raggi

45 ms·

601.
by raggi 4y ago
Around the time I joined Tailscale, actually just before, I had a look at rsh with an eye in this direction. The problem is that rsh is very stale and unmaintained - even those versions that have had releases in recent years (e.g. GNU Inetu
602.
by raggi 4y ago
I was really excited about Flex when I first heard about it. I then heard it didn't have Widevine or Android or Linux features. I don't know if that changed, but I wouldn't be surprised if not. If it did ship those it would b
603.
by raggi 4y ago
This. And this is the problem with signing too, in general. Signing is all well and good, but it doesn't do anything to demonstrate that the signed contents were prepared by a particular person. It only means they probably came from on
604.
by raggi 4y ago
I guess I should mention, I have Go code for gtfs too, if it's of interest I can extract that too and get it up somewhere.
605.
by raggi 4y ago
I wrote one years ago, I just put it in a gist: https://gist.github.com/raggi/d5c8cad1d3c7b25c6748d8322d3c14... happy to share experiences, etc.
606.
by raggi 4y ago
This could have interesting implications for Go programs. Go optimizes io.Copy down to splice if dst and src both support the necessary bits. Unlike C code where you could easily grep this out, this happens transparently, and could even by
607.
by raggi 4y ago
if they want to keep it, they should come up with a viable long term business model, because obsoleting hardware isn't it. otherwise their threat hopefully will vaporize eventually, along with their non-ip stranglehold.
608.
by raggi 4y ago
Was that your takeaway from reading it, or something else?
609.
by raggi 4y ago
even if all the sources were green, and they're not, the energy is being poured into the atmosphere as heat, which is still pollution.
610.
by raggi 4y ago
Yep, good luck with getting the soc vendor to look at your bug on IP that's probably EOL'd in their eyes.
611.
by raggi 4y ago
In 2005 he was still responding to customer emails directly. I sent in some (mostly positive) feedback then, and I got a very thoughtful reply in return including detailing some upcoming plans relating to my mail. I miss that version of the
612.
by raggi 5y ago
The organization that owned the code at the time was Google, and there were multiple teams contributing to that code base concurrently with the patch in question.
613.
by raggi 5y ago
About a decade ago I had a social media marketing platform (Wildfire) part of which was a special case web page builder. We scaled our engineering team in many different ways, one of the many ways was to also contract external teams. One su
614.
by raggi 5y ago
https://github.com/w3c/webauthn/issues/1462
615.
by raggi 5y ago
We did all this stuff for packages in fuchsia and it works really well. We went further though, the on-disk storage is a write-once immutable store of read-verified data.
616.
by raggi 5y ago
So can we be allowed to cross build with the toolchain on non-mac hosts now please?
617.
by raggi 5y ago
Study the traffic in Wireshark, and also sniff upstream of your router to compare. I'd bet it's your router before I'd bet it's your isp. I gave up with cots routers a while back, and life has been significantly improved
618.
by raggi 5y ago
tagline: > Unlimited, ad-free, customized radio faq: > Music is not free but Jango is able to give you unlimited amounts of it for free thanks to ads. Still, we try our best to keep commercial interruptions down to a minimum. In fact,
619.
by raggi 5y ago
came here to raise the same thing, it's odd that this rand was allocating. it seems a little odd to be fixing reentry in rand() and not rand_r() when rand is already so bad anyway. I'm not sure what's worse between doing this
620.
by raggi 5y ago
JSON inside server sent events gives you a browser native client, no need for streaming extensions to your JSON lib which is kinda rare, and various intermediates know not to buffer the content type already. Sorry to be the what about X guy
621.
by raggi 5y ago
What happens once there are layers of execution of the lack of attribution, but then someone downstream comes into a battle over provenance? They have to backtrack now even more poorly documented provenance in discovery? Sounds awful.
622.
by raggi 5y ago
There's a side of this that I agree with, however there's other sides. The reason I've been in the code base a bunch is because I've taken on support of forks bootstrapped by others in various scenarios. Design safety go
623.
by raggi 5y ago
Stop using fail2ban/tallow/etc, and follow a sensible guide like https://infosec.mozilla.org/guidelines/openssh to harden your ssh configuration. This will result in about half the attempts failing at protoco
624.
by raggi 5y ago
I've been enough in the SSH code to be somewhat terrified by it. The main server loop has so many nested macro conditionals it's exceptionally difficult to read precisely. That said, fail2ban had an RCE in the last year, so if we&
625.
by raggi 5y ago
because for many servers, ab taps out before the servers do
626.
by raggi 5y ago
`su` sends the vm into a spin on a single core, is it going to get somewhere? Is there anywhere that documents the covered/uncovered syscall surface?
627.
by raggi 5y ago
Sure, but also no one should be benching servers with 'ab' either...
628.
by raggi 5y ago
Here are a couple of more recent RCE's: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2521... https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8625 There are numerous DoS CVE
629.
by raggi 5y ago
Lost me at wanting to run BIND. BINDs security track record is poor and does not show promise of improvement. Run something else. There are plenty of systems that can consome or convert from bind format if thats what you want.
630.
by raggi 5y ago
Glass houses: https://snyk.io/vuln/npm:lodash@4.17.15 / http://ariagno.com/spotify/

More ›