lvh

91 ms·

901.
Critical vulnerability in monocypher(reddit.com)
1 points by lvh 8y ago|0 comments
902.
by lvh 8y ago
It’s precise and factual, and several people have had they’re laptops replaced more than once. It is not hyperbole.
903.
by lvh 8y ago
Latacora, corpsec perspective: audit Google Groups and OAuth'd apps, run a phishing red-team exercise. Finding appsec bugs matters but maybe not so much if everyone just signs over whatever privilege apps ask for and it'll exfil w
904.
by lvh 8y ago
Yep, definitely not debating that it's overpriced and questionable value compared to KMS + storage of your choosing -- just surprised that you ended up with a model where it's nontrivial cost :)
905.
by lvh 8y ago
Replying to new content: it's true that Hashicorp tools in particular are hilariously bad at dealing with expired credentials. Terraform doesn't realize the error and just sits there banging away (retrying) forever. If this is rea
906.
by lvh 8y ago
So, concretely: $0.40/secret/month (prorated if < 1m) + $0.05 per 10,000 API calls. KMS: $1/CMK/mo + $0.03 per 10,000 requests. What are you doing with it that makes it a major expenditure? That seems like a drop in t
907.
by lvh 8y ago
You appear to be confusing aws-vault, a gratis and open source project that manages IAM credentials, with AWS Secrets Manager, a hosted AWS service that stores and manages secrets. I agree AWS Secrets Manager is overpriced but I doubt it&#x
908.
by lvh 8y ago
Where do you take Uber pool that is similarly priced to CTA?!
909.
by lvh 8y ago
FWIW: submission is not endorsement. I think there are tons of flaws in this argument. For example, they mention TLSA would have prevented this. TLSA would not have prevented this. Not only did the attackers not succeed in acquiring a TLS c
910.
Why you must learn to love DNSSEC(circleid.com)
4 points by lvh 8y ago|1 comments
911.
by lvh 8y ago
There are lots of useful changes you can make that don't break the world but do materially improve things. I already gave an example elsewhere of aws-vault. Similarly, CI/CD/code review are easy wins that not everyone has alr
912.
by lvh 8y ago
Latacora perspective, AWS specifically: go install aws-vault. https://github.com/99designs/aws-vault There are a ton of benefits to aws-vault. Strategically: getting everyone on an aws-vault workflow is step one to eve
913.
by lvh 8y ago
The cost of a blue line ticket in Chicago — a line running from downtown out to O’Hare and out west past city limits - is $2.50. If you take it every day, a monthly pass is... $120 or so? That’ll take you anywhere: buses & trains. Do yo
914.
by lvh 8y ago
Is there a metric where they’re not worse at what you’re suggesting than trains?
915.
by lvh 8y ago
An army of self driving cars doesn’t get you the density of a train when space is already at a premium, which is the case in many urban centers. Even the source acknowledges this; they just downplay how many centers it’s true for. It’s an i
916.
by lvh 8y ago
You are comparing the current state of the Blue Line against a proposed system, though. The argument is that you could improve the Blue Line significantly for $1B, and also that there's good reason to believe it's not actually $1B
917.
by lvh 8y ago
If they really are footing the bill themselves, what is their incentive to understate price? Closing deals before the real price of the actually-shipped tunnel is known?
918.
by lvh 8y ago
I'm not sure I understand your argument. On the one hand, you cite induced demand, on the other you say "cars going through this tunnel are cars off other roads". Isn't that a contradiction? Or are you saying induced dem
919.
by lvh 8y ago
Do you believe that it’ll ship and the on-paper cost will be 0? Or that even accounting for operations and externalities it’ll be zero? (I appreciate the city wouldn’t get the profits directly, but I imagine it’ll benefit via taxes. I’m su
920.
by lvh 8y ago
The question was about endless construction delays, not limited to existing trains. My understanding of the current plans is they don’t overlap a lot with current rail lines.
921.
by lvh 8y ago
Probably less than drilling a new tunnel through all of Chicago.
922.
by lvh 8y ago
Yep, the El’s number of stops contributes greatly. Metra follows it starting Jefferson Park and Mayfair or so, and it gets to downtown a lot faster. There already are some express trains but they still have more stops than what you’re sugge
923.
by lvh 8y ago
True, but they’ve been pretty happy to expand 90 our past 94. Judging by the amount of trains on the blue line even during rush hour and the relatively tiny capacity of the proposed shuttle, we can do a LOT more with the infrastructure we a
924.
by lvh 8y ago
Detroit’s connection between airport and downtown is a complete disaster compared to either Chicago airport. A high speed rail link would make a ton more sense there.
925.
by lvh 8y ago
Chicago already has two rail systems that go in that direction. One, the CTA Blue Line, literally connects O’Hare and the Loop. The other, Metra, goes most of the way to the airport already. The El (that’s the blue line) already has absurd
926.
by lvh 8y ago
That's an argument from/with random people on the Internet, not clients. The nice thing about being around clients for a long time is that you build a working relationship with them based on mutual trust and respect. That said, a
927.
by lvh 8y ago
I think there are a few weird incompatibilities between libraries that are likely to bite you unless you have 1 library you use, but generally speaking: yes, figuring out how to structure your claims is the hard part. Most claims are really
928.
by lvh 8y ago
Securealpolitik: saying there are safe asymmetric primitives doesn’t mean that’s what’s actually deployed. As long as the spec says is P256 ECDSA it’s a pretty reasonable assumption someone is going to screw up nonce handling. (Incidentally
929.
by lvh 8y ago
FWIW, this matches my experience. Large new enterprise systems have JWT all over the place. My first pass counterargument to this is: great! You also have FAANG’s security budget and know how to find and resolve bugs like the FB OAuth2.0 to
930.
by lvh 8y ago
Re: JWT; sure, but it’s a multifaceted problem that’s more than one blog post. We’ll get there. Unfortunately, we’ve been saying most of that for years now, just because it’s not easily accessible in one place (a valid criticism!) doesn’t m

More ›