tashian

8 ms·

1.
by tashian 21d ago
The proof itself relies on asymmetric crypto, and that part is not tenuous (well, until Q Day, but that's a different story...). But: - You cannot prove that no one has ever been able to break a Secure Enclave or a YubiKey or another s
2.
by tashian 23d ago
I have a feeling Apple is going to knock it out of the park on this when they get around to it. They have a great foundation for doing image provenance well. The device attestation workflows are already there. And the same attacks that work
3.
by tashian 2mo ago
Fiddling with the knobs is the fun part. https://www.youtube.com/watch?v=la2u4VlGwbQ
4.
by tashian 1y ago
The notion of "zero trust" shouldn't just mean corporations not having to inherently trust users and networks. It should also mean users not having to inherently trust corporations. VPN providers all run the same two or three
5.
by tashian 1y ago
I did a little synth project recently that uses an AudioWorklet processor to morph between single-cycle waveforms, and it worked super well. When I tried to do this with the Web Audio API, the audio would stutter when I moved the controls.
6.
by tashian 2y ago
or to hide the AI content areas
7.
by tashian 2y ago
Just copy/paste from the chat window. I kept running into token limits. I came away from it wanting a much better workflow. That's the next step for me in learning AI... playing with different integrated editor tools.
8.
by tashian 2y ago
I used Claude to help me build a side project in 4 hours that I would never have built otherwise. Essentially, it's a morphing wavetable oscillator in React ( https://waves.tashian.com ). Six months ago, I tried building this
9.
by tashian 2y ago
Good point. Primarily, the YubiKey is there to lock away the private key while making it available to the running CA. Certificate signing happens inside the YubiKey, and the CA private key is not exportable. This uses the YubiKey PIV applic
10.
by tashian 2y ago
It's true, the defaults are quite strict. As for the "hours" max interval, this is the result of a design decision in Go's time duration library, dealing with the quirks of our calendaring system.
11.
by tashian 2y ago
I love this idea!
12.
by tashian 2y ago
Hi, I'm the author of the post. Thanks for your questions here. > -Complete overkill requiring the use of a YubiKey for key storage and external RNG source - what problems does this solve? For a Yubikey to act as a poor man's H
13.
by tashian 2y ago
How should a company figure out what to charge for something in the first place? Especially a startup that doesn't have much market data to go on, and may be making something entirely new that no one quite knows the value of. When this
14.
by tashian 2y ago
AI agents run in isolated VMs, but PDFs have been out here running in the open for 30 years!
15.
by tashian 2y ago
Reminds me of the Hamming distance texture: https://chalkdustmagazine.com/features/the-hidden-harmonies-...
16.
by tashian 2y ago
I learned C by running a MUD — a DikuMUD derivative. I was in high school, in the 90s, and I didn't know any programmers in my town who could teach me how to really code. My high school computer science teacher didn't know. What I
17.
by tashian 2y ago
I tried learning to make sourdough bread by reading the Tartine Bread book. The problem is, baking bread is such a sensual activity. You need to understand what it feels like when the texture of the dough is right. You need to learn how to
18.
by tashian 3y ago
Hi, I'm one of the authors of CLI Guidelines. See my post https://smallstep.com/blog/command-line-secrets/ for a bit more of a deep dive about using secrets on the command line. Credential files are a good, s
19.
WPA3 Enterprise 192-bit mode at home(smallstep.com)
289 points by tashian 3y ago|193 comments
20.
by tashian 3y ago
Cruise certainly knows.
21.
by tashian 3y ago
I ran one in the 90s for a couple years. I was 15. I had two lines at 16.8kbps. 100 megabyte HD, which was enough to hold a giant archive of Amiga downloads. It was fun, lots of local folks on there and we'd meet up in person sometimes
22.
by tashian 3y ago
Not every day, but I appreciate the global tech perspective of https://restofworld.org
23.
by tashian 3y ago
https://tashian.com I write about various tech topics. Writing is thinking. It helps me learn.
24.
by tashian 3y ago
I loved this podcast episode on the same topic: https://www.reboot.io/episode/wisdom-for-work-13-accountabil...
25.
by tashian 3y ago
Ah, this was a grammar error on my part. Sorry about that, let me clarify. TPMs do offer up their endorsement key (or an endorsement key certificate) to third parties. And, TPMs can share attestations in a way that doesn't reveal the e
26.
by tashian 3y ago
I agree with the sentiment of the piece, but I disagree with the idea that TPMs don't add much value for end users. TPMs were originally designed in the early days of ecommerce, when it became clear that home computers would need bette
27.
by tashian 3y ago
Philip Greenspun's blog posts about web development got me into building web applications in college and sold me on the design principles behind ArsDigita Community System (ACS), which ran on AOLServer and Oracle. When I joined Zipcar
28.
Protect your homelab with mutual TLS, ACME device attestation, and a Yubikey(smallstep.com)
67 points by tashian 3y ago|5 comments
29.
by tashian 3y ago
SSH CAs would make the challenge a lot easier. It sounds like they are using RSA keys here for the widest possible compatibility, and while OpenSSH's certificate support is not at all new, it still may be too new for this application.
30.
by tashian 3y ago
It's easy to say "should have used an HSM" (or, in truth, many HSMs), but I can appreciate the technical challenges of acutually doing that at their scale. It would not be a trivial project. There's a ton of operational

More ›