Viewing profile — robbya

I read this as: a group of professional engineers dedicated to hosting/scaling a platform designed for hosting blogs will perform better than a single random person managing a pers…

There's an HTTPS version too: https://dspace.mit.edu/handle/1721.1/97690

For anyone who is curious about this line of thinking, I'd recommend reading a little bit of Neil Gorsuch's "A Republic, If You Can Keep It." The book covers these ideas very well.…

Anyone know what malware was served?

> removing a 'create file' clause does not cause that file to be removed on subsequent runs, as the tool has no concept of ownership Terraform on the other hand does have a concept…

More info about the issue here: https://www.mozilla.org/en-US/security/advisories/mfsa2020-0...

I think it's worth recognizing that this is a good first step in a hard problem. Hosting many TB of data for free isn't easy. Building an index on top of that data isn't easy eithe…

https://academictorrents.com/about.php#mirroring Using RSS to allow mirrors to host different subjects is really clever, although some of the categories seem quite large (>5TB). It…

Is Samsung Internet better than Chrome? I've always assumed it was bloatware since it's preinstalled and I haven't heard of people using it. I personally use the Firefox mobile bro…

> just put a different joke in I wonder how often you get a different joke on the translated audio and yet another different joke in translated sub titles. Kind of wild.

FWIW subtitles for the original language will also sometimes vary from the original audio as well. I tend to re-watch shows on low volume with subtitles on so I've caught this a nu…

> Imagine someone in a domestic abuse situation Depending on how abusive you are thinking, that sounds like rubber hose cryptanalysis. That's a hugely powerful approach and I think…

Edit: looking again, I see what I missed. > The only real defense is to never associate your phone number with personal accounts which even then is often not possible. Yes that's e…

You're talking about account recovery, not 2FA. A website can use my phone number for account recovery even if I'm not using SMS as 2FA. I agree with everything you said about SMS …

Sure, everything that has a backdoor is bad. But what does that have to do with SMS 2FA? Surely SMS 2FA (without a backdoor) is better than nothing. Sites should still offer someth…

Why? It's not "secure" but it's more secure than nothing. The paper mentions some websites that claim to use SMS 2FA, but actually use SMS as a single factor for password resey. Wh…

This is really a criticism that Google called their system 2FA but actually was using it as a sole factor. That's bad security and bad naming. Had they actually used it as a second…

For anyone who doesn't detect the sarcasm or is unfamiliar: https://techcrunch.com/2018/09/27/yes-facebook-is-using-your...

> Most any language's built in psuedorandom number generator is going to be sufficiently random that you will have no trouble. I once collected a $3k bug bounty over this. Python's…

Agreed. I found this project helpful for automating dependency checks: https://github.com/pivotal/LicenseFinder I actually played around with turning it into a GitHub action for fu…

For changes that are a pure file rename 'git mv' tracks those pretty cleanly. Anything beyond that... I don't know of any good tooling either.