kjetil

In the EU (and EEA), eIDAS distinguishes between

- "electronic signatures", which can be any electronic data used to sign, like a drawn signature - "advanced electronic signature" (AdES), usually a type of digital signature (XML-DSig, PDF signature, etc.) - "qualified electronic signature (QES), which is a digital signature created by a certified signature device

QES is legally equivalent to a "wet signature", but in my experience rarely used because of cost. AdES is much more common for high-trust scenarios like loan applications. For low-trust like package delivery, a signature (or smiley) drawn on a touch device will usually do.

There is actually one more way to quit vim. If you only have one window open in vim, Ctrl-W Q will exit.

In practice, though, PAdES has a lot more support and has the crucial property of being easy to view by end-users.

Is there any wide use of ASiC?

The article does not mention passkeys, but they seem destined to be almost all of WebAuthn usage in the future, now that both Apple and Google support them. External FIDO keys will probably remain a niche solution for those with special security needs. But where does that leave the platform authenticator approach? It’s great that you can store the key on-device, but is it really worth it ti not use passkeys instead?

QWACs are for web sites, not users. CAs have to be audited as a TSP in order to issue them and be approved by the member state.

Are the TSP audit requirements less strict than what the browsers’ root programs require?

Not being able to automatically renew certificates seems like a rather minor point in the bigger picture.

I get QWAC goes against the trend of phasing out EV certs. But isn’t the real issue that the browsers don’t trust TSP audits carried out for EU member states?

Identity verification services usually combine document reading with something like a video selfie, which provides 1) a liveness check (you are a real person) and 2) a match against the digital image data that was read.

Is it possible to fool? Like anything it is a trade-off. Acceptable security for an acceptable cost. Hopefully it fulfills your security requirements and you saved a physical visit.

Since the Javascript NemID client was introduced last year, most users don't need Java anymore.

That's for OTP though, users with tokens or keyfile have to use the OpenSign applet still. Haven't seen any stats, but OpenSign usage is probably pretty small compared to standard NemID/OTP.

Not to detract from your point, but the applet part of Norwegian BankID is now mostly replaced by the new Javascript-based solution.

Are you seriously suggesting that String incompatibilites are a big issues in Java?

String interning is specified in the JLS: http://docs.oracle.com/javase/specs/jls/se8/html/jls-3.html#...

As far as I can tell, the substring "feature" has been there since Java 1.0 and was fixed in Java 7. Hardly groundbreaking stuff.

Even without such vulnerabilities, I would be wary of printing out stuff from any untrusted files in a terminal. Most terminal emulators have been vulnerable to escape character attacks at some point.

http://marc.info/?l=bugtraq&m=104612710031920 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2383

With love to all the UNIX apologists in this thread: you're missing the point.

Why isn't software easier to install and configure? Why are we still using relics from the 70s as the base of our systems? Why are we so focused on mastering the tools of the past instead of creating new tools for the future?

I'm a long time Linux and BSD user. I sit in a shell for hours every day. And I still can't believe why we put up with this crap.

Shell scripts and one-liners. Ls and cat and grep and uniq and sed and awk and tar and loads of other low-level tools that you haphazardly string together. For the love of all that is holy, just use a real programming language!

With the powerful computers of today, we still interface to other computers through a text-based bottleneck that's basically from the stone age. What's up with that?

OK, this turned out to be a little rant. Don't take it the wrong way; I love UNIX, but I also hate all the cruft that just seems to accumulate and never gets cleaned up. I think we could do a lot better.

Slightly related fun fact: Oslo also uses recovered heat from sewage to heat homes.

http://www.enn.com/top_stories/article/4032

Or just use BankID for mobile or the BankID app for iOS, no need for applets.

Little known fact: the -0/-print0 idea is due to DJB.

At least on OS X you can set up an "idea" command for opening arbitrary files. Only local files though. Check the File menu.

For me it's the fingerprinting that does it.

I once told an American acquaintance that US customs fingerprinted all my ten digits last time I was in the US. Her reaction: She refused to believe me. That her country would do that to visitors was unthinkable. And I'm from Norway, a reasonably US-friendly country (and ally, I guess).

The most appropriate reaction would be for all other countries to fingerprint all American visitors (like Brazil). But governments in small countries don't dare mess with the US.

Nice site, but it seems of the books aren't really free. Code complete and Programming pearls come to mind.

Are people in the US aware that visitors have to agree to be fingerprinted to enter the country? When I told an (American) friend about this the last time I visited the US, she refused to believe it.

Java 7 also adds java.util.Objects, which contains hashcode() and other useful methods:

http://download.oracle.com/javase/7/docs/api/java/util/Objec...

What's with the attitude? Remi just explained the background for the name of his neato prototype PHP-like project. I don't see why that deserves these kinds of snarky replies.

So basically, Apple should stick with making pretty pictures and stop all this needless user interface innovation?

I guess we'll see whether Siri is successful or not, but I think you should at least appluad Aplle for (again) raising the bar.

Arrogance? Come on, it's a rant. Cut him some slack.

Other than that, I agress with pretty much everything you said. It's easy to forget how reliant we are on things like industrial-strength GC, multithreading and JIT and how young those things really are.

That's a reasonable (if knee-jerk) first reaction. But reality is a bit more complicated.

log4j was the first de facto standard (excluding System.out). Making it part of the standard API would have been a no-brainer. Unfortunately, java.util.logging sucks (hard to customize, coupling with J2EE app servers). So people keep using log4j.

Library writers now have a problem: How do you choose which logging framework to use? You really want to use the same framework as your users, the developers making apps. Thus was born commons-logging.

commons-logging has a number of problems, including non-deterministic setup and being bundled with some common app servers (which creates its own share of problems).

Thus: slf4j. Which works.

I agree with the author that slf4j is the way to go. Alternatively you can just use log4j directly. But slf4j has one feature which log4j doesn't: format strings. If you've ever had to add "if (log.isDebuggingEnabled())" checks to logging code you'll appreciate what a difference this makes.

In conclusion: Java logging is a clusterfuck, but if you know what to use you'll be fine. The end.

> He's also inconsistent. He capitalizes 'I' and Emacs and Lisp (among other things).

No, you're missing the point.

Naggum didn't eschew all capital letters, only where they led to loss of information (ie. failure to separate common and proper nouns).

Emacs and Lisp are proper nouns and therefore capitalized. Common nouns that happen to start a sentence are not.

Spotify for the US certainly has been "in the works" for, well, forever.

But coming from a would-be competitor, this piece only comes across as cranky trash-talk.

Curious to see if Spotify will do as well as in Scandinavia.

That's a lot of quotes, mostly by people I've never heard of (PG, Kay, Greenspun and Yegge excepted). I'm not saying there's no truth to them, but they're mostly fluff and little content.

Some notes: I don't know why PG can't, but I can certainly name a dozen great programmers who mostly work in Java. Greenspun recommends that instead of Java, you use (wait for it...) .NET.

The Dick Wall comment I have no issue with :-)

I recently deleted all my RSS subscriptions and went Twitter only for "feeds".

For what its worth, Tim Sweeney appears to endorse GC for game programming in his POPL talk:

http://lambda-the-ultimate.org/node/1277