regecks

13 ms·

61.
by regecks 7y ago
You only have to trust your phone momentarily. Add TOTP, add security key, then delete the TOTP token from your phone. At that point, the only copy of the TOTP secret is stored on Twitter's servers.
62.
by regecks 7y ago
So do you have some arrangement with Cloudflare to satisfy the the "Limitation on Non-HTML Caching" part of their terms?
63.
by regecks 7y ago
That's interesting. When I needed help with some emails in 2016, the support staff asked me to move the emails into a folder called "forwebmaster" so that they could look at it.
64.
by regecks 7y ago
Further down in the same article: >but you don't really want to have your password manager also store OTPs
65.
by regecks 7y ago
I have the opposite experience when it comes to availability. I sell some software that runs on servers, and we used to get so many tickets that came down to the server's IPv6 transit being busted in sometimes obvious, sometimes subtle
66.
by regecks 7y ago
No real mention of key passphrases, except that a team member might forget to use one. It seems to me that the title is not really true for individual users or small teams - modern OpenSSH passphrases are good enough to protect against thef
67.
by regecks 7y ago
If you want to scare yourself off psychedelics for life, /r/hppd has some pretty horrifying posts from people reaching out for help. I am grateful that my own extremely minor experience with similar symptoms taught me to stay clea
68.
by regecks 7y ago
Well, "ssl_early_data" is opt-in. If you enable it on a virtualhost, then you also need to look at the "Early-Data" request header in your backend and make a decision there. e.g. process GET requests, otherwise send HTTP
69.
Open-source apps removed from Google Play Store due to donation links(lists.zx2c4.com)
1438 points by regecks 7y ago|557 comments
70.
by regecks 7y ago
>For new designs: basically just use libsodium. Check out libhydrogen from the same author. The API contains less footguns (like nonces).
71.
by regecks 7y ago
I don't think curve25519 is used in any ECDSA implementations. ed25519 is part of EdDSA.
72.
by regecks 7y ago
usgbuard is another countermeasure if you have a Linux workstation.
73.
by regecks 7y ago
What do you think about Paul Vixie's views on DoH? On the face of it, it seems like we're going to end up with a bunch of black box devices (from Google, Amazon etc) in our homes that are totally immune to most forms of network po
74.
by regecks 7y ago
Extra queries are a gamble that you don't encounter latency on any of the important ones, right? For example, on mobile data when you're hitting packet loss. I'm not so fussed about extra queries when they do not delay the us
75.
by regecks 7y ago
No thanks. There are already too many DNS lookups and TCP connections a user-agent has to make in 2019: - OCSP if not stapled. - IPv4/IPv6 racing/Happy Eyeballs. - Encrypted SNI (DNS lookup). - Certificate Transparency: some Chrom
76.
by regecks 7y ago
There is also usbguard-applet-qt, which I have found very helpful to navigate around the options. It also pops up a permission screen as soon as a device is plugged in.
77.
by regecks 7y ago
Right, for some reason in Go (which Helm is written in), the standard library calls them encoders/decoders with marshal/unmarshal as the operations. Serialize is definitely the more common term generally.
78.
by regecks 7y ago
Why would they have chosen to use template/text to generate YAML? That seems insane. Surely using an encoder on an object/structure hierarchy (like people do with encoding/json) is the way to go? On the other hand, the qualit
79.
by regecks 7y ago
Not that familiar with Rust, but should the key generators perhaps take CryptoRng rather than Rng in their signatures, to prevent footgunning by users of the crate? https://github.com/ArgusHQ/wagyu/blob/6b723d
80.
by regecks 7y ago
Yes, I tried it just now on a random website I built in Vue. Any sane implementation of client-side navigation uses the History API[1]. It is indistinguishable from "real" navigation in the browser UI, apart from how fast it is. I
81.
by regecks 7y ago
Using easy-rsa, choosing the right ciphers and other protocol options always seemed overly complex and opaque to me. Wireguard was a breath of fresh air in comparison.
82.
by regecks 7y ago
jedisct1 sure is prolific with all these lean and friendly crypto-related applications. dnscrypt-proxy, libsodium, libhydrogen, minisign, dsvpn, probably others I've never heard of.
83.
by regecks 7y ago
I like the sentiment and practice it myself, but you need to be careful with snaps. They more often than not come with the home[1] interface connected by default. To me, that somewhat defeats the purpose of running the snap. 1. https:&#x2F
84.
by regecks 7y ago
There are real life situations where you must program without loops, and eBPF programs are an example. They also have an program size and various other limitations ( http://www.brendangregg.com/ebpf.html#bccprogramming ). Whe
85.
by regecks 7y ago
You can, but the problem with using old.reddit.com is that clicking on reddit.com links (e.g. from reddit comments) will take you back to the new design. With the opt-out, you get the old design no matter what.
86.
by regecks 7y ago
They absolutely are intended for that. RHEL, Canonical, Oracle, SUSE and KC all disagree with you.
87.
by regecks 7y ago
There are a lot of live patching solutions available, paid and free. On my Debian systems, I use KernelCare (like $2.50/server/mo) for a hands-off experience, have only had good experiences over the years. It's possible that
88.
by regecks 7y ago
Yeah. The Downloads directory inevitably accumulates sensitive data over time, especially lacking automatic cleanup/expiration of files. For this reason alone, Firefox should follow the Chromium/Edge policy. Running Firefox via sn
89.
by regecks 7y ago
Big fan of request coalescing, was introduced to it by Varnish. Really helps when a cache entry drops. I believe what the article did is called a "grace period". Are there any open implementations of distributed request coalescing
90.
by regecks 7y ago
In addition to the solutions in my sibling comment, there is also the commercial (but cheap) KernelCare ( https://www.kernelcare.com/ ), which supports basically every major server OS ( https://patches.kernelcare.co

More ›