msm_

15 ms·

181.
by msm_ 3y ago
I mean, do tell them that because you're right. CVEs are not broken, your auditors, security scanner vendors and journalists are. Sounds like if you replace CVEs with another system you'll get exactly the same mess.
182.
by msm_ 3y ago
You can file CVEs anonymously, but CNA don't have to assign a CVE number if they consider submission bogus. Depending on the CNA they may also verify the submission themselves or contact the vendor before assignment (usually vendor has
183.
by msm_ 3y ago
I disagree with comments being distracting. You can overdo them, but one good comment - like "baz = 1 # the default is 1 instead of 0, because most real-world production servers foobars 1s into 7s" can save days of frustration. I
184.
by msm_ 3y ago
>and they're also "buy a new phone, n00b" That's uncharitable wording. They're more like "Our main goal is providing a secure OS for your device. We can't promise that, if your device no longer receives
185.
by msm_ 3y ago
I never used Meta. Discussion platforms I use are HN, reddit, ocassionaly twitter/mastodon and online chats, like mattermost or discord. Maybe I'm currently the minority, but even now it's not true that entirety of online d
186.
by msm_ 3y ago
>tons of docker images in production that lack basic debugging functionality like... a shell That's a commendable security practice. A whole class of vulnerabilities is mitigated (and others are much harder to exploit) if you don&#x
187.
by msm_ 3y ago
I miss Flux (not flux2). It did everything I needed, and was simple to understand. It had its problems, but I feel like they could be resolved without a complete rewrite/revamp the Flux2 is. I understand the need for Flux2, but for my
188.
by msm_ 3y ago
There is a way, I've recently generated my own CA with domain name constraint, trusted it, and used it cross sign my company's self signed CA. It works like a charm.
189.
by msm_ 3y ago
It's not that bad if you just want to use/configure existing software - I often find exactly what I'm looking for by googling "[software i want to use] nixos". It gets harder when you start to write your own derivat
190.
by msm_ 3y ago
It's a great thing the "little people" don't give up on their freon. Forcing anyone to give it up - either by direct prohibition or taxation - its a totalitarian move. Honestly though, limiting harmful things and/or
191.
by msm_ 3y ago
My attempt of explanation with a (hopefully) relatable example: imagine that you store all your backup files encrypted, then restore the backup on your machine. The backup is stored on untrusted NAS but it's OK since it's encrypte
192.
by msm_ 3y ago
Because Google is a corporation, not a person. Even if Google decides to be "nice" in this case, this will be for purely selfish reasons (they decide good PR they get from paying this guy is worth more than whatever they pay). Exp
193.
by msm_ 3y ago
Interesting. I can't confirm though - I personally changed my 2FA device 2 weeks ago using a backup code. I couldn't find old yubikey that I used as 2FA for google, decided to regain access with a backup code and add my new yubike
194.
by msm_ 3y ago
You may or may not be right (I don't know enough about cryptocurrencies to know), but I think people don't like your snark. Some people lost a lot of money - they are victims of a scam. Now how much the attacker will actually earn
195.
by msm_ 3y ago
Yeah, whatever works for you. When I was at a place that did regular 1:1s, my manager always stressed that they're for me, not for the company, and if I want to change the frequency of time I should just let them know. Not sure about y
196.
by msm_ 3y ago
>Second, true it will continue on, but the error is well logged with a traceback. The thinking, I happen to agree with is that a logging error shouldn’t halt the program. And the parameters are also logged, so you don't really lose
197.
by msm_ 3y ago
Bragging a little: I successfully convinced most of the people at my org to avoid pre-formatting the logging messages. On the other hand I'm "the weird one" because I'm the one who complain about it in the code reviews a
198.
by msm_ 3y ago
It depends on the situation. There are cases when I "expect the exception" - for example anything that touches the network has a tiny chance of failing. I want to know how often this happen, because too many network errors probabl
199.
by msm_ 3y ago
>What did I expect? The "warez = trojan" thing is mainly corporate propaganda. Commercial products are just as likely to contain malware. How do you define "malware"? I'm quite sure most commercial products don&#
200.
by msm_ 3y ago
It's "just" a fixed point of the sha256's compression function, right?
201.
by msm_ 3y ago
>For example, a quarter full of high-rises, no way you can get away without expensive high-capacity subterranian trains to handle commuters Aren't trains much, much more efficient than individual transport? Compare the average urban
202.
by msm_ 3y ago
But that directive is a big success? I know which sites are trying to track me, and which do not. What's more, even less technical people know that and may make an informed choice. Way better than allowing advertisers do whatever they
203.
by msm_ 3y ago
And I basically never give my consent. I'm happy that I have that choice (assuming a site honours it, of course). This also allows me to decide which sites value my privacy (no cookie banners) and which do not (annoying banner every ti
204.
by msm_ 3y ago
In this case you might be interested in this recent post: https://news.ycombinator.com/item?id=36757542 .
205.
by msm_ 3y ago
If you ever want to have fun with setting up your own k8s, I recommend to start small. The author is already knowledgeable, so they probably knew from the start what they want, but a lot of this complexity is not essential. When I deployed
206.
by msm_ 3y ago
Honest question: why? I'm not really interested in portable scripts, usually I just want to get a job done as fast as possible and move on (for serious automation I prefer Python, shell is for more interactive use for me). Is there any
207.
by msm_ 3y ago
There's where the real fun starts. Now try to recover from this extremely restricted shell!
208.
by msm_ 3y ago
Similarly, my country is trying to get rid of a coal industry, and they absolutely pay or promise a lot of money to the soon-to-be unemployed miners.
209.
by msm_ 3y ago
>ctrl+f "abuse", ctrl+f "contact": no results What are your thoughts on abuse? From experience, your gateway will be used by phishers and malware operators. You might want to stay "hands-off" and argue that
210.
by msm_ 3y ago
You could argue for "Websites that don't validate client's WEI compliance are marked as insecure by Chrome". But that's a stretch, your version makes much more sense. The real fear is that if WEI happens, in 10 year

More ›