phicoh

39 ms·

421.
by phicoh 7y ago
That's indeed a risk. Though XMPP had to deal with a number of paradigm shifts: images, markup, audio and video calls, persistant history, disconnected operation, security, threading, multi device operation. And I probably forgot a few
422.
by phicoh 7y ago
Suppose that lots of companies have a public Matrix room where customers and potential customers can ask questions. Now lots of people start using one particular Matrix instance for that kind of communication. Now the popular instance stops
423.
by phicoh 7y ago
In the context of the metric system, the problem is that the second and the 'day' don't line up. From a human time keeping point of view, days and fractions of days would be ideal. However, actual days are nowhere close to a
424.
by phicoh 7y ago
One problem I see with XMPP is that there is a lot on isolated use and not a lot of public use. If a lot of companies would provide XMPP as a way to contact them, then what Google did would be as silly as taking email private. Instead, most
425.
by phicoh 7y ago
My experience with Matrix compared to XMPP, is that Matrix is way ahead in usabiliy. I wanted to get people to use XMPP for years, but I always found too much lacking. Matrix is not there yet, cross device signing has to land. But the way i
426.
by phicoh 7y ago
I don't see the problem. Phones often run at full (thermal) limits when they have an external power source. So, just connect an external battery pack if you want your phone to go faster.
427.
by phicoh 7y ago
In my experience, current phones are the best way to have a computer in your pocket. In past I wanted to have a physical keyboard, but I changed my mind and the onscreen keyboard is actually best. All in all, a phone is a lousy computer. Bu
428.
by phicoh 7y ago
This is described as an attack on DNS. DNSSEC protects again these kinds of attacks. If you then want to use the IP address to connect to a web server, then you can use TLS. Which, in the case of letsencrypt, again depends on DNS to prevent
429.
by phicoh 7y ago
There is already DNSSEC is you care about these kinds of attacks.
430.
by phicoh 7y ago
Imagine somebody using a Librem Riot version that has been modified to default to the Librem homeserver. Now that user needs to use Riot on a new device and ends up with the standard Riot. The user doesn't see any difference but just f
431.
by phicoh 7y ago
I can imagine two reasons for branding. The first is that librem may need to make changes that cannot be accepted by upstream. It can be features they need to have now to keep users happy. But another example could be that they want their R
432.
by phicoh 7y ago
If we want federated services, like matrix, to take off then we need to find a way to get users to pay for it. Everybody is still free to set up a server at home or on a VPS. But there has to be a place you can point ordinary people to.
433.
by phicoh 7y ago
Note that there is quite a big difference in goals between the MINIX versions that were current when Linus started writing Linux (i.e. MINIX 2.0 and earlier) and the MINIX3 project. For early versions of MINIX the goal was teaching. Many li
434.
by phicoh 7y ago
MINIX was special because the book was used in many universities to teach operating system principles. MINIX also one of the few affordable Unix-like operating systems you could run on your own PC, and it came with full source (except for t
435.
by phicoh 7y ago
Markdown has a syntax for bullet lists, why not use that? The nice thing about standards is that there are so many to chose from. It would be nice if there were a single light weight markup language. In many contexts you need something wher
436.
by phicoh 7y ago
I'm old school. I like my source files to be at most 80 characters wide. So for plain text, yes a markup language should reformat paragraphs. Pre-formatted text is different. But that usually requires a separate context to make sure th
437.
by phicoh 8y ago
DNS hijacks at routing level are not common. But they do happen: https://www.theregister.co.uk/2018/04/24/myetherwallet_dns_h... DNSSEC fully supports DNSSEC validation on the host. So the main reason you hav
438.
by phicoh 8y ago
Which makes sense, because there is (in general) not much point in protecting traffic between recursive and auth. servers if you don't protect the stub resolver. At the same time traffic between stub resolver and recursive resolver is
439.
by phicoh 8y ago
The argument seems to be that if your attacker is stupid enough to only change your NS records and doesn't know about DS records, then DNSSEC will provide some protection. It is not clear with ICANN mentions this, because somebody hack
440.
by phicoh 8y ago
I think it means 'if you have a hacked DNS server that has all kinds of custom code to talk to databases, or other resources, then you will find that off the self DNS servers with DNSSEC will not support your hacks'. Note that DNS
441.
by phicoh 8y ago
It's a pity that you link to a page that compares DNSCurve to plain DNS. DNSSEC has the feature that it works even in the presence of caching (recursive) resolvers. DNSSEC only solves half of the problems. That's why you use DNS-o
442.
by phicoh 8y ago
My non-registered Dutch t-mobile SIM worked fine in Spain a couple of weeks ago.
443.
by phicoh 8y ago
I agree that we need to push back against centralization. But I'm not sure this incident is why. Where ever you host something, the provider may make mistakes which causes you to be off the air for some time. It doesn't matter if
444.
by phicoh 8y ago
Maybe you can expand a bit on how the receiving MTA can have certificates (both for the HTTPS part and the SMTP-TLS part) that are signed by a CA trusted by the sender? Currently we have only one system for doing that (at scale) and that is
445.
by phicoh 8y ago
DANE doesn't require universal deployment of DNSSEC either. The sending mail server only needs DNS resolvers that are transparent to DNSSEC. Which is just about everything. And you can also run a modern recursive resolver on mail serve
446.
by phicoh 8y ago
If we look at gmail's current policy: version: STSv1 mode: testing mx: gmail-smtp-in.l.google.com mx: *.gmail-smtp-in.l.google.com max_age: 86400 Then if somebody can take over the domain google.com they immediately start receiving mai
447.
by phicoh 8y ago
From RFC 8461, Section 4.2: "The certificate presented by the receiving MTA MUST not be expired and MUST chain to a root CA that is trusted by the Sending MTA." (And Section 3.3: "During the TLS handshake initiated to fetch
448.
by phicoh 8y ago
Maybe it is just me, but I get mail from lots of small organisations. Maybe the bulk volume of mail is handled by a few parties, but if I look at all mail I care about, there are lots of parties.
449.
by phicoh 8y ago
From https://support.google.com/a/answer/9276511 version: STSv1 mode: testing mx: mail.solarmora.com mx: *.solarmora.net mx: backupmx.solarmora.com max_age: 604800 It is just fascinating how people who dislike DNS
450.
by phicoh 8y ago
It is always the case that an app can break due to something in the app itself. An app may for example link with a different TLS implementation that breaks. Or an app may use the local DNS resolvers but do DNSSEC local validation. With QUIC

More ›