jfindley

39 ms·

331.
by jfindley 12y ago
It does seem to be somewhat OSX focussed - although dropping OpenSSL in favour of GNUTLS is going to be interesting, as currently I don't believe there's any sanctioned OSX build of GNUTLS.
332.
by jfindley 12y ago
Not exactly the same thing, but there's CurveCP which is essentially a TCP replacement for creating encrypted communication tunnels. It is part of NaCL and uses the same crypto primitives. It's a really interesting project, but i
333.
by jfindley 12y ago
Me too - it's much more interesting to read about terrible decisions, why they were made, etc than it is to read yet another unblemished story of success. We as an industry should be better at sharing "Hey, I did this wrong becaus
334.
by jfindley 12y ago
I wonder when that was posted. Linux networking has improved massively since the 2.6 days, and continues to get better. It's still not FreeBSD, but the difference is pretty small these days.
335.
by jfindley 12y ago
While I sympathise with the sentiment, there's a couple of things to point out here. Firstly, none of the firewall distros I've seen have really prioritised security all that much - they tend to prioritise fancy interfaces and rol
336.
by jfindley 12y ago
While I don't disagree with anything you've written, depending on your risk appetite there is a difference between compromises that require physical access and those that don't - not that I think this particular product is a
337.
by jfindley 12y ago
I was amused to see that on neither of the links in the post does SSL work correctly. convergence.io identifies as whispersystems and www.certificate-transparency.org produces an ssl error on every version of openssl and browser I have to
338.
by jfindley 12y ago
When doing things like this, you'll be hitting your shell's ARG_MAX way before you hit the kernel limit. The 15 million craziness only applies to cases where you're calling executables in ways that don't go through the s
339.
by jfindley 12y ago
I was interested to learn that the kernel actually allows you to pass 15 million arguments via execve(), with each one allowed to be enormous. It seems very much like asking for trouble - I can't offhand think of a good reason why th
340.
by jfindley 12y ago
There have been a huge number of projects with this issue - e.g. fedora's directory service, called 389. But I think far and away the worst offender for me was chef. In the early days of using chef, googling for chef cookbook was a to
341.
by jfindley 12y ago
I'd be very interested to see a qualified crypto expert on the "sealing" that journald uses. This is one of two indicators of a troubling level of arrogance from the developers. The crypto method used by journald to verify
342.
by jfindley 12y ago
You could potentially register your application with firewalld to make the iptables part even more elegant - then the port would only be open when the service was running. That said I'm somewhat on the fence about firewalld in a server
343.
by jfindley 12y ago
There are far, far easier ways of getting pirated music if that's your goal. I strongly doubt this will significantly affect the level of piracy in music; instead it's a really interesting application of a pair of interesting thin
344.
by jfindley 12y ago
nginx doesn't use ini files for configuration, and I seriously doubt that ajenti is going to help you write your own nginx modules. This reads a little bit to me like a clumsy and misplaced advert for a control panel - but that could b
345.
by jfindley 12y ago
First off, thankyou for a detailed and well laid out post. I do however think that there is a material difference between hosting unpleasant speech (to which the counter is speech pointing out that the speaker is wrong/idiotic/etc
346.
by jfindley 12y ago
It'd be interesting to see a real world test of this. I'm not sure how large the sample variation is with these units, but if you're actually hitting the write limits of your disks I don't think mirroring is going to be
347.
by jfindley 12y ago
I hadn't seen that - that's interesting. Thanks.
348.
by jfindley 12y ago
Yeah, because ext4 never cleans up the dentry table after it's been made. This is a pain. Unfortunately XFS also sucks for handling larger numbers of files - at the hundreds of millions or larger scale, you're largely metadata bo
349.
by jfindley 12y ago
This is sadly such a common issue these days. Please give some idea of your pricing! Not providing any pricing information at all on your website is a massive disincentive to paying for your services. I don't want to have to deal wit
350.
by jfindley 12y ago
Requiring admins to ssh to a different, unique-to-them, user, and use sudo from there for any operations requiring root is much better. It's far easier to audit what's been done to the server, which is important not just for compl
351.
by jfindley 12y ago
It's worth pointing out that there is an upside of shared state, in that goroutines are extremely cheap to create. There's also a fairly decent race detector[1], and clear documentation on what is and isn't thread safe. 1: h
352.
by jfindley 12y ago
Are there any public docs on the details of how you've implemented the equal preference cipher suites at the server end? Is this simply an extension to the server's cipher selection, or do you use NPN/ALPN for this?
353.
by jfindley 12y ago
This looks really great - not only is the tool itself very useful, but I was surprised to find that it comes with what appears at first read to be really good documentation, with plenty of examples. More software should have docs like this
354.
by jfindley 12y ago
I've heard it argued - convincingly I might add - that the autism male/female skew is actually a lot less than this, but we (as a society) are bad at spotting autism in females. This book also has some interesting passages on the