d-z-m

6 ms·

1.
by d-z-m 2y ago
Looks cool! a bit of crypto hygiene though, I'd recommend passing the ECDH output through a KDF before using it in xsalsa20-poly1305. Also, if you're using xsalsa20 anyway, why go through the trouble of doing incremental n0nces? O
2.
Ask HN: How does WebKit ITP work?
5 points by d-z-m 2y ago|1 comments
3.
Ask HN: Why does Firefox treat 3rd party cookies from Google differently?
7 points by d-z-m 2y ago|3 comments
4.
by d-z-m 2y ago
I would recommend Derek Lin's translation[0]. [0]: https://taoism.net/wp-content/plugins/wonderplugin-pdf-embed...
5.
by d-z-m 2y ago
If you're going to stand behind your product, I'm not sure posting with a throwaway sends the strongest message.
6.
by d-z-m 2y ago
also an unfortunate acronym
7.
by d-z-m 2y ago
> 0¹²⁰10000111 for those of you(like me) wondering where this apparently spooky constant is coming from, it is a bitstring of the coefficients of the lexically first irreducible polynomial of degree b with the minimum possible number of
8.
by d-z-m 2y ago
QUIC still runs over UDP. Are you referring to MASQUE?
9.
by d-z-m 2y ago
> No it does not. If the packet is at your door it is too late already. Too late for what? Again, it only makes sense to talk about "security" in the context of a threat model. You can debate the reasonableness of that threat
10.
by d-z-m 2y ago
use a vpn that does not advertise its presence, like wireguard.
11.
by d-z-m 2y ago
"security" is a term that has to be defined in relation to a threat model. If your threat model is an attacker with a static IP hammering your server, fail2ban does provide some security against that sort of attacker.
12.
by d-z-m 2y ago
Link appears to be broken.
13.
by d-z-m 2y ago
In context, I believe interpretation number 1 stands on firmer ground than yours. In the previous paragraph: > Unlike his wife, Hemingway never went ashore at Normandy. On June 6, all he could do was watch from a landing craft as America
14.
by d-z-m 2y ago
> using a model from a place like Huggingface means the author of the model can execute any code on your machine To my knowledge this is only a problem if the model is serialized/de-serialized via pickle[0]. [0]: https://
15.
by d-z-m 2y ago
I'm saying that when I import something, "foo/bar" "bar/baz" etc, The way I access the exposed functions and types in that package usually corresponds to the basename. e.g. bar.* for the first example, an
16.
by d-z-m 2y ago
Happiness arises spontaneously when our desires are sated, whether they be sexual or otherwise. It arises also when our aversions are fended off. "Desireless-ness is wisdom. The two are not different; they are the same."
17.
by d-z-m 2y ago
"if you see the illusion, you are enlightened. but if you think that you are enlightened, you are in the illusion."
18.
by d-z-m 2y ago
The original quotes are deeply profound. They point to something that is beyond understanding. I also found the attempt to invert them to be off-putting. "Do not belabor wisdom to examine it;" - Niutou Farong [0]: http
19.
by d-z-m 2y ago
it means: this is normally how imports in Go work, is it not?
20.
by d-z-m 2y ago
This is normally how it works, no?
21.
by d-z-m 2y ago
For those with whom this resonated, you may also like the writings of Jacques Lusseyran. Some selections from his works can be heard here[0]. [0]: https://www.youtube.com/watch?v=Bn4SHdeVz-o
22.
by d-z-m 2y ago
In the linked video, is there a timestamp for when the TLS+DNS blocker is discussed?
23.
by d-z-m 2y ago
> There are tons of things that linters warn about (today), that should have been errors too by their logic. Can you give a couple examples?
24.
by d-z-m 2y ago
> "Unused vars are warnings" is not a possible opinion for go, period. It's also not a possible opinion for go tooling like 3rd party linters. Right, but that doesn't mean that Go doesn't have an opinion about un
25.
by d-z-m 2y ago
> SNI = nsa backdoor into https everywhere. No. Not even remotely true. If you can write a coherent argument that substantiates this claim then I will address it.
26.
by d-z-m 2y ago
> I don't see how you think NSI doesn't nullify https everywhere. It doesn't. SNI doesn't leak the URL being accessed, or anything that isn't encoded in the hostame.
27.
by d-z-m 2y ago
Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect. The scenario I'm imagining is: someone opens the T
28.
by d-z-m 2y ago
There comes a point when "just asking questions" crosses a line into conspiratorial theory crafting. I can ask all kinds of crazy questions, like: "what if the world is run by a species of lizard people who live underground?
29.
by d-z-m 2y ago
> Call me paranoid You're being too paranoid. If you have a substantive disagreement with the content of the "Too Much Crypto" paper then we can talk about it, but to posit that Aumasson was compromised by a TLA(with no e
30.
by d-z-m 2y ago
can you elaborate?

More ›