pfg

64 ms·

631.
by pfg 10y ago
> EU turnout makes the American midterms look positively Athenian That doesn't seem accurate. Turnout for the last 4 midterms vs. EU parliament elections: EU 49.5% 45.4% 42.9% 42.6% US 39.5% 40.4% 41.0% 35.9%
632.
by pfg 10y ago
I feel like the metadata collection argument is overrated here. It's a nice promise, and it's not that I don't believe them, but at the end of the day it's just that: a promise. We've got messengers with E2E crypto
633.
by pfg 10y ago
Telegram uses homegrown crypto with known weaknesses[1] and doesn't do end-to-end encryption by default (your messages are stored on their server in plain text ). [1]: https://news.ycombinator.com/item?id=10713064
634.
by pfg 10y ago
Blocking ads wasn't made illegal, just the opposite. Eyeo's business model of getting paid to whitelist ads in their ad blocking software was deemed illegal.
635.
by pfg 10y ago
I think he's referring to better support for crash reporting inside of mobile apps.
636.
by pfg 10y ago
WoSign and StartCom are actually included in all major root programs.
637.
by pfg 10y ago
Looks like CloudFlare has an API endpoint for certificate management[1], so this should be possible, though I haven't seen any tooling for this specifically. [1]: https://api.cloudflare.com/#custom-ssl-for-a-zone-proper
638.
by pfg 10y ago
You can use any custom certificate, but you'll need the Business ($200/month) plan.
639.
by pfg 10y ago
WoSign offers free certificates as well.
640.
by pfg 10y ago
From the post: > One a separate note, since we are talking about protecting intellectual property, there is no law protecting business models. When Lets Encrypt copied Comodo's 90 day free ssl business model, we could not protect it
641.
by pfg 10y ago
CloudFlare uses them for Universal SSL, so that's roughly 5% of all websites[1]. Their overall market share (in the CA business) appears to be around 40%[2]. [1]: https://w3techs.com/technologies/details/cn-
642.
by pfg 10y ago
CloudFlare's Origin CA was created exclusively for communication between CloudFlare and backend servers. I haven't seen any kind of announcement mentioning that CloudFlare has plans to operate a public CA and apply to root program
643.
by pfg 10y ago
Unfortunately, it doesn't look like they have plans to use ACME. They do have a public API (StartAPI) for issuance, which is better than nothing, but they definitely missed an opportunity with ACME, IMO. Mainly, being the first CA with
644.
by pfg 10y ago
mholt is the lead developer of Caddy[1], so it's probably safe to assume that he knows a bit about this. The goal behind the HTTPS everywhere effort isn't just to encrypt private data, but also to provide authentication for your c
645.
by pfg 10y ago
> I can understand that geolocation could be tremendously sensitive and you absolutely would want to offer the option of SSL ... but why limit it to SSL ? I think you answered your own question. ;-) > geolocation is also something tha
646.
by pfg 10y ago
> What "really cool" HTML feature requires HTTPS? There can be problems with mixed secure/insecure content, but that's more of an offsite content issue. One example would be the the Geolocation API, with more to come[
647.
by pfg 10y ago
You don't need to "open up" your internal network (the ownership validation can happen via DNS), but the hostname would be public through Certificate Transparency. Generally, if you're relying on your internal hostnames
648.
by pfg 10y ago
Not necessarily. As an example, an IoT vendor could set up a domain for their devices and delegate a subdomain to each device (basically what Plex does). They could also provide an API that allows those devices to provision a TXT record to
649.
by pfg 10y ago
Fraudulent is not usually a term that's referring to legal assessments when talking about the CA system. Various browsers and root programs are (to keep the comparison) both the executive and judiciary branch of the CA system, and if c
650.
by pfg 10y ago
It's a fairly new project (in "internet standard/security technology" years), first introduced in 2013. CT Monitoring/Auditing is basically a group effort, being most effective when everyone from domain owners, brow
651.
by pfg 10y ago
If a site uses key pinning (e.g. via HPKP), the site is in control of telling you which keys are acceptable, so there would be no way to pretend it's a routine rotation after your first site visit (unless the site is cooperating, in wh
652.
by pfg 10y ago
It's certainly possible to get a trusted certificate for a LAN-only device. DNS-based validation is your best option here. The only requirement is that you use an ICANN ("public") domain. This is not a requirement made up by
653.
by pfg 10y ago
It would certainly be considered fraudulent by all major browser vendors, possibly leading to a death sentence for the CA (i.e. root removal) in cases of deliberate misissuance or massive negligence. Key pinning mechanisms and Certificate T
654.
by pfg 10y ago
> Those should be distributed by the service providers, who are the actual trustworthy entities in the user's minds. That's what HPKP does, basically, unless I'm misinterpreting what you mean with service providers. HPKP i
655.
by pfg 10y ago
They don't have the right to ask them to pay for the software , but they have a right to dictate how their trademark can be used. They're free to distribute their software under a different name. They could also deliver an unmodi
656.
by pfg 10y ago
The same way you know (or don't) that your existing OTP app is not uploading your secret key.
657.
by pfg 10y ago
RuboCop is what most Ruby projects use.
658.
by pfg 10y ago
You can definitely run PCI compliant infrastructure on services such as AWS. Stripe runs on AWS IIRC. Many (most?) AWS services are PCI compliant and using them won't prevent you from being PCI certified.
659.
by pfg 10y ago
You can add multiple keys, so you could have a primary one that's with you and another one that's stored somewhere safe. You can also configure OTP and/or SMS-based 2FA and backup/recovery codes as a fallback mechanism.
660.
by pfg 10y ago
Not sure if I'm parsing your requirements correctly, but 1Password with Dropbox sync would work without a data connection as long as you sync the files beforehand. Works both for Android and iOS. Don't know if adding/modifyin

More ›