it's bad practice to merge from upstream when it is not necessary [1,2,3], because you clutter your branch with new features that are mostly unrelated to what you are trying to accomplish. Consider mer
204.
by jedbrown 13y ago
HTML email allows an unreasonable level of deception. How does your mail client render this? <a href="http://evil.host">http://trustworthy.host</a> If you can't get your message
205.
by jedbrown 13y ago
> you know that encryption is happening, because you are doing it on your computer before sending bits to the server If your server receives email for you over SMTP, you are trusting the server not to log a copy before encrypting, trusti
206.
by jedbrown 13y ago
I have a million emails occupying 20GB, and receive several hundred per day. I search my mail archive using xapian (via notmuch) on my laptop, but such solutions are less practical for phones and even some desktop users expect IMAP search
207.
by jedbrown 13y ago
What is different about the government logging traffic between Lavabit and the user versus the SMTP between another host and Lavabit? With Lavabit's key, they can get all incoming mail (and many providers don't even use STARTTLS)
208.
by jedbrown 13y ago
Lavabit's encrypted storage was a paid feature that was used by less than 10% of users. From the wording, it sounds like he never stored passwords for those accounts. It's possible that Snowden was the first premium customer for
209.
by jedbrown 13y ago
He had the keys and encrypted messages on the server. Everything but passwords (to unlock the private key), which he received from users and chose not to store. There is no way for users to audit that the passwords are not stored or inter
210.
by jedbrown 13y ago
You can use the remote tracking branches if you don't want to make local commits and want them to be automatically updated by fetch. I.e., git checkout origin/interesting-branch Git will warn you that you're in &quo

More ›