pilif

42 ms·

601.
by pilif 9y ago
> not to mention by default out of the box sure. Disable it by default, but leave it compiled in, so an admin can re-enable it by changing a config setting instead of recompiling half a distro. > and thus putting yourself at risk t
602.
by pilif 9y ago
I don’t know. We have customers connect to us with their internal systems they haven’t touched in ages. I can’t possibly tell them that they need to update their infrastructure two years (Debian has a two year release cycle and has released
603.
by pilif 9y ago
>So what is going to happen to all of the packages published before TOTP is turned on? same as what happens with all the package that were uploaded before the hypothetical GPG support was added to npam an packages could be signed. &gt
604.
by pilif 9y ago
That would still be a two-step process (downloading from the browser and then manually executing it). `npm install` runs code as part of the initial step. Also, `npm install foo` will of course not just run code from `foo` but from all its
605.
by pilif 9y ago
> can't verify that the developer used TOTP to publish they can if npm enforces the usage of TOTP for publishing. As a user who uses both a GPG key to sign commits and a 2FA token to authenticate to all sites where this is possibl
606.
by pilif 9y ago
>They should first get package signatures implemented, it's a bigger threat to the npm community Considering that signature checking would not have prevented this attack that has actually happened, I would say that not having sign
607.
by pilif 9y ago
> If ever you decide you want to migrate away from Postgres[…] it's one of the things to keep in mind. Depending on your application, migrating away from postgres will be more or less painful. If you're already deeply investe
608.
by pilif 9y ago
what would be the option? Leaving the Chinese market, having iPhones be pulled from the market and the AppStore blocked by the Great Firewall? Even without VPN clients, iPhones still provide superior client-side security to a lot of other p
609.
by pilif 9y ago
My Macs have an uptime in months. Sometimes I have to restart a process, but needing to restart the machine is exceedingly rare outside of the normal security update related reboots. Over the years I have given quite a few presentations to
610.
by pilif 9y ago
> When things get completely borked (which in two weeks of heavy use only happened a couple of times for me) how are people willing to live with this? I would be furious if I had to lose all my state and (for all intents and purposes)
611.
by pilif 9y ago
> At the very least, a secure IPv6 network will need to hide end user addresses somehow, because giving everyone a unique, globally-addressable and trackable ID is a security showstopper. this is a solved problem now. All modern OSes e
612.
by pilif 9y ago
DHCP activity from 4 devices will not slow your network, much less take it down. A DHCP negotiation to get an IP address takes 4 UDP packets, all of them usually below 500 bytes in size. Not even when you have set the lease time to the theo
613.
by pilif 9y ago
In this specific case, the DHCP server configuration under Windows makes it abundantly clear though that you need to make your DHCP server authoritative by adding a warning icon and presenting a warning dialog when it's not running in
614.
by pilif 9y ago
U2F has the advantage that a server compromise won't compromise the second factor as there's no shared secret accessible to both parties. Of course, keeping the token on the same machine that you're using for logging in is re
615.
by pilif 9y ago
I wonder why they went such great lengths to prevent unauthorized clients (which also is a thing that’s fundamentally impossible. All you can do is making it harder for attackers). What would be so bad about third party apps ordering coffee
616.
by pilif 9y ago
it has a lot of quirks, and, frankly, webkit is pretty bad at printing in general as it lacks a ton of printing specific features like re-printing table headers across page boundaries. There's also only very rudimentary support for pag
617.
by pilif 9y ago
Let’s encrypt has tight limits on the amount of certificates it issues per domain. Presumably to stop this exact scheme
618.
by pilif 9y ago
As it's a local installation, it will be blocked by user's limited permissions, by locally installed security products and by paranoid users regularly culling their certificates (believe me, been there, done that). It also won’t w
619.
by pilif 9y ago
A wildcard won’t help much. If you want to do this correctly, then each client needs to generate a unique certificate and private key. The name in the certificate, the custom resolver helps with, but now you’re stuck with that uniquely gene
620.
by pilif 9y ago
Which means: special deal with digicert. Or can you link me to a product page where anybody can sign up?
621.
by pilif 9y ago
In my case I’m using this to allow people to read data from a locally connected (via USB) barcode scanner. Remind me again how <video> would be of help there?
622.
by pilif 9y ago
Yeah. The webpage is remote and using ssl and now wants to talk to the locally installed app. I agree that SSL doesn’t make sense there and honestly, in my opinion it would make sense for browsers to treat localhost as a secure origin. But
623.
by pilif 9y ago
Yes. But it requires them to have a CA certificate which requires special contracts with a CA. Now, Cisco could certainly do that, but for smaller companies, that‘s probably not feasible
624.
by pilif 9y ago
The domain in question (drmlocal.cisco.com) resolves to 127.0.0.1. This is a handy and above all cross-platform/cross browser way for a website to talk to a locally installed application (that's running a web server, bound to the
625.
by pilif 9y ago
It’s using PBKDF2 with a configurable amount of rounds. So yeah. Strange it limits the length
626.
by pilif 9y ago
This is an old microsite from last October. Most features listed on that page are not available in production (or at all).
627.
by pilif 9y ago
> Graphical email clients are universally buggy and slow. That's the advantage of mutt. that's what they said back in the early 2000s too, so I tried it, but I was appalled by the horrible support for message threading and IM
628.
by pilif 9y ago
This change has caused so much pain in our internal network too. Not because of intercepting proxies, but because of a ton of certs signed by an I terns CA. I really wonder what kind of issue triggered them changing this and whether it was
629.
by pilif 9y ago
I’m I using it for debugging barcode scanners talking to a web service. I much prefer the qt based UI. It’s much faster and obviously feels much more native to the platform
630.
by pilif 9y ago
> Google uses quite a lot of other domains for analytics and tracking than google.com ... for now. It's just a matter of time before analytics and tracking will move. Just like maps has moved to google.com in order for search to a

More ›