indolering

5 ms·

1.
by indolering 15d ago
For a definition of "efficient" that isn't shared by anyone else. This isn't a new rationale either, but a well known trade-off involved with JIT compilation and garbage collection. It's the reason Chrome "hog
2.
by indolering 2mo ago
Montenegro (.me) seems to be aligned with the EU. But I would have expected there to see a legal ruling in France before Montenegro would do this sort of thing. I wouldn't be surprised if GoDaddy caved to request. They are known for
3.
by indolering 4mo ago
That's not how I remember it: it was an experiment that was useful at the time but didn't work out. It was useful internally to sandbox Flash player, but the limitations of the LLVM based approach were soon evident to everyone in
4.
by indolering 5mo ago
I really wish I had messed with Windows Phone when it was a thing. They were the only ones not to just ship a clone of an existing interface ASAP. But it was closed source and offered no advantages for carriers or device makers compared t
5.
by indolering 5mo ago
The floating point "standard" was basically codifying multiple different vendor implementations of the same idea. Hence the mess that floating point is not consistent across implementations.
6.
by indolering 5mo ago
The answer is unequivocally yes: RISC-V is designed to be customizable and a vendor can put whatever they like into a given CPU. That being said, profiles and platform specs are designed to limit fragmentation. The modular design and core
7.
by indolering 6mo ago
I think it's a joke: you REALLY don't want to own your own servers.
8.
by indolering 6mo ago
I'm not unaware of this and I agree that WebPKI has greatly reduced global risk. New DNS tech takes a lot longer to implement but that doesn't mean we should kill DNSSEC support like the trolls insist upon! Why would Let&#x27
9.
by indolering 6mo ago
> The same reasons not to deploy DNSSEC that face large organizations apply to you: any mistake managing your DNSSEC configuration will take your domain off the Internet (in fact, you'll probably have a harder time recovering than l
10.
by indolering 6mo ago
It can be used alongside WebPKI. And as someone who is worried about other protocols, it sure would be nice if I could setup DNSSEC for my domain and have clients pick up on that automatically.
11.
by indolering 6mo ago
More rhetorical dunking instead of engaging with the substantive technical issues. I'm done.
12.
by indolering 6mo ago
But it also applies to every other part of the stack, including WebPKI. Would you accept this as a valid argument against using HTTPS everywhere?
13.
by indolering 6mo ago
DNSSEC also solves a bunch of real world threat models that do cause massive security issues. I think we should put that effort into DNS as well.
14.
by indolering 6mo ago
That's fair! My primary gripe was about the need for non-profits to step in to begin with. Sorry if I didn't communicate that well. However, I'm don't feel sorry for registrars or TLDs. Verisign selling HTTPS certs wh
15.
by indolering 6mo ago
I would really appreciate it if you would respond to my points instead of just moving on to another argument. Do you hardcode Github and AWS keys in your SSH config? Do you think it would be beneficial to global security if that happened a
16.
by indolering 6mo ago
DNS is where domain name authority is delegated. Anything you build on top of that is also going to be a world of hurt if it gets compromised.
17.
by indolering 6mo ago
DNSSEC PKI does not preclude one from hardcoding specific keys in the client as well. Providing global PKI and enabling end-to-end authentication by default for all clients and protocols certainly would make the internet a safer place.
18.
by indolering 6mo ago
Phishing existing isn't a good argument against cryptographically authenticating DNS records.
19.
by indolering 6mo ago
The engineering effort! ECC solves the theoretical concerns around latency anyway yet we have people arguing that it shouldn't be done. But if it was worth making HTTPS faster to secure HTTP, why not DNS?
20.
by indolering 6mo ago
If DNS PKI is compromised, so is HTTPS. So yes, they would be scrambling too.
21.
by indolering 6mo ago
HTTPS also has expiring keys that also need to be rotated. Most people outsource this to a service provider for them - as is the case with DNS. It's weird how people gripe about standard cryptography/PKI when it comes to DNSSEC
22.
by indolering 6mo ago
And for everyone else that just wants to connect to an SSH session without having to setup PKI themselves? Tying that to the records used to find the domain seems like the obvious place to put that information to me! DNSSEC lets you delega
23.
by indolering 6mo ago
> None of what you've written here applies to the TLS and WebPKI case, so I'm going to take it that you're not arguing that DNSSEC validation by clients provides a security improvement in that case. It would benefit the li
24.
by indolering 6mo ago
> LE isn't primarily funded by non-profits, as you can see from the sponsor list here: https://isrg.org/sponsors/ I mean, Mozilla got the ball rolling and it's still run on donations (even if they come fro
25.
by indolering 6mo ago
> They did, and then we spent an enormous amount of time to shave off a few round trip times in TLS 1.3 and QUIC. But if it's worth doing for HTTP, why not for DNS? > Actually, it really depends. It can actually be faster. Here a
26.
by indolering 6mo ago
Which is a problem with the OS and browser, not with DNSSEC.
27.
by indolering 6mo ago
DNS underlies domain authority and the validity of every connection to every domain name ultimately traces back to DNS records. The amount of infra needed to shore up HTTPS is huge and thus SSH and other protocols rely on trust-on-firs
28.
by indolering 6mo ago
It's a lot like HTTP and every other early internet protocol that existed before the crypto. Everyone agrees that it's a problem but fixing all the existing infra is really hard and expensive.
29.
by indolering 6mo ago
> Sir, this is a Wendy's. This you?
30.
by indolering 6mo ago
Sorry, the point I was trying to make is that this isn't a problem operationally. Hyperscalers go to crazy lengths because they can measure monetary losses due to milliseconds of less view time and it's much easier when they have

More ›