packetized

Literally the most terrifying service for any security-minded operations-focused person. Wonderful tool, interesting and useful in a dizzying array of aspects - but dear lord, I've had some real horrific moments when users told me that they installed it to allow access to their (private) repos for testing.

Also try Garajito and (the somewhat unceremoniously named) G-Spot across from Moscone on 3rd.

Eagerly awaiting the response from Cloudflare detailing their response, since all of the domains associated with this so far appear to have been hosted with them, or at least fronted by their service.

What's cheaper - an iOS phone, or an Android phone + a Yubikey?

What specifically do you consider a gigantic pain in the ass about using SSH keys on a Yubikey? Also, how is keeping the private key ensconced in a (presumably) secure HSM a 'bit of security theatre'? Genuinely interested, here.

Erm, not true - changing the Yubikey setting to require a touch for key use (S/C/E) is trivial. Malware can't use it without restriction if it requires you to physically touch it every time you want to approve use.

You're correct, I was a bit too quick on the 'reply' button there.

Can you share where you found the project files in the client tar.gz?

edit: Found it, uws.js in resources/bootstrap/discord_rpc.zip

edit2: This is arguably worse, but the argument may be "it's a compiled binary":

  -bash-4.1$ strings discord_rpc.node | grep uws.*cpp$
  ../../discord_common/native/third_party/uws/nodejs/addon.cpp
  ../../discord_common/native/third_party/uws/nodejs/addon.cpp
  ../../discord_common/native/third_party/uws/src/EventSystem.cpp
  ../../discord_common/native/third_party/uws/src/Extensions.cpp
  ../../discord_common/native/third_party/uws/src/HTTPSocket.cpp
  ../../discord_common/native/third_party/uws/src/Network.cpp
  ../../discord_common/native/third_party/uws/src/Server.cpp
  ../../discord_common/native/third_party/uws/src/UTF8.cpp
  ../../discord_common/native/third_party/uws/src/WebSocket.cpp
  ../../discord_common/native/third_party/uws/nodejs/addon.cpp
  ../../discord_common/native/third_party/uws/src/HTTPSocket.cpp
  ../../discord_common/native/third_party/uws/src/WebSocket.cpp
  ../../discord_common/native/third_party/uws/src/EventSystem.cpp
  ../../discord_common/native/third_party/uws/src/Extensions.cpp
  ../../discord_common/native/third_party/uws/src/Network.cpp
  ../../discord_common/native/third_party/uws/src/Server.cpp
  ../../discord_common/native/third_party/uws/src/UTF8.cpp
  -bash-4.1$

Of note, they also appear to have forked a version of uWebSockets from Sep 2016 [0] in their Github org.

0: https://github.com/hammerandchisel/uWebSockets

Would you mind sharing with HN the data that you shared with the Discord team? I'm afraid that you didn't link what the project was, or how exactly it's a "private open-source library", which seems like a self-contradictory statement.

Corruption is corruption. He's a centrist Democrat considering a party switch.

Happy now?

Of note: the CEO of Mylan, Heather Bresch, is also the daughter of the senior senator representing West Virginia, Joe Manchin, who was also the governor of the state from 2005-2010. Joe's wife (and Heather's mother) Gayle Manchin took over as the head of the National Association of State Boards of Education in 2012, and helped push through the 'EpiPen Law' in 2013 that gave funding preference to schools that stocked them. [0]

Much like fish, the head tends to rot first.

0: https://www.usatoday.com/story/news/politics/2016/09/20/fami...

It's been a couple of years since I was really immersed in the operational aspects of NTP/PTP - glad to know I can still mostly follow along.

Nice theme on the blog.

httpstime is interesting, but roughtime seems to have a few additional features:

* stateless operation (via UDP)

* no reliance on SSL/TLS or PKI

* ability to catch incorrect servers (assuming no collusion)

I think it's a very interesting take on time services, without being something quite as heavy as PTP/IEEE1588. The stated goals of fixing wildly incorrect clocks over ultraprecise timing [0], preventing clock-source tampering, and keeping largely in-line with the original design concepts of ntp (while solving a number of security shortcomings) seems to be targeted squarely at user devices, and much less so at service providers or operators that require precision timing for log stamping and the like.

Additionally, if you need a roughly-correct clock for validating HTTPS certificates, and you have to connect to an HTTPS server to update your time to be roughly correct, how do you trust the server? Sure, you can simply connect to something with a self-signed cert, but then you're putting the trust squarely back in the hands of that single server, without any method of verifiability. Turtles all the way down.

[0]: "The Roughtime creators state that 25% of Chrome’s certificate errors are caused by incorrect local clocks (off by days or more). A local clock within a few seconds of reference time is good enough."

Looks like they SWIP'ed out the subnets of 18/8, transferred that object to ARIN allocation, and transferred 18.145/16 to Amazon.

https://whois.arin.net/rest/net/NET-18-145-0-0-1.html

edit: Looks like a lot more than just 18.145/16, based on https://whois.arin.net/rest/org/AT-88-Z/nets

None. There's a handful of n-grams in there that keep me guessing at 'em but I can't really piece together what the encipherment method might have been.

The title is ROT13'ed "Think, Columns Key: Billforward". Haven't been able to make much progress past that; I've tried the text against all of the symmetric ciphers on my system using the key "Billforward" without any luck.

$ IFS=":$IFS";for i in $( openssl ciphers 'ALL:!ADH:@STRENGTH:!EXP' | sed -E -e 's/(-(MD5|SHA)|(DHE|DSS|EDH-DSS|EDH|RSA)-|3)//g' ); do openssl enc -$i -d -in bf.txt -k Billforward; done

I am mostly amazed that this is the first time that I've read in depth about John Scott Haldane, who is the father of noted evolutionary biologist J.B.S. Haldane. Super interesting.

I have, several times. It still doesn't answer my sincere question, nor does it make your apparent criticism look any less venal.

I'm not quite sure what your motivation in stating this is, so I'll ask plainly: What are you trying to imply with this statement? That it would have been of greater value had he taken up this cause in the Thatcher years?

I'm sure there are those who would shout cries of 'self-aggrandizement!' about you submitting this, but instead I'd like to offer my sincere thanks for doing so, and even deeper thanks for taking this on as a cause years ago. Bravo.

I can't speak as to others in the bay area, but I quite enjoy the traditional Sunday dinner, wherein I cook for a number of friends in my own home, without expectation. I live in downtown SF, so clearly not an extravagant amount of space, but we make it work (and well). I feel this article is written by someone who doesn't actually know anyone outside of their own echo chamber in SF.

edit: if anyone likes meat, potatoes, and whisky, get in touch.

Test profiles is an especially interesting idea, something that I don't believe other tools in this space (Gomez/Compuware APN, ThousandEyes) have quite yet. Other than test profiles, what sets Calibre apart?

FTA:

  ACM handles all aspects of SSL/TLS certificates for _custom domains_;
  you no longer have to purchase certificates, or worry about their
  expiration or renewal.

Emphasis mine.

They aren't generating certs on the fly for randomly named dynos:

  -bash-4.1$ curl -vkLs https://wind-river-5693.herokuapp.com 2>&1 | grep certificate
  * Server certificate: *.herokuapp.com
  * Server certificate: DigiCert SHA2 High Assurance Server CA
  * Server certificate: DigiCert High Assurance EV Root CA
  -bash-4.1$

I have, and I believe that you're being extraordinarily reductionist about the true costs involved in developing and operating services like certificate management at scale.

Saying that "that's only 20 gigabytes worth of certs" is roughly equivalent to saying "this database is only 1.8TB - that's miniscule, 2TB drives are only $70!". There's a whole lot more moving parts, especially at scale (developing a system to manage 5M certs? Pretty sure that's a whiteboard interview question somewhere).

Toll records would be the CDR, I'd imagine. [0]

[0]: https://en.wikipedia.org/wiki/Call_detail_record

I always forget that this exists - thanks for the reminder.

By "reliable", what I mean is that the IP address to ASN mapping is as up-to-date as possible.