Secure enclaves
844 karma · joined February 29, 2012
The doctor never should have prescribed hydroxychloroquine for COVID-19 because it was ineffective and the medical community already knew it at the time, and if they were going to they should have done a physical exam or taken labs to determine if it was safe first, and they didn't.
Keep in mind that the username/password are just hex-encoded 128 bits from /dev/urandom, so they're not guessable at all without some sort of leakage attack, like a timing attack. And if anyone attempts to do a timing attack the person hosting the file will see all the requests scrolling down their terminal in real-time and can always hit ctrl-c.
There's also the bit about knowing the hidden service .onion to attack in the first place, which wouldn't be trivial to discover, especially since I envision these to mostly be very short-lived.
But all that said, this is great feedback. Keep it coming and feel free to open security issues on github.
There are about 100 root CAs, and something like 1000 CAs if you include intermediates (controlled by ~650 different organizations - https://www.eff.org/observatory), and browsers trust ALL of them. All it takes is one to issue a malicious cert, or to get hacked, to do a MITM attack on ANY domain without showing a browser warning.
The trustworthyness of a single CA doesn't make a difference, because if any CA isn't trustworthy then an attacker can use them instead the other ones. This is the problem with CAs, and the problem with centralized trust systems in general. There are hundreds of weak points.
But also, StartSSL does fairly thorough identity verification. I've had to send them photos of my passport and talk to them on the phone to do identity verification. It's also worth noting that it's the CA that both https://www.eff.org/ and https://pressfreedomfoundation.org/ use.
As long as there's a broken CA system, the choice of CA does not matter in the slightest as long as it's trusted by browsers. Users only care if it breaks a website with a scary warning, but if it doesn't, it doesn't matter. There's no need to spend money.
StartSSL does charge if you have more than very basic needs, like if you want multiple alt names, or if you want a wildcard. But it's still cheaper than the competition.
Last night we released a Chromium update that had a critical bug that broke the browser. As soon as we discovered this we removed it from the Chrome store temporarily until we could release an update.
We just released an update that fixes this bug, and it's back in the store again: https://chrome.google.com/webstore/detail/https-everywhere/g...
If you want to read it quicker, add this to your /etc/hosts:
190.93.254.39 micahflee.com
Also, there aren't 10,000 men that go to DEFCON. A large percentage of the attendees are women.
There's still occasionally searches that I make that I can't find what I need from DGG, so I manually go to google for those (and of course for image search). But DGG definitely meets my daily needs for a search engine, and I love how privacy friendly it it.
So I just me giving my permission before anyone has to ask, but only for the purpose of App Store distribution. They're not allowed to re-license my code as proprietary for any other purpose.
Now Ars has iPad with iOS 7 user-agents in their logs too :)
This game is licensed under the GNU General Public License (see gpl.txt). As the copyright owner, I hereby give anyone permission to re-license my GPL code under a non-GPL license for the purpose of distributing it in the iOS App Store or the Android Market.
So people are welcome to fork my project and still publish in the App Store without even having to contact me.