zrm

110 ms·

931.
by zrm 10y ago
> Those drivers need to actually communicate with something though, that something is exactly what BMCs are. If the hardware physically providing communication with those systems isn't there, no amount of drivers will help. Addition
932.
by zrm 10y ago
> That could all be implemented, but it would require another hardware controller or some sort of api that has lower level hardware access than the OS does, and something to actually provide that access and communicate with the various c
933.
by zrm 10y ago
> Yes, but BMCs do more than just power machines on and off, and are used for more than powering machines on and off. Turning on a powered-off machine is the only thing that couldn't be done by a hypervisor. Once the machine is turn
934.
by zrm 10y ago
> Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. That's the point. If all you need is the ability to power on the machine, why are you exposing any more than that to the network? > Most platforms don&#x
935.
by zrm 10y ago
> There's no hypervisor that'll let you power up a halted server, change bios settings, change boot device or order, boot the system of pxe, etc, etc. Wake on LAN is a 20th century technology that requires no other privileges t
936.
by zrm 10y ago
> The whole point of a independent hardware KVM is that it's autonomous Which Intel ME isn't any more than a hypervisor is. It uses the same CPU and network interface and can be misconfigured in the same ways a hypervisor can
937.
by zrm 10y ago
If you want this there is no reason the software needs to be embedded in the hardware. Install a hypervisor with remote access, install the other OS in a VM and you have all the same capabilities through the hypervisor, but now you can insp
938.
by zrm 10y ago
IPv6 auto-configuration can encode the ethernet hardware address into the IPv6 address. Then anything that advertises that IPv6 address is advertising your hardware address. Even if you don't use IPv6 -- or especially then since that&#
939.
by zrm 11y ago
> The primary role of SUA was to encourage applications to get ported to Windows without significant rewrites. Is this a supported use of the Linux subsystem? Running native Linux apps directly is great if it works but there are going to
940.
by zrm 11y ago
That isn't what it's for. You can assume the government (really any government) has control over at least one CA. What Let's Encrypt does against state-level actors is let people easily use HTTPS instead of HTTP without subje
941.
by zrm 11y ago
> (Entropy strikes again, even if it's information entropy for a change.) Information entropy and physics entropy are actually the same thing. You can measure heat capacity in bits.
942.
Detexify: handwritten symbol recognition(detexify.kirelabs.org)
91 points by zrm 11y ago|15 comments
943.
by zrm 11y ago
Not only that, anybody with a WiFi Pineapple or any other MITM could 301 redirect anything you visit without HTTPS to their spam site. It seems like browsers interpreting permanent as forever is some kind of a bug. Even if that's lit
944.
by zrm 11y ago
If you don't follow the RFC then people will email you from gmail saying "I tried to send you mail from my company's mail server and it didn't work", other people will submit a github issue to your project saying th
945.
by zrm 11y ago
The local router should only see something that looks like a TLS encrypted connection to a Tor relay.
946.
by zrm 11y ago
> Could you explain why this should be necessary when email communication between the servers and clients is already encrypted via SSL/TLS? Can they bypass that? (And if so how?) RFC2487 Section 5: A publicly-referenced SMTP se
947.
by zrm 11y ago
> Is there anything we can do to protect ourselves from, say, posting something into a HN forum? Or any chat program? Or FB chat, etc...? Tor.
948.
by zrm 11y ago
Where is the extra latency? You can do DNS queries for example.com and _http._tcp.example.com concurrently so that you get both answers in the time of one round trip to the DNS server. If there actually is a SRV record and the target isn&#x
949.
by zrm 11y ago
The article says not to do this: uint32_t numbers[64]; memset(numbers, 0, sizeof(numbers) * 64); That is certainly true because that is a buffer overrun.
950.
by zrm 11y ago
Authorized keys in the context of ssh means the ability to logon without password using public key authentication. Now that I'm thinking about this, anybody know how they're doing public key authentication for domain accounts at a
951.
by zrm 11y ago
Feature request: Domain group policy setting for authorized keys. Make some ssh key(s) authorized to logon as some domain user(s) for every machine in the domain.
952.
by zrm 11y ago
It's very friendly to large providers. The amount of computation needed to send to a domain is the same regardless of how many emails you send so large providers can amortize it over more emails. And large providers generally operate t
953.
by zrm 11y ago
I was thinking about this a while ago and have been meaning to write it up and post it somewhere, so I guess this is as good a time as any. Hashcash (also known as the precursor to Bitcoin) was proposed to solve this problem in 1997: https
954.
by zrm 11y ago
Separating users by subdomain leaks information. An observer can trivially see your DNS queries but not which repository you access over https or ssh. There is also little benefit in it. If the subdomains only point to the same servers then
955.
by zrm 11y ago
It already supports CNAME. You can do example.com CNAME aaa<..>.key. SRV is on the todo list, not least because it also lets you look up the IP address and port in DNS as an alternative to the DHT.
956.
by zrm 11y ago
> The main problem with using a public key as your identity is that once it is leaked, you no longer have an "identity" (or more exactly, it's not uniquely you). There is no way you can change your identification without c
957.
by zrm 11y ago
You're right that SNI is part of TLS rather than HTTP. It's the same trouble though. Most applications don't support TLS+SNI. The way Tor does it is to use a SOCKS proxy. Then you don't need an IP address and it's p
958.
by zrm 11y ago
I'm very strongly considering replacing OpenSSL with NaCl/libsodium. OpenSSL is a nightmare.
959.
by zrm 11y ago
> So if i'm following this right, querying the builtin DNS server for a .key actually triggers DHT lookup and NAT setup? That's the idea. > How are NAT entries recycled? DNS responses have a TTL. The mappings last at least a
960.
by zrm 11y ago
I can answer more questions later today. The project is in the middle of a partial rewrite. The existing DHT has several issues and I'm replacing it. The change is going to break compatibility, which made it into a much bigger change b

More ›