kpcyrd

13 ms·

121.
by kpcyrd 8y ago
https://mastodon.social/@dansup
122.
by kpcyrd 8y ago
Not a lawyer, but this reads like an intent-based law, which aren't too uncommon in Europe. There are some other laws that are phrased in a similar way, like the so called "hacker paragraph". To stick to your analogy, unless
123.
by kpcyrd 8y ago
They also aggressively reject certain phone numbers.
124.
by kpcyrd 8y ago
mozilla
125.
by kpcyrd 8y ago
I've just edited my comment to make this clearer. Doing code signing with signify or pgp gives you a way the verify the binary you downloaded is actually the file the developer built on their laptop, even if the webserver is compromise
126.
by kpcyrd 8y ago
It seems the author is very focused on signing with x509. I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Right now there are only checksums but no wa
127.
by kpcyrd 8y ago
You don't care about the build date, you care about the release date, which is specifically what debian is trying to achieve with SOURCE_DATE_EPOCH.
128.
by kpcyrd 8y ago
Yes, this is known as a rebuilder. There is still work to be done, but NYU was one of the organizations working on developing and running a rebuilder. The idea is that you pull buildinfo files from https://buildinfo.debian.net&#x
129.
by kpcyrd 8y ago
twitter also aggressively collects your phonenumber. Telegram is so aggressively anti privacy that I tried around 5 numbers I own and only 2 of them worked.
130.
by kpcyrd 8y ago
I've designed an OSINT system with this specific feature in mind (it's on github since a few months). Basically being able to go from phonenumber->accounts is very powerful and works even more efficiently to identify a person t
131.
by kpcyrd 8y ago
This is the correct threat of a 51% attack, although if the currency is unpopular enough, had little use and everybody stopped mining, you could theoretically fork from the genesis block and replace the whole chain as soon as your fork beco
132.
by kpcyrd 8y ago
DNT should have been part of GDPR as explicit opt-out
133.
by kpcyrd 8y ago
I build very simple websites, I'm using a tiny bootstrap subset that's sufficient for what I do. My css files average around 400-1100 bytes of unminified css.
134.
by kpcyrd 8y ago
How often do you run into certificate pinning issues?
135.
by kpcyrd 8y ago
Just to be sure, this is only for free accounts, right? Having a paid account suspended because a friend runs a pi hole would be pretty annoying.
136.
by kpcyrd 8y ago
Compile your own video decoder to webassembly and render the video to a canvas.
137.
by kpcyrd 8y ago
Are you using china as a strawman to advocate for corporate userdata harvesting?
138.
by kpcyrd 8y ago
The title on hackernews is highly misleading, there's quite a difference between "for any domain" and "for any domain using shared hosting".
139.
by kpcyrd 8y ago
Did anybody look into how this is going to work with proxies? It seems fairly naive to standardize this without having a solution for that.
140.
by kpcyrd 8y ago
It seems debian testing and unstable are still vulnerable: https://security-tracker.debian.org/tracker/CVE-2019-3462
141.
by kpcyrd 8y ago
Is there a CVE yet?
142.
by kpcyrd 8y ago
I started doing something like this (but with a different provider) and I noticed this is surprisingly difficult: Especially messaging providers identify users based on phone numbers, but also a lot of websites started requiring a phone num
143.
by kpcyrd 8y ago
It seems this has all disadvantages of jwt-style sessions, plus a BREACH-style vulnerability in the crypto due to compression if `plain-text-cookie-value` contains data an attacker can taint.
144.
Rocket_failure: Semantic error handling for rocket applications(github.com)
1 points by kpcyrd 8y ago|0 comments
145.
Database corruption regression in sqlite 3.26.0(gist.github.com)
2 points by kpcyrd 8y ago|0 comments
146.
by kpcyrd 8y ago
>> server spoofing attacks (as in attackers changing the code you boot) > Can you elaborate? I think this is referring to the server being compromised. This isn't something that can be solved easily because while the bootloade
147.
by kpcyrd 8y ago
You can't reliably fix this as a website. You can try to resolve this on the client by using the websites origin as part of the 2FA challenge (which is what U2F does) but ultimately there's no good, universal solution for this. It
148.
by kpcyrd 8y ago
> Obviously, the pain of severe software defects is not yet high enough to warrant switching to memory-safe systems programming languages. The decision to rewrite in a memory-safe language would create a lot of work for the developers, t
149.
by kpcyrd 8y ago
The "surface" in "attack surface" implies reachability. Your argument doesn't make any sense, how would "the exploit" make an unreachable vulnerability reachable without being able to execute the vulnerabl
150.
by kpcyrd 8y ago
I see that argument a lot, but this assumes that vulnerabilities in binaries that are never executed are magically exploitable from the internet. It doesn't really matter if a container contains a 5 year old imagemagick binary if that

More ›