Promarged

> I'd say EV worked perfectly.

Ian run a legit site, not phishing, so what's perfect in revoking his EV cert and not giving back cash?

> Prosody's XMPP server implementation dropped websocket support in favor of BOSH years ago.

You probably refer to the "old websocket" spec, new websockets are working well: https://prosody.im/doc/modules/mod_websocket

I wish they published Ink scripts for their games (especially Sorcery series), I've beaten them numerous times but the games are so complex that it's basically impossible to go through all branches. Even if I tried I couldn't replicate some of dialogue and that's in a game that always allows you to undo everything!

I just tested tutanota. The interface is clean and nice but the encryption to external contacts is the same as in Gmail (link back to tutanota and shared passwords).

Why can't these services use something like OpenPGP's Web Key Discovery [0] fetching key from https://domain.com/.well-known/openpgp/hu/hash-for-localpart and avoid links altogether?

[0]: https://www.gnupg.org/blog/20160830-web-key-service.html

In my experience people making fun of technology X (for all X) only reveal their own lack of understanding of not only X but their own tools too. Every tool has its own advantages and disadvantages.

Fanatics of any kind always remind of this fragment of Zen and the Art of Motorcycle Maintenance:

> You are never dedicated to something you have complete confidence in. No one is fanatically shouting that the sun is going to rise tomorrow. They know it's going to rise tomorrow. When people are fanatically dedicated to political or religious faiths or any other kinds of dogmas or goals, it's always because these dogmas or goals are in doubt.

> all my friends can at least contact me on this number that follows me around carrier-to-carrier

Isn't it possible to migrate phone number between carriers in US?

I wanted to take a look at how it works but the on-boarding process is not really welcoming. Getting started [0] redirects to this weird site [1] served over plain HTTP, installer is also not signed :(

[0]: https://www.scuttlebutt.nz/getting-started.html

[1]: http://dinosaur.is/patchwork-downloader/

It seems the new Clipboard API requires explicit permission (video on [0]), that's not going to increase adoption I suppose.

[0]: https://developers.google.com/web/updates/2018/03/clipboarda...

I think these issues were directly tackled on by Roslyn team, that wanted something more than just compiler black box (text goes in, machine code goes out). There are some interesting videos on Channel9 about Roslyn internals (sorry no access now ).

Thanks!

Also, there is relatively minor subset of features that provide good messaging experience: https://conversations.im/compliance/

> France has adopted Matrix for the project

Could you provide a source for this?

For a long time this article [0] was my go-to when explaining Bitcoin transactions to others but this submission is more recent (has SegWit, etc.)

[0]: https://curiosity-driven.org/bitcoin-contracts

If available it's better to use instantiateStreaming [0] for faster compilation, e.g. this:

    fetch('../out/main.wasm').then(response =>
      response.arrayBuffer()
    ).then(bytes => WebAssembly.instantiate(bytes))

could be expressed as this:

    fetch('../out/main.wasm').then(response =>
     WebAssembly.instantiateStreaming(response))

[0]: https://hacks.mozilla.org/2018/01/making-webassembly-even-fa...

To be precise only v4 UUIDs are (pseudo-)random, and not the entire thing, there are some version bytes.

One of the most interesting advances is formally verified cryptography [0] using F*. Unfortunately that's only for NSS (Firefox TLS engine).

[0]: https://blog.mozilla.org/security/2017/09/13/verified-crypto...

Is there not a recommended replacement library for OpenSSL? I'm thinking of LibreSSL for example that has leaner API but probably not the same amount of resources as OpenSSL.

> ...they would never be caught

Well I think most companies need stronger guarantees than "[probably] never be caught".

For comparison, Apache's "Category X": https://www.apache.org/legal/resolved#category-x

> This always comes and bites us back isn't it? The whole promise of Docker was that we would be freed form these pains... But yet here we stand :(

Exactly. Using a separate build host makes builds more independent but on the other hand you'll be running images that the dev did not check.

By the way, are docker image identifiers derived from the actual contents? (Are they reproducible?)

This would suggest they are not:

> Docker images are non-reproducible: each "layer" identifier is a random hex string (and not cryptographic hash of the layer content),

Source: https://blog.bazel.build/2015/07/28/docker_build.html

Unfortunately ActivityPub (that powers Mastodon) has a lot of incidental complexity (including RSA signatures, JSON-LD, RDF normalizations to quads etc.)

But this is a very simple alternative, distributed "Twitter" for hackers: https://github.com/buckket/twtxt#twtxt

Shouldn't RUST_LOG use "microservice_rs" instead of "microservice"? the "_rs" is a crate name.

Another thing, in a make_post_response stub function I think it's better to use StatusCode::NotImplemented instead of NotFound (when trying this code I thought the match did not work correctly as everything returned NotFound).

> For instance, you can see our OP meta data here [3].

Do you e-mails end with @idp.gluu.org? Or how would the RP discover that the domain is not "gluu.org" but "idp.gluu.org"?

But OpenPGP applet on Yubikeys cannot use ECC keys (no generation, no import). PIV applet can use ECC keys (but that's not covered in the attached article).

I hope it's more full featured than regular Android Auto that is so basic (compared to what is built-in in my Skoda) that enabling it just degrades my "driving experience". The only added benefit is traffic info in Google Maps.

Link to this survey was sent by Samsung for anyone that subscribed at https://seap.samsung.com/linux-on-galaxy

Bad news: they're checking if consumers/developers would pay to have Linux on a smartphone :-/

Bytes being signed is the ultimate Java oddity. Can't say how many times I've been bitten by this.

I've been pondering this for a while. The standard thinking is if everyone federated (e.g. XMPP in Facebook, Gmail) it would be good. But look at it from another perspective. Then your main account, your identity would be permanently tied to one provider (Facebook, Google) as your JID would end with @facebook.com.

The only true solution is to use your own domain and then, if possible, delegate to hosted server. If the provider does something that you don't like you just change provider or host your own. And one's @gmail.com address will always be hosted by Google.

> The Smalltalk undefined value was involved in some paradoxes

Could you elaborate on this? Or provide some references? This sounds interesteing but when I tried DDG and Google for "smalltalk undefined paradoxes" the results were not exactly satisfactory.

Exactly. I was removing my account yesterday and they pulled this trick. After some careful analysis it turned out that of all my integrations (Github, Twitter, Facebook) Facebook was rarely used, so I removed support for it in my site, removed the app at developers.facebook.com and the account.