jesprenj

24 ms·

331.
by jesprenj 4y ago
Chrome simply using DNSSEC and NSEC(3) by default would fix this to a great extent.
332.
Chromium's impact on root DNS traffic (2020)(blog.apnic.net)
101 points by jesprenj 4y ago|83 comments
333.
by jesprenj 4y ago
If a government agency takes over a domain name, which they can, they can just as well obtain a TLS cert from LetsEncrypt. DNS registries are already SPOF.
334.
by jesprenj 4y ago
I suggest you fix the HTTP TLS-less version of the site, so that chromium browsers may access the plaintext version. Currently I get a 404 Not Found for the linked HTML file when connecting via plaintext. TLS only complicated things (: I do
335.
by jesprenj 4y ago
> What is needed is less centralization, not more. I don't think depending on more CAs counts as constructive decentralization. Since every CA is ultimately trusted, the security of our PKI depends on the weakest link in the chain.
336.
by jesprenj 4y ago
I think the whole design of PKI is bad. Instead on trusting a handful CAs that have to charge for or severely limit access to their signing servers, PKI could be based on the DNS hierarchy. CA type certificates do have an extension for spec
337.
by jesprenj 4y ago
Can one buy uncut sheets of euro banknotes?
338.
by jesprenj 4y ago
Are you sure this is how, let's say, Linux behaves? I tested it now in a minimal privilege account in a chroot on Debian 11 that I use for login from untrusted machines, and strace worked. This is how I captured a password entered into
339.
by jesprenj 4y ago
I ended up logging in as root mostly for the sake of convenience, as now I am no longer bothered with suid wrappers like sudo for mundane tasks, like editing system configuration files and udev rules for devices -- as the sole user of the c
340.
by jesprenj 4y ago
The app in question can just dump the memory of ssh-agent and obtain the private key from there. Or not?
341.
by jesprenj 4y ago
Fair point, but a browser bug leading to code execution in an unprivileged user could, as mentioned, read my SSH private keys, GPG private keys, ... This in turn would allow an attacker to login to my servers and other computers leading to
342.
by jesprenj 4y ago
That's usually my argument when someone mocks me for logging into all my computers as root. Having a separate nonprivileged user and running tons of desktop/shell programs isn't really much better considering all those progra
343.
by jesprenj 4y ago
Probably random() returns a value from 0 to one, multiplying by 6 yields a random point between 0 and 6. There is a 1 in 6 chance for this number to be in range [0, 1), which is checked by rounding it down and checking if it's zero. ri
344.
by jesprenj 4y ago
Why would an oven need Internet access? You physically need to open the oven and put stuff in it and then take it out. Food over IP is not a thing yet. Unless it has an internal camera with which you can observe the food while it's coo
345.
by jesprenj 4y ago
It could also be a script that imports a private key and searches for the string BEGIN PRIVATE KEY. Likewise if someone searched HN for this string he'd find your comment (:
346.
by jesprenj 4y ago
https://_.4a.si . works for me with letsencypt wildcard cert in firefox (:
347.
by jesprenj 4y ago
I had a similar non-related idea for web browsers. Currently domains are mainly lowercase on the web, so we could use a HTTP header to specify the correct capitalization. capitalization: HarryPotter.Hogwarts.UK Of course we'd have a lo
348.
by jesprenj 4y ago
Even us, users of IDN domains, still submit to the outdated and always present ASCII. Punycode is, after all, still ASCII and "real" UTF-8 characters are rarely and exceptionally seen in DNS. It may be debated that with introducti
349.
by jesprenj 4y ago
Yes, I agree. I hoped for the domain with s to be forgotten by the owner. It impossible to use this domain with š if I don't own the other one, that's why I don't use the domain under national TLD and instead use .eu for pers
350.
by jesprenj 4y ago
This is great! It's usually more expensive to have a non ASCII leter in your surname, as you have to register two domains. And if we'll ever ditch punycode for real UTF-8, one will have to buy three for backwards conpatibility wit
351.
by jesprenj 4y ago
So if a piece of software is, let's say, a web frontend for nmap, and it ships as the main web interface binary alongside nmap.exe in a folder, would that mean that nmap is shipped alongside the web server and not within it, even thoug
352.
by jesprenj 4y ago
It wasn't my intention to discredit the kkrieger game, it's nonetheless a great accomplishment.
353.
by jesprenj 4y ago
wrong parent?
354.
by jesprenj 4y ago
memgraph.com was discussed on HN a week ago: https://news.ycombinator.com/item?id=34342371 -- Bullshit Graph Database Performance Benchmarks
355.
by jesprenj 4y ago
Is this a change that's local to Wikipedia or to the entire MediaWiki open source frontend that powers it?
356.
by jesprenj 4y ago
You can still use old reddit versions: http://old.reddit.com . http://old.reddit.com./.compact
357.
by jesprenj 4y ago
AFAIK this was achieved by heavily using DirectX API and features it contains. When running, it uses around 300 MiB of RAM.
358.
by jesprenj 4y ago
I see - probably the Nujno (urgent) checkbox on a SEPA form activates this SEPA instant payment. I know about Flik and I like the appeal of it, but I do not use it because it requires a proprietary client (NLB Pay in my case). Do you know o
359.
by jesprenj 4y ago
You are right, I verified this now. EU payments cost me the same amount as domestic payments. The ~7 € charge I remember was probably due to conversion. I wanted to send money to Croatia, which at the time did not use Euro yet.
360.
by jesprenj 4y ago
It or one of its libraries did not compile for me OOTB in Gentoo. Granted it's marked as nonstable (~*). That's unfortunate, because I really liked to use it when I was mainly running Debian. Though I didn't really put any de

More ›