doomrobo

6 ms·

1.
by doomrobo 22d ago
Yes, though MW has the important distinction that it uses short human-readable session identifiers. This means MW supports file transfer where the out-of-band channel is just a phone call. This is also why it needs PAKE as opposed to the si
2.
by doomrobo 2mo ago
Recording of a talk with the same title. I’m not certain it’s the same content as the linked PDF though https://youtu.be/mS9Lr43cIB4
3.
Moving Past Bots vs. Humans(blog.cloudflare.com)
6 points by doomrobo 5mo ago|1 comments
4.
by doomrobo 6mo ago
I’ll ask the dual question: how many of the mobile safari checkmarks are fully fleshed out? Media Session has a check, but I have absolutely fought obvious Media Session implementation bugs in my own PWAs when designing for mobile safari
5.
by doomrobo 7mo ago
>Small block ciphers are thus generally a bad idea against active adversaries. >However, they can be very useful against passive adversaries whose capability is limited to observing identifiers, who are then unable to map them to the
6.
by doomrobo 11mo ago
Yes, if every single URL in your web application has a hash in it (including <a> hrefs) then you don’t have to worry about anyone maliciously serving a webpage anymore. But how do you get new app versions? I argue, if you want any mea
7.
by doomrobo 11mo ago
Emailed :)
8.
by doomrobo 11mo ago
1. I didn't know about this [1] actually! It looks like it's been unsupported for a few years now. The format looks pretty barebones, and we'd still need hashes like you said, as well as "wildcard" entries. I reckon
9.
by doomrobo 11mo ago
Gotcha, yeah I agree. Fwiw, with the imagined code signing setup, the pubkey will be committed to in the transparency log, without any extra work. The purpose of the plugin is to give the browser the ability to parse (really fetch, then p
10.
by doomrobo 11mo ago
I'll actually argue the opposite. Transparency is _the_ pivotal thing, and code signing needs to be built on top of it (it definitely should be built into the browser, but I'm just arguing the order of operations rn). TL;DR you&#x
11.
by doomrobo 11mo ago
You're right that, when your own server is trustworthy, fully self-hosting removes the need for SRI and integrity manifests. But in the case that your server is compromised, you lose all guarantees. Transparency adds a mechanism to det
12.
Improving the Trustworthiness of JavaScript on the Web(blog.cloudflare.com)
65 points by doomrobo 11mo ago|34 comments
13.
Orange Me2eets:We made an end-to-end encrypted video calling app and it was easy(blog.cloudflare.com)
18 points by doomrobo 1y ago|1 comments
14.
by doomrobo 1y ago
Ah ok. How is the encryption key, if there is one, established then?
15.
by doomrobo 1y ago
There are middle boxes between the two peers, yes? Routers and such. They observe the encrypted messages. They can brute force the password, even after the session is over. Even if you assume the PIN is uniformly random (you should not assu
16.
by doomrobo 1y ago
If the server stores the transcript of a session, can it brute force the PIN later on? Magic Wormhole ( https://github.com/magic-wormhole/magic-wormhole ) avoids this by using a password authenticated key exchange (PAKE)
17.
AI Safety Inst.: Pre-Deployment Eval of Anthropic's Upgraded Claude 3.5 Sonnet(aisi.gov.uk)
2 points by doomrobo 2y ago|0 comments
18.
by doomrobo 2y ago
In Europe, this is not uncommon for online purchases. You put in your IBAN number and authorize the transaction
19.
by doomrobo 2y ago
Link should be https://status.gitlab.com/
20.
by doomrobo 2y ago
It’s not actually much different. The main reason to use this is because it’s the standardized version of that concept and has been analyzed by people. All the smaller cryptographic detailed like domain separation, proper key derivation, we
21.
by doomrobo 2y ago
What’s grim? 9.4 billion chickens are killed every year in the US. That’s 25.7 million a day https://www.nationalchickencouncil.org/statistic/broiler-ind...
22.
by doomrobo 2y ago
IBE allows two users to communicate without the trusted party being online
23.
by doomrobo 2y ago
The idea of "appear to be resistant to attack" is an empirical one. When someone says that, they are saying that we simply have not found a good attack against this problem. That can change any day, in principle. Unfortunately, &q
24.
by doomrobo 3y ago
https://www.youtube.com/watch?v=uwJQQux0TF0
25.
by doomrobo 3y ago
There was a great interview with the authors of this game and accompanying book https://srslywrong.com/podcast/290-half-earth-socialism-w-tr...
26.
by doomrobo 3y ago
Also grad student. I use Voice Dream reader on my devices and it's helped a lot with reading dense texts https://www.voicedream.com/
27.
by doomrobo 3y ago
Do you have a source on it being a net carbon sink? I'm skeptical bc there's a lot more effort to make and distribute paper bags than cutting down a tree
28.
by doomrobo 3y ago
I use landscape mode and TTS to read PDFs on the subway. Highly recommend Voice Dream Reader for that use case https://apps.apple.com/us/app/voice-dream-read-aloud/id49617...
29.
by doomrobo 3y ago
Looks like the mention of RSA is outdated. Seems from the codebase like it's all libsodium (x25519 + XSalsa20Poly1305) now. > We formerly used AES and RSA encryption, we prefer to use generic terms now that do not imply any one impl
30.
by doomrobo 3y ago
Context Bug: Microsoft has a majority market share https://bugs.launchpad.net/ubuntu/+bug/1

More ›