r1ch

23 ms·

211.
by r1ch 5y ago
I was thinking more along the lines of one of the signing keys leaking.
212.
by r1ch 5y ago
I'm speculating somewhat as I haven't been through the process, but it seems like the test centers give you a string that the app converts into the QR code. The app is supposed to work offline, though perhaps the initial string -&
213.
by r1ch 5y ago
This design looks pretty sound, revocation seems like the big missing piece but I guess that could be done by pushing an updated scanner. Here in The Netherlands our app is also used for proof of a negative test. I wonder if giving signing
214.
by r1ch 5y ago
I was searching around on the subject and came across https://nootropicsdepot.com/longvida-curcumin-capsules/ via Reddit which claims to do testing on their products with an in-house lab: https://nootropicsd
215.
by r1ch 5y ago
Have any recommendations?
216.
by r1ch 5y ago
I have a recording from one of my drives which I believe was a failing Deathstar. Not a pleasant sound to experience. https://r-1.ch/hdd.mp3 (warning, loud)
217.
by r1ch 5y ago
Reddit is actually a great example of not caring about performance. See those tiny reward icons rendered at 12px? Here's the source image, a 512x512 1.6 MB APNG: https://www.redditstatic.com/gold/awards/icon&#
218.
by r1ch 5y ago
I'd be quite surprised if frontend developers know the size of an Ethernet frame or TCP ICW. I'm all for these kind of optimizations, don't get me wrong, but I just don't realistically see them mattering any more.
219.
by r1ch 5y ago
I think the days of developers caring about 16 KB of bandwidth savings for an image have long passed. Pages with GIFs for video content, photos saved as PNG, multiple megabytes of JS are the norm now.
220.
by r1ch 5y ago
Using a library-provided CDN can be performance-negative now, since you usually need several RTTs for DNS, TCP, TLS before you even get to HTTP. Serving it from your own domain / CDN allows it to be part of an existing HTTP connection.
221.
by r1ch 5y ago
The reference implementation is Python, so there's lots of room to optimize. I wonder if you can eventually build an ASIC that replaces the disk based lookup with in memory calculations of the same data.
222.
by r1ch 5y ago
It runs the kernel under a hypervisor. Technical details: https://www.microsoft.com/security/blog/2020/07/08/introduci...
223.
by r1ch 5y ago
Downloading over HTTPS also protects against data corruption in transit.
224.
by r1ch 5y ago
You don't download the hash from the mirror, you use a signed hash from the distributor, allowing you to test that the untrusted mirror is serving you the correct file.
225.
by r1ch 5y ago
One of the first things everyone should do on a new network setup is disable 802.11b, this raises the minimum modulation in beacons from 1mbps to 6mbps which helps a little.
226.
by r1ch 5y ago
The page does seem to be the official wordpress development blog, linked from wordpress.org's "get involved" page. "The WordPress core development team builds WordPress! Follow this site for general updates, status repor
227.
by r1ch 6y ago
Physical mute switches can be worse for other listeners as it creates an audible pop every time you mute and unmute on a 3.5mm connection. Digital (USB) mute switches are better.
228.
by r1ch 6y ago
I'm curious how the "BadChoice" vulnerability did not get picked up by a static analyzer. Only initializing part of a structure should be very easy to catch.
229.
by r1ch 6y ago
Assuming you're using HTTPS (and if not, why?!), this is checked automatically as part of the TLS handshake. The only downside is Cloudflare makes it easy to accidentally disable this check as "Full SSL" bypasses certificate
230.
by r1ch 6y ago
> If a Cloudflare customer has configured their origin server to respond only to Cloudflare IPs, then they MUST also verify that the "Host" header on any request actually matches their domain name. This could be improved consid
231.
by r1ch 6y ago
While well-intentioned, I don't think the casual website visitor is going to understand what a cryptominer is and the blog post doesn't really do a good job of explaining what's going on, especially for non-English visitors.
232.
by r1ch 6y ago
I'm a big fan of flashing OpenWRT on supported APs. You lose central management and setup takes time, but I'm very happy with the stability and no worries about cloud services or vendor lock-in etc.
233.
by r1ch 6y ago
Unfortunately I can't bring myself to like Ubiquiti products. They have a history of GPL violations, most of their Wifi product range is Mediatek based and there's an increasing requirement for an always-on cloud connection. Their
234.
by r1ch 6y ago
I generally try to avoid anything with a Mediatek or Broadcom wireless chipset, Atheros seems to be the more stable of the bunch. My OpenWRT experience hasn't been entirely flawless - the switch on the hEX kept crashing until I found a
235.
by r1ch 6y ago
I admit I was very tempted to go with a proprietary AP, the TP-Link EAP660 HD for example looks amazing. However all my client devices are 2x2 and only my PC supports 802.11ax at this time, so I don't mind waiting a bit longer for poss
236.
by r1ch 6y ago
Yes, though there are two hardware revisions - the newer model (2020 onwards) has a completely different chipset and no support yet (see comments at https://openwrt.org/toh/hwdata/mikrotik/mikrotik_rbwapg-5hac
237.
by r1ch 6y ago
I refuse to use anything that doesn't support OpenWRT these days. The stability of a modern kernel, drivers and usermode can't be beat. While ax support is still a ways away, many ac devices support OpenWRT. I have the $70 wAP AC
238.
by r1ch 6y ago
I've seen similar Shopify apps that exposed other customers entire order information publicly. Don't trust that every developer implements apps in a perfectly private way.
239.
by r1ch 6y ago
I wonder if the use of a .win domain had any influence. I've seen nothing but spam and malware / phishing from these $2 TLDs. https://symantec-enterprise-blogs.security.com/blogs/feature...
240.
by r1ch 6y ago
What are the chances this was independently discovered and weaponized in the two months after the original report to MS? Can't help but wonder if the security researcher or MSRC were compromised or have a leak.

More ›