lvh

55 ms·

601.
by lvh 7y ago
Firefox requires extensions installed via their "store" be signed with a certificate to make sure they're actually from there. That certificate has an expiry date. It expired, so now all of its signatures are invalid -- and F
602.
by lvh 7y ago
Short-term certs _are_ a virtue. Not only do you not have a manual event rare enough for people to forget how to do it, you also don't have to worry about which 15 services someone granted a 10 year wildcard cert to early in the compan
603.
by lvh 7y ago
When you say "based off of", you mean spiritually, not codewise, right?
604.
by lvh 7y ago
That website is extremely unhappy right now and is taking a full minute to load. I guess the cobbler's children have no shoes :-)
605.
by lvh 8y ago
Neat! I haven't audited it but a quick look through the README suggests the approach is sound.
606.
by lvh 8y ago
Sure: that’s WebCrypto. The main problem it solves is that you don’t really want your AES implementation to be in JS which is only a small part of the problem. You still have the problem that the site would be telling you to do with all of
607.
by lvh 8y ago
What control does Android give you that you want? (I’m legitimately asking: is there an immediate pragmatic reason, or is it a principled stance against walled gardens?)
608.
by lvh 8y ago
X25519 is great, but it doesn’t make Protonmail (really, OpenPGPjs) a net safe communications mechanism. It inherits all of the flaws inherent in OpenPGP, including optional authenticators (which lead to EFAIL), kitchen sink bulk protocols
609.
by lvh 8y ago
GNU Gnash and Lightspark.
610.
by lvh 8y ago
iOS has the same feature: https://developer.apple.com/design/human-interface-guideline...
611.
by lvh 8y ago
The relevant paper here is: https://www.hpl.hp.com/techreports/1999/HPL-1999-90.pdf It's not actually faster if you have to try all of them :)
612.
by lvh 8y ago
Whoops; you're right of course, but same idea with fewer primitives -- either way, obscure the output of the polynomial MAC with the output of a cipher, so you get the fast MAC that you can reuse multiple times.
613.
by lvh 8y ago
You mean for 2 values under the same (key, nonce), right?
614.
by lvh 8y ago
This is playing a little fast and loose but just to get an idea: the keyed hash is fast but only secure once. By encrypting it, you get most of the perf benefit (the tag is much smaller than the entire message), and you get multi-message se
615.
by lvh 8y ago
But why have that mechanism when HTTP already has a caching mechanism? Is it really "skip that HTTP request"?
616.
by lvh 8y ago
Thing I don't understand about the MTA-STS spec and glossed over until someone pointed it out to me: there's both an `id` in the DNS record (which is supposed to refer to the specific policy uniquely, but can be anything e.g. a ha
617.
by lvh 8y ago
There's a lot to like here, but two things I wish were different: > MTA-STS policy suggestions in the security center are available to G Suite Enterprise and G Suite Enterprise for Education customers only. MTA-STS policy suggestion
618.
by lvh 8y ago
Are there any other specs that ICANN tells everyone to deploy that regularly take down entire TLDs, DNS providers, and occasionally an entire RIR? [0]: https://www.icann.org/news/announcement-2019-02-22-en [1]: https:
619.
by lvh 8y ago
Not only do humans demonstrably not do that, no: they cant memorize that much data. Secondly, a password manager does not have to upload your passwords anywhere directly, they can be protected with a master password or a different encryptio
620.
by lvh 8y ago
The cryptographic answer is: yep, that sounds about right (with low confidence because the model violation is subtle). The cryptographic engineering answer is: use OCB3 instead which doesn't have this problem :)
621.
by lvh 8y ago
It looks like voice packets are intended to be OCB2 (CryptState.cpp, cryptstate go package in Grumble). I haven't read the code through to figure out how to mount it (and it looks slightly funky), but if it does what it says on the tin
622.
by lvh 8y ago
There's no "Containers and orchestration" section, but there's a "Containers and Schedulers" which is what I assume you meant. Here's the full text of that section: ---- Once you have a containerized appl
623.
by lvh 8y ago
It also doesn't help that when some people say restricted shell they mean "actually like bash, running on a real system", or more of a debugging console (a bespoke REPL a la Python's stdlib's cmd module). I'd h
624.
by lvh 8y ago
Where does the post tell you to do that? If anything it tells you a) spend a lot of time paying attention to what sounds like what you might call "the general security implications of containers" and b) it also tells you that syst
625.
by lvh 8y ago
That's true, but GGP comment mentioned AGPL presumably for a reason :)
626.
by lvh 8y ago
I'm a board member of Clojurists Together[ct] who is trying to solve this problem for _just Clojure_. Obviously this is a generic issue and while most Clojure libraries are hardly core infrastructure underpinning 2/3ds of the serv
627.
by lvh 8y ago
Data anonymization is an incredibly complex problem and de-anonymization is an entire subfield. I’m by no means a Facebook apologist, but “we don’t trust our ability to deanonymize data so it would be suitable to publish” rings true.
628.
by lvh 8y ago
Oh, sure: I was just clarifying that copyright doesn't help here. Honestly I think it'd be a silly patent? But USPTO grants lots of silly patents.
629.
by lvh 8y ago
A word clock is a concept that requires patent protection, not a copyrightable expression.
630.
by lvh 8y ago
“Copyright”, is something you get automatically in most countries whenever you durably persist some kind of creative expression. It does not generally prevent you from copying a design like this. A word clock is a concept: but that requires

More ›