lvh

114 ms·

871.
by lvh 8y ago
No? I don't understand why it's concerning at all. Progress is being made. Who cares?
872.
by lvh 8y ago
We should have the safe, just-connect version of Noise; my understanding is NoiseSocket wants to be that. I disagree with the comparison you made to JOSE et al. The problem with those specs is the specification and implementation complexity
873.
by lvh 8y ago
We wrote this. Happy to answer questions.
874.
by lvh 8y ago
We wrote this, happy to answer questions.
875.
by lvh 8y ago
> .NET’s LINQ cannot be expressed in LISP That's an extraordinary claim. Do you have extraordinary evidence to back it up?
876.
by lvh 8y ago
But Quicklisp exists today. Are you suggesting testing is unnecessary or ineffective? If it is effective, why wouldn't Quicklisp use it?
877.
by lvh 8y ago
TL;DR: a terrifying amount of sites legitimately end up using these unsafe features without realizing it. The spec revisions are a little arduous, but in my experience the biggest problem is that any site big enough to start caring about CS
878.
by lvh 8y ago
So you have no idea what it was but you’re certain it’s Python’s fault?!
879.
by lvh 8y ago
OK, Wikipedia it is. Wikipedia lists C’s typing discipline as “Static, weak, manifest, nominal“, and Python’s as “ Duck, dynamic, strong since version 3.5: Gradual[4]”. > I’m not sure why evidence that “strongly typed” python in practic
880.
by lvh 8y ago
What was the root cause?
881.
by lvh 8y ago
> In fact, C and C++ are both strongly typed, but they are both memory unsafe. You are refuting my point but provide no evidence and implicitly redefine several terms in a way contrary to common usage. Is there a definition you can pen d
882.
by lvh 8y ago
The rest of the points are silly rehashes of arguments as old as Emacs v vim, but sure, let's go there too. We've done empirical research to see if this matters. Charitably, the results are "inconclusive"[0]. > The fi
883.
by lvh 8y ago
The author complains about CPU-bound performance and then mentions PyPy but claims it's ecosystem is barren enough that the point stands. This claim is presented without evidence. In practice it doesn't really show up: the cases w
884.
by lvh 8y ago
This starts off with a misunderstanding of what "strongly typed" means. Python is strongly, but dynamically typed. Static typing means you know the type of something at compile time. Dynamic typing means you don't. The upside
885.
RCE vuln in gddo (Go docs hosting)(groups.google.com)
1 points by lvh 8y ago|0 comments
886.
by lvh 8y ago
I love that Sen. Wyden was able to articulate accurately _why_ Wireguard matters. I have no idea to what extent they wrote the letter and to what extent they understand its contents, but I feel for a US Senator this is what trying looks lik
887.
Sen. Ron Wyden Asks NIST to Consider WireGuard to Replace IPSEC and OpenVPN [pdf](wyden.senate.gov)
5 points by lvh 8y ago|1 comments
888.
by lvh 8y ago
There is no doctrine of stare decisis in EU courts. Case law is not binding. Further complicated by the huge number of courts that might hear a case, dependent on the DPA.
889.
by lvh 8y ago
Apparently 465 is only for mail submission, not MTA-MTA -- but of course that still leaves the obvious questions of a) why? b) if it must be a different port, why not make that TLS-only?
890.
by lvh 8y ago
True, but the underlying question is still interesting: why isn't there a similar TLS-only port for MTA-MTA and we all agree to try to connect there first
891.
by lvh 8y ago
Ah! I figured out the underlying reason: in the default configuration the PSK isn't per-peer-pair, it's per server. That makes a ton more sense! You get to keep the relatively simple key distribution mechanism, keep identity despi
892.
by lvh 8y ago
This uses HIBP for the underlying dataset. I'm not sure what's added though. Convenient UX? They claim to only send anonymized data out, but HIBP already supports the underlying hash range queries -- that doesn't appear to b
893.
by lvh 8y ago
I think (from issue tracker spelunking) PBKDF2 got added in because at some point the PSKs weren't very strong and intended to be human-transmittable. They're still in the transport protocol. I'm not sure why, but I guess for
894.
by lvh 8y ago
FWIW: I followed up on the "slapping both modes together" part: if you assume both parts work individually, PBKDF2's them together as part of the transport rekeying: https://github.com/oxy-secure/transpor
895.
by lvh 8y ago
Hah, OK then :-) I figured there might be a unit-testy reason or something -- where you can temporarily disable panics and patch out process exits. Thanks!
896.
by lvh 8y ago
If anyone knows rust better than I do: https://github.com/oxy-secure/oxy/blob/571ef12199f8b0f3eca55... What is the point of panic! after exiting the process?
897.
by lvh 8y ago
Something else I didn't understand until I read the code: I couldn't figure out why the ephemeral key would be Ed25519. Turns out it's not, that's probably a typo: https://github.com/oxy-secure/oxy&#
898.
by lvh 8y ago
I get the general argument, but the spec doesn't really try to make that case. The default knock and PSK are (PQ) tiny: they appear to be 20 base32-encoded bytes or 96 bits of entropy. If they were being used in the same sense as Wireg
899.
by lvh 8y ago
I haven't audited the code, but did take a peek at the protocol. Nothing obviously busted from the description, but there are definitely some weird design choices. https://news.ycombinator.com/item?id=17393780
900.
by lvh 8y ago
Great to see protocol versioning over negotiation. I don’t think replacing OpenSSH is as important as wireguard replacing OpenVPN but it’s up there. Protocol tasting notes: - If you’re going to dole out PSKs, why care about signatures? If y

More ›