jvdongen

9 ms·

31.
by jvdongen 14y ago
For one thing, AFAIK, Alice can be sure that Bob's 'pad' is the only copy in existence because no one can copy Bob's 'pad' without destroying the entanglement. For a 'regular' one time pad this is not the case. Someone could have copied it
32.
by jvdongen 14y ago
Not really - if a one of the CDN's mentioned develops a security issue my sites are among the 26.6% that are unaffected.
33.
by jvdongen 14y ago
Indeed - that is exactly what went wrong in the case of our unfortunate Wired reporter. Also, there's a big chance of course that if someone has lost the password to a services he uses more or less regularly, he'll also not be able to remem
34.
by jvdongen 14y ago
Indeed - that was the whole idea. But may be I'm becoming old fashioned ;-) Also, if something like this gets implemented by a few (or even a single) high profile site being someones 'password buddy' will probably quickly become an accepted
35.
Password recovery procedure idea
4 points by jvdongen 14y ago|7 comments
36.
by jvdongen 14y ago
That can't work - how would they identify the service using them? Ip address is useless for this purpose and other identifiers ar either not available or very easily spoofed and thus equally useless. If somebody gets hold of the application
37.
by jvdongen 14y ago
Indeed there is no right or wrong in thus case. Just different shades of grey. The scale you're aiming for is an important factor though (and I don't know what you're aiming for so I provided ours for context). And perhaps even more importa
38.
by jvdongen 14y ago
We actually do automate as much as possible (small team, lots to do). We've a Fabric script that sets up a complete new environment for a customer/tenant in one go. That includes creating and populating the virtualenv, creating a new databa
39.
by jvdongen 14y ago
I actually have implemented a multi-tenant application based on Postgres 3 years ago and we have been using it in production ever since (for paying customers that is). As such I have some experience in this field and I'm actually in the pro
40.
by jvdongen 14y ago
In principle you could already achieve that by binding a session (and corresponding cookie) to the client's IP address. No big deal. Problem you may have is that some clients are behind proxy farms and can arrive with different source IP ad
41.
by jvdongen 14y ago
Keeping your software up to date is great advise. However I do not entirely agree with the statement that security through obscurity never works. It can never work alone - true. But in combination with other measures it can be a great hel
42.
by jvdongen 14y ago
A skilled locksmith or someone with a serious interest in locks will have no problem [1] to open your front door without any damage using a lock pick tool [2]. If there's no need for said lock to survive, a selection of power tools make it
43.
by jvdongen 14y ago
Thanks for your clarification. Phrased this way I tend to agree with you.
44.
by jvdongen 14y ago
I'm not sure I read your final remark correctly. Do you mean to say that using Skipfish or sqlmap has no place in a professional pen test or that a professional pen tester should not subject his clients to the raw results from said tools? T
45.
by jvdongen 14y ago
I'm a 'lefty' and write with a fountain pen using Parker's Quink - a fairly fast drying ink. Works remarkably well.
46.
by jvdongen 14y ago
I do not expect software pricing to match the marginal cost to the supplier per se. And you're right that pricing in general is done in relation to what's the customers perceived value. However, I disagree with your first statement. Lets ta
47.
by jvdongen 14y ago
I've some reservations with regards to your pricing model. Say when I go from 3 user to 4 users I pay 33% extra. At basically no extra cost for you as a supplier ... (the operational cost difference between 3 or 4 users is in the case of a
48.
by jvdongen 14y ago
The decision to require ISP's to block the Pirate bay is currently being appealed by the way. It's a judicial issue based on existing laws, not a political one such as the net neutrality one. And as long as the appeal is going on nothing is
49.
by jvdongen 14y ago
Well, that kinda depends on how you define standard of living of course. We live very different and longer lives today as opposed to 200 or 1000 years ago. But on a basic day-to-day level, do you think you live a significantly happier and m
50.
by jvdongen 14y ago
If you are in the position to passively sniff the traffic, you're almost always also in the position to redirect and modify the traffic. The only thing you're protected against with encryption sans authentication is passive sniffing. If tha
51.
by jvdongen 14y ago
I now see your 'PS' (perhaps added while I was adding my comment?) - however I cannot follow the argument you make. IF you assume that MITM-attacks are rare, you probably also assume that traffic snooping is rare (which is after all a form
52.
by jvdongen 14y ago
Not to pick on you per se, but this reasoning is often seen in relation to SSL (or encryption in general) and is dangerously wrong. Encryption without identification and authentication of your communication partners is useless. You may very
53.
by jvdongen 14y ago
I've noted that split as well - and wondered indeed if there is no middle ground. Recently it occurred to me that perhaps there is no real need for that middle ground. The fact that Django comes with even more batteries included than Python
54.
by jvdongen 15y ago
Easy way out - if you estimated 3 days and it turns out to be 3 hours ... simply sit on it for 2 more days ;-)
55.
by jvdongen 15y ago
Personally I would be delighted if the government hired (as in permanent, not by the hour) top-notch tech engineers to maintain their IT infra. It would most likely cut down IT costs enormously while at the same time making things running a
56.
by jvdongen 15y ago
And even if the IP address is unaltered - what will prevent the owner of the closed network from routing every http(s) request silently through a proxy on its way out to the Internet?
57.
by jvdongen 15y ago
In a corporate setting in which you use a computer provided by your employer this will always be possible. You can do it by simply generating your own CA certificate and making sure every browser used throughout the company has it in its CA
58.
by jvdongen 15y ago
Not sure it is such a great analogy. Driving is a fairly deterministic affair where you can just follow a proven recipe and obtain the desired result. It takes some skill, certainly. And so does running a business. But there is a major diff
59.
by jvdongen 15y ago
The front-page of HN is a filtered list in and of itself. And I for one actually like the result. Some people would like to see a different filter and thus create one, because they can. That is indeed not something you can, or should want t
60.
by jvdongen 15y ago
Though not a bsd user myself, I'm glad to see this happening. A few extra security-minded eyes on the nginx source code can only make it better.

More ›