lvh

22 ms·

181.
by lvh 6y ago
The REPL in Clojure (and other Lisps) is far more tightly integrated with your editor environment. When I wrote python, I would do what you're describing: test something in (i)python, write some code, rinse, repeat. With Clojure, I Wri
182.
by lvh 6y ago
The REPL in (Lisp) driven development is generally attached to your editor, not like irb or ipython or whatever: so the thing you're building is either the resulting function, or something that mostly looks like a test already anyway a
183.
by lvh 6y ago
TL;DR: Clojurists Together outgrew its previous digs (at the Software Freedom Conservancy) and we're our own legal entity now. I'm the president of the new foundation; happy to answer questions here.
184.
Clojurists Together Foundation(clojuriststogether.org)
3 points by lvh 6y ago|1 comments
185.
by lvh 6y ago
Both are true, but usually that means the latter. Clojure was designed to make it as easy as possible to rub a little bit of parens on an existing (JVM, though now also other platforms) project. That means being a hosted language that embra
186.
by lvh 6y ago
> Clojure's main shtick (at least its main influence on me) is a combination of image-oriented programming (that is a live REPL that lets you edit a program you're writing on the fly without needing to restart the program) with
187.
by lvh 6y ago
It's really neat to be able to empirically verify this. If you watch Rich Hickey's talks, especially Spec-ulation, you'll see this deep commitment to compatibility and progress through growth. This is exemplified by Clojure i
188.
by lvh 6y ago
98point6 is a Latacora client. "... primary care as easy as googling something, without needing to make a financial tradeoff" is a great way to put it; their product is one of the best in the market (and I'm not just saying t
189.
by lvh 6y ago
The submitters are different people. Are you suggesting they're sockpuppets?
190.
by lvh 7y ago
We bootstrap security teams in a long-term engagement. We staff bug bounty programs, but do not bill for that service separately. If a client uses H1 and pays them for triage, it fairly straightforwardly removes a cost for us. The bug bount
191.
by lvh 7y ago
(Full disclosure: I am the Latacora person quoted in the article. While I didn't coordinate my quote w/ Latacora and speak only for myself, I've documented elsewhere in the comments[0] why I think the idea that Latacora and b
192.
by lvh 7y ago
I'm quoted in the article, so I feel I should point out I didn't coordinate w/ Latacora, and am speaking for myself only and I largely agree with most of what Thomas says here. To summarize, my argument is: - Bug bounties are
193.
by lvh 7y ago
I'm quoted in the article. I was not paid for it. I am a practitioner, and I believe what I am saying. Which, to reiterate succinctly, is: - Bug bounties are a waste of time and money for most startups, because you will drown in nonsen
194.
by lvh 7y ago
Sure, use Ed25519 keys, but their cryptographic strength and convenience are only some of the reasons: they also enforce the new style OpenSSH key format (which should be the default in current releases of OpenSSH, after we released that ra
195.
by lvh 7y ago
That's mostly the case now, but that's a much more recent development than Wayland on the desktop becoming popular. Also, pipedrive gives you the plumbing, but you still need the portal API. My understanding is everyone more or le
196.
by lvh 7y ago
Whoa, that's awesome! I tried to get the same thing working with ffmpeg, a la: ffmpeg -device /dev/dri/card1 -f kmsgrab -i - -vf 'crop=4096:2160:0:0,hwmap=derive_device=vaapi,scale_vaapi=w=4096:h=2160:format
197.
by lvh 7y ago
Right, I figured capturing is the big ticket item, and that most people wouldn't care what OBS itself runs on. Is there a reason to care about it running on XWayland other than being able to say you don't need X at all anymore? Wo
198.
by lvh 7y ago
If you're running a modern Linux desktop you're probably running Wayland, and screencasts on that have long since been a complete pain in the neck with per-compositor "solutions" that mostly don't work quite right.
199.
by lvh 7y ago
If you just change the audience field, the signature will be invalid, so it might tell you the SP won't accept a bad signature, but it doesn't tell you that the SP would accept a correct-signature-for-wrong-audience assertion. And
200.
by lvh 7y ago
OK, but my question was specific. You appeared to hint that anything that doesn't do audience validation is so horribly broken that it's unusable. That's not only very different from my experience (audience confusion, and par
201.
by lvh 7y ago
Are you suggesting that there are "levels of broken" here, where an application that doesn't do audience validation will almost certainly screw up group membership assertion?
202.
by lvh 7y ago
SAML typically uses RSA-OAEP or RSA-PKCSv15 for KEM. You usually get the cert from that from the SP (since otherwise you hold the private key), so I'm not sure how that goes sideways. The SP might still use the same encryption keys for
203.
by lvh 7y ago
The use case in the article is enterprise login to a bunch of services. It's hard enough to get them to do SSO, you can't seriously suggest you're going to get them to implement bespoke schemes?
204.
by lvh 7y ago
The article provides examples of the IDP providing using different _IDP identities_ but I couldn't find an example of it suggesting different _user identities_. The problem is the SAML assertion is effectively a bearer token, which is
205.
by lvh 7y ago
Sure, but two reasons that's not quite optimal and you might not want to do that in practice: 1. This tells you the SP is broken; just using individual keys means that doesn't matter anymore if the SP is broken or not. Individual
206.
by lvh 7y ago
This is not an outlandish thing to ask of your security auditor _for your own app_. (It's something we do for clients.) The challenging part is doing it for vendorsec, when you are vetting _other apps_. The timelines that stakeholders
207.
by lvh 7y ago
Good point--you're talking about the embedded handset or something else? That said, as you hint at: not quite the same thing from a threat model perspective :)
208.
by lvh 7y ago
You can send faxes to someone without the telco running a local webserver on your fax machine, and you don't run thousands of other applications on your fax machine, and your fax machine doesn't usually come with a nifty record fe
209.
by lvh 7y ago
Atlassian is an Australian company, headquartered in Sydney, though the current plc is legally in the UK. (I have no idea if that means they're bound by said backdoor law.)
210.
by lvh 7y ago
The Security Rule and Transmission Control Standard mention encryption, but as Addressable, not Required, if memory serves. That means you have to do it if it's "reasonable and appropriate", and in this context they just mean

More ›