zhfliz

7 ms·

31.
by zhfliz 4y ago
anyone can upload someone else's code to GitHub, not just people who can grant such permission.
32.
by zhfliz 4y ago
I've read the entire issue and it's just about bridge users. UIDs get desynced between IMAP client and bridge, as the bridge does not seem to use persistent UIDs for messages. If you don't use the bridge you won't have i
33.
by zhfliz 4y ago
haven't seen an official announcement of this, only various people assuming in various places on the internet. if you have any official statement to support that i'd be happy to see that.
34.
by zhfliz 4y ago
at least with paypal it's possible to allow future deductions without explicit authorization through paypal every time. i don't know if their terms allow this to be used for recurring payments, it is used e.g. for services such as
35.
by zhfliz 4y ago
ylearn.com != lyearn.com
36.
by zhfliz 4y ago
my mojang account was not banned for alleged ToS violations which i can buy myself free from by providing them with a phone number they promise to only use for "validation" (this is not related to bans for chat, this is about MS j
37.
by zhfliz 4y ago
> Reallocate new IP ah yeah, because I just want to do trial and error until I maybe find an IP that isn't flagged. fwiw, several VPS providers will keep the same IP assigned to you if you just create a new VPS after deleting the ol
38.
by zhfliz 4y ago
not as flexible, as it has more dependencies, but you can make it work without gpg as well: https://developers.yubico.com/yubico-piv-tool/YKCS11/
39.
by zhfliz 4y ago
The part I'm having issues with is "taking", which is e.g. in the Merriam-Webster definition of "steal". If someone hands/gifts you something you're still taking it (which would match that), maybe I was mo
40.
by zhfliz 4y ago
How is it stealing if someone drops an envelope with $1000 cash in your mailbox? Not arguing that crypto.com has no right to the money, but stealing is very different from being the wrong recipient of a transaction/delivery.
41.
by zhfliz 4y ago
for https, since 1.19.4 you can reject the tls handshake early https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...
42.
by zhfliz 4y ago
that's a good point, although it wouldn't make a difference from the outside perspective. it is however much easier to serve static content than evaluating headers. the benefit of significantly increased compatibility in how you c
43.
by zhfliz 4y ago
without referring to this particular case, how is `/.well-known/LsyrYyZGDMMPwS1lAUS7qXo7c81XLaxPeRrSZdSReFk5zPaJaD` less secure than `/.well-known/key` requiring an `Authorization: LsyrYyZGDMMPwS1lAUS7qXo7c81XLaxPeRrSZd
44.
by zhfliz 4y ago
wow, webauthn is indeed available now. i've been using totp for a long time but webauthn has been long overdue.
45.
by zhfliz 4y ago
not just that, they're also incredibly hostile to users trying to retain privacy. they're requiring phone number validation just after registration or you run the risk that they suddenly lock your account, demanding a phone number
46.
by zhfliz 4y ago
greylisting is not the same. greylisting is responding with a temp error under the assumption that most spam won't retry on temp errors, which isn't the case for most spam anymore. real bounces are permanent errors.
47.
by zhfliz 4y ago
Azure is really supporting use of IPv6. you can get IPv6 addresses from Azure for the same cheap price you can get IPv4 addresses for! not ridiculous at all.
48.
by zhfliz 4y ago
can you name even one service that uses login links and allows you to configure an address that is exclusively used for login links and not any other communication? i'm not talking about unselecting all other types of communication,
49.
by zhfliz 4y ago
that's what i meant. the resolvers (which those apps talk to) are (afaik) generally rfc-conforming and respect ttl, though they may have lower max ttl values, allowing faster refreshes in some cases. certain bad applications however ju
50.
by zhfliz 4y ago
it's not like they haven't tried on macOS https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=25109724 (this was reverted after backlash)
51.
by zhfliz 4y ago
isn't it usually the opposite, except for client applications that ignore the ttl they got from their recursive resolver as they don't want to bother with keeping track of ttls?
52.
by zhfliz 4y ago
if you spoof your user agent to not show windows it'll let you download an ISO directly from MS instead of just MCT
53.
by zhfliz 4y ago
are you the one going to buy everyone in UK a new phone? and fund their data plans?
54.
by zhfliz 4y ago
properly working browser extensions also act as a measure of phishing prevention, as they will only fill your credentials automatically on the correct domains.
55.
by zhfliz 4y ago
cheapest offers go down to $0.55-$0.6 for 1k recaptcha v2 with solving times from close to a second up to 3 minutes depending on provider and luck.
56.
by zhfliz 4y ago
if it's the same one i'm thinking of, the number is shared in the sense that you can buy a verification for google while someone else can buy a verification code for twitter on the same number. iirc they had a guarantee that the n
57.
by zhfliz 4y ago
how? standard TOTP MFA (which is what most password managers would offer in terms of MFA) uses a shared secret, which you would just dump from the same database you get the dumped passwords from. unless you use asymmetric crypto e.g. in web
58.
by zhfliz 4y ago
acme.sh moving to ZeroSSL has nothing to do with increasing variety. acme.sh moved to ZeroSSL as default due to being sponsored by them. my primary reason for avoiding ZeroSSL is the requirement of providing an email address to them that ca
59.
by zhfliz 4y ago
why isn't 1970-01-01 more common?
60.
by zhfliz 4y ago
font injection using a remote server is also problematic due to CSP

More ›