aeijdenberg

5 ms·

1.
by aeijdenberg 9mo ago
https://github.com/continusec/htvend/ htvend is a tool to help you capture any internet dependencies needed in order to perform a task. It builds a manifest of internet assets needed, which you can check-in with y
2.
by aeijdenberg 1y ago
I've been thinking a lot about this kind of thing recently - and put a prototype up of htvend [1] that allows you to archive out dependencies during an image build. The idea being that if you have a mix of private/public dependenc
3.
by aeijdenberg 1y ago
Thanks for taking a look. The intent was to support basic build systems accessing package eco-systems that tend to always serve the same response for the same URL. Docker registries do this reasonably well, as do Maven repos. It wasn't
4.
Show HN: Htvend, a tool to capture internet dependencies(github.com)
3 points by aeijdenberg 1y ago|2 comments
5.
by aeijdenberg 1y ago
The TS doesn't seem to provide for a way to modify return values for the function. For example the following is a common pattern in Go using defer to ensure that errors closing a writeable file are returned: func foo() (retErr er
6.
by aeijdenberg 7y ago
We use Terraform a lot too - and most of the time it's great, but not infallible. Our team managed to screw-up some pretty major DNS due to a valid terraform plan that looked OK, but in reality then deleted a bunch of records, before f
7.
by aeijdenberg 8y ago
Slight, but important (if you don't want to run out of fuel) nit, indicated airspeed (KIAS) is not the same as true airspeed (KTAS). To calculate ground speed (as required for navigation and fuel planning) you need true airspeed (not i
8.
DTA warns blockchain is still a solution looking for a problem(itnews.com.au)
2 points by aeijdenberg 8y ago|0 comments
9.
by aeijdenberg 8y ago
False only for very small values of code. ie if your code itself is split into modules, they won't work (as they are imported by their full path, not relatively), and anything in your vendor dir is also ignored when used outside of a G
10.
by aeijdenberg 8y ago
You can certainly claim something is centralized and tamper-evident. ie demonstrate proof that something has not been mutated over time. See RFC6962 Certificate Transparency logs and their consistency proofs for a widely used example.
11.
by aeijdenberg 8y ago
Not quite as simple as a cryptographic hash alone - remember that if the set of possible inputs can be easily enumerated, then it's trivial to find the input data by brute force. There are ways to work around this, for example objectha
12.
by aeijdenberg 9y ago
Glad to see any doc published that gets developers thinking more about security... One "trend", or rather bad habit that I've noticed a lot in discussion with other developers recently, and this doc also falls into, is that t
13.
by aeijdenberg 9y ago
Making a hash of the release is just a small part of it (and is the first part of what they are doing). The trick is to be confident that you're getting the same hash as everyone else - and that's what requiring a proof that it be
14.
by aeijdenberg 9y ago
CT significantly pre-dates the recent Symantec issues, but yes, it does provide an excellent tool for providing evidence of misissuance [0] [1] - and that's the crux of it - in order for a certificate to be considered valid in a CT wor
15.
by aeijdenberg 9y ago
CT logs are designed to be able to handle queries from all web browsers on a daily / more frequent basis, and the output from queries is easily cacheable (and the logs can be mirrored in a read-only manner). If FF is already doing an
16.
by aeijdenberg 9y ago
If I'm understanding correctly, the plan is to piggy-back on top of the existing Certificate Transparency [0] infrastructure by issuing a regular X509 certificate per Firefox release, but for a special domain name that includes a Merkl
17.
by aeijdenberg 9y ago
As I understand it, Chrome (unlike Firefox) does not ship its own root CA store - rather it defers to the root store of the operating system that it's running on. It does however apply some form of blacklist / additional restricti
18.
by aeijdenberg 10y ago
If you're looking to be able to consistently hash JSON objects you might want to look at Ben Laurie's objecthash: https://github.com/benlaurie/objecthash It describes a consistent way to hash an object withou
19.
by aeijdenberg 10y ago
I'd always assumed the primary goal of LinkedIn endorsements is the same as every other email I get from LinkedIn, to keep user engagement with the site - and based on the number of colleagues I see accepting them, I'd say it&#x27
20.
by aeijdenberg 10y ago
What benefits does this approach give above those offered by Certificate Transparency [0]? I was surprised to see no mention of this as related work in either the linked paper or site FAQ. [0] https://www.certificate-transparency
21.
by aeijdenberg 10y ago
The problem I've found is that when we start using cute tricks like the old "xxx" % locals(), or the newer f-strings, is that we tend to start forgetting basics like escaping the strings that we're substituting in. For
22.
by aeijdenberg 10y ago
If I recall correctly, don't some older versions of Windows broadcast (as an adhoc network) the SSID of the last hotspot they successfully connected to? [0] If so, wouldn't it be quite plausible that an owner of a Galaxy Note 7, w
23.
by aeijdenberg 10y ago
Probably no reason other than that it takes time and resources to go through all the steps necessary to launch in a region (e.g. localization, legal etc), and it's more effective to get feedback on a beta product early in one region th
24.
by aeijdenberg 10y ago
Should such a requirement (CT for private CAs) exist, wouldn't the said laptop vendor simply ship embedded SCTs in their fake certs signed by their own fake log key, also baked into Chrome? (that doesn't even need to correspond to
25.
by aeijdenberg 10y ago
So that you (or other interested parties) can verify the correct operation of the centralized authority, and so that the central authority can prove that they aren't hiding anything. For example, in the case of certificate transparency
26.
by aeijdenberg 10y ago
If you can accept centralization (which for many non-crypto-currency use-cases actually makes sense, since it mirrors the way the real world works) - you don't actually need proof of work. You can still get the benefits of verifiabilit
27.
by aeijdenberg 10y ago
Congrats to Adam, Steve and team! Flight search is a tough industry to break into, and they did a great job against the odds to get there.
28.
by aeijdenberg 10y ago
(founder here) I recently launched Continusec, which provides hosted Verifiable Data Structures. These are verifiable logs and verifiable maps based on the same principles as Google's Certificate Transparency logs, generalized for any
29.
Show HN: Verifiable Data Structures(continusec.com)
2 points by aeijdenberg 10y ago|1 comments
30.
by aeijdenberg 10y ago
Would be interested in your feedback on Verifiable Maps as implemented at https://www.continusec.com/ which can give verifiable answers to specific questions such as what is the current balance as well as a full history log

More ›