lvh

64 ms·

661.
by lvh 8y ago
> We've met with hundreds of Fortune 500 / Global 2000 companies, startups, and government policy makers asking: "How do I get started with artificial intelligence?" and "What can I do with AI in my own product o
662.
by lvh 8y ago
They are completely different to the person making the buying decision, and they are only completely different from a technical perspective if you’re an architecture astronaut in low earth orbit that all you see of an API is boxes on a diag
663.
Japan's cybersecurity minister has never used computer(abcnews.go.com)
2 points by lvh 8y ago|0 comments
664.
by lvh 8y ago
It’s complicated, and there are exceptions (archiving a deteriorating work for example) but in almost all cases it’s just expiry via passage of time.
665.
by lvh 8y ago
Turns out not even Google employees could figure out how to use Google+.
666.
by lvh 8y ago
ArtChain had that bug, it was trivially discoverable with automated scanners, someone told them about it, and they did _worse_ than ignoring the report -- so yes, I agree, your example is really more of a counterexample :-D
667.
by lvh 8y ago
Do you have any evidence of that claim? Also, even if it’s true, why does the company get to command the researcher’s time? Finally, as a company, you get to mitigate this by having a serious disclosure policy. It helps if you don’t look li
668.
by lvh 8y ago
Well, I'm happy to walk you through it if you're game. Let's say the company is an incompetent idiot: that also means they're unlikely to respond well to a well-written vuln report. So what protects the general public th
669.
by lvh 8y ago
Well, it's subtle, right? That presupposes they're an incompetent idiot, and if they are, I agree: you should just publish a full disclosure. A lot of projects/companies fortunately are not staffed by incompetent idiots. I&#x
670.
by lvh 8y ago
This is one reason 'tptacek any I are so militant on the "responsible disclosure" issue. People who seem to believe the onus is on security researchers to do whatever song and dance the person who are actually responsible wan
671.
by lvh 8y ago
Most of those other systems don’t claim to be designed to prevent them intrinsically via process, though.
672.
by lvh 8y ago
I can’t speak for GP, but Nelson invented hypermedia/hyperlinks and had a vision for the future that included documents including other documents. All of that seems pretty compatible.
673.
by lvh 8y ago
Of course it won’t ensure anything, but currently being completely unable to reproduce results, even as the author but just a year from now, is par for the course.
674.
by lvh 8y ago
So you're saying you can have sane sessions as long as you have some server-side storage? :-)
675.
by lvh 8y ago
Latacora has its token Clojure person: me. I write Clojure every occasion I get, we've shipped Clojure code to customers, et cetera et cetera. Most of the stuff I'm doing in Clojure would be possible in other languages, but in a s
676.
by lvh 8y ago
It's a reference to the 1995 cult movie "Hackers".
677.
by lvh 8y ago
Absolutely! There are some things you can't check that are still bad, for example, md5(timestamp) or Mersenne Twister might not be obvious, but 16 base32 symbols that decode to 10 ascii bytes is a pretty dead giveaway :)
678.
by lvh 8y ago
I had exactly the same problem (exacerbated because Latacora: 4-5 secrets per client x N clients == too many secrets) and I started using the Duo Mobile app because of it (yes, it does Duo push, but it'll also read TOTP).
679.
by lvh 8y ago
It's not clear to me what that even means. Google Authenticator is the client, it doesn't get to pick the secret. I'm guessing it means "people did it wrong for a while and Google Authenticator had to compatible so it al
680.
by lvh 8y ago
Mind you: to wit, the TOTP RFC defers to the HOTP RFC, and that insists on at least 128 bits or something, so 16 pseudorandom bytes, not 16 ASCII bytes as you said :) But if you grep the article for "10 byte", you'll see the
681.
by lvh 8y ago
Sure? The article addresses this: the RFC says it's the minimum, but apparently most clients will allow less, and sometimes (allegedly) servers produce less. I'm not sure I understand your comment: it's still responsive to GP
682.
by lvh 8y ago
10 bytes, or 80 bits, is cutting it, but realistically fine for now if it's actually random. The problem isn't that it's 10 bytes, but rather that it's 10 bytes of _ASCII text_. English prose is only about a bit per lett
683.
by lvh 8y ago
Endpoint means managed laptop in this context :)
684.
by lvh 8y ago
Fossil is a source control system that has, among other things, a builtin forum. I'm convinced that tight integration between source control, issue trackers, wiki pages, and forums is a good thing. Generally you can use URLs, but that&
685.
by lvh 8y ago
Agreed on the RAM bit. I have 32GB and it's sufficient. But keep in mind we have N customers, all with Slack, so our use cases are probably a little out of the ordinary.
686.
by lvh 8y ago
Yes, docking station + 4k@60Hz + builtin laptop screen. Works fine, though there's an annoying bug where occasionally the updated screen sizes won't be reflected properly on the secondary screen. Reboot works as a workaround, I he
687.
by lvh 8y ago
I'd generally agree (CPU perf fine, GPU perf noticeably worse), but it's honestly fine for normal browser/editor use, even on my 4k@60Hz display. I do stuff like (digitally) sign documents and mild Inkscape/GIMP work. I
688.
by lvh 8y ago
I have a T470 -- at the time the most recent T-series 14" Thinkpad. Everything pretty much worked fine? But that's just one data point. Perhaps if they're super new, you'll run into more issues. dom0 is hyperconservative
689.
by lvh 8y ago
FWIW: just over half of Latacora uses Qubes on a daily basis. We do that because "Xen VM" is a pretty great boundary; it allows me to have totally separate client environments with the convenience of a single laptop. (We've h
690.
by lvh 8y ago
That wasn't intended as a complete list? Elsewhere I also mentioned the mystery HTTP services on something like 8443 (but that's to wit).

More ›