lrvick

27 ms·

661.
by lrvick 11mo ago
THIS is the post that finally got me to make a pre-order, as a former Pebble engineer. FOSS all the things so my freedoms are never restricted again, and I am happy to pay.
662.
by lrvick 11mo ago
Saw comment about local LLM support that I somehow totally missed. Re-opening tab. Should have led with that!
663.
by lrvick 11mo ago
€1M would not even cover the property tax to retire in the cheapest bay area home.
664.
by lrvick 11mo ago
Update: Response from Eric. https://ericmigi.com/blog/pebble-rebble-and-a-path-forward
665.
by lrvick 11mo ago
OSI licenses for all of the things. Make it easy for anyone to stand up their own Rebble infra, data and all, or it is not really free.
666.
by lrvick 11mo ago
FWIIW I have not yet talked to either side about this and we should wait to hear more from the other side before we raise our torches too high. But regardless of whatever happens with Core Devices and Rebble: Personally, I just want choice
667.
by lrvick 11mo ago
A commitment to making things available to all, means making them available to those seeking to make profit from your work without giving you any influence. Rebble was built on borrowed work of others combined with their own and should be w
668.
by lrvick 11mo ago
1. All: Put an FOSS license file in every single repo involved and make it public 2. Rebble: Make every database be easy to export as JSON or similar 3. All: Let everyone do what they want 4. Core Devices: Make it easy for devices to point
669.
by lrvick 11mo ago
I am the primary author of the current generation Pebble Appstore frontend, the one that maintained the database most of the time, the guy who ran the security, infrastructure, data privacy team, and quite a few things around the Pebble eco
670.
by lrvick 11mo ago
At least strong evidence it happened once: https://niconiconi.neocities.org/posts/ken-thompson-really-d... With careful planning though, with the ability to rootkit any linux kernel it compiles that in turn hot-patches
671.
by lrvick 11mo ago
Only stagex and Nix/Guix that I am aware of.
672.
by lrvick 11mo ago
Also the wider reproducible builds website/community https://reproducible-builds.org/ Also live-bootstrap, stage0, mrustc, mes, and so many amazing projects whose combined efforts all helped finally make probably trust
673.
by lrvick 11mo ago
My team and I built stagex as the first software build toolchain that internally mandates 100% determinism and full source bootstrapping. It is explicitly designed for supply chain security to trust no single human or computer. Also contain
674.
by lrvick 1y ago
Perhaps you are not aware of PGP Web Key Discovery or Keyoxide. I know of no solutions even close to this for Minisign or Age keys that does not rely on centralized corporations like Microsoft.
675.
by lrvick 1y ago
> That is very silly. I founded and ran what was at the time... This just seems to be an appeal to authority. I will just say your credentials do not impress me. Lets just stick to two security engineers on different sides of the same in
676.
by lrvick 1y ago
If I as a security researcher want to send a super sensitive disclosure to an organization like "I have reason to believe your devices are compromised", I want to be damn sure it goes to a PGP key held on smartcards that decrypt r
677.
by lrvick 1y ago
Fair enough. If you care about your identity so little, I expect when your personal domain ever expires you will not mind if I buy it and impersonate you? It would be valuable for my supply chain attack education work.
678.
by lrvick 1y ago
I do indeed strongly believe decentralized identity is critical to free internet. I cannot imagine any good outcomes from trusting a small handful of corporations that answer to a small handful of governments to decide what identity and acc
679.
by lrvick 1y ago
I hit send too fast before I was actually done typing/thinking because I was going too fast, and you somehow got a response in seemingly instantly. My bad on this one.
680.
by lrvick 1y ago
In my experience building bug bounty programs for many high risk orgs, PGP reports are rare, as you indicate. Maybe a couple a year. That does not make them any less critical or relied on. We always took them super seriously and read them o
681.
by lrvick 1y ago
I agree it is easy for people to shoot themselves in the foot with many historcal PGP tools, which is exactly why we made keyfork. It generates modern ECC PGP keychains with best practices in one shot, with multiple reasonably secure user f
682.
by lrvick 1y ago
You spend a lot of energy steering people away from PGP, but what is your alternative to solve the same problems with the same threat models? What do you want to shift the entire software supply chain security foundation of the internet to
683.
by lrvick 1y ago
Minisign and Age entirely dodge the actually hardest problem with humans using cryptography, that PGP puts front and center: identity and public key discovery. You cannot just skip these! If a human focused cryptography tool gives a user no
684.
by lrvick 1y ago
If I am wrong I challenge you to point at a well specified replacement for PGP with a diversity of competing implementations as a decentralized cryptographic identity and trust system for open source software supply chain signing, authenti
685.
by lrvick 1y ago
> Neither Google nor Apple rely on PGP for vulnerability disclosure handling. They support and rely on it exclusively for security disclosures sensitive enough to merit encryption.
686.
by lrvick 1y ago
If you write open source code others rely on, or have any online identity that could be used for harm if stolen, it is irresponsible to not have a well published public identity signing key that cryptographically ties together your online p
687.
by lrvick 1y ago
I think even brilliant cryptographers can be wrong, or acting on strong biases formed from a limited perspective. In this case I think they have not thought about personal cryptographic key management and how people use tools like PGP in th
688.
by lrvick 1y ago
I have made no false claims or implications that I am aware of. Mainly I was arguing at your implication that PGP is the wrong tool for any job as your link concluded. I don't doubt you or a lot of people could build something better,
689.
by lrvick 1y ago
There are many ways to use PGP just as there are many ways to use openssl or any other cryptographic suite of tools. For most individuals seeking to establish a long term durable personal keychain they want others to be able to externally t
690.
by lrvick 1y ago
> In what situations do you want people to discover your key Just to name some of the most common use cases I have: 1. When people in my orgs want to encrypt sensitive information to me, e.g in encrypted password databases over git. 2.

More ›