zrm

53 ms·

541.
by zrm 7y ago
It's not possible to make an informed decision about whether to accept a particular cookie without first becoming informed. No UI can change that. But it can at least provide the option for the people who take the time.
542.
by zrm 7y ago
You don't need 120 separate questions, just a single list with all 120 cookies and their domains, with a checkbox next to each one and some "select/deselect all" buttons.
543.
by zrm 7y ago
A VPN server doesn't strictly need a static IP, you can use dynamic DNS.
544.
by zrm 7y ago
Note that hardware offload only really matters when you're combining fast networks with slow processors. WireGuard on a modern PC CPU will more than saturate gigabit ethernet and the per-packet latency hit is <1ms.
545.
by zrm 7y ago
> Aside from the suggestion of beta testing on human lives There was no such suggestion. You can do thorough internal beta testing and still not uncover every bug that will surface in production, because encountering every possible scena
546.
by zrm 7y ago
The thing about systemic risk is that it's systemic. You don't have to wait six months for leaves to fall because when it's spring in North America it's autumn in Australia. One place going without rain for months may be
547.
by zrm 7y ago
Unless you think we should stop having computers in planes, what are you proposing as a solution to that? More to the point, what does it have to do with systemic risk or reducing it by staggering updates?
548.
by zrm 7y ago
Problems like that have technical solutions. You phase in updates over time. A hundred vehicles a day for the first week after release, then a thousand a day, then ten thousand a day and so on. That way if there is a serious bug, you find i
549.
by zrm 7y ago
But then we're back to it being about repair again. If you drop your phone on the concrete and break it, it's completely reasonable that that isn't covered under warranty, but you still want to be able to repair that phone ra
550.
by zrm 7y ago
There is a solution for that -- install a local resolver that makes queries using DoT/DoH/DNSCurve/DNS-over-WireGuard/whatever but answers them using ordinary UDP DNS, then make that your DNS server in /etc/res
551.
by zrm 7y ago
DNSCurve is specifically designed to look like UDP DNS. The problem isn't that the packets don't validate as DNS, it's that some of the middleboxes modify them , or don't send them to the appropriate server at all and t
552.
by zrm 7y ago
You can't get 0-RTT with TCP because the TCP handshake itself isn't 0-RTT. HTTP/3 accomplishes it by switching to UDP -- but then you can't get through the legacy middleboxes that only allow HTTPS over TCP port 443.
553.
by zrm 7y ago
Trusted mainstream implementations come from use. You might get the same number of vulnerabilities from a green new DNSCurve library as from old battered OpenSSL because you're trading off the protocol complexity against the years of g
554.
by zrm 7y ago
It's simple if you pull in a dependency on a library that does it for you, but that's just putting the complexity in the library. HTTP is a complex protocol, TLS is a complex protocol, even just using TCP isn't exactly simple
555.
by zrm 7y ago
It'd be nice if we could settle on DNSCurve for authoritative servers even now. It's significantly simpler and more efficient than DoH and the only real advantage DoH has over it (less interference from quarrelsome middleboxes) is
556.
by zrm 7y ago
> My mother would click any number of scary UAC prompts in Windows just to get to the webpage she's trying to get to. That's not Windows' fault, but it is reality. It kind of is Windows' fault, because it's prete
557.
by zrm 7y ago
> The i7-2600K is a desktop CPU, the i3-8121U is a laptop CPU. The i3-8121U is a low-power CPU. Low-power processors often end up in desktops like the Mac Mini (which doesn't use that specific model but has used U-series processors)
558.
by zrm 7y ago
i3-8121U (one year old) vs. i7-2600K (eight years old): https://www.anandtech.com/bench/product/2367?vs=2413 The newer i3 wins a few, and has much lower power consumption, but the old i7 wins more. Naturally the 2
559.
by zrm 7y ago
Which is a good argument for not using your ISP's DNS either, but those are not the only two options. One of the better alternatives is to get a VPN you trust that puts multiple users behind the same IP address and then operate your ow
560.
by zrm 7y ago
A lot of these are just words describing two-subject events. When there is a lease, someone is lending and someone is borrowing. Same for rent, bill, left, etc. A lot of the others are present vs. past tense. After you put something where y
561.
by zrm 7y ago
> DoH solves an immediate problem, which is that ISPs (and other entities) passively monitor DNS traffic to collect intelligence on network users. DNSSEC does nothing about this problem. That's assuming the DoH provider isn't m
562.
by zrm 7y ago
Aren't you the one usually telling everyone that DNSSEC is useless even though it solves the same problem, e.g. because the server can be verified with TLS instead? If the DNS attack is nothing more than a denial of service then it see
563.
by zrm 7y ago
Adversarial networks are not the common case. On the majority of networks you can send a plaintext UDP DNS query to 8.8.8.8 or 1.1.1.1 and nothing will actually interfere with it in practice. Adversarial networks exist , which is why somet
564.
by zrm 7y ago
> Is security policy via DNS really a good way to go? There are other, imo more effective, ways of handling this. If your security policy can be defeated by using a DoH resolver, it’s evidently not very hard to bypass. That's assumi
565.
by zrm 7y ago
That's really the opposite of those cases. If you're using group policy then Mozilla's default doesn't matter very much because you can set it to whatever you want using group policy anyway. Where the default really matt
566.
by zrm 7y ago
Better, but still broken because in many cases the names also exist in the global DNS but should have different addresses, e.g. because they have port mappings from public addresses but you don't want to have to use hairpin NAT for loc
567.
by zrm 7y ago
The primary advantage to HTTP is that you can run the DNS server on the same host as an ordinary HTTP server that serves other pages. And then, especially for the likes of Cloudflare, that makes it harder to block. But what they should have
568.
by zrm 7y ago
It's not a matter of knowledge. If each application ignores the OS DNS configuration in favor of its own, it's no longer possible to make a system-wide change to it. You have to change each application individually, and then go ba
569.
by zrm 7y ago
It has been ATX12V/EPS12V since around the Pentium 4, which itself only added more 12V rails to the original ATX connector to supply more power. Moreover, ATX and ATX12V power supplies have the same dimensions, use the same mounting, a
570.
by zrm 7y ago
Then implement it with elements rather than pages. Regardless of how many elements fit on a page, you could then get a reference to the page that begins at element 12345 in a given sort ordering, and come back and continue from there at any

More ›