rkeene2

39 ms·

361.
by rkeene2 6y ago
FWIW, there was a good LWN article recently on the work to expose FS to userspace control safely
362.
by rkeene2 6y ago
I started a project similar to the fictional "skip instructions that cause segmentation violations" for SIGILL (illegal instruction) which tried to implement SSE3 replacements on hosts without SSE3. It had two modes: replace the
363.
by rkeene2 6y ago
Art is about how we convey emotional information -- the "But you didn't" part of modern art is a reference to the hard part of creating art being the conception, not the implementation. In other words, making is art is hard N
364.
by rkeene2 6y ago
For what it's worth, that is a meme regarding modern art ("I could have done that" + "But you didn't").
365.
by rkeene2 6y ago
I actually wrote an even better way to do this, since my build system drops network access after downloading SHA-256 validated source (to ensure that source can't go out and fetch more things during build): https://chiselapp
366.
by rkeene2 6y ago
I've done something kind of similar (but much less low-level) using the nRF24L01+ attached via SPI on the GPIO pins of a Raspberry Pi Zero. I'm in the middle of writing it up, but it will probably be a couple of weeks.
367.
by rkeene2 6y ago
The only real low point in the documentation I've found was around MIT Kerberos. I implemented a PKCS#11 module from the documentation for NIST SP 800-73 and RSA PKCS#11 in about a week. What things do you think could be better documen
368.
by rkeene2 6y ago
This is exactly what I do -- I posted some links to both the SSH Agent (well, the ChromeOS version -- I've got C versions as well) and the PKCS#11 module which talks to the SSH Agent. So on a remote system I can do things like sign f
369.
by rkeene2 6y ago
I mostly use CACKey, since I wrote it to replace CoolKey for my needs.
370.
by rkeene2 6y ago
There are MANY vendors that supply hardware security modules that make their information available via PKCS#11 modules. From smartcards to TPMs to dedicated large HSM devices. There are many advantages of something like PKCS#11 over One-Ti
371.
by rkeene2 6y ago
I forgot to mention that also, of course, CoolKey is open source and the CoolKey PKCS#11 module supports the CoolKey applet (obviously) and makes some attempts to support the US DOD CAC and the US Government PIV -- though I don't know
372.
by rkeene2 6y ago
The PIVKey C910 complies with NIST SP-800-73 (PIV) -- same as YubiKey PIV mode, so OpenSC supports it. Also, the middleware I wrote (CACKey) is open source and supports it and works on macOS as a tokend driver.
373.
by rkeene2 6y ago
If you're going the Smart card route you can get the PIVKey C910 on Amazon for $15/ea. in quantities of 1. You can also buy them for about $0.10/ea on AliExpress, and then load CoolKey or some other applet.
374.
by rkeene2 6y ago
Forgot to include a link the PKCS#11 module which talks to the SSH Agent: [0] [0] https://chiselapp.com/user/rkeene/repository/ssh-agent-pkcs1...
375.
by rkeene2 6y ago
One thing I like to do with the SSH Agent is also forward my X.509 certificates by adding new opcodes to the SSH Agent protocol, then you can do stuff like PKCS#11 on the remote side with your local smartcard. [0] This gives you, among othe
376.
by rkeene2 6y ago
Chromebooks can run Termux, so at least as good as Android devices :-D
377.
by rkeene2 6y ago
This rationalization may have been valid at the time, but certainly the software has changed in the intervening 20 years such that it is very likely that the user configured their OS and environment to their preferred language weights -- at
378.
by rkeene2 6y ago
For all practical purposes it is true that classified work will not be done at home for a long period of time -- because doing meaningful classified work over a long period of time requires connectivity to a classified network, which requir
379.
by rkeene2 6y ago
It was clearly a joke response to a joke question. Reporting Edward Snowden for timecard fraud, while technically it could be a valid infraction, misses the scope of the crimes he is already known to have committed. Also, the penalty would
380.
by rkeene2 6y ago
Correct -- his house would not have a link to NSANet, nor have anywhere for open storage of classified material. The VERY best he could have hoped for would be a SME-PED and a vault.
381.
by rkeene2 6y ago
No. If he did work at home (which is what I'm assuming you mean by "fully remote") on classified material it was not part of his job, and thus if he billed the US Government for that time it would be timecard fraud. If you
382.
by rkeene2 6y ago
You can also mitigate it by including in the session token something from the server side that is sent by the client as part of the HTTP request but not as part of the query, such as a hash of their user-agent. I did something similar to th
383.
by rkeene2 6y ago
I would use something like OfflineIMAP to sync from an external IMAP server to your own Dovecot instance, assuming you want the local copy to be kept in sync (e.g., read status should be copied to the local copy as it changes, etc).
384.
by rkeene2 6y ago
> Well, serving high-definition video isn't free. If you watch a lot of YouTube, have an adblocker, and don't pay for Premium, that would make you a freeloader. The serving part is likely almost free since YouTube doesn't
385.
by rkeene2 7y ago
FWIW, this is roughly how Tclkits work in the Tcl world. Although by default they use a Metakit database instead of SQLite. Currently they append the database to the end of the executable, which has some problems and I'm working to ma
386.
by rkeene2 7y ago
A good, controversial read is available at [0]. I don't agree with his conclusions entirely, but the data he presents is interesting. And also paired with [1] to give space overhead and MTBF figures for various RAID configurations (w
387.
by rkeene2 7y ago
ZFS and EXT4 on LVM have a lot of overlap. A decade or so ago I made a comparison between ZFS, BtrFS, and EXT4 on LVM [0] that may be of interest. [0] https://rkeene.org/projects/info/wiki/BtrFS
388.
by rkeene2 7y ago
Linux VServers came out around the same time (2001) [0], so the claim about "many years earlier" is spurious without being more specific about which things it did earlier. [0] http://linux-vserver.org/Frequently_As
389.
by rkeene2 7y ago
With Fossil you could create many private branches off your feature branch with your experiments, and merge them into your feature branch when you're satisfied with that experiment.
390.
by rkeene2 7y ago
The most naive solution would be to run a nested framebuffer with just the meeting and the windows you would like to share.

More ›