irl_

At any moment some change outside my control could occur and my place in society would change. Right now I'm pretty self sufficient and don't really need the support of others in day to day life, but that can change, and there's nothing I can do about it. Seems like a good idea to use this opportunity to try and improve things for everyone, even if you don't care about others, just in case your place in society changes. (I actually think it's neat if we try to improve things for everyone for everyone's sake tbh but I get there are people that do not have such empathy)

I think this may be a US thing, in the UK at least unions work to promote solidarity.

I'm a director of my small company, and a member of UTAW. The union doesn't just help with employment disputes but also campaigns generally on improving working conditions for all, through things like health and safety and setting reasonable expectations for how work will be done.

When I read this through 25 years ago I learned more about networking than I think I knew in total up until that point, and that was nearing the end of an A level (English further education) Computing course. It's a really comprehensive guide that laid it out exactly the way I needed it for me to absorb it. I still recommend it to people that might be new to network programming as the sockets API really doesn't change that much whether you're using C or Python or some other language.

It's pretty upsetting that we've got India's UPI and China's UPI (UnionPay International) and they're both doing exactly the same thing and without geographical context you don't know which one it is.

Like QuickBooks Online?

That's nonsense. There are somewhere between 2 and 8 million users of Tor every day. The vast majority of Tor users are ordinary people that want a little more privacy. What a waste of resources it would be to try to identify and track each of them.

If you need a primer for the primer: https://web.archive.org/web/20140118063258/http://notabug.co... (unfortunately it wasn't finished)

China and Chinese Red Cross are different things.

I know the title is the title on the actual article, but it's the Chinese Red Cross, not China itself. National Red Cross Societies are independent of the country's government. They may receive government funding but they decide what they do with the money themselves.

From https://www.ifrc.org/fundamental-principles

"The Movement is independent. The National Societies, while auxiliaries in the humanitarian services of their governments and subject to the laws of their respective countries, must always maintain their autonomy so that they may be able at all times to act in accordance with the principles of the Movement."

SSH keys authenticate you. They are an identity. You probably don't need more than one or two identities (maybe personal and work). You can just get a couple of YubiKeys and configure the OpenPGP applet, or the PIV applet, with an authentication key/certificate and use that for SSH. Take the token with you and you've got some pretty strong authentication.

More modern SSH servers will let you use U2F security keys in the same way, which are cheaper than the full YubiKey.

I've learned recently that YubiKey has really good documentation for how to set up their tokens to achieve different goals, it would be worth reading their docs if you're considering getting a hardware token for your keys.

I see. They didn't mention it on the two factor authentication page I was reading because they've split the security key and TOTP documentation and not made it obvious (enough for me to see it while skimming) how to find the former from the latter.

Ok, I assume that's with FIDO/U2F, so that's not so bad.

At that point though, you already have a hardware token capable of holding SSH keys, so I'm still not convinced of the benefit.

It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone.

This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single-factor + TOTP, where you previously had a phishing-resistant cryptographic protocol.

Is this really an improvement for security, or is it just a usability improvement (i.e. sync of keys) intended to work around policies trying to improve security (i.e. required use of keys)?

(The other option is I skimmed the docs badly and maybe I've misunderstood something, it's possible.)

Edit: I did skim the docs badly, it is possible to use a FIDO2/WebAuthN key for 2FA. https://support.1password.com/security-key/

In modern TLS this just doesn't work, because you generate a shared key. You can verify what you've received from the server because you know you didn't generate it, but someone else cannot verify if any content was generated by you or the server, only that it was part of an exchange between you and the server.

Missing from almost every calendar hosting thing I've used is the ability to publish free/busy information to allow others to schedule me into meetings without needing to be on the same system.

I'm pretty sure vCalendar supports this, just no one has implemented it.

If I could host a lightweight javascript app that let you browse the information until your client supports it properly that'd be cool.

I have a TI-83 and an HP 19B II and both see regular enough use that they live on my desks (one at home, one in the office) rather than in the drawer. The calculator on my phone sucks (no history, difficult to enter anything more complex than adding up a few numbers) and I don't even know how to calculator on my Mac (because I never had a need to).

I use the calculator as an extension to my brain, it has a little memory and a lot of quick compute available, I know how it works well enough that it's all muscle memory and invisible to my conscious processing.

If quality scientific/business calculators ever go away I'll be sad.

I ran a survey in 2017 and found that around 0.1% of the DNS servers we poked at would negotiate TFO and of those around 94% were Google's. It might be interesting to take another look at the deployment numbers at some point.

https://irl.xyz/stuff/pubs/PATHspiderEvolution2017.pdf

I think you're missing a few things here:

* Services started with sysvinit would put logs where they want, which is fine if you know where they are but per-service you might be guessing. Having everything always in the same place is handy.

* sysvinit wasn't giving you any of these security benefits.

* If your system really was working fine before, why did you need to upgrade it to a newer distribution with systemd?

https://www.irccloud.com/pricing see "Teams"

GDPR is for people. It doesn't help you if you're a business.

This is a common theme.

Your employer writes your contract of employment and has fancy lawyers to make sure everything works in favour of the employer. You likely did not have input into the contract at all, and also likely did not have fancy lawyers to help you understand the terms of the contract. Your employer has made up the rules of the game and you do not understand them.

I predict you're going to lose.

If you wanted to do this "enterprise port knocking" on OpenBSD, you could use pf to do this.

https://www.openbsd.org/faq/pf/authpf.html

The FAQ entry is about building an authenticated gateway, but the same technique can be applied to open individual ports.

https://media.ccc.de/v/emf2018-284-why-automated-number-plat...

The best password is the one written in plaintext on the outside of your car.

An active measurement example: https://www.microsoft.com/en-us/research/wp-content/uploads/...

I worked with Brian Trammell when he wrote this, and I maintain that it missed something. The assumption is that you have no idea about the path that the data has traveled, but if you actually did know the topology of the larger transit routes and of the end-user's ISP, the "distance" that you're using for your calculations is different. It's no longer just the distance on the map, but the path along fibers and cables. I believe that by combining the topology information with the RTT data you can get a far more precise location.

I also maintain that you can get all the information you need from active measurement, and that adding leaks to live traffic just so you can save that active measurement overhead is irresponsible.

This is not metadata analysis resistant, so Mozilla could still technically see who is sending files to who (unless you use Firefox Send in Tor Browser - not sure how well that works).

That's not to say this service isn't useful, but it's not a drop-in alternative to OnionShare.

For Facebook, you can use its onion service to get improved speeds (the traffic doesn't leave the Tor network, which itself is quite fast, it is only the exits to the Internet which are slow): https://facebookcorewwwi.onion/

For additional security, instead of exposing your internal services to the Internet, communicate using a Tor Onion service. It handle NAT for you, and can be very resilient (you have 6500 servers that can act as a rendezvous point in the Tor network instead of just the 1 VPS). It's not going to give you the same low latency and high throughput as putting the service straight on the Internet but it's going to be difficult to match the security (for confidentiality, integrity and availability) properties any other way.