snowstormsun

7 ms·

1. 31.▲
   by snowstormsun 2y ago

   vim + markdown files <3
2. 32.▲
   by snowstormsun 2y ago

   Yes, because it keeps happening.
3. 33.▲
   by snowstormsun 2y ago

   > First, you have to copy all production data. It’s expensive, and a reckless breach in privacy and security, but it’s doable. So, what does "doable" mean in this context? We unnecessarily increased the attack surface for produ
4. 34.▲
   by snowstormsun 2y ago

   Very click baity and not good journalism imho. Starting with a "A GeForce RTX 4090 could be cracking your password at this moment." tag line only to later note: > With bcrypt, the hashing times soared. While the GeForce RTX 409
5. 35.▲
   by snowstormsun 2y ago

   > I find it very hard to believe Amazon's or Google's servers do not already have full disk encryption. I find that very easy to belive.
6. 36.▲
   by snowstormsun 2y ago

   Don't follow that advice if you're a doctor please.
7. 37.▲
   by snowstormsun 2y ago

   One huge benefit of random session tokens is also that you can't include arbitrary metadata that is sent to the client. Decoding JWTs of web apps can give you a lot of suprises like the account email address or even password being stor
8. 38.▲
   by snowstormsun 2y ago

   Is there a video demo where you can see how it refreshes the display and how smooth it really is?
9. 39.▲
   by snowstormsun 2y ago

   Open Source Maintainers shouldn't judge the people trying to contribute, but the contributions. If the contribution is misguided or not good, it's their responsibility to reject it. On the other side, if the contributor's int
10. 40.▲
    by snowstormsun 2y ago

    How can anyone verify the others actually did the thing?
11. 41.▲
    by snowstormsun 3y ago

    Oh, that's good news. I guess I wasn't up to date...
12. 42.▲
    by snowstormsun 3y ago

    I'd switch to passkeys immediately where possible, if Android/Google would allow third party password manager apps to provide and store them. Afaik they still want you to use the Google Password Manager, which is not an option for
13. 43.▲
    by snowstormsun 3y ago

    Cool!
14. 44.▲
    by snowstormsun 3y ago

    Thanks, didn't know there were lectures on YouTube, too!
15. 45.▲
    by snowstormsun 3y ago

    Adverserial examples in CVs coming soon?
16. 46.▲
    by snowstormsun 3y ago

    How much does that increase the index size?
17. 47.▲
    by snowstormsun 3y ago

    I don't get it. If the laptop can already boot up with the tpm and the attacker has the entire laptop, what exactly is broken here? Isn't the TPM mainly there to protect against decrypting the SSD when it's separated from the
18. 48.▲
    by snowstormsun 3y ago

    assert x >= 1 and x <= 10, "x is out of the allowed range" What novel way to add validation in python?
19. 49.▲
    by snowstormsun 3y ago

    Nice!
20. 50.▲
    by snowstormsun 3y ago

    I find https://simplemobiletools.com/index.html decent, but not sure if it supports automatic backup.
21. 51.▲
    by snowstormsun 3y ago

    I think many companies probably don't like to be open source because - they like the idea of "security through obscurity". Open source means more work patching found vulnerabilities, so they rather not publish their code and
22. 52.▲
    by snowstormsun 3y ago

    Because they wouldn't have enough good quality training data then probably.
23. 53.▲
    by snowstormsun 3y ago

    Maybe I missed that
24. 54.▲
    by snowstormsun 3y ago

    > ah yes, the famous XSS coming from your own backend API calls… Author does not seem to understand the concept of XSS. Of course your own API could return user-provided data to trigger XSS attacks. Entering <script>alert(1);<&#
25. 55.▲
    by snowstormsun 3y ago

    For fido2 and passkeys, I'd recommend Adam Langley's blog: https://www.imperialviolet.org/
26. 56.▲
    by snowstormsun 3y ago

    Absolutely
27. 57.▲
    by snowstormsun 3y ago

    For Android the mobile app seems to be last updated in 2021 and not compatible with the latest Android version. I would switch to pass immediately if they had both a well maintained and audited browser extension and mobile app.
28. 58.▲
    by snowstormsun 3y ago

    Wireguard also has a mechanism where it may choose (under high load) to respond with a cookie, which is the MAC of the requesting IP address. The sender then needs to resend his request with that cookie. https://www.wireguard.com
29. 59.▲
    by snowstormsun 3y ago

    10 minute intervals and only 5 monitors is very limited for the hobby plan. Why shouldn't I use UptimeRobot (or any other alternative) instead which has 5 minute intervals and also only one status page for free?
30. 60.▲
    by snowstormsun 3y ago

    And DO consistently ignores requests to add this. It prevents me from seriously using Spaces and I think many others, too.