kevincox

43 ms·

871.
by kevincox 3y ago
This is worse than not having these functions at all... Oh yeah, pass those arguments as a list, then we'll completely ignore that and fuck your shit up. Err, I mean you need to quote them! Even though they are passed as separate argum
872.
by kevincox 3y ago
https://blame.email/ is a website that does this. I wrote a Lua checker for rspamd that bypasses the spam filter if the address is "signed". I also have a bookmarklet that generates a signed address and inserts it
873.
by kevincox 3y ago
Beeper has been talking about running on-device bridges rather than server-side bridges. So presumably that would allow encryption to the user's device, then re-encrypted on-device to Matrix then sent to Beeper.
874.
by kevincox 3y ago
I wonder if this is a localization bug. Some part of the code is assuming that for full-week view Monday is the second day of the week. But another part of the code is respecting locale settings and starting the week on Monday.
875.
by kevincox 3y ago
Well what are you advocating? It seems like you are suggesting that device security isn't important because it is hard to do and a firewall will solve most problems. But at the same time we are looking at a vulnerability that works thr
876.
by kevincox 3y ago
Why would you assume the compromised laptop is my own? What if I have roommates? Or a friend comes over for a LAN party? I want them on my real network for Steam game transfers and game traffic. Maybe I want them to pull mods off of my NAS.
877.
by kevincox 3y ago
> they can do ARP poisoning[0] and MitM your NAS to steal your credentials (unless you're also vigorous about managing your own TLS CA) All traffic to my NAS is secured, even over the local network. I don't trust the network a
878.
by kevincox 3y ago
Why are all bets off if you have malware on my network. My devices are hardened with the expectation of being on hostile networks. My computers, phone and home server all assume that they are exposed to malicious actors. Of course defence i
879.
by kevincox 3y ago
While "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. Even if it is protected outside of your local network many people have crappy IoT devices or even j
880.
by kevincox 3y ago
I don't know if I agree with that. The official docs do list a lot but often you get something like compression_level takes an integer from 1-8. But doesn't tell you if 1 is smaller output or 8 is to work the hardest. However the
881.
by kevincox 3y ago
What would be the appeal of this to the customer? It is basically a prisoners dilemma. It is globally optimal to stop rewarding people for using credit cards but for each individual they lose if they don't do it. This is why in the EU
882.
by kevincox 3y ago
Location: Toronto, Canada Remote: Small preference for yes. Willing to Relocate: Probably not. Technologies: Rust, TypeScript, C++, Python, HTML, Git, much more. Résumé/CV: https://kevincox.ca/resume/ Senior devel
883.
by kevincox 3y ago
I think there is a fundamental "proxy problem" with AGPL-like licenses. If I put a transparent proxy in front of the service and let users connect to that am I exposing it to them? Almost certainly yes. What about a proxy that pro
884.
by kevincox 3y ago
I think most packagers that can pull from Git can also pull from Mercurial, SVN or whatever else. Pulling from Git doesn't really require using GitHub other than connecting to their IP. You don't need an account or any tool other
885.
by kevincox 3y ago
I think most distributions use some sort of build sandboxing at this point to avoid this problem and increase reproducibility in general right?
886.
by kevincox 3y ago
Element has a beta running for video/audio channels. I don't think other clients have picked it up yet but it should be a relatively small feature past the existing audio and video support.
887.
by kevincox 3y ago
Encrypting the payload will allow you to get by more scanners and in general make the traffic harder to notice. Since the publicly available server code needs to be able to decrypt the payload there is no way to make it completely secure, s
888.
by kevincox 3y ago
A good time for a reminder that you shouldn't `ldd` untrusted executables. It basically works by executing them with some special flags that the linker picks up which causes it to print the report. If the binary is nefarious it can hij
889.
by kevincox 3y ago
Yes. SMS is completely about raising the insecure people to some base level of difficulty to compromise. This is often at the cost of more secure individuals. The problem is that you can't force users to use a decently strong unique pa
890.
by kevincox 3y ago
Yes, it isn't technically an issue when it is purely a second factor. But it almost always ends up being trusted enough that the support team will reset your account with just that info.
891.
by kevincox 3y ago
This is a huge pain when packaging things. You set up the package, add dependencies until it builds and think you are done. But they feature X is missing. What? Oh, it was silently disabled because libY isn't available. Ok, go back and
892.
by kevincox 3y ago
It also shows how brittle these sorts of checks are in general. I really think that this auto-disable of features based on compilation was a big mistake. It is not only very annoying when packaging things (Why does feature X not work? Becau
893.
by kevincox 3y ago
To really nitpick the server does have the password during authentication. The alternate would be a PAKE which is currently quite rare. (But probably should become the standard)
894.
by kevincox 3y ago
In the other hand it was very hard to detect. The slow login time was the only thing that gave it away. It more seems like they were so close to being highly successful. In retrospect improving the performance would have been the smart play
895.
by kevincox 3y ago
It's always amazing how someone's "indispensible feature" is something that someone else couldn't care less about. I don't even really use the concept of open files. I mostly switch files using a fuzzy finder t
896.
by kevincox 3y ago
Yeah, I'll happily take GUIs written in a fairly fast and memory efficient language that are using a full GUI toolkit. It beats Electron, Python, Java or Go programs any day.
897.
by kevincox 3y ago
Let alone malicious third parties.
898.
by kevincox 3y ago
Yes. The algorithm is very much using SIMD in the abstract sense but it isn't using SIMD instructions. It is basically using 64 bit integer operations to check 8 bytes at a time.
899.
by kevincox 3y ago
How do you handle credential stuffing? Attackers will use a huge number of regular residential IPs or VPNs that you would expect to see logins from. How do you tell a credential stuff from a regular login? They are both coming from unknown
900.
by kevincox 3y ago
I'm not saying that there aren't other motives, but there are legitimate security concerns. Credential stuffing is a huge issue for large providers and requiring 2FA is a huge mitigation. Sure, a targeting attack will make the SIM

More ›