I used to work on side projects late into the night. Yeah, it'd be difficult to fall asleep on those nights. These days it's usually a mix of side projects and then winding down for 0.5/1 hour before going to bed at a reasonable hour, unless I have something particularly absorbing going on.
Self hosting GitHub is an option as well. We've been self hosting GitHub Enterprise for years and it has had no downtime other than during scheduled updates (at night, when nobody's at work).
Reading this article in 2013 scared me off as well. A few years later, I had no choice but to visit the US and had 0 issues getting through CBP and TSA. The former was especially surprising (and a relief) to me, as my purpose of travel was not tourism or business. I came there to undergo an outpatient operation, so I had prepared lots of proof and documentation to show to border patrol officers. Because while this would technically fall under "medical tourism", I had heard this purpose of travel is somewhat likely to get you denied entry. The officer didn't seem to care one bit. After being asked the routine questions and answering truthfully, he asked me one trick question: "So, you're here on business?". I said "No" and then I was let through. No issues at TSA either. Being white and Dutch must be pretty powerful.
To add a positive anecdote, I've had 6 experiences with Airbnb and all of them were great. If you're traveling with just 1-3 people, the prices are comparable to hotels, as you say. But when traveling with a large group of people, I've found that Airbnb is a lot cheaper.
We use this as well. It's alright, but really only useful for user accounts. I wish they would focus more on writing extensions for third-party services (think: Jenkins), so that it also becomes useful for service accounts.
I agree that most laptops suck, but recent Thinkpads are perfectly fine machines. The only piece of hardware in my T470s that doesn't work out of the box on the latest Linux kernel is the fingerprint sensor. I can live with that.
I really hope this gets nicely abstracted away into a NixOS module soon. I've been looking for a solution to securely suspend to RAM by clearing the LUKS keys and reopening the LUKS volume when resuming. It looks like systemd-homed will be the first viable option to accomplish that.
TLS supports ECC certificates, so any web client using crypt32 to verify those is affected. That includes web browsers and lots of other types of services, so it's not primarily code signed executables.
Does Firefox still use NSS when using the Windows Certificate Store for the source of trusted root certs? What about Chrome?
You're right that RSA certificates are unaffected. There's no such thing as AES certificates, though.
The advisory from Microsoft is quite bizarre. It focuses on code signature validation, rather than X.509 as a whole. It also doesn't say anything about how the vulnerability itself works. Vague advisories like this are dangerous, because it gives adversaries an advantage over IT departments that don't know which system they should patch first. It would be much better if everyone understood exactly what the impact is from the get go. The NSA advisory is a bit better, but still doesn't tell us how exactly the ECC certificate validation bug works. We're left with only a few hints.
Thanks for the info. This is not really 2FA anymore though, is it? Now WebAuthn authentication is happening on the same device as the one I'm using to log into the service. Is there a way to use my phone as a completely separate factor for WebAuthn authentication?
What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?
Neat. I'm curious, which problems did you have with existing password managers that made you write your own? You mention Lastpass and mitro in the REAMDE, but there are lots of other good options available, like KeePass or Bitwarden.
No, but there is a quantum computer algorithm for classic asymmetric cryptography, which would affect some major proof-of-stake coins if quantum computers ever become practical.
This is a great talk. I'm excited to see what else they can learn about the PSP as they continue working on their tools. So far, it seems that it's much easier to explore than the Intel ME.
Because they are free to choose to not work for a company that has such an IP clause in its employee contract. They are also free to negotiate a change to that clause.
It's stunning that HackerOne staff use their production credentials to reproduce security reports. Is there no internal instance of the HackerOne platform they can run their tests on?
Tear free mode has never worked for me on multi-monitor setups. All Xorg drivers have this issue in my experience. Nvidia, AMD, Intel and even the modesetting driver. Wayland seems to magically fix it.
Also worth checking out: the "near death" page on the Google cemetery website: https://gcemetery.co/tag/near-death/. Lots of obscure products you probably haven't even heard of.