lawl

68 ms·

601.
by lawl 13y ago
Are there any advantages over something like sshuttle? [0] Doing sshuttle --dns 0/0 seems more convinient especially since a regular sshd on my box is all I need, no additional software. And it instantly tunnels all my traffic, no ne
602.
by lawl 13y ago
WoT won't work, yes. > Sure, the PKI isn't too great, but its what we have, and it is currently more practical than any other solution out there. Security needs to be usable to be useful. But I disagree with you here, there a
603.
by lawl 13y ago
> If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site. Uhm no? Because you can litterally just buy a new valid cert for it? As long as we're talking Domain Validated. I dou
604.
by lawl 13y ago
Gotta try that after i catched some sleep. Got no reply from them on twitter. I'd expect them to an annouce this officialy though.
605.
by lawl 13y ago
I use(d) free StartSSL for my hobby projects too. So I wanted to revoke my certificates today, post heartbleed and stuff. They charge $25 to do the right thing and revoke your cert. So I will not use them again. Edit: Btw. That's per
606.
by lawl 13y ago
Counter point: If you self sign your browser does cert pinning. With CA certs it accepts ANY valid certificate. Certificate pinning should be on by default for all certs. I use CertPatrol to accomplish this: https://addons.mozi
607.
by lawl 13y ago
Different build flags? Might one of them have been built with -DOPENSSL_NO_HEARTBEATS?
608.
by lawl 13y ago
But it's written in C. So it can't be good! (Sorry, I'm just still pissed at HN's simple mindedness and try to get more downvotes: https://news.ycombinator.com/item?id=7549916 )
609.
by lawl 13y ago
There's a problem with your logic here. You're not neccesarily reducing the attack surface. You're adding complexity. While you might reduce the attack surface on low level bugs. You might open yourself to new bug classes.
610.
by lawl 13y ago
What? Sorry, that doesn't make the least amount of sense. If you have a VM your code is DATA! You can have say format string bugs in managed languages too, see for example: http://blog.stalkr.net/2013/06/golan
611.
by lawl 13y ago
If that would work Virtual Machines and runtimes wouldn't have vulnerabilities. So uhm. Yeah, that doesn't work either. Edit: Btw since HN has this obessions with Tarsnap, it's written in C btw. So you should stop obessing ab
612.
by lawl 13y ago
Agree. This needs a big fat the world is coming to an end stlye of warning. I've just shut down the webservers running SSL that I can control. If you are vuln and don't want to build openssl from source and can afford the outage
613.
by lawl 13y ago
Holy shit. That seems worse than the debian openssl debacle. If i got that right ALL openssl private keys are now potentially compromised. I hope vendors push fixes soon, and then I guess I'm busy for a few days regenerating private
614.
by lawl 13y ago
Don't use the functions from the map object, but keep a separate function reference for validation? I mean if you want to cheat you always can. But that's not the point. Right now you can cheat using official apis. Just use map._b
615.
by lawl 13y ago
Been there, done that: https://news.ycombinator.com/item?id=7548257
616.
by lawl 13y ago
Ctrl+1 for API docs. There's an API to change the color of a tile :)
617.
by lawl 13y ago
This is fun. But I have one wish. Overwrite console.log() so it logs onto the website and I don't need to open firebug :) Edit: I think I solved lvl two to four all the same way. Not sure if that's intended. But I also don't
618.
by lawl 13y ago
> In the talk about git in 2007, Linus said something about git being secure — that if someone would attempt to alter git history (as in attack that happened at Linux repo before), it would be instantly noticed because of hashes. >
619.
by lawl 13y ago
I started programming when I was 10 years old. Profesionally it's been more like 3-5 years though. I picked 10-15 nevertheless. Sue me.
620.
by lawl 13y ago
They're trolling, right? this is a joke, right? Please tell me this is a joke. Edit: There's nothing on the page in the image: http://www.catholicvote.org/?s=firefox&submit=%C2%A0 So i assume this is indeed ju
621.
by lawl 13y ago
Pretty much. Though Linus says he's okay with other people parsing these options, that's why they expose them. But of course you should do it in a sane way. And systemd refuses to patch their code to namespace their flag and liste
622.
by lawl 13y ago
You can pass the kernel options before booting. i.e. "quiet" or "debug". The Kernel exposes these options via /proc/cmdline. systemd parses /proc/cmdline and if "debug" is set, it also raise
623.
by lawl 13y ago
I think it's interesting how GitHub is trying to push open source contribution. However, we shouldn't rely too much on GitHub for (open source) collaboration. Git is decentral after all. Open source should remain too.
624.
by lawl 13y ago
I personally think it's sad that he's leaving But I do have to say I think Brandon handled that really well and its definitely the right thing to do. He had to step down eventually from mozilla to avoid further damage to the brand
625.
by lawl 13y ago
Luckily my timeline was not affected. However, I wonder, shouldn't Twitter be able to pick these messages up automatically fairly fast, after (I assume) hundreds if not thousands of users have flagged them? Also, the spammers can'
626.
by lawl 13y ago
It's incredibly difficult to keep people from using insecure technology. After the whatsapp facebook aquisition many of my friends looked for something different. So they choose Threema and Telegram. Which are both horrible . Please
627.
Which Online Discussion Archetype Are You?(blog.codinghorror.com)
1 points by lawl 13y ago|0 comments
628.
by lawl 13y ago
> Are you really sure that none of them put sensitive stuff in there? Are you willing to bet your job on that? If you really want an answer to that: Yes, I would. Even if there are credentials in there, I'd expect them not to be
629.
by lawl 13y ago
> certain parts may depend on components they don't intend to release Then hopefully that code isn't in the same repository during develoment, but as a separate library. Everything else makes no sense. The open source code
630.
by lawl 13y ago
Very awesome that they release the code. I wish all companies would open source code they don't use anymore. I mean it really doesn't cost anything pushing your old code in a github repo or something.

More ›