Boulth

Statistics by Freedman et al is a great introduction to statistics. It took me a year to fully read it but the exercises are fun, real world examples of applying statistical methods.

I haven't seen any mentions or this extension that allows verifying pages before they are rendered: https://github.com/tasn/webext-signed-pages

Another thing is non exportable WebCrypto keys that can limit the damage even if the page is compromised.

Ha, great to hear. I always assumed they went back to windows as part of some deal as around the same time Microsoft opened a big HQ in Munich.

Whether the island o stability exists: https://en.m.wikipedia.org/wiki/Island_of_stability

Great resource indeed, thanks! Too bad the latest one is 2 years old :(

Right! I remember now buying the book just to read the chapter about Anders. Was not disappointed. (for the record other "masterminds" were also interesting).

As someone that also used languages designed by Anders I'm also a huge fan of his work.

Too bad there are just a few quality interviews with him: https://www.artima.com/intv/anders.html

Yep. Although in my opinion Programming Rust [0] is better even though dated. The word goes that the 2nd edition will be out by the end of the year.

[0] https://www.amazon.com/Programming-Rust-Fast-Systems-Develop...

the monetisation strategy for New Vector is selling Matrix hosting (https://modular.im) and helping out big folks like Governments who want to jump on board Matrix. While the company is certainly not profitable yet, it certainly has a path to being sustainable (otherwise folks like Automattic wouldn't invest!)

Thanks for this info! Exactly what I was looking for.

Nope, worse is that investors subtly want to extract value from them e.g. utilizing user data from identity server on vector.im or so.

Even if they just "went Keybase" not having people outside of the org working on it would slowly bring them the XMPP fate (irrelevance).

Very cool. If you liked that check out their Sorcery series of games. I played them over and over for weeks. Highly addictive!

Matrix allows you to host your own server, federate messages in real-time between servers, and still benefit from end-to-end encryption between multiple client devices.

This sounds like XMPP so nothing new.

What sets the Matrix apart is that they have the money and spend time and effort to get their clients into good shape. The E2E verification is a prime example: looks simple and works well.

VC money mixed with open source software again. It didn't end well for Keybase. I hope Matrix has a monetization strategy.

Edit: for people interested there are company docs at https://beta.companieshouse.gov.uk/company/10873661/filing-h... eg. "25 Mar 2020 Total exemption full accounts" document (2.2) shows a yearly loss of almost 2M pounds.

Edit 2: it seems Matrix people no longer control 50% of their company shares, or I'm reading it wrong: https://beta.companieshouse.gov.uk/company/10873661/persons-...

Pacman can remove dependencies that are not used: https://wiki.archlinux.org/index.php/Pacman/Tips_and_tricks#...

This is explicit rather than implicit but it works even on one package.

Yes, totally. I've also migrated to Linux after decades of working on Windows.

Still, it's interesting development (nope, I won't be coming back).

It was some time when I read the explanation on how do they want to approach this but I guess the card identifier will no longer be needed (or all card ids will be stored).

If you want to check it yourself https://dev.gnupg.org/T4695

I worked on Windows for two decades and tried WSL1. Windows is not super annoying but as a developer all my tools were actually Linux native or cross platform so one day I just cut the middle man and switched to Linux. It wasn't such a big leap but my productivity definitely increased.

WSL is nice when you don't have choice. Linux is actually the optimum choice for most developers.

The biggest pain is that I have to reconfigure when I switch yubikey.

This is planned to be fixed in GnuPG 2.3.

It's not a big problem because tokens lock themselves after 3 tries so even if someone got your token they'd have to guess it. Having separate subkeys for each token is nice but works best only with the signature subkey. For encryption it doesn't work as GnuPG encrypts only to one subkey. The same with authentication subkey: it doesn't matter if you revoke it because SSH doesn't understand OpenPGP revocations.

Yeah I had the same experience using OpenPGP applet on the Yubikey both on Linux and Windows. It just works. Maybe it was a problem once but got improved with time?

I think you confused this with security.txt standard. WKD is not enumerable (unless explicitly configured like that) so the issue doesn't exist.

Is there a setting that allows that "push to allow" for a short while?

Yes there is. In a newer firmware.

2) when I ssh into a system and touch the button to allow it, and the push allowed the use of they key for a short while, am I not in the same problem as before - as the system may be compromised and may be performing other operations I'm unawares of?

Yes but the window of opportunity for the attacker is smaller. Also: it's your setup that requires multiple key operations within short time interval, for some people touching every time is sufficient and most secure.

I think the proper solution would be 1) don't use forwarding unless necessary 2) setup touch-to-use on a Yubikey so even with your scenario the attacker couldn't just use the key (it requires touch to be used).

Yeah I always wonder how do they get the logo there. Is Pragli asking Facebook for permission to put their logo there?

Yeah maybe it should be more obvious but Mailvelope just adds end to end encryption to existing webmails (through extension overlay).

Thanks for the elaborate answer!

I wonder if you considered Dhall (https://dhall-lang.org/) that's declarative but at the same time has functions and other convenience factors.

A different line of arguing may be helpful: not even GnuPG validates DNSSEC signatures (source: https://dev.gnupg.org/T4618 ). That's why DNS key discovery schemes are not enabled by default there (WKD is).

If you don't want to self host I'd recommend https://account.conversations.im/ it's paid but properly maintained to have all extensions for modern experience. If you don't want to pay just pick something with good grades from https://compliance.conversations.im/old/

From the property name it sounds like your property is about trust roots (CAs) and parent's about client certificates (for mutual TLS authentication).

Actually it's even worse than that: signature creation time is added by the signer so it's totally under control of the attacker. IMHO all SHA-1 based signatures should be ignored.