peanut-walrus

8 ms·

61.
by peanut-walrus 1y ago
1. There is no requirement to make it impossible to determine which transactions someone has made, in fact, quite the opposite. 2. Transactions get rolled back all the time for various reasons. 3. The global digital financial system is a re
62.
by peanut-walrus 1y ago
Ok, but we can all agree that even 6% constant CPU usage is way too high for a note-taking app, right?
63.
by peanut-walrus 1y ago
The responsibility ended up with payment processors and other financial institutions because otherwise they would be forced to give access to all their customer / transaction data to governments and law enforcement. I really wish we ha
64.
by peanut-walrus 1y ago
Huh weird, usually top 3 results are "sponsored" links serving malware.
65.
by peanut-walrus 1y ago
My favorite one I've seen is "open redirect when you change the domain name in the browser address bar". This was submitted twice several years apart by two different people.
66.
by peanut-walrus 1y ago
Three points: 1) Even the obvious claims (and often especially these) deserve scientific verification. 2) Most people are dumb is not because they are missing the relevant information, but because they are failing to act upon the informatio
67.
by peanut-walrus 1y ago
Downdetector does not actually monitor the services. It aggregates user reports from socials etc. For large-scale incidents, the reports get really noisy and it will show that basically everything is down.
68.
by peanut-walrus 1y ago
Downdetector in incidents like this is 100% misinformation.
69.
by peanut-walrus 1y ago
REST has for a long long time meant "rpc via json over http". HATEOAS is a mythical beast nobody has ever seen in the wild.
70.
by peanut-walrus 1y ago
No. Real life rarely has natural keys that are unique and do not change. For example the national id number in several countries can change in some circumstances...and that is already a synthetic key.
71.
by peanut-walrus 1y ago
As someone who has been working in security for past 10 years and systems / network admin for another 10 before that, I don't even know what a firewall is supposed to be any more. Also, since I've worked on military systems a
72.
by peanut-walrus 1y ago
Oops your developer accidentally enabled logging for headers. Now everyone with access to your logs can take over your customer accounts.
73.
by peanut-walrus 1y ago
The core design for producer/broker/consumer certainly is. All the logic is on the ends, broker just makes sure your stream of bytes is available to the consumers. Reliable, scales well, can be used for pretty much any data.
74.
by peanut-walrus 1y ago
So it's cheaper *on AWS*. Any cloud provider where cross-AZ traffic is not $$$, I can't imagine this architecture being cheaper. Engineering solutions which only exist because AWS pricing is whack are...well, certainly a choice. I
75.
by peanut-walrus 1y ago
Object storage for Kafka? Wouldn't this 10x the latency and cost? I feel like Kafka is a victim of it's own success, it's excellent for what it was designed, but since the design is simple and elegant, people have been using
76.
by peanut-walrus 1y ago
CAA account binding is basically this. Not cryptographically verified but similar idea that the CA confirms you possess a secret (account) before issuing. https://www.rfc-editor.org/rfc/rfc8657
77.
by peanut-walrus 1y ago
What? When was the last time you had to bypass a cert warning because of "CA store wars" (whatever that means)? What examples can you give for public CAs giving certs to "whatever"?
78.
by peanut-walrus 1y ago
Wouldn't using relative chords simply show that 99% of songs use the I chord? :)
79.
by peanut-walrus 1y ago
So the assumption here is that somehow your private key is easier to compromise than whatever secret/mechanism you use to provision certs? Yeah not sure about that one...
80.
by peanut-walrus 2y ago
I for one did encounter exactly this problem when configuring a list of countries via ansible for geoip whitelisting.
81.
by peanut-walrus 2y ago
I hate this article. There are so many obvious and glaring problems with the current US administration, there is no reason to reach for these kinds of straws. With the amount of leaked and hacked data out there - almost everyone who is acti
82.
by peanut-walrus 2y ago
We use them. The product is genuinely great and I hope Google doesn't mess with it. For us they replaced a bunch of different tools and a hodgepodge of custom scripts and hacks. For those who have not heard of them - it's basicall
83.
by peanut-walrus 2y ago
By far the most logical default behavior to me is that if the issuing CA was valid and trusted when the cert was issued, the cert should be considered valid until it expires. This of course means you need a trusted timestamping service or I
84.
by peanut-walrus 2y ago
Do those change during program runtime though? I don't think many people have problems with global constants.
85.
by peanut-walrus 2y ago
Screen recording and processing because it's easier than just scraping now is wild.
86.
by peanut-walrus 2y ago
Yeah, it sucks, but that's the way it is. It is super common for bug bounty findings to be ignored or downgraded unless you show actual code exec on their machines or dump some of their creds.
87.
by peanut-walrus 2y ago
Yeah, this is at least being discussed now for eID. Getting it to a point where it is actually usable for everyone and trusted by everyone will not be easy though. But even in the best case, this would cover maybe 5-10% of internet users in
88.
by peanut-walrus 2y ago
The problem is that any solution so far proposed for this is very privacy-unfriendly. For example, Google proposed https://github.com/explainers-by-googlers/Web-Environment-In... and this was shot down by privacy advoc
89.
by peanut-walrus 2y ago
Ok, what does the venn diagram of: 1) People who anonymize their IP, use Linux, a browser with noscript, etc 2) People who are OK with having a government issued digital id and having to use it to access the internet ...look like, in your o
90.
by peanut-walrus 2y ago
Even in the case of gmail, which is the best case, you can not be sure the person in control of the Google account is the same as the one that used that gmail address to create an account on your site. The person might have got their Google

More ›