lvh

25 ms·

211.
by lvh 7y ago
A BAA is a Business Associate Agreement. It's a standard HIPAA document where an entity with PHI (typically a Covered Entity, which is an entity specifically mentioned by HIPAA, such as e.g. a healthcare facility) effectively puts a ve
212.
by lvh 7y ago
Text _segment_ size. That's executable instructions; presumably it makes a bit more sense that Google would have a binary with 300MB worth of instructions laying around.
213.
by lvh 7y ago
How do you currently host your Docker container at edge nodes? (It's a facetious question: unless you're a $100B company you're not doing anything of the sort.)
214.
by lvh 7y ago
This basically bumps the amount of behavior you can stuff into the edge by several orders of magnitude. Previously, Lambda@Edge will like, maybe validate a JWT. Now, you can put like half your app in there. It sounds like a tiny incremental
215.
by lvh 7y ago
I'm so glad you've launched. I loved the entire thing every time you've explained it. Absolutely chuffed to see Wireguard and Firecracker getting deployed "in anger". Tensorflow@Edge sounds like the good kind of ban
216.
by lvh 7y ago
It's true that the factor between RMS vs peak-to-peak is different for e.g. a sine vs a sawtooth wave, but for other waveforms its still a constant (just a different one), and for this engine it should be just about a sine wave anyway.
217.
by lvh 7y ago
Saying it was just for phones is your quote, so I think your reaction is a little misplaced. If you don’t want people to tell you what Jamf Pro does then maybe don’t make being wrong about your what Jamf Pro does part of your argument. (Plu
218.
by lvh 7y ago
Wait, I can't find Love Actually and Say Anything in the post. Are you talking about a draft?
219.
by lvh 7y ago
I'm guessing we have a different opinion on what "competing solutions" or "accurate user <-> device attribution" or "setting up an LDAP server" mean. I'm sure there's a version of this stor
220.
by lvh 7y ago
> And what's with the JAMF pro recommendation? MDM is more than iPhones JAMF Pro is not just for iPhones.
221.
by lvh 7y ago
Maybe! Generally, I get the impression auditors haven't changed their tune much, and we've seen success with people ELI5ing controls and why they are good. For malware in particular, on the server side, we've seen: a) auditor
222.
by lvh 7y ago
I feel like that's recognized in the article: we even point out that anti-malware is one of the few (technical) things the AICPA criteria do care about. The point is not that you need SSO, the point is that it is _much simpler_ to demo
223.
by lvh 7y ago
Maybe! I get the impression there are definitely plenty of people have bought SOC2s the way they also buy pentests: "I'm spending $X0,000 today so I can close $X00,000 in sales tomorrow". Which of course, we as security peopl
224.
by lvh 7y ago
Thanks! Just fixed that.
225.
by lvh 7y ago
I have no problem with Fleetsmith and sure Jamf ain't perfect but... just to restate your point briefly: you're claiming "show inventory, turn on FDE, don't fuck up XProtect" are "very time-intensive efforts&qu
226.
The SOC2 Starting Seven(latacora.singles)
109 points by lvh 7y ago|65 comments
227.
by lvh 7y ago
Wait: whenever I've used OpenSCAD I get polyhedral approximations, not actual spheres/cylinders/etc. You can pump up the resolution but that quickly kills performance and obviously doesn't solve the underlying issue. How
228.
by lvh 7y ago
Something I really want is the ability to write code to produce exact curves exportable via STEP, so I can get them into Fusion 360, which is what most CNC (e.g. the Shopbot PRS Alpha) prefers to consume. Imprecise polyhedra approximations
229.
by lvh 7y ago
Absolutely. It took a long time for everyone to catch up on basic features (Closure had modules figured out while the rest of the JS community still had several competing standards), but it’s still tremendously effective. The only downside
230.
by lvh 7y ago
Major IdPs tend to provide an endpoint where you can send them the JWT, they validate it and return its contents as a plain JSON response. You're effectively trading JWT parsing for HTTPS. They can't walk JWT back now without brea
231.
by lvh 7y ago
You don't appear to have engaged with my core point: policy is not access control.
232.
by lvh 7y ago
The guide does do that, but, regardless: like a lot of acronyms, they've become terms of art and spelling them out is not instantly helpful to people who have used SAML before the way that say, spelling out "ICYMI" or "F
233.
by lvh 7y ago
I agree with all of this (no wonder since Thomas' opinions and mine largely come from the same place), but dark horses like Kelby Ludwig's canonicalization bug make me even happier if I can outsource that infrastructure to a vendo
234.
by lvh 7y ago
Even if we stipulate that's true: that's precisely my point, nobody has built the tooling to make any of it good, but companies need a reasonable access control story today.
235.
by lvh 7y ago
They don't need to take a corporate device with them. They need to have exfiltrated a credential during the (long) time they had alone with the laptop. You trust new employees' phones the way you decided to trust anything else: a
236.
by lvh 7y ago
The OIDC "id token" is a JWT that contains identity assertions, just like SAML would. You can go fetch the profile via HTTP, but that's mostly because major providers have quietly conceded that JWT is a nightmare, and encoded
237.
by lvh 7y ago
I love mTLS a lot more than the average bear[0], but the main reason I see companies deploy SSO is centralized access control and access management (particularly for offboarding), which client certs are only a tiny fraction of. Since they&#
238.
by lvh 7y ago
I'm a lisper and dislike XML as much as the next guy, but XML-DSig seems like a fundamental mistake and sexp-dsig would not have been a better spec. All of the problems you get from in-band signing and encryption are still there--case
239.
by lvh 7y ago
The biggest problem with SAML is probably XML-DSig. The spec is ridiculously complex, but unfortunately the implementations are no better. You're de facto either using libxmlsec1 or the Java stdlib. libxmlsec1 is (anecdotally) a terrif
240.
by lvh 7y ago
Everyone supports SAML, not everyone supports OIDC, and for everyone besides GSuite SAML is absolutely still the default even from the IdP side. There's a subtle difference where the de facto best practices deployment for SAML includes

More ›