phicoh

44 ms·

481.
by phicoh 8y ago
Which is fine. Do I really care about the security of Gmail? Yahoo? Hotmail? For me the important thing is that all TLDs I care about support DNSSEC. So I can implement DNSSEC-based security locally. If other people want to play a different
482.
by phicoh 8y ago
Putting user keys in DNS is an obvious mistake: deeply connected to DNS is the idea that the data in DNS is public. It requires heroic attempts like NSEC3 to keep data private and even NSEC3 is not enough. Trying to put list of users (mail
483.
by phicoh 8y ago
One of the nice things about DNSSEC is that it is both optional and it actually works. It being optional means that everybody who doesn't like DNSSEC can just ignore it. Just don't sign your zones, don't run a validating reso
484.
by phicoh 8y ago
Only if you have an out-of-band way of verifying SSH keys. In my experience, 9 out of 10 times that doesn't happen and people just accept a changed SSH key.
485.
by phicoh 8y ago
If your attack model includes Verisign or a government modifying your DNS zone, then that will allow them to obtain a DV certificate as well. By and large, TLS security depends on the connectness of DNS. Though you could try your luck with
486.
by phicoh 8y ago
The problem here is ethernet. Even the latest greatest many gigabits per second ethernet can be bridged to plain old coax based 10 Mbps ethernet. Within the ethernet protocol there is no way to negotiate the maximum frame length between sta
487.
by phicoh 8y ago
I would naively assume that with the huge number of POPs that Google has and the desire to provide a low latency service, Google would only need to have the queries that originate from their resolvers have the right local addresses. What mi
488.
by phicoh 8y ago
I assume that most parties that enforce DRM will look at the source address of the TCP connection, not what instance is accessed. Too many people know about DNS tricks to get the 'right' instance. Additionally, most VPN providers
489.
by phicoh 8y ago
It seems to me that the right way to start would be to type '!?' If that gets popular, then you can have an !?-ligature.
490.
by phicoh 8y ago
It is worth noting that prolonged activities mostly burn fats, whereas short (90 minutes or less) high intensity mostly burn carbs. If you only burn carbs, it is hard to get rid of excess fat.
491.
by phicoh 8y ago
The dot at the end has a technical meaning in two different contexts. The first is to disable search lists in the DNS stub resolver. If you try to look up, say 'ai', then the sub resolver is likely to append your current domain na
492.
by phicoh 8y ago
I have domains that have deliberate broken DNSSEC. Does that that count toward DNSSEC being broken? Same for TLS, I have websites with broken certs. If you want to say something about how the internet is broken, then look at production traf
493.
by phicoh 8y ago
I'm sure you are aware that Google has different results for different people. So for me the first 10 hits: don't seem to include any reference to browser versions that did DNSSEC validation. And didn't have any reference to
494.
by phicoh 8y ago
We know that a very large group of internet users are directly or indirectly using Google's public resolvers, which do DNSSEC validation. Therefor, any DNS stub library in common use already has to know about DNSSEC failures, because i
495.
by phicoh 8y ago
Any pointers to which browser versions did do DNSSEC validation and is there any documentation of what didn't work? My experience with running the validator plugin for a couple of years is that it just works. Obviously, in the early da
496.
by phicoh 8y ago
The reason DNSSEC is vulnerable to that kind of MITM attack is because browsers refuse to do client side validation. For privacy reasons, DNS over TLS and DNS over HTTPS are still a good idea. So even with DNSSEC you would need one of those
497.
by phicoh 8y ago
Just my opinion of course, but I see the basic problem as employees using twitter. Many companies encourage employees to use twitter, social media, etc. for more direct interaction with customers, the community, etc. What is often overlooke
498.
by phicoh 8y ago
I'm not an expert, but it seems that this is about actually selling something. In addition, if the item is sold by a private person who is not acting in any professional capacity selling then it doesn't apply. So my naive reading
499.
by phicoh 8y ago
It seems that at the moment registrars have chosen to comply with the GDPR and ignore any requirements from ICANN that violate the GDPR. If ICANN leaves it at that, then with respect to the GDPR the situation is fine. If ICANN decides to en
500.
by phicoh 8y ago
At least in the Netherlands, I'm not aware of any requirements for 'commercial' web sites. If they exist, they are not enforced. Typically it is mostly the tax office that cares about your commercial activities: if you sell s
501.
by phicoh 8y ago
If you are directly or indirectly paid by a company, then it is unlikely that you have sufficient amount of operational information at home to warrant searching your home. Worse, if you suspect that somebody's role is related to fund r
502.
by phicoh 8y ago
Given that searching somebody's house is a serious invasion of privacy, there should a very good reason why this search is required. I.e., if somebody is a witness only very loosely connected to a case, then it is better just ask that
503.
by phicoh 8y ago
Contracts work fine if they are common. Suppose you are in a bar buying one drink at a time. Each time you buy a drink you enter a new contract. Is that a problem? No. The 'click here to agree and continue to the article' is a pro
504.
by phicoh 8y ago
The GDPR is quite explicit on what consists of consent. This means that if European privacy regulators agree that this approach does not in fact means that users consented then Facebook/Google/Microsoft may be violating the GDPR.
505.
by phicoh 8y ago
It is weird to call this 'IPv6 Only'. Connectivity to the IPv4 internet is still provided. It is just that to talk IPv4 you have to go through a couple of complex translation steps.
506.
by phicoh 8y ago
If we are talking about obtaining DV certificates, then why do you bring up the connection between a browser and Google DNS? The good thing about Google doing DNSSEC validation that on average zones can either be unsigned or need to have va
507.
by phicoh 8y ago
Actually, a large number of hosts are behind a DNSSEC validating resolver. And that's because the use of Google's public resolvers is extremely wide spread. I don't know if they document it somewhere, but it is essentially tr
508.
by phicoh 8y ago
Can you explain how you got the idea that this is what was voted on? Maybe you can link to the agenda where it shows that they voted on this specific text?
509.
by phicoh 8y ago
The relevant part should be Amendment 746 http://www.europarl.europa.eu/meetdocs/2014_2019/plmrep/COMM...
510.
by phicoh 8y ago
That's not how it works for existing cases. There is in each country a single agency per section of the law. For example, if you want play music in a restaurant, you know who to contact. In return you get the right to use all music eve

More ›