jesprenj

> Everyone seems upset about OCSP as of late, but the domains being sent in plaintext is not exactly limited to just OCSP - we've had this with SNI and DNS.

My main privacy related concern isn't about domains being sent in plaintext but that they are sent to the CA and they can then theoretically do analytics on this data and profile web users.

But maybe this concern doesn't really make sense as we have strict personal-data regulations now.

Regarding OCSP, off-topic for Apple: Firefox enables OCSP by default. This means that for every TLS connection an OCSP plaintext HTTP request will be made to the certificate authority that signed the certificate of the website the browser is connecting to. This means that the certificate authority receives very well timestamped information about the exact domains you are visiting if you are using Firefox and don't disable OCSP and the website you're connecting to does not use OCSP stapling (most don't). Note that disabling OCSP will make Firefox unable to get certificate revocation information (maybe it still uses system's revocation store, I'm not sure about that, but it certainly does not use more privacy preserving CRLs).

Where does sqrt come from? Shouldn't it be log? I don't know much about DHTs, but Kademila (BitTorrent's DHT) has query complexity of around O(log n), with n being the total number of nodes in the network. Kademila also uses random node IDs and XOR disrance metric.

What I very dislike about current browser automation tools is that they all use TCP for connecting the browser with the manager program. This means that, unlike for UNIX domain sockets, filesystem permissions (user/group restrictions) cannot be used to protect the TCP socket, which opens the browser automation ecosystem to many attacks where 127.0.0.1 cannot be trusted (untrusted users on a shared host).

I have yet to see a browser automation tool that does not use localhost bound TCP sockets. Apart from that, most tools do not offer strong authentication -- a browser is spawned and it listens on a socket and when the controlling application connects to the browser management socket, no authentication is required by default, which creates hidden vulnerabilites.

While browser sessions may only be controlled by knowing their random UUIDs, creating new sessions is usually possible to anyone on 127.0.0.1.

I don't know really, it's quite possible I'm just spreading lies here, please correct me and expand on this topic a bit.

Shouldn't they instead add 0.0.0.0/8 to the list of private networks, because it's possible that 0.0.0.0/8 might be private?

> in 50 years nobody wants to use glass containers

yet here we are, 50 years later, still using glass containers and fluorescent tube lamps that break because they are designed to break every two years

Wouldn't this break the embedded video?

Wildcard certs match subdomains with underscores, as pointed out by a sibling comment. Example: https://_.4a.si./

Google also indexed my site http://_.4a.si as seen here http://google.com/search?q=site:_.4a.si

How do they detect MS Word docs being opened?

My 100 mbps upload bandwidth at home is free (apart from the monthly 35€ payment). Useless bots will get stuck downloading from me instead of hogging readthedocs.

The official government website for accessing information about property ownership information in Slovenia only works during working hours -- mon-fri 8h-20h.

OP here. It doesn't work anymore:

Requested host does not match any Subject Alternative Names (SANs) on TLS certificate [d22c2cdf866a373f3648c0d7c30f9399e974d07c8c5417566ff11059a06f5b40] in use with this connection. Visit https://docs.fastly.com/en/guides/common-400-errors#error-42... for more information.

But I'm just doing this from memory, it's possible I did something else a years ago.

Please explain.

I was on a ~20 hour ferry ship from Italy to Greece once. They had paid wifi using sattelite internet, which I did not want to pay. But for payments to work, they allowed access to stripe. Turns out, everything on stripe.com was accessible, even dev docs etc. So I started to waste their bandwidth by downloading gigabytes of images from the stripe website over and over again.

But that's quite unproductive. As it turned out, in order for stripe to work, it needs access to fastly CDN. And then I remembered that reddit also uses fastly. By connecting to stripe and changing the Host HTTP header to reddit.com, I could browse reddit! Images didn't work though (i.redd.it is not on fastly). I could edit my /etc/hosts and associate old.reddit.com with stripe's fastly IP address. After ignoring scary TLS errors, I could even log in.

Ohhh, that's what it's for! I use it for scaling x11 apps with the run_scaled script that's shipped with xpra (:

> Finally, if sshd cannot be updated or recompiled, this signal handler race condition can be fixed by simply setting LoginGraceTime to 0 in the configuration file. This makes sshd vulnerable to a denial of service (the exhaustion of all MaxStartups connections), but it makes it safe from the remote code execution presented in this advisory.

And ArtNet also over UDP.

Great, thank you!

Is there a communuty project that maintains a copy of the 500k books? Is there a libgen torrent or anna's archive torrent?

Mastodon is bouba?

"?" is bouba "!" is kiki

What about the effect where for some pairs of words that don't theoretically have ordering preference (kiki/bouba vs bouba/kiki), (plus/minus vs minus/plus), (on/off vs off/on), (positive/negative vs negative/positive) have some psychological order that most people use and if the other ordering is used, it sound weird?

Does this effect have a name?

Related: Proxying can be disabled by setting the environment variable GOPROXY=direct [0]. I put it in my bashrc.

[0] https://www.practical-go-lessons.com/chap-18-go-module-proxi...

I'm interested whether the device mentioned has some haptic feedback for the user; can the user feel the resistive force when they grab an item?

Most services can be described by "essentially supervising a txt file" if you are succinct enough.

I guess ICANN needs to get money somehow.

OP could search-and-replace all Ds in Word with something more understandable by the OCR, maybe a period, before faxing the document. Or maybe convert every hex character into two characters from the set .0-|, doubling page count.

It's just a broken HTTP->HTTPS redirect. Try https://maps.google.com ... this works for me.

Good catch! Thank you.

That's a good counterargument, I agree.