Promarged

http://hnblogs.thume.net/feed.xml returns 500 for me :(

Sounds nice, too bad there are no screenshots so I can't see what does it look like without giving my e-mail.

Does it run on an open protocol? (Maybe HTTP or XMPP based?)

It has the advantage of not relying on the Certificate Authority system

I wouldn't say it's an advantage, while CA system has many flaws at least it's monitored somehow (for example via Certificate Transparency) while putting keys in DNS would require the app to validate records (does GnuPG do that?), not to mention the queries are not encrypted (so are visible to any hop) and could be transparently replaced by your government or TLD operator. Many DNS providers do not allow adding "exotic" records.

For further info see e.g.: https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con...

and not requiring a full web stack (which some email clients and servers wouldn't want to open themselves up to).

Email clients and servers that do PGP usually have "full web stack" already to connect to keyservers.

Additionally while DANE or PKA lookups can be enabled in GnuPG only WKD is enabled by default ("auto-key-locate" is "local,wkd").

Nice nick by the way :)

Or cleaning up their work-in-progress, currently there are around 11307 issues open: https://gitlab.com/gitlab-org/gitlab-ce/issues

Actually CSP can also block content modifications by extensions. I frequently get CSP reports from browsers using plugins that want to insert something on my site. Some time ago I also got CSP reports that indicated the AdBlocker couldn't touch the site too...

I was only able to get the situation sorted because I know people who work at Google on the Chrome team.

Hehe, one thing all successfully resolved issues have in common - a friend inside of Google. Maybe that's by design... Google employees are not friends with bad guys!

33mail probably...

put my own domain-specific CA Cert in DNS directly.

Remember that this allows any of your government or people controlling the zone to transparently put the cert there too. (For potential problems see [0]).

With the CA system (that I personally also don't like) at least the certs are logged in Certificate Transparency logs so you see any potential attacks.

[0] https://www.theguardian.com/technology/2010/oct/08/bitly-lib...

Oh, I guess the vulnerability needs an extremely tenuous name and logo right? Here goes

I admire the extra touch here :)

I recently sold an XPS 13, an i7 9543 model from 2015, which was the first laptop in a long time that I regretted buying.

I've got 9350 and it's also bad. Coil whine, one firmware update completely bricked it (fortunately was on warranty), "fun" with accessories (TB15 was a disaster). Would not recommend.

Actually it's only the NBD warranty that keeps me with Dell (used that and it's very convenient). Does Microsoft have something like that?

This paper [0] (from 2013) linked from this article [1] was also executed on chain, see date here [2] and the actual script via API here [3].

[0] https://eprint.iacr.org/2013/784

[1] https://curiosity-driven.org/bitcoin-contracts

[2] https://blockexplorer.com/tx/7ae5760af2105a5ba54a914f188686e...

[3] https://blockexplorer.com/api/tx/7ae5760af2105a5ba54a914f188...

It reminds me of one person here on HN describing their interaction with Google w.r.t. their startup's novel idea.

Yep, your link is more relevant. There is also this: https://www.gnu.org/software/repo-criteria-evaluation.html

I have to agree, Google gives new meaning to "open source". Open source as "we share some source but the actual meat is in closed proprietary codebase that you cannot inspect". I still remember the AOSP maintainer (Google employee) leaving because he couldn't do his work properly because of Google's politics w.r.t. Android.

Or was that the open source that RMS warned us about?

ActivityPub is indeed both simple and extensible. Perfect for issues and comments, also PRs.

For the actual code behind PR I would just setup a git daemon and reference own repo. With appropriate CORS the code can even be cloned in a browser.

I see only SSL_ERROR_BAD_CERT_DOMAIN. (but on http it looks very nice)

Related: integers do not have identity [0] but objects that have reference semantics have identity.

[0] https://cs.stackexchange.com/questions/60549

I agree with this suggestion. It took me a year to slowly absorb the entire book of Statistics [0] including solving all exercises. It's just like walking to school but there is no external supervision. I made a rule to complete one chapter every evening including exercises and sticked to it.

[0] https://www.amazon.com/Statistics-4th-David-Freedman/dp/0393...

As far as I've seen there were some problems with hanging Prosody at trashserver.net [0], was this resolved?

[0] https://social.tchncs.de/@trashserver in German

So if I understand it correctly the client-to-server API is simple but servers internally build a Git-like structure? Interesting design, I think I'll read the specs for how history is stored.

In fact, there is no way to just 'send a user a message' in Matrix: instead, you can only synchronise your copy of a room's state and history with someone else's copy of it.

I've read in a different thread that sending a message in Matrix can be easily achieved with a simple curl. Is it true? Synchronizing my copy of room state doesn't sound so simple. Maybe it's optional or I misunderstood the "message via curl" post?

XMPP is reliable, the server can mandate client-server encryption, and has some client-side features including simultaneous appearances (being one person logged in through several devices) and better one-to-one chat than IRC. File-sharing is an optional add-on. There is no good iOS client that I know of; mobile clients tend to be bad at requesting history.

ChatSecure works on iOS and has history fetching features (MAM), for Android there is Conversations.im, IMHO the best XMPP client to date.

The bug would work only if all of these are true:

  - only-encrypted (not signed) message (signing is good practice),
  - clients that do not do MDC (MDC was introduced in 2000, every non-prototype client uses it)
  - client that rendered HTML mail with broken markup,
  - client that automatically fetches remote resources.

Enter Bloom, who helped design a test whereby 500 employees were divided into two groups--a control group (who continued working at HQ) and volunteer work-from-homers (who had to have a private room at home, at least six-month tenure with Ctrip, and decent broadband access as conditions).

Did it say volunteer? That already stains the results as control group and the test group are not similar. Maybe volunteers are already more productive than people that don't want to experiment?

Congrats on the release!

Would the book be updated as new features are added to Rust? I see some useful things being incorporated slowly into the language...

Yes it can, I used U2F in CLI apps to sign HTTP requests: https://developers.yubico.com/U2F/Libraries/Using_a_library....

There is also pam-u2f: https://developers.yubico.com/pam-u2f/

and https://github.com/bluecmd/openssh-u2f (not in upstream)

I agree this looks very good. I'm waiting for people to try it out and write some reviews to be sure it's not just a dream...

It seems centralized solutions (Telegram, Signal) are under fire recently. I wonder what would happen if federated protocols (Matrix, XMPP, etc.) were more popular and, thus, also in spotlight.

To be more precise you can run your own server but it would not connect to the rest of the network (so it's useless).

Source code here: https://github.com/signalapp/Signal-Server

Moxie is probably annoyed by the slow pace in which federated protocols move. Having it centralized he can move it a lot faster.

Fortunately there are solutions that incentivize modern features in federated protocols too, like SSLLabs HTTPS checker or https://conversations.im/compliance/ for XMPP.