majke

78 ms·

751.
by majke 14y ago
Say that to the Tor exit node :)
752.
by majke 14y ago
Well, what about wildcard certificates? * Without SNI you know - guy A spoke to guy B, who is say facebook. * With SNI you know - guy A spoke to guy B, who is facebook, and asked for myfavouriteuniquepics.facebook.com. SNI may reveal some i
753.
by majke 14y ago
That was not my intention. I just wanted to spread the dark knowledge - there is more stuff in the unencrypted TLS handshake than most people know.
754.
by majke 14y ago
Randomizing the ciphers is not a good idea. First, their order is significant - in theory the server should pick up the first it knows. Second, limiting supported ciphers inevitably may lead to incompatibility with some websites (as they ma
755.
by majke 14y ago
Fixed. Thanks.
756.
Dissecting the SSL handshake(idea.popcount.org)
77 points by majke 14y ago|32 comments
757.
by majke 14y ago
True. Thanks for clarification. Actually, I never understood why "sticky bit" is called that way, wikipedia article gives an answer: The sticky bit was introduced in the Fifth Edition of Unix in 1974 for use with pure executable file
758.
by majke 14y ago
Relevant `unlink` attack: http://lcamtuf.coredump.cx/tmp_paper.txt
759.
by majke 14y ago
[...] the government would be able to request any service provider to keep data about internet usage, although initially it will involve about a dozen firms including BT, Virgin and Sky. I guess that includes VPN services (l
760.
by majke 14y ago
SSL does encrypt the traffic, but requested domain name is still transferred in plain text during the SSL handshake. I guess for tracking purposes remote IP and domain name would are more than enough.
761.
by majke 14y ago
And WizzAir keeps passwords in plain text. What can be done to shame them?
762.
by majke 14y ago
> While the concerns is valid, flow control looks like overkill to something where a per-channel pause control frame could do the same job with less implementation and protocol overhead. Coming from messaging world I can say: nope. "Pa
763.
by majke 14y ago
Shameless plug: SockJS[1] is a client and server library that tries to be a WebSockets poly-fill. Basically, you can start using SockJS right now, write code using WebSockets API, and replace SockJS with native websockets when they're ready
764.
by majke 14y ago
Congratulations indeed!
765.
by majke 14y ago
This seems to be done by an extraordinarily smart guy - Neil Fraser. He's behind "google-diff-match-patch" [1] project, which is AFAIK the machinery behind realtime collaboration on google docs. Definitely worth watching. [1] http://code.g
766.
by majke 14y ago
Shameless plug: SockJS is non-complex alternative to Socket.io, websockets polyfill.
767.
by majke 14y ago
That's also what I thought. But I couldn't find Raspberry Pi idle wattage anywhere, so I'm not sure if that's good or bad in comparison.
768.
by majke 14y ago
Trinity was using nmap 2.54, how lame.
769.
by majke 15y ago
<shameless plug> That's exactly what I thought and that's why SockJS is there: https://github.com/sockjs/sockjs-client a) start using SockJS b) wait until enough browsers supports it c) drop SockJS. SockJS has a we
770.
by majke 15y ago
> The difference between browser-based CSRF protections (which don't exist) What about the X-Frame-Options and Origin headers? They are browser-based mechanisms that hint server side, right? (not for the classic POST case though...)
771.
by majke 15y ago
If you think NaCL is bloated, Russ Cox's vx32 may be a lightweight answer: http://pdos.csail.mit.edu/~baford/vm/ Some of my experiments: http://www.lshift.net/blog/2010/03/31/what-has-happened-to-t... https://github.com/majek/vx32examp
772.
by majke 15y ago
Yeah, but there is not much value in installing socket.io globally, as you can't require() it. It makes sense only for executables like coffee-script http://npmjs.org/doc/faq.html#I-installed-something-globally...
773.
by majke 15y ago
That's not exactly a new idea: http://entrian.com/goto/ Jokes aside, Kay Schluehr did a package called generator_tools: http://www.fiber-space.de/generator_tools/doc/generator_tool... I used it to do iterators serialisation in Pytho
774.
by majke 15y ago
I have no clue what web servers are present in Perl world :) But seriously, writing a SockJS server is not an impossible task, feel encouraged! Here's some reference material: http://sockjs.github.com/sockjs-protocol/sockjs-protocol-0.2
775.
by majke 15y ago
> does SockJS do reconnects? No. WebSocket API doesn't do automatic reconnects. Also, it is impossible to get have it built-in: every single application will need to behave differently after reconnection! For example - you may want to m
776.
by majke 15y ago
(I'm the SockJS author.) To some extent yes: aesthetics are an important difference :) Functionally you can do the same things on Socket.io as SockJS (but not the other way around). Socket.io provides high-level messaging abstractions, incl
777.
How to compose apps using WebSockets(rabbitmq.com)
43 points by majke 15y ago|7 comments
778.
Ask YC: Good Alan Turing biography?
1 points by majke 15y ago|0 comments
779.
by majke 15y ago
Interesting comment from an influential blogger, who was fighting against ACTA since the beginning (and is also a lawyer): http://prawo.vagla.pl/node/9662 (Polish) http://translate.googleusercontent.com/translate_c?hl=en&#38... (transla
780.
by majke 15y ago
It is worth noting that this happened after 250000 signatures were gathered for the referendum about ACTA: http://translate.google.com/translate?sl=pl&tl=en&js...

More ›