r1ch

57 ms·

511.
by r1ch 10y ago
Back in the HDD age, you had to optimize applications for sequential I/O and minimize disk seeks. When you tested your software, you could audibly hear the HDD grinding away with seeks. With an SSD there's no feedback like slow lo
512.
by r1ch 10y ago
When such telemetry exposes the names of programs you are running and is sent unencrypted, it's a big deal. Coupled with very specific hardware information, this could easily be used to track TOR users for example.
513.
Launching Our Crowdfunding Campaign(letsencrypt.org)
246 points by r1ch 10y ago|81 comments
514.
by r1ch 10y ago
I think a lot of botnet operators are also worried about their bots being "discovered" during sustained bandwidth attacks. Your average home user isn't going to notice their internet being weirdly slow for a couple of hours e
515.
by r1ch 10y ago
It's not really bandwidth that causes the issue. Javascript is just really slow, both in parsing and execution. According to Chrome dev tools, parsing jquery takes 20ms on my 4.4 GHz desktop CPU. Now imagine how long that takes on a mi
516.
by r1ch 10y ago
You can also use the meta referrer tag on modern browsers. https://moz.com/blog/meta-referrer-tag
517.
by r1ch 10y ago
I recall there was a followup to the article that confirmed that he had granted access to his gmail (or someone in his network etc). What the article describes should not be technically possible.
518.
by r1ch 10y ago
Had a similar nightmare trying to get a code signing cert. Luckily I went through a reseller who were very prompt about issuing a refund.
519.
by r1ch 10y ago
Surprised to see so many big names relying on a single provider. DNS is designed to be distributed, it should be possible to avoid a single point of failure.
520.
by r1ch 10y ago
We sell esports merchandise (t-shirts, hats, etc) with our team logo, and there's a lot of counterfeits out there trying to use our brand on print-on-demand sites (Redbubble, Zazzle, etc) and generic shopping sites like Alibaba and Ama
521.
by r1ch 10y ago
This one in particular feels very strange, since there's actually nothing bad actively happening with the connection, it's more of a policy decision.
522.
by r1ch 10y ago
> overridable “Untrusted Connection” error Allowing users to click past security warnings is a really bad idea. How is a user supposed to know the difference between untrusted because of SHA-1 deprecation and untrusted because of a MITM?
523.
Wi-Fi Beacon Pollution(r1ch.net)
15 points by r1ch 10y ago|2 comments
524.
by r1ch 10y ago
They made a good post addressing this. https://www.ovh.co.uk/news/articles/a2294.how-ovh-expand-in-...
525.
by r1ch 10y ago
No home network or consumer ISP should allow spoofed source packets beyond the edge. The spoofing problems come from cheap / shady dedicated + VPS providers.
526.
by r1ch 10y ago
Also be sure not to allow loopback connections (ie your own site or localhost) or you can cause a deadlock if the user requests the same URL to download from your site recursively. Choose an appropriate timeout too to prevent users tying up
527.
by r1ch 10y ago
One thing I've found that helps a lot is instant delivery notifications. When you try to register a new account, our "We've sent a confirmation email" screen will report within a few seconds if there was a mail delivery
528.
by r1ch 10y ago
I've had several attacks hit my services on OVH. Not once did they null route, and as far as I could tell the majority of attack traffic was filtered with only a minor service interruption before mitigation kicked in. Granted these wer
529.
by r1ch 10y ago
Most DDoS attacks are volumetric. There isn't a way to defend against this other than simply having a huge pipe, or paying someone with a huge pipe to be in front of your site. Non-volumetric attacks like SYN or HTTP floods can be miti
530.
by r1ch 10y ago
Beam (recently acquired by Microsoft) does very similar to this. Rather than wait for the whole X second segment to be built and distributed, they apparently stream MPEG atoms through websockets which are them reassembled in JS and presente
531.
by r1ch 10y ago
According to my data, the TI6 English stream had 16M viewer hours. Unfortunately I don't know the breakdown of what bitrate everyone was watching at, but assuming a mix of 50% Source quality and 50% High quality, that would equate to a
532.
by r1ch 10y ago
HTTP keepalives prevent the excessive connection requests. The main issue with HLS distribution is TCP sucks over high latency links, so you have to have edges near your users.
533.
by r1ch 10y ago
I've had several companies ("data partners" they call themselves) approach us to add these scripts to our websites. All of the ones I've seen use MD5(email) for the "anonymous hashing". I mentioned our privacy
534.
by r1ch 10y ago
At first I wondered what was up too, and noticed bad grammar throughout the entire page. Then I realized this isn't actually an official Facebook post, it's someone's blog post hosted on Facebook notes.
535.
by r1ch 10y ago
Site doesn't work without JS. No love for progressive enhancement :(.
536.
by r1ch 10y ago
If airlines had a clear policy that they would compensate for lost luggage in emergencies I think this would be less common. When a small handbag can be worth $1000 and it takes you 5 seconds to grab it, it's an easy choice to take it
537.
by r1ch 10y ago
Browser security and anti-malware in general is increasingly a nightmare for small ISVs that release software that does anything remotely suspicious (eg DLL injection). As a personal anecdote, my website has been blacklisted multiple times
538.
by r1ch 10y ago
TCP congestion control is one of the main offenders in holding back high speed broadband. It can take minutes for TCP to discover the link bandwidth and a single lost packet can cut performance in half and the ramp back up to full speed may
539.
by r1ch 10y ago
EVERYTHING you say... while using the voice recognition feature. Sensationalist title.
540.
by r1ch 10y ago
Bounties aren't just monetary motivation - they show that the company understands security and responsible disclosure. For example, I've found pretty bad flaws in some white label web-based CCTV DVR software (privilege escalation

More ›