richm44

SBOMs are more an attempt to solve some of the problems introduced by software reuse. https://archive.fosdem.org/2025/schedule/track/sbom/ has some interesting talks about the successes and failures of them.

Try this https://theconversation.com/the-reinhart-rogoff-error-or-how...

Here's an example I made a while ago of how easy it is to use LD_PRELOAD to hook things and change file contents etc. https://github.com/richmoore/reciprocity

If that same tool is unable to spot LD_PRELOAD in use then I'd suggest getting a new one. :-)

Time for me to dust off CVE-2010-3170 again? :-)

Odd - I also have 16.93 on Mac and I don't get the checkbox (unless I just can't find it I guess).

As the article explains, that's not been implemented on Mac yet.

Downloading things from the AIA fields would mean triggering HTTP/HTTPS requests to an untrusted URL from a certificate you haven't verified - not a good idea. What firefox does is cache intermediates that it has seen elsewhere, the windows TLS stack can fetch additional certs from windows update on-demand (and actually starts with only a small bundle of trusted roots). There is no good solution for incomplete chains other than getting the sites fixed (or using a provider like cloudflare that solves it for them).

1. A SYN will receive a SYN-ACK or a RST 2. A host from my machine is the same as from your machine 3. An IP from my machine is the same as from your machine

It was also possible in earlier browsers by using hidden frames. User interaction or a timer would trigger, then you load the frame (which contained dynamically generated js) and then call the javascript you'd just loaded.

You can't get perfection, but you can do things like ask for them to document the controls they implement and to evidence that they have operated them appropriately via an audit like SOC2.

See https://woboq.com/blog/verdigris-qt-without-moc.html for detailed breakdown

You're looking for these:

https://github.com/hoglet67/RGBtoHDMI - HDMI adaptor - works nicely with the beeb https://www.gotekemulator.com/ - Floppy emulator that lets it use USB storage

There are similar addons that can use things like the 1 MHZ bus via SD cards too.

Here's a version of the same as a BBC Microbot tweet https://twitter.com/bbcmicrobot/status/1333542986588753921

This video is good background for khtml/webkit on which chrome was based https://www.youtube.com/watch?v=Tldf1rT0Rn0

If you care about performance then you should start by reading High Performance Browser Networking (the text is available online here https://hpbn.co/ ).

Must be a while ago then - it's 12 characters upper, lower and digits. Pretty reasonable.

I remember coding this effect in C a long time ago. Back in the day we used to use the frame buffer as the data store too, not really feasible today!

The primary implementation on MacOS and iOS is SecureTransport.

A few more:

- Localhost is 127.0.0.1

- A TCP SYN will also always result in a SYN-ACK

- Ok, a SYN-ACK or a RST

- Ok, ok, an out-going TCP packet will always result in a TCP response

There are some other fun edge cases - for example:

- If you have a port-forward to a machine that is switched off then you can get ICMP network unreachable or ICMP host unreachable as the response to the a SYN in the initial handshake.

This can also happen at any point in the connection. Other ICMP messages can also occur like this (eg. admin prohibited).

It's always worth remembering that the TCP connection is sitting on an underlying network stack that can also signal errors outside of the TCP protocol itself.

I'd recommend this book instead 'The Linux Programming Interface' http://man7.org/tlpi/ it's a lot more recent and the content is excellent, though it's not a free download. The author is also the maintainer of the linux man pages.

I'd like a standardised function to clear a block of memory that is guaranteed to not be optimised out, and a constant time compare function.

Sadly it doesn't on linux due to overcommit. You can actually get the failure much later when you try to use the memory. The exception is when you try to allocate absolutely huge buffers. So malloc returning a valid pointer doesn't indicate success (though it returning NULL does indicate failure).

I was part of the Qt community at the time (and still am) and that's really not how it happened.

Heh. Qt was released in 1995 and the The Cathedral and the Bazaar was released in 1997 with the OSI being formed in 1998. This means Qt pre-dates the term 'open source' by approximately 3 years!

And people can't comment on them etc? TBH I'd be fine with it if they were flagged as the adverts they are.

> - It's somewhat complicated for a site to implement correctly

This is true, but the same thing was said about running a site at all not long ago.

> - It mainly protects users who have already connected to a site once from a secure location and whose browsers support HSTS and other "fixes"

The point of using a valid CA is to allow the first connection be secure. It's certainly true that you can secure subsequent connections more than the initial one though.

> - Circumvented easily via phishing

Phishing is attacking something completely different and is not something SSL/TLS can or should protect you against. It's like expecting a seat belt to protect you from being run over.

> - Does not prevent nation states from MITMing connection

Actually it does if HPKP is used, though not on the initial connection.

> - Can only host one site per IP, without a wild-card or UCC cert (which not all clients support)

This is supported via the server name indication extension, and additionally by using multiple subject alternative names. The former is better though since it allows each site to have its own key.

> - Makes caching difficult to impossible

True, but that's a feature. Caching on the client is still of course entirely based on what the client chooses to do.

> - Adds performance overhead

Not much, see https://istlsfastyet.com/

> - Potential for new attacks on the TLS layer (SSL Strip, STARTTLS Command Injection, BEAST, POODLE, RC4, CRIME, TIME, BREACH, Truncation, FREAK, Logjam, Heartbleed, BERserk, Root cert forgery, ChangeCipherSpec injection, Protocol downgrade, Certificate errors, Renegotiation, Triple Handshake, Virtual Host confusion, DoS)

Note that there are protections again those, and saying "because it might have a problem" is basically just burying your head in the sand of the problem you already have.

> - General confusion by users as to what makes a connection secure

True, but not a good reason since you as a site owner can do most of the work for them (in combination with their browser).

That's not correct, it was to learn bignum arithmetic not C.

It's a pity this article is based on a false premise since it could have contributed to the discussion more usefully. What's being removed is the keygen tag, not client certificate support - the two are independent.