Viewing profile — DorothySim

> For example, IIRC NetBSD required new developers to meet with one or two existing developers in person to verify their identity. (Pretty much like a regular PGP WoT.) Debian also…

> What I'd really like to see is a JS implementation of the "dynamic" features like diffing That's possible. I've made something like that (dynamically fetching git info via dump H…

But if you don't provision the device yourself how can you be sure it hasn't been tampered with in a way that just displays "bootloader OK, everything good" but in the mean time it…

Interesting design. As far as I understood from old papers client certificates are used only to identify the device while user authentication is handled differently. Could you elab…

They also take into account the state of the machine you're working on. So locked bootloader and probably a client cert in TPM-like component, plus "device health". Client certs al…

I think the only restriction is working on Google approved hardware so no BYOD there. (Disclosure: not a Google employee).

For people interested in specs, here's the link: https://www.greenbytes.de/tech/webdav/draft-ietf-httpbis-cac...

The "Online Demo" button brings me to the download page. Is this a bug?

I suggest returning 404 Not Found instead of 422 Unprocessable Entity on failed GETs: https://jsonbin.io/b/2342342 as well as Content-Type: application/json instead of current text…

> C# and Java allocate objects to the heap and primitive types to the stack by default (...) Note that it only applies to local variables. If you have a primitive inside an object …

Looks very good and I like that they have a screenshot right on the home page. I wish there was an anonymous instance to try it out without the tedious login process...

I've used a simple iptables approach to redirect traffic to new Docker container: iptables --wait --table nat --append PREROUTING --protocol tcp --dport 80 ! --in-interface docker0…

Also relevant: https://vimeo.com/110554082

Note that it is about TLS client certificates so it's not as widespread as it seems (unless you use these certs of course :) ).

Probably yes. Sending scores in HTTP requests is such a low-hanging fruit for exploitation. A friend of mine was responsible for scoring system on games. As they had some real awar…

Wow, very nice! I think this comment on issues is also relevant: https://github.com/Microsoft/vscode/issues/1031#issuecomment...

...or Thunderbird (Enigmail) for people that like GUIs.

> For hostkeys on DO you can probably get a script to run that'll request a signed certificate from a server you own. Or just embed the signed host certificate in cloud-init.

You are not required to use SSL to do hello world. You are required to use SSL if you want to use HTTP2 (yes, I know about h2c).

According to this [0] they are related ("SRP is related to Diffie-Hellman."). [0]: http://web.archive.org/web/20130407190430/http://chargen.mat...

CVE disclosure list: oss-security@lists.openwall.com (unfortunately since Mitre stopped taking bug reports via e-mails it's not as active as it has been).