minitech

25 ms·

301.
by minitech 6y ago
Small typo spotted: big data and *its impact
302.
by minitech 6y ago
Not really correct for JavaScript (among others). All modern implementations optimize repeated appends in cases like this. They all have ropes, too.
303.
by minitech 6y ago
What do you mean “didn’t begin to swap”? It should always be using swap. It starts locking up when you run out of both swap and RAM (because it’s run out of things to swap out that aren’t critical to what’s currently running). What it fails
304.
by minitech 6y ago
Yep! If you’re using file capabilities (setcap), it doesn’t look quite like that – you use setcap on the file separately, and then nohup when running it. You should probably run production services using something other than nohup, though,
305.
by minitech 6y ago
> How do you do that if you're not root? > And if you are building an executable with that capability, how do you enable your Makefile to set it? The goal is to bind without passing through root, not to never have root at all, so
306.
by minitech 6y ago
> If the server is compromised they don't need to use meltdown/spectre to do damage since servers need root for everything useful (open port <1024)?! - there are lots of useful things you can do without root - you don’t need
307.
by minitech 6y ago
It’s a big deal regardless of whether documents or code are being stored. Cloning a repo should not open you up to RCE.
308.
by minitech 6y ago
Well, I clone repos to inspect code all the time, and when I run code, it’s usually not with the same permissions as the corresponding `git clone`. Maybe I should be better about sandboxing Git…
309.
by minitech 6y ago
There is a huge difference between “clone a repo” and “clone a repo and run code from it”.
310.
by minitech 6y ago
Some side notes: - The readFileSync in this benchmark has UTF-8 decoding (produces a string instead of a Buffer). That’s why it’s slower; not sure why it’s included. - The first guess/suggestion, > I suspect the cause is right here:
311.
by minitech 6y ago
> I believe it takes 72 TERAWATTS running for 10 minutes to mine one bitcoin. Some corrections: - 10 minutes per block, not per bitcoin (block reward is currently 6.25 bitcoin) - it’s more like 14 GW, not 72 TW
312.
by minitech 6y ago
In theory, sure. In practice, nobody does, and length prefixes stop a format like that from being conveniently writable with a plain text editor.
313.
by minitech 6y ago
Text is the problem, here and everywhere else. Text encourages looking for delimiters, escaping, and flexibility (optional whitespace, case insensitivity, leading zeros, redundant signs, newline style compatibility). Compared to binary wi
314.
by minitech 6y ago
They wouldn’t steal the cookie, they’d just have the script send the requests as the user directly.
315.
by minitech 6y ago
> Does anyone else get the same feel from Wayland as from WebExtensions? Yes, in that it’s another much-needed security and architectural improvement. (Bootstrapped Firefox extensions were a huge pain to build.)
316.
by minitech 6y ago
> Eventually you containerize the container and realize that only a single if is enough for everyone. You either have a typo somewhere or are not being very clear. Either way, keep editing.
317.
by minitech 6y ago
“install” and “execute later” don’t always involve the same permissions. If you apply restrictive sandboxes your code, package managers that aren’t designed to be able to download untrusted code are annoying. Of course, this problem isn’t u
318.
by minitech 6y ago
The relevant “ends” in end-to-end encryption are usually clients, and that’s the case here.
319.
by minitech 6y ago
I’m not going to install it to check, but when someone writes “Fast datetime parser for Python written in Rust. Parses 10x-15x faster than datetime.strptime.” it seems reasonable to assume that this is not the case.
320.
by minitech 6y ago
No risks analogous to the ones detected by those tools exist for encrypted messages.
321.
by minitech 6y ago
> and not backdoored. Are you saying that Signal is backdoored? Evidence?
322.
by minitech 6y ago
I think they’re referring to the encryption. Group chats can’t be encrypted end-to-end, direct messages aren’t by default, and the direct messages that are encrypted (”secret chats”) aren’t available on the desktop client.
323.
by minitech 6y ago
Discord doesn’t need to be bought by Google to be a huge privacy concern. No end-to-end encryption or even claims to not read direct messages, closed source, third-party clients are banned…
324.
by minitech 6y ago
Compared to saved passwords in terms of usability: it adds extra steps, potentially several, which is annoying. Compared to passwords in terms of security: you have to consider that the client visiting the link might not be the client with
325.
by minitech 6y ago
numpy doesn’t get sent to the client if you use it on the server. > JavaScript frontends are becoming unnecessarily bloated
326.
by minitech 6y ago
It’s just a newer Firefox default that wasn’t applied to old installations, and you can turn it off right at the top of about:preferences (”Ctrl+Tab cycles through tabs in recently used order”). The first thing I turn off with every install
327.
by minitech 6y ago
s/CORS/Lack of CORS/, but you can probably tell from my comment as a whole that I was covering exactly what you’ve just mentioned. Forgetting CSRF protection and Host header checks are exactly the kinds of things developers w
328.
by minitech 6y ago
Both of those requests can be sent. CORS just stops the response from being read. It’s up to web servers on localhost to assume they’re at just as much risk as any other non-local service, and they often fail to do so. (See also DNS rebindi
329.
by minitech 6y ago
> So because there are illegal videos on other platforms, they should be allowed on PH And this is called a “straw man”!
330.
by minitech 6y ago
Correct, and I’m taking those into account when saying “extensions shouldn’t even try to do this”.

More ›