md_

50 ms·

541.
by md_ 6y ago
Sure, I agree that RPs should not use attestation in most cases. (Enterprise use—where the company has issued specific hardware to clients—is an obvious exception.) Vanguard, for example, only trusts Yubico keys, and it's a pain in the
542.
by md_ 6y ago
That's cool. Either I haven't seen this before or I've forgotten. :) I do think (as I said elsewhere here) that ultimately people will adopt WebAuthn via their browser/OS vendor. Support is widespread! But for relying pa
543.
by md_ 6y ago
Platform support isn't exactly the problem. Apple, Microsoft, and Android all support WebAuth ( https://blog.mozilla.org/security/2019/03/19/passwordless-we... , https://webkit.org/blo
544.
by md_ 6y ago
Mostly agree with a lot of this, but it's a little unfortunate to lump all WebAuthn authenticators together. WebAuthn keys--physical dongles you plug into the USB port--are indeed problematic for the reasons the author notes. (A small-
545.
by md_ 6y ago
Which details? :) E2ee messaging is used by billions. Without talking details, it’s hard to know what about the status quo we wish to improve.
546.
by md_ 6y ago
So is this better viewed as a replacement for enterprise messaging?
547.
by md_ 6y ago
IETF isn't disinterested in solving the spam problem. If that were true, why would they have published multiple RFCs to fight spam?
548.
by md_ 6y ago
PGP is incompatible with both forward secrecy and metadata secrecy. If you only want to keep your message body confidential (or authenticated), PGP is reasonable. But it provides a strictly lesser degree of secrecy than modern e2ee messagin
549.
by md_ 6y ago
As someone fairly well-versed in the email ecosystem, I don't understand this proposal, like, at all. - Is it even federated? It seems like not--it seems like it's proposing a protocol for organizations to use to run their own mes
550.
by md_ 6y ago
Hmm, the value proposition of MNM here (in preventing phishing) seems to derive from the design goal of not allowing arbitrary content on first contact between arbitrary users, or do I misunderstand? This strikes me as a cure worse than the
551.
by md_ 6y ago
Signal does have reproducible builds: https://signal.org/blog/reproducible-android/
552.
by md_ 6y ago
Thanks! “Stolen or searched” isn’t a very specific description. Does the attacker have the screen lock? Or is the screen unlocked but they don’t have the screen lock factor? Does the attacker have the ability to inject code into the running
553.
by md_ 6y ago
I'm super curious if someone can explain the threat model here in more detail. Some of these mitigations seem reasonable, some reasonable-but-very-esoteric, some mostly unreasonable. But maybe I am misunderstanding. Going through the f
554.
by md_ 6y ago
Is it a bug? Arguably, everything here is working as intended.
555.
by md_ 6y ago
I don’t really buy that. USD is still sufficiently used (in cash) in high denominations. Reducing that usage to the point that it deters counterfeiting would presumably reduce the impact of the dollar globally, which is likely against the U
556.
by md_ 6y ago
I don’t understand why using USD results in an import economy. There’s nothing that stops dollars from circulating domestically, is there? I was suggesting it reduces the government’s ability to apply monetary policy, but that’s a bit diffe
557.
by md_ 6y ago
Why is #1 a goal? I’m assuming because of some desire to maintain the independence of a central bank in the occupied country?
558.
by md_ 6y ago
I really don’t know more on the subject than Graeber writes. He describes it as a fairly regular occurrence in some societies, associated with upheaval (like citizens getting angry about overburdening debt or a new regime wanting to ingrati
559.
by md_ 6y ago
Ah. In that case, I misunderstood you. :) Yes, practically, Graeber is not suggesting consumers go out and take on debt willy nilly. He's suggesting rather that we stop moralizing the issue of debt. The religious connotations of debt a
560.
by md_ 6y ago
> Personal debts aren't like government debt, they need to be repaid. Why? Serious question. Do you mean this morally (like, "you gave your word"), practically ("if consumers defaulted in high numbers, it would cause
561.
by md_ 6y ago
I'm reminded of David Graeber's writing in "Debt". Apologies for the long quote; I find the whole text goes together, and I can't see what part can be edited out. Graeber writes: All these moral dramas start from th
562.
by md_ 6y ago
Thanks!
563.
by md_ 6y ago
I don't know. That seems oddly zero sum to me (which is why I alluded to it before). It suggests that there never are real productivity gains—in the sense that any resultant wage increases are followed by compensatory inflation. Yet ev
564.
by md_ 6y ago
I don't totally follow. Your comment about increasing the price on old things seems like a reference to Giffen Goods? But the actual existence of such goods is somewhat unverified/contentious, I understand. One shouldn't assu
565.
by md_ 6y ago
I think in that link they're just using US Census data, which uses fixed thresholds. You're right that rural costs of living are lower. Unfortunately I don't see any good data adjusting for this. Nonetheless, the idea that ru
566.
by md_ 6y ago
Developing countries also tend to have faster economic growth than "vanguard" countries. This can be explained by the fact that for developing countries, productivity growth is driven in part by importing of existing technology an
567.
by md_ 6y ago
> What we see now (compared to say 1980s): almost no major corps offering pension, inflation to the point where both Husband and Wife need to work in order to just afford a property and perhaps a kid, creeping fees/charges (cellphon
568.
by md_ 6y ago
Hmm, the poverty rate in rural America is almost the same as in urban ( https://www.brookings.edu/testimonies/the-changing-geography... ). The broad trends in union membership, financial insecurity, and income and wealth
569.
by md_ 6y ago
Are you agreeing or disagreeing with the premise of the article?
570.
by md_ 6y ago
I forked Python “newspaper3k” and hacked bits of it to work better on sources I like.

More ›