garrettr_

6 ms·

1.
by garrettr_ 2y ago
EVs are heavier than similar ICE vehicles, but they also have regenerative braking, which greatly reduces wear on the brake pads. I suspect EVs produce much less particulate pollution from brake pads, but somewhat more from their tires.
2.
by garrettr_ 2y ago
Go to the left sidebar, open the dropdown menu labeled with your account email at the bottom, click Feature Preview, enable LaTeX Rendering.
3.
by garrettr_ 2y ago
w.r.t SQLite, the only horrifying revelation I’ve had is that it allows NULLs in composite primary keys, which I’ve seen lead to some nasty bugs in practice.
4.
by garrettr_ 4y ago
Exporting is purposefully made impossible in many implementations of Passkeys (aka Webauthn authenticators) other than Apple's. For example, Yubikeys are designed so private keys can never leave the authenticator [0]. Enabling the expo
5.
by garrettr_ 4y ago
Paste ( https://pasteapp.io/ ) has this feature too.
6.
by garrettr_ 4y ago
There's a striking similarity between the author's mockups from Feb 15 and the redesigned System Settings announced in the beta of macOS Ventura and last week's WWDC [0]. I guess they got their wish! [0]: https://w
7.
by garrettr_ 4y ago
Regenerative braking
8.
by garrettr_ 6y ago
There are numerous Firefox add-ons that provide this feature, e.g. https://addons.mozilla.org/en-US/firefox/addon/leechblock-ng... . IMHO, the main benefit of using Safari/Screen Time for this is that it
9.
by garrettr_ 7y ago
> I don't know what you mean by "Firefox doesn't enforce [CT]". They mean Firefox, unlike Chrome and Safari, doesn't require proof of inclusion in a CT log for recently issued TLS certificates to be considered va
10.
by garrettr_ 7y ago
The jobs.apple.com link appears to be broken :) It doesn't link to a specific job description, just an empty search form with 100s of results.
11.
by garrettr_ 7y ago
Project Zero also regularly publishes on flaws in Google's own products. Check out https://googleprojectzero.blogspot.com : they do a fair amount of reports on Chrome, ChromeOS, Android, etc.
12.
by garrettr_ 7y ago
I was recently asked by a friend who teaches 5th graders to do something similar for their school's "career month." I tried a few different things, and found the most successful was showing them how to use a web browser'
13.
by garrettr_ 7y ago
> It's a video with no transcript While Apple only started posting transcripts of WWDC presentations last year, https://asciiwwdc.com has been around for a while and is a great searchable archive of WWDC transcripts. Her
14.
by garrettr_ 8y ago
“What this does is free your co-worker to be 100% honest. They don't know which parts of the interview were really you trying to perform well.” Since there was no mention of it in the post, this is called “randomized response,” and is
15.
by garrettr_ 8y ago
It's fiddly, but you can get good results in a consumer grade oven if you: 1. Use a preheated pizza stone or similar (e.g. cast iron pan) to get as much radiant heat into the crust as possible. 2. Position the pizza stone close to the
16.
by garrettr_ 8y ago
Good point. I'm pretty sure this component of resistFingerprinting is derived from Project Fusion, which uplifts privacy/anonymity-related changes from Tor Browser into Firefox. In the Tor Browser threat model, the idea is that yo
17.
by garrettr_ 8y ago
Windows’ OS keychain API is pretty weak, accessing secrets does not require user authorization. macOS and some Linux desktops environments do it slightly better, but there’s only so much you can do to defend against an attacker with the sam
18.
by garrettr_ 8y ago
This a nice practical technique for extracting Chrome cookies, and is slightly less work than the alternative of writing a cookie db decyptor based on Chromium’s publicly available source code. On platforms that have a decent OS-level keych
19.
by garrettr_ 8y ago
As pronoiac has already said, libssh != OpenSSH, which is far more widely used. According to the footer on https://www.libssh.org/ , projects using LibSSH include KDE's sftp implementation, X2Go, and... GitHub: "Gi
20.
by garrettr_ 9y ago
For the love of god, please stop calling all cryptocurrencies and cryptocurrency-related projects "crypto."
21.
by garrettr_ 9y ago
> I'm aware it's only 190 bits of keyspace. I mentioned this in my blog post[0], and would in fact be more likely to decrease it than increase it, in order to make the URLs shorter. I don't think it's a problem, but a
22.
by garrettr_ 9y ago
A quick look at the source code shows the generate_key() function [0] to be insecure. It generates 32 random bytes (good, that's what you need for an AES-256 key), but then it uses those random bytes to sample from a distribution which
23.
by garrettr_ 9y ago
Cryptography Engineering [0] is a great book that covers key topics in cryptography with a focus on best practices for implementors and system/protocol designers. Matthew Green's blog, A Few Thoughts on Cryptographic Engineering [
24.
by garrettr_ 10y ago
I think it's a mistake to interpret the wave of stories about Uber's misbehavior as indicative of a "hit job" or "media bias" against Uber. Courage is contagious, and as people have started to speak out publicl
25.
by garrettr_ 10y ago
Zeroing on malloc and/or free would not have prevented this type of error, since the information disclosure was due to an overflow into an adjacent allocated buffer. However, zeroing on free is generally a useful defense-in-depth measu
26.
by garrettr_ 10y ago
(SecureDrop developer here). Obviously we agree, using a SecureDrop-specific subdomain makes traffic analysis trivial. Our deployment best practices [0] warn folks not to use subdomains. Sadly, since SecureDrop is decentralized, we cannot e
27.
by garrettr_ 10y ago
(SecureDrop developer here) That's why we created https://securedrop.org/directory (HTTPS, HSTS, preloaded, .onion available, etc.). Use that instead! Also, we have strong recommendations for the news organization&#x27
28.
by garrettr_ 10y ago
My favorite is "monkey-patch," which came from engineers incorrectly reproducing an earlier term, "guerilla patch", as "gorilla patch": https://web.archive.org/web/20120730014107/http:
29.
by garrettr_ 10y ago
No, but they don't have to because (the vast majority of) users don't establish trust in website's TLS certificates themselves; instead, they use a trusted third party: the set of all trusted certificate authorities in their
30.
by garrettr_ 10y ago
If the codes are time-based (TOTP), they are typically generated with a rolling window of 30 seconds (as you saw in Google Authenticator). The 30s rolling window is the recommended (and widely implemented) default value from the TOTP RFC [0

More ›