ryan-c

84 ms·

1. 961.▲
   by ryan-c 12y ago

   I've also been using sneakemail for at least twelve years. They also let you set up addresses with a bunch of randomly generated letters/numbers that are opaquely mapped to you, but you have to log in to do that. The only problem
2. 962.▲
   by ryan-c 12y ago

   Cloudflare can't act as a "cloud waf" unless they are able to decrypt the ssl sessions.
3. 963.▲
   by ryan-c 12y ago

   As someone who likes perl, this frightens me. It seems like an esolang, is it really intended for productivity?
4. 964.▲
   by ryan-c 12y ago

   Routing all Firefox users through Tor relays by default would be madness. * It would make Firefox slow. * It would place a tremendous load on the Tor network. * It would defeat content filtering (which includes blocking malware) on enterpri
5. 965.▲
   by ryan-c 12y ago

   Yeah, was amused by the "six months" figure. Two systems in my apartment: 02:02:44 up 753 days, 5:19, 0 users, load average: 0.00, 0.01, 0.05 (my router) 18:02:43 up 649 days, 20:51, 0 users, load average: 0.09, 0.43, 0.56 (m
6. 966.▲
   by ryan-c 12y ago

   It's not difficult to get figure out what operating system you're on without looking at the user agent string.
7. 967.▲
   by ryan-c 12y ago

   Seemed relevant given the hubbub about Facebook's Tor vanity address. I hold the record for longest "real word, proper case" prefix. This was done by loading an entire dictionary into oclvanitygen. Unlike Tor addresses, you c
8. 968.▲
   Bitcoin vanity address hall of fame(bitcointalk.org)

   4 points by ryan-c 12y ago|1 comments
9. 969.▲
   by ryan-c 12y ago

   T-Mobile advertises "xGB of high speed data", and the unlimited is actually unlimited without throttling as far as I can tell.
10. 970.▲
    by ryan-c 12y ago

    We use a commitment scheme in Namecoin. There is a NAME_NEW transaction that is done first that secretly reserves the name. This transaction is then spent, a minimum of 12 blocks later with a NAME_FIRSTUPDATE which reveals the name and sets
11. 971.▲
    by ryan-c 12y ago

    Chrome, last I checked, mostly relies on the OS list of trusted CAs in OS X and Windows, and brings its own on Linux which uses NSS.
12. 972.▲
    by ryan-c 12y ago

    Any software installed on the system can add root CAs to both of them.
13. 973.▲
    by ryan-c 12y ago

    Yes, that is true, it's a limited sample size, but it agrees with what I've seen from various sites that measure browser popularity. Having better numbers would be good.
14. 974.▲
    by ryan-c 12y ago

    See my other comment. * The popularity of that browser is way over reported - they tend to report "installed" statistics rather than "used". * If you read the article you'll see self signed certificates were used fo
15. 975.▲
    by ryan-c 12y ago

    If they got caught it'd get removed from Firefox and Chrome. I am more surprised that they don't have common Chinese software install a set of MitM CAs.
16. 976.▲
    by ryan-c 12y ago

    I've done some analysis on 360 secure browser's SSL handling in the past. I don't have my notes handy, but it can easily be taken advantage of by anyone, not just the Chinese government. I'm somewhat confused by this, as
17. 977.▲
    by ryan-c 12y ago

    Security works best when it is like an onion - layered. Tweaking a password hashing algorithm (for example, changing the initialization constant in bcrypt) does not hurt security, and means that the attacker will not have sufficient informa
18. 978.▲
    by ryan-c 12y ago

    They may just not want to disclose what they're using.
19. 979.▲
    by ryan-c 12y ago

    You are correct. It generates a private key and then sends a SPKAC which is essentially a different format of CSR.
20. 980.▲
    by ryan-c 12y ago

    There's also the fact that, at least in the US, you can get credit cards that will pay you to use them if you have good credit.
21. 981.▲
    by ryan-c 12y ago

    I paid $100 for my current couch second hand five years ago. Usable free couches in cities tend to be picked up by people who then sell them on craigslist. When I was in my early 20s, I lived in a town that was maybe 30% college students. A
22. 982.▲
    by ryan-c 12y ago

    Isn't it rock paper scissors spock lizard?
23. 983.▲
    by ryan-c 12y ago

    I wrote an entry about two years ago: http://www.rpscontest.com/entry/614005 The comment in the program is, of course, a joke. What I actually did was download every other bot on the site, pick out all the ones that ma
24. 984.▲
    by ryan-c 12y ago

    > However, if the car three cars in front of you just broadcast "I'm doing an emergency stop right now", that's really valuable data. Until some asshat implements a button that sends this message for "lulz",
25. 985.▲
    by ryan-c 12y ago

    I've found XSS bugs that allow full account takeover being actively exploited on Yahoo! a couple of times. They have a lot of legacy crap that was written 15-20 years ago.
26. 986.▲
    by ryan-c 12y ago

    Yup, I've used Mandos, just stating that there are other options if you don't want automatic.
27. 987.▲
    by ryan-c 12y ago

    I actually do some work on Namecoin, and need to post in that thread. The current namecoind is based on a horribly old version of bitcoin, and we could really use some donations to help get a rewrite against something more maintainable done
28. 988.▲
    by ryan-c 12y ago

    Mandos is pretty cool. Debian and Ubuntu can also embed dropbear into the initramfs so you can ssh in and unlock the disk.
29. 989.▲
    by ryan-c 12y ago

    In some cases, yes is that simple.
30. 990.▲
    by ryan-c 12y ago

    I mentioned in a thread a few weeks ago on DNS-based XSS that I had this data, and a bunch of people were interested. I finally remembered to bring a copy of the data into work so I could upload it to archive.org. The scan was done through