HN user

epimenov

88 karma
Posts0
Comments35
View on HN
No posts found.
Official Mastodon server of the Dutch government 3 years ago

It makes sense really. About a week ago there was “code red” storm in the Netherlands, and first phone alarm contained something along the lines of “for more details see this Twitter account”.

Then they removed any mention of twitter from from the second message.

0ThreadHN
SSH tunnelling for fun and profit: AutoSSH 11 years ago

I have a key generated for AutoSSH only.

Also you can limit to which hosts/ports it can connect with:

     no-agent-forwarding,no-X11-forwarding,command="read a; exit",permitopen="host:port" ssh-ed25519 AAAA
Pretty nifty.
0ThreadHN
Please Stop Writing Secure Messaging Tools 11 years ago

There was a TOR talk where a person from China told that he recommended two systems to different people: TOR and some other one. The people he recommended the other one ended up in prison.

This kind of consequences you get when you falsely claim security. This is the main reason I want people stop saying that Telegram is somehow secure. It's just another messenger, people who need security should use something else. There must be no confusion about it.

0ThreadHN
Please Stop Writing Secure Messaging Tools 11 years ago

Absolutely dangerous thinking is to declare cryptography off limits. With that in mind eventually you just scare more people to participate in this process and eventually be left with a tiny core community.

Anybody can participate, just don't claim it's secure.

Sure, that's exactly how SSL works. We invented crypto systems and we are using them until they are broken, then we phase them out for something else.

The only difference is there's a maillist with actual cryptographers (https://www.ietf.org/mail-archive/web/tls/current/threads.ht...), that iterate over design. If you look at the history of TLS, you'll see how tricky is to get crypto right. There has been lots of attacks on the protocol, that no one person could've think of. You don't have that if you roll your own and/or have "very good reasons" when people point your mistakes out.

0ThreadHN
Please Stop Writing Secure Messaging Tools 11 years ago

This is absolutely dangerous thinking. There are a lot of people researching crypto and making sure it's secure. If you're using non-standard crypto, you don't have that safety net.

They're using primitives that are proven to be insecure against certain types of attacks (non-checked DH, MAC-then-encrypt, etc). And their code seems to be not perfect (https://twitter.com/matthew_d_green/status/58291636575066931...).

Signal on the other hand uses a variant of OTR (https://whispersystems.org/blog/advanced-ratcheting/). Which was thoroughly reviewed, and mentioned in NSA documents as not-cracked.

You can't just invent something and claim "last time I checked it's not broken". It's not broken (yet) if enough competent eyes looked at it, and the more standard building blocks you use, the easier to make those claims. That is absolutely not what Telegram does. I really wish the myth that Telegram is secure would die.

0ThreadHN
Topo – A library to create in-process topologies of goroutines 12 years ago

I think you misunderstood the blog post and go channels. Shuffle is absolutely not want you want to use (in the README example). Sending to a channel blocks until the message is accepted by the receiver (unless you're using buffered channel).

What you want to do instead, create 1 channel, and make multiple goroutines (Sinks) read from it, then whenever goroutine is finished with the task it would take a new message from that channel.

By picking a channel to dispatch yourself you don't take into account busy-ness of it, so you might wait on a channel even though there are others that are idling waiting for messages to be accepted.

0ThreadHN