md_

23 ms·

211.
by md_ 5y ago
Ugh. Thanks! :)
212.
by md_ 5y ago
No. The “famous” cases of hyperinflation—Weimar Germany, Argentina, etc—all come with extraordinary political instability as well. I’m not an economist, but it seems to me safe to say that hyperinflation is as much a political phenomenon as
213.
by md_ 5y ago
In May 2020, the definition of M1 changed to include savings accounts that were previously excluded. If you look at the “old” series it’s _much_ less alarming: https://fredblog.stlouisfed.org/2021/05/savings-are-no
214.
by md_ 5y ago
No. Also, bootcamps don’t turn out experienced senior engineers or talented managers. If you’re really good at that, grow your leadership and management skills—those are rarer and more valuable than your ability to hack JavaScript.
215.
by md_ 5y ago
I don’t think that’s necessarily true. Do I trust ProtonVPN’s free tier less than I trust a random access point named (say) “NYC Free WIFI”? I would say no: I know who ProtonVPN is, and I’m only trusting them, not all their other users. I a
216.
by md_ 5y ago
As I said to the other reply, I was thinking “that you host yourself” (i.e. Algo) when I wrote this. That said, I think this is a bit too absolute. ProtonVPN has a free tier, for example, and they’re seemingly a legit company (who make thei
217.
by md_ 5y ago
This is what I use when: a) I'm traveling b) I remember to turn it on c) I'm not blocked by the wifi (which is common) IOW, while Algo is great, and I'm pretty paranoid, "distrusting public wifi" is sufficiently far
218.
by md_ 5y ago
I meant like Algo. My point was only that the threat here is so small as to not be worth spending real money to mitigate it. But I'm being a bit tongue in cheek--most users are not going to want to set up Algo. And you're right th
219.
by md_ 5y ago
Private Relay DNS appears to be a default (at least on my device).
220.
by md_ 5y ago
Doesn't Android do DoT by default? And iOS does iCloud Private Relay by default?
221.
by md_ 5y ago
It's not a "yes/no" answer. If you're visiting http:// sites, if your OS doesn't use DoH/DoT, if you have unpatched vulnerabilities exploitable by same-subnet attackers, then maybe it's da
222.
by md_ 5y ago
I do think the author is correct to imply that there's substantial survivorship bias when people talk about US market returns over the 20th century. (A stronger statement than the author makes: the causality is bidirectional; strong
223.
by md_ 5y ago
It’s a little odd to me that the author hopes FIDO keys as a single factor is rare. This is explicitly supported by FIDO and Yubico, and available in the Microsoft ecosystem ( https://support.microsoft.com/en-us/windows&
224.
by md_ 5y ago
In any sufficiently long discussion of PGP’s merits, it becomes obvious that those arguing for PGP are not motivated by a desire to keep communications confidential, but, rather, to justify use of PGP. So, why not just use Signal or WhatsAp
225.
by md_ 5y ago
It feels like you’re arguing that, technically, GPG _can_ be used to achieve the same level of security as modern messaging platforms. That’s probably true. (I say “probably” because I’m not a cryptographer, so I’m not qualified to speak to
226.
by md_ 5y ago
> Sounds like poor security if their client isn't doing the encryption, not an issue with encryption itself. Regardless, the point of encrypting email isn't to worry about what happens on the receivers end. If the receiver mess
227.
by md_ 5y ago
Yeah, I think that’s fair. As a nerd, it does seem to me like I should be able to give the bank a public key and let me worry about my own security. But I don’t think this is actually what the bank or the user wants—they don’t want encryp
228.
by md_ 5y ago
OMFG. This is the sort of thing that makes people not want to use PGP. "It's totally easy to get PFS with PGP. You just have to read my 1000-word blog post about manually creating and distributing subkeys and be super careful you
229.
by md_ 5y ago
The other person replying already pointed out why this is an apples-to-oranges sort of argument, but for one specific point: > There is no technical reason that you can't do forward secrecy for PGP. There is simply no real need for
230.
by md_ 5y ago
IMAP with OAuth is standard. What am I missing?
231.
by md_ 5y ago
App passwords are not limited in scope, AFAIK.
232.
by md_ 5y ago
You can use XOAUTH with IMAP just like any other IMAP client (including Thunderbird, as I noted above).
233.
by md_ 5y ago
I think that’s the biggest problem, but there are others. Off the top of my head: - PGP key discovery is hard to do securely. Do you just trust what’s on the public keyserver? Do you use RFC 7929? S/MIME is relatively better in this re
234.
by md_ 5y ago
> Google, not the Thunderbird team, are to blame for why your Gmail password is the same as your Google Vault password… Hmm, but couldn’t third party developers just use OAuth instead? Thunderbird works with Google’s standard XOATH Oauth
235.
by md_ 5y ago
The nice thing about FIDO is that I can use the same USB key for a bunch of different websites. I have a single key on my keyring, and I use it for Github, for my brokerage, for Gmail, for my work, etc. And the reason I can do that is becau
236.
by md_ 5y ago
> People love wireguard for its simplicity because it doesn’t use certs and PAKEs and whatnot. I don't know of a VPN that uses PAKE, so I don't get this comparison, but whatever. My point about certs was that OP was effectively
237.
by md_ 5y ago
It depends a lot on the situation. I think it’s reasonable, for example, for banks who have different liability standards depending on how transactions are authenticated to require batch attestation. But like I said, most consumer IdPs aren
238.
by md_ 5y ago
Which part was knee jerk? I read everything on the (minimal) webpage. It doesn’t explain anything of substance, nor does it anticipate the (obvious) issues other commenters here noted. It’s like the author just proposed to remove everything
239.
by md_ 5y ago
But then what's it actually demonstrating? That public key cryptography can be used to...validate that someone has a private key? I feel like I knew that already. ;)
240.
by md_ 5y ago
I think if I'm being generous, the proposal is to eventually have a credential management ecosystem (with cross-device key syncing, and keys per origin) similar to WebAuthn. However, if you do this, you rapidly start to discover some o

More ›