psanford

39 ms·

421.
by psanford 5y ago
To be fair, y'all had some serious vulnerabilities, including zone escapes and arbitrary kernel memory reads, discovered by @benmmurphy.
422.
by psanford 5y ago
They were acquired for $170m.
423.
by psanford 5y ago
You should be wary of projects that claim to be secure but have a history of game over vulnerabilities.
424.
by psanford 5y ago
croc just had multiple major vulnerabilities discovered that required protocol breaking changes to fix: https://redrocket.club/posts/croc/
425.
by psanford 5y ago
There's nothing hard about writing iterators in go.
426.
by psanford 5y ago
I've been quite happy with LXD's support for VMs. Its really easy to pull an image an have a running VM with a single command.
427.
by psanford 6y ago
The source code for storing the last login timestamp is here: https://github.com/signalapp/Signal-Server/blob/master/servi...
428.
by psanford 6y ago
Android does verify that any new versions of an APK are signed with the same signing key as previously installed versions. So you would have to compromise the signing key held by the developer in order to push an evil APK.
429.
by psanford 6y ago
Came here to say that the example code in the docs for ParsePKIXPublicKey seems to be exactly what the author was looking for.
430.
by psanford 6y ago
xdg-open is so frustrating. Its defaults are wrong and its a pain to reconfigure. I replaced xdg-open with this shell script that simply copies the url and posts a desktop notification saying it did so (I got the idea from a post on twitter
431.
by psanford 6y ago
> if you prefer a locally-installed command line tool and you're sending files to someone who understands the command line There's at least one good desktop GUI for Magic Wormhole[0]. I've also recently released an Magic W
432.
by psanford 6y ago
Indeed it is different enough to justify using a different name.
433.
by psanford 6y ago
Wow, what a weird tangent that has nothing to do with this thread.
434.
by psanford 6y ago
> I had forgotten he moved orgs. Matt Levine has been at Bloomberg since 2013.
435.
by psanford 6y ago
> Every place I've worked which has had issues with last minute certificate changes or expiring certificates without renewal has had a systemic problem with underpaid and understaffed IT department. That's an interesting anecdo
436.
by psanford 6y ago
People were really bad about upgrading off of Java 6. That was pretty terrible if you operated a TLS endpoint and wanted to drop old insecure configuration options. Sorry, you've got some ancient Java 6 clients that only supports DH 10
437.
by psanford 6y ago
Its interesting to compare the general reluctance of the Java community to upgrading vs the Go community's preference to be on the latest version (or at most N-1). I suspect this is due to a number of reasons. Go doesn't have a se
438.
by psanford 6y ago
I use the Philips-SHP9500S headphones. I found they were very uncomfortable with the ear pads they came with. I replaced the ear pads with some thinker ones (Shure HPAEC940) and it really helped a lot.
439.
by psanford 6y ago
Its a good idea to have a big red button that you can hit to pause your auto scaling groups when incidents like this are in progress.
440.
by psanford 6y ago
> It's still around and it doesn't take down the whole Internet every three weeks anymore. Maybe that's because the vast majority of email no longer goes through sendmail.
441.
by psanford 6y ago
> yet every other service is doing far worse behavior Please provide specific sources of AWS, GCP, or Azure leaking file names and sizes to a third party.
442.
by psanford 6y ago
I've had this in my config for a long time. Seems to make tramp work a lot better: ; use ssh instead of scpx mode for tramp ; this should work a lot better with ssh connection sharing (setq tramp-default-method "ssh&
443.
by psanford 6y ago
Here's Ubuntu's: https://ubuntu.com/security/notices/USN-4891-1
444.
by psanford 6y ago
Actually, that project still has the nostalgia Reader interface online: http://readerisdead.com/reader/view/#overview-page
445.
by psanford 6y ago
All these years later, I still use the Google Reader frontend (with newsblur as the backend). It turns out that Reader's UI assets were stand alone enough that you could just implement the backend API and it all would work. I saw this
446.
by psanford 6y ago
I've found the entropy detection in trufflehog to be pretty noisy. When I've run it I generally disable that.
447.
by psanford 6y ago
No.
448.
by psanford 6y ago
There are tools available to help look for this sort of thing (for both you and any potential attackers). TruffleHog[1] is the first one that comes to mind for me. I also like shhgit[2] for looking for secrets in repositories. (I don't
449.
by psanford 6y ago
`M-x lsp-find-implementation`.
450.
by psanford 6y ago
Don't leave out the part where Mahaffey first confirmed the P&F results before having to retract that due to improper equipment usage. That likely was a big contributing factor to the many conspiracy theories that P&F had in-fa

More ›