twitchyliquid64

5 ms·

1.
by twitchyliquid64 3y ago
I've been fairly impressed at Waymo's defensive driving skills, down to it being able to tell when someone turns around towards the road with an eye to cross, & the car slowing-down/giving a wider berth. We will need to w
2.
by twitchyliquid64 3y ago
A simple fix might be to bind the encrypted value to a PCR (hopefully one that isnt too fragile, but prefs one that measures the initrd) and then to invalidate that PCR when you drop to the recovery shell (by extending some junk bytes to it
3.
by twitchyliquid64 3y ago
Can anyone that knows a thing or two about law comment on section 12 & 13? Seems like there's... a LOT of calve-outs for due process / checks-and-balances? or is that fairly normal and i'm mis-interpreting in my ignorance
4.
by twitchyliquid64 9y ago
I stand corrected. Rogue AP / MiTM only needs a AP with the ability to send raw packets, gotcha.
5.
by twitchyliquid64 9y ago
> Many, many websites and APIs don't have HSTS enabled to force all connections to use TLS. True. Yet another reason for us to push for it. I have a chrome extension that sets the background-color of all form fields to red if the si
6.
by twitchyliquid64 9y ago
On second read, timing requirements arent a thing if you are spoofing the network (obviously) so for that attack vector you don't need specialized hardware. (wont let me edit :( )
7.
by twitchyliquid64 9y ago
You can't preload the whole internet, but by getting the top xx thousand you get 99% of all Chrome users traffic. Its not perfect, but it is very, very effective.
8.
by twitchyliquid64 9y ago
This is not an end-of-the-world type vulnerability. 1. Does not affect long-term credentials - certs, wifi passwords are still safe. Rather, confidentiality (secrecy) from client --> AP is affected, and in some cases packet forgery is po
9.
by twitchyliquid64 9y ago
Guess you could say noise is pretty quiet xD +1 for trying to eliminate complexity from developer error. This was one of the worst cows in the herd for OpenSSL. That said, I think a bit of good design on the APIs part can go a long way. For
10.
by twitchyliquid64 9y ago
> What a bunch of senseless FUD. inb4 strawman arguments and other funzies. Perhaps you should argue with me on my actual assertion, which is that 'we should use crypto that has stood the test and scrutiny of time'. Do not inte
11.
by twitchyliquid64 9y ago
Throughput: It depends on the link, but I'm getting 16mbps peak where my connection to my ISP gets me 20mbps peak. Mobile: You have to use the APIs that are available on the platform to hook into the network layer. After that its prett
12.
by twitchyliquid64 9y ago
Thanks! This is definitely something I need to get around to once I read up a bit more on vendoring.
13.
by twitchyliquid64 9y ago
I'm glad you're asking these kinds of questions, they need to come up more often especially in a software-supply-chain context. I am a strong advocate of the saying 'trust but verify'. I believe you should closely audit
14.
by twitchyliquid64 9y ago
Correct. While simple, this does have the performance impact you're alluding to. On my 20mbps (down) connection, I peak out at 16mbps on subnet. The 'double congestion-control' effect can be alleviated by opening 10 or so TLS
15.
by twitchyliquid64 9y ago
My concern is that 'built on modern crypto' and 'reviewed by cryptographers' amounts to 'rolled our own crypto'. IMHO history has shown us time and time again that this is a bad idea - we should use the protoco
16.
by twitchyliquid64 9y ago
I'm afraid not :/ Windows is a whole new kettle of fish to get working - you need a device driver to emulate TUN/TAP. That said, I'm using a library called Water for the low-level networking, and that library just added
17.
Show HN: Encrypted VPN in 2k lines of Go(github.com)
123 points by twitchyliquid64 9y ago|64 comments
18.
Subshard – Re-Inventing the Tor Browser Bundle Using Chrome, Go, and Python(github.com)
5 points by twitchyliquid64 9y ago|0 comments