akerl_

I don’t understand.

The name of the site is GitHub. The repo is called tttt, with the description “The Tess TypeScript Type checker”.

How did it seem like the title you wrote reflected the rules?

It’s worth noting that while folks were getting busy with 11 and 13, plenty of experts in the field were saying ~“yes, we do have viable exploits here, but we’re not sharing them at this time. This is a big deal.” And that the person who spun up 13 spun up a static html page at first and also misrepresented how vanilla the stack was.

We could have skipped from 7 to 19 if folks had just taken seriously the guidance from experts in the field.

A bunch of folks tried to say the challenge was dubious at best and that the vulnerability was a legitimate concern, and were told by commenters here that they were fearmongering or shills.

Evidence has shown they were pretty spot on about the first part (the test originally served static html, the php code wasn’t actually as vanilla as described, and the bitcoin key wasn’t actually there).

I’d have hoped this kind of clear vindication on the first point might have caused folks to revisit their stance on whether to trust the expert stance on the second. But maybe I’ve been overly optimistic.

I’ve been using docker since the early days. One of the early choices I made and stuck with is to never let Docker touch iptables.

I make a bridge for Docker to use and configure iptables rules myself via parallel config management.

That assumes the key is actually on the server.

A reminder that this cannot falsify the existence of an exploit, trivial or otherwise.

It can only show you if someone has used an exploit against this server.

Sure, but I’m only worried about CAs that exist in root trust stores, and a CA that ignores CAA records has two options:

1. Publish a CT record and tattle on themselves when they issue

2. Don’t publish a CT record and tattle on themselves when they try to use the cert

Either one ends with them getting the boot from the root trust stores. There’s very few folks out there whose adversaries are willing to burn an entire root-trusted CA to attack.

> have the website define which CA they use, and don't let any of the others certify it.

Isn’t this exactly what CAA records are for?

Similarly to vaccines, part of the magic is that you don't need "all", you just need "most".

Right now CT support is rough for things outside of browsers; it's a pretty fair bet that if you pick up a command line tool or library, it is not checking SCTs, and that makes those workflows vulnerable. If we flipped that, and the average command line tool or library did validate by default, it would dramatically alter the risk calculus for attackers.

You said "yes" but then answered "no"?

Like it seems your disagreement is that you're pointing out there are systems today that trust WebPKI CAs but don't validate CT/SCTs. I'd agree that that's an issue and I want those systems to join the world where CT exists.

As I said, in a world with CAA records and CT logs, this isn't an issue. If your CA wants to be in root trust stores, you have to put your certs in CT logs. CAA records are "advisory" in the sense that we mandate that root-trusted CAs obey CAA records and that they write cert issuance to CT logs, so a trusted CA that violates CAA records has to tell on itself in a very detectable way.

In a world with CT logs and CAA records, is that actually the case?

I don’t think you’re grokking what “death penalty” means here.

If a CA does something stupid or malicious, the browsers remove that CA from their root stores, effectively ending that CA’s existence as a going concern. People with websites go buy replacement certs from a new vendor and life goes on. This has happened before and is a massive incentive for CAs to not fuck around, and it incentivizes everybody to lean into improving the security of issuance.

It’s basically impossible to do the same thing to a TLD. If .io goofs around and is negligent in handling their security, you can’t do anything unless you’re willing to make every .io website rehome to a new TLD.

Seems to be 100% AI-written content.

The point is that if the comparison point is PGP-encrypted email, which has no protection for any metadata and passes it on the wire in the clear, raising concerns about Signal’s metadata protections makes no sense.

This is an especially interesting comment given that it misunderstands the Dropbox comment in the common way.

To pick a boring example: you run IT at a big company. You want all your employees using passkey auth, and you want it to be smooth for them, so you buy a bulk order of a couple thousand yubikeys and some glass fishbowls and plop a fishbowl full of yubikeys in the middle of each office.

Attestation means you can trust that nobody is accidentally or intentionally enrolling some random passkey-presenting device with rogue components.

We just had a front page story here this week about folks buying what they thought were secure hardware cryptocurrency wallets that had been modified maliciously.

You say this like there's nobody out there working on transistors or C or Emacs or Sqlite. There definitely are.

You listed some broad areas of criminal law. If you’re saying that some statute inside those areas would apply here, can you say what it is so that we can actually look at the elements?

You listed a couple civil claims, but the rest is pretty vague.

Outside of the CFAA, what criminal charge do you feel is applicable here?

Do you have another charge that you think is applicable?

This feels like a really weird comment on a post about gTLDs that exist in parallel to .com

Your linked icann doc is huge, but from skimming it the top portions seem to describe google’s intent to use it themselves for hosting their own projects and services.

It seems odd to ask why there isn’t a reserved option for this, then acknowledge home.arpa and immediately discard it.

Home.arpa exists, or buy a domain and use that. Or pick something that’s not reserved and run the risk of this happening.

I store my digital ID, payment cards, etc in my phone’s wallet. But I also still have my physical wallet.

If I lost my phone (either because it was locked or smashed or stolen), I’d use my physical wallet to access my money.

This seems to be the statute: https://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Disp...

With the obvious IANAL, it doesn't seem to rely on the message be sent to the person being threatened. The specific segment is "in any manner in which it may be viewed by another person".

This may be one of those cases where we get to find out how courts view SaaS platforms.

It seems most plausible if “formatted” is doing some heavy lifting in that sentence.

Do you have an example of that?

Flock isn’t a third party here, when they’re being contracted by the government.

Flock didn’t just yolo decide to slap cameras up. Your elected officials signed contracts to let them.

"It's complicated."

Cell phones are kinda weird because they carry some of the elements that were built up around hardline phones (similar to how physical mail has a ton of protections that accumulated historically that make it distinct from other mediums).

This one generally gets treated legally more like any other data collection in a public space. Essentially, it's not a violation of your rights if somebody sits on a street corner and takes a picture of every car that drives by. There's a really interesting debate about whether there should be some concept of scale (Flock makes it really easy to effectively put somebody on every street corner), but the law generally hasn't changed to take that kind of thing into consideration.

You can see the same kind of thing in many of the AI training debates. Training AIs on bulk data has been found in a couple different cases to not be copyright infringement because they're drawing parallels to any other learning, even if the scale here is obviously several orders of magnitude apart from what was ever possible before.

For what it's worth: if I own a business in the US and have a camera pointed at the street, and the police ask me for footage, I don't need to require a subpoena. I can just choose to give it to them.