zrm

106 ms·

961.
by zrm 11y ago
> circa 1995 How about this one from just last year: I'm writing an application that encrypts packets using datagram TLS with OpenSSL. Take a raw packet, send it through OpenSSL, it comes out the same on the other end and everything
962.
by zrm 12y ago
Timeouts that short violate RFCs. Established TCP connections can't be abandoned unless idle for two hours four minutes (RFC5382 REQ-5) and even UDP timeouts normally have to be at least two minutes (RFC4787 REQ-5). If people are viola
963.
by zrm 12y ago
That doesn't mean they want to get caught forging signatures. It would destroy their credibility and cause people to take additional countermeasures. In theory the community could revoke their control over the TLD. But I'm trying
964.
by zrm 12y ago
The solutions to those problems aren't possible within the DNS but they also aren't incompatible with it. There is no reason you can't use both DNSSEC and key pinning, and the .com registrar does not want to get caught forgin
965.
by zrm 12y ago
> DNSSEC is a terrible, terrible idea. DNSSEC is a terrible, terrible implementation . All of your criticisms are valid but none of them are inherent to the idea of authenticating DNS resolution. That basically means we need to start ov
966.
by zrm 12y ago
> As a temporary fix we reduced the MTU for all IPv6 paths to 1,280 (solution mentioned as #2). Many other providers have the same problem and use this trick on IPv6, and never send IPv6 packets greater than 1,280 bytes. This feels like
967.
by zrm 12y ago
It looks like what's going on is that gethostbyname() calls __nss_hostname_digits_dots() which checks to see if the string you passed it was an IPv4 or IPv6 address rather than a name, and in that case it functions like inet_aton&#x2F
968.
by zrm 12y ago
The main reason gethostbyname is deprecated is that it doesn't support IPv6. The implementation of getaddrinfo uses gethostbyname, so you're using it either way.
969.
by zrm 12y ago
gethostbyname() and friends fill in struct hostent: struct hostent { char *h_name; /* official name of host */ char **h_aliases; /* alias list */ int h_addrtype;
970.
by zrm 12y ago
> game changing would include SSL for all Let's Encrypt is going to be doing that later this year anyway. https://www.eff.org/deeplinks/2014/11/certificate-authority-... https://letsencrypt
971.
by zrm 12y ago
> Until Amazon starts coming at this with the primary goal of producing a greater, better phone - and the goal of selling more Amazon content a distant second - they will keep failing. The strange thing is that they would have succeede
972.
by zrm 12y ago
> They produced a great stable OS, worked hard, then it was making billions of dollars. Ok, what next? Institute 4 day weeks? (maybe not a bad idea, but I am being hyperbolic here a bit). It's really a business problem. Once you hav
973.
by zrm 12y ago
> And as users start making fewer decisions because of this automation, the "advanced features" that they would otherwise use get used less, leading to their eventual removal. That much is probably inevitable. When they build a
974.
by zrm 12y ago
There is an extent to which that's true, but it's still subject to the same consequences. If you block all "incoming" traffic then developers react to it. Apps that need incoming data just maintain a persistent connectio
975.
by zrm 12y ago
I think I see where you're going wrong here. We need to put some numbers to it. Suppose you can make $20 if you spend $15 adding a feature. Obviously you should do it, right? You'll make $5. So you do. Now the customer comes back
976.
by zrm 12y ago
They don't even have to inject anything, it's surprising they're doing this at all. They could just use the TCP/IP source and destination addresses and ports to identify the connection. TLS wouldn't help that. VPN w
977.
by zrm 12y ago
> In what sort of world default DROP is not a widespread practice? That's the problem. Instead of asking why you're running services you don't really want to be running, just kill anything you don't understand. It&#x2
978.
by zrm 12y ago
The trouble with everyone using whitelists is that the ecosystem responds to it. Widespread use of default deny causes new applications to be tunneled over HTTP[S] or ssh instead of using their own ports, which is in effect just default all
979.
by zrm 12y ago
See also The International Journal of Proof-of-Concept Or Get The Fuck Out. https://archive.org/details/Pocorgtfo00 https://archive.org/details/Pocorgtfo01 https://archive.org/deta
980.
by zrm 12y ago
It's still possible even with DRM, it's just more work. You have to get out a debugger and write new code. But what I meant was that you shouldn't try to make modifications impossible. Yes, it's futile anyway, but it&#
981.
by zrm 12y ago
> My philosophy for a long time has been "every tunable parameter is a design weakness, and every one that must be tuned is a bug." It's completely true that good defaults are essential. But no one person is competent to m
982.
by zrm 12y ago
> Couldn't some form of proof-of-work system be used to increase the cost of sending a message without it having much of an economic impact on a casual sender? Was that what he was alluding to with the "burning bitcoin" re
983.
by zrm 12y ago
First you need a rigorous formal definition of strong AI. Then write a computer program that iterates over all possible computer programs until it finds one that meets the definition. Or try simulating a human brain.
984.
by zrm 12y ago
> In the presence of CTCs, quantum mechanics allows one to perform very powerful information-processing tasks, much more than we believe classical or even normal quantum computers could do That seems like an understatement if I'm un
985.
by zrm 12y ago
> WTF is this "urgent"? How might this affect "all internet users"? Suppose you have a domain registered with Namecheap (or really anyone). You've reused your password and the attackers get into your account at t
986.
by zrm 12y ago
The only way you can make a device "not be world reachable" is to not connect it to the internet. It's silly to think that a vulnerable application invoking listen() is more dangerous than a vulnerable application invoking co
987.
by zrm 12y ago
> Any NAT deployment that large will included local DNS caching servers A DNS cache only reduces the number queries by answering some from the cache, it still sends queries and requires source ports proportional to the number of client q
988.
by zrm 12y ago
Thanks. I can see the bug: The function is overloaded as taking uint64_t or a pointer and I'm passing "0UL" to it, which on 64-bit is an exact match for uint64_t but when 0UL is 32-bit it doesn't know whether to convert
989.
by zrm 12y ago
NAT != firewall. You can have a firewall without NAT. Probably the sensible thing to do for IPv6 is to make the default to block the ports of specific applications people don't canonically expect to be visible from the internet, like W
990.
by zrm 12y ago
It isn't about privileged ports. It's about the protocols those ports are assigned to, and it's really only referring to port 53 for DNS because it's the only protocol that requires it. Using a shorter mapping timeout fo

More ›