winstonwinston

17 ms·

61.
by winstonwinston 5mo ago
> I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. So, how is that
62.
by winstonwinston 5mo ago
I think it’s problematic that one permission was automatically adding another high trust permission, that they argued as expected behavior and then they silently changed this behavior, fixing the reported security issue.
63.
by winstonwinston 5mo ago
On my account they always serve Google issued certificates. There is also Let’s encrypt certificate but it is not used though. I guess that’s a fail-safe.
64.
by winstonwinston 6mo ago
I see your point.
65.
by winstonwinston 6mo ago
It's a software, not a machine. The comment is relevant to the suspicion that THE software is using (distributing) some OSS code without attribution.
66.
by winstonwinston 6mo ago
I agree with your point but this is the reality: F.E. Python stdlib http.server comes with a warning: Warning http.server is not recommended for production. It only implements basic security checks. The `standard` way is then to use WSGI or
67.
by winstonwinston 6mo ago
These are often not enough ‘battle-tested” and come with a warning to never expose to public internet. So then you put a WAF in front of it, and you are back to HTTP reverse proxy setup.
68.
by winstonwinston 6mo ago
There is /etc/services to map port numbers to service names, and using getportbyname() to resolve port numbers.
69.
by winstonwinston 6mo ago
> Let’sn’t Encrypt But also very funny.
70.
by winstonwinston 6mo ago
> There's nothing anyone can do about it, but the suspicion is that the big companies have taken everyone's code on GitHub, without consent, and trained on it. I asked agent X what is the source of training data it generated co
71.
by winstonwinston 6mo ago
For that use case SMB with Time Machine you just need a mini PC type that you can install Linux or BSD OS, and the Samba configuration is really simple, up to 20 lines in one conf file to support Apple Time machine. It will always be up to
72.
by winstonwinston 6mo ago
First time I enabled iCloud keychain when it was released in iOS 7, it asked for both user defined security code (4-pin at the time) and a verification phone number. When you switch to a new device and want to pull iCloud keychain to a new
73.
by winstonwinston 6mo ago
No, the ssh CA model works like this: servers trust one CA, and the CA signs user keys. No more distributing individual public keys to every machine. It is the user machine that needs new certificate signed by the CA once the short-lived on
74.
by winstonwinston 6mo ago
These are often to install a repository and a package. The alternative is to run something like rpm -i from_url.rpm to install some package directly. Which is not exactly any different from security perspective. There is no easy way around
75.
by winstonwinston 6mo ago
There exist some disclosure embargo exceptions when you believe the vulnerability is being used in wild or when the vulnerability fix is already released publicly (such as git commit), which makes it possible to produce exploit quickly. In
76.
by winstonwinston 6mo ago
> Now, there are definitely folks who will choose to mark some of what we send as spam. And for them, rightly so. We get that. But this is not that. Your reputation depends on THAT. Other metrics you think matter, they do not.
77.
by winstonwinston 7mo ago
> Additionally, the DMARC policy for upwork.com is set to "strict" - which means that if the SPF check fails then all RFC-compliant SMTP servers should reject the message. There is no “strict” policy. DMARC policy can be one of
78.
by winstonwinston 7mo ago
Very likely, from experience package manager like dnf consumes about 1GB of memory just to fetch package metadata.
79.
by winstonwinston 7mo ago
"Enterprise Linux 10" based distros by comparison cut out support for a lot of what they consider legacy hardware in current versions. Namely CPU must support x86-64-v3 which means AVX/AVX2 capable CPU only, whereas Windows (
80.
by winstonwinston 7mo ago
The last push for native apps was in Windows 8 era, i think, it didn’t work. Since then i don’t know of any native apps from Microsoft, anything new is web based or electron.
81.
by winstonwinston 7mo ago
> I mean if i really didnt remember my password then my keychain data would have been gone without which lot of work related info would have been hard to recover. It is reasonable to expect that having a password it is used to protect th
82.
by winstonwinston 7mo ago
It will work, they'll figure it out based on postcode and city name. I get items delivered to me, to this day, because at the time of account registration the address form had only Yugoslavia.
83.
by winstonwinston 7mo ago
> to protect against really only physical attacks where someone directly steals the data storage. Yes, physical access poses a significant risk to data security, it should not be ignored.
84.
by winstonwinston 7mo ago
TESLA? They probably meant to say TLS.
85.
by winstonwinston 7mo ago
*.example-private point is to have multiple machines using private addresses such as web.example-private in A 192.168.0.100 and db1.example-private in A 192.168.0.101. If you just want to resolve 127.0.0.1 then you just resolve hostname &qu
86.
by winstonwinston 7mo ago
> Why are they (DNSSEC + WebPKI) never considered complimentary? WebPKI works without DNSSEC, whereas DANE (a more secure WebPKI replacement) depends on a robust DNSSEC deployment.
87.
by winstonwinston 7mo ago
If it just says that it is partly based on Nextcloud, that does not imply they modified Nextcloud code at all. Other parts of the platform could be based on some other code, even closed one.
88.
by winstonwinston 7mo ago
> Blanchard's account is that he never looked at the existing source code directly. That’s a weird statement while releasing the new version of the same project. Maybe just release it as a new project, chardet-ai v1.0 or whatever.
89.
by winstonwinston 8mo ago
I have an electronic certificate for sign and verify on my physical national identity chip card. You either use it physically or online but only at times when identity confirmation is required.
90.
by winstonwinston 8mo ago
> I see a few people here complaining about the idea of a central digital identity service. Digital identity service is fine for gov services. It’s not OK as a hard requirement for anything else such as banking. Digital ID in my country

More ›