phicoh

13 ms·

91.
by phicoh 2y ago
The situation with respect to condensation: look at historical data for the dew point during the summer season. That as low as you can get. For example, I'm in The Netherlands and our system is set to 18 degrees Celsius. The amount of
92.
by phicoh 2y ago
Think about if it happens (or does not happen) every 6 months and you can never plan ahead. And daylight saving is a local problem. In my country the rules have not changed for more than 4 decades. The other problem is that most systems use
93.
by phicoh 2y ago
The problem with leap seconds is that any conversion between TAI and UTC for a time stamp more than 6 months in the future is undefined. If we did the same thing with time zones or leap days, that some committee would only announce changes
94.
by phicoh 2y ago
The how is simple, all devices will be required to be as locked as iphones. No apps on your device unless approved by the vendor. Open source is fine as long as you jump through the hoops to submit it for review.
95.
by phicoh 2y ago
I wonder if they are going to kill open source chat applications.
96.
by phicoh 2y ago
In my experience, meeting people in person at the coffee machine or at lunch creates way more social cohesion compared to exclusively using mail, chat, and video conferencing. This is important even in bigger organizations, because you want
97.
by phicoh 2y ago
Where do you find an attack on a registrar account in the following attack: https://freedom-to-tinker.com/2022/03/09/attackers-exploit-f... I can't find it.
98.
by phicoh 2y ago
Maybe you can be a bit more specific and explain how exploiting BGP can change the CAA record in a DNSSEC secured zone? ACME validation with dns-01 relies only on DNS. Routing does not matter other than to create DoS.
99.
by phicoh 2y ago
It seems you miss something, maybe because you don't consider DNSSEC as something that gets actual use. With DNSSEC, somebody can reroute traffic all they like, they cannot generate fake DNS responses that are DNSSEC valid for DNSSEC s
100.
by phicoh 2y ago
Here is a recent attack showing the lack of resilience in the CA ecosystem: https://freedom-to-tinker.com/2022/03/09/attackers-exploit-f... With password resets your own mail server is not involved. STARTTLS
101.
by phicoh 2y ago
It's a common misconception that DNSSEC is not needed if you have TLS. Two reasons come to mind: 1) CAs will happy issue TLS certificates if you can spoof DNS. In the past you would have to spoof MX records, with letsencrypt (or other
102.
by phicoh 2y ago
If you set the CAA correctly, then letsencrypt will limit validation to the dns method. Together with DNSSEC that is enough to prevent issuing certificates in case of a route hijack.
103.
by phicoh 2y ago
That's not correct. If you set the CAA correctly you can limit certificates to for example letsencrypt and dns validation. An attacker can get around that if a CA does not use DNSSEC validation to check the CAA. But that would be a pro
104.
by phicoh 2y ago
BGP hijacking also works on a small scale. If you don't use DNSSEC and somebody hijacks the prefix(es) that host your DNS, they can obtain a letsencrypt certificate and redirect all your traffic. If you don't have a CAA record and
105.
by phicoh 2y ago
As an undergraduate I had to use Modula-2 in the first year programming courses. It was a decent language for teaching programming, but I don't recall anybody who liked it. Those in systems programming quickly switched to C the next ye
106.
by phicoh 2y ago
The fun part is that the actual uuencode format has the file mode in octal after the word begin. Somebody at microsoft decided this was optional and that begin with two spaces and then the filename should also be the start of a uuencoded se
107.
by phicoh 2y ago
Indeed, I don't. But languages can be compared based on features. Even a language that doesn't exist can be described based on what features it needs to have. I'm not an expert in type systems, but there is a huge amount of r
108.
by phicoh 2y ago
Obviously Rust has some features, like async, that are not needed for 'C with safety'. But in my experience you need most of the other features. So any 'C with safety' will have a lot of the complexity of Rust. Though of
109.
by phicoh 2y ago
I'm not saying anything about what is possible. What would be the amount of time it takes to create a new language, create a stable compiler, create a sizable community? It can easily be ten years. There are lot's of organizations
110.
by phicoh 2y ago
In my opinion, Rust, though large, is in some sense quite minimal. Lot's of features in Rust are actually needed to allow the compiler to statically reason about memory safety. And this is why Rust is likely going to take over from C,
111.
by phicoh 2y ago
Yes, both C and Unix are amazing designs. Far from perfect, but good tools for many jobs. In my opinion, it is now time for Rust to take over. But comparing Rust to C, it took a huge amount of improvement over C to replace C.
112.
by phicoh 2y ago
If you make software with a small team and you have about 2 dozen customers who pay for a support contract, then those contracts are actually surprisingly cheap.
113.
by phicoh 2y ago
At some point Firefox was quite effective at competing with Microsoft's browser. So it happened at least once.
114.
by phicoh 3y ago
Assuming you are talking about IPSEC, that uses a model that is very hard to deploy. The problem is that applications typically use TCP connections, but IPSEC works at the IP level. Early on, the (BSD socket) kernel API was basically fixed
115.
by phicoh 3y ago
There is no quickly in the Google article. It took them ages to roll out 0x20. Cookies are not very well supported. And then the elephant in the room is the connection between the stub resolver and the public DNS resolvers. The interesting
116.
by phicoh 3y ago
DNS is where the web would have been if browsers basically didn't force websites to support HTTPS. The reasoning is that DNS is not important enough to go through the trouble of deploying DNSSEC. These days TLS is often cited as the re
117.
by phicoh 3y ago
We should not think in absolutes, but in terms of tools. What risks come with using a certain tool. In your Rust example, using C is like using a power tool without any safety measures. That doesn't mean that you are going to get hurt,
118.
by phicoh 3y ago
I think there is a fundamental difference between how corporations used to work and how open source typically works. In a traditional corporation, people would come to an office. It would be known where they live. If you would require somet
119.
by phicoh 3y ago
I think a problem is that there doesn't seem any way to automatically check this. If we assume that anything that is used during build time can be malicious then figuring out those dependencies is already hard enough. Mapping that to o
120.
by phicoh 3y ago
They had an interesting hack to connect to a high-res monitor. Timing wise they had to stick to the standard TV timing otherwise regular Amiga software would not work. So they created a hack where the Amiga would send 4 screens of pixels th

More ›