jmhodges

I used to use `go get` for grabbing even non-Go repos but had to stop because of similar problems. I finally wrote a small tool to replace it I call `grab` https://github.com/jmhodges/grab to take over my "fetch the code and organize it into a tidy directory system" need

It actually uses the nice VCS library guts that `go get` does!

Well, no, the DNS resolved to these endpoints, just like in an HTTP attack, and then this is as if the Host header wasn't checked by the HTTP provider. You and these few specific hosting providers didn't think they had to look at the SANs, but, in fact, the Baseline Requirements expected them to verify that the SANs in the certs are controlled by the same user.

There's a reasonable disagreement but I (and others[1]) liken this the "postmaster@" attacks. At some point, for every protocol the hosting provider handles, we always end up having them do a bit more work then they thought they had to do but them's the breaks when dealing with the modern internet.

[1] https://twitter.com/sleevi_/status/951041801368035328

My "Hosting providers haven't, previously, thought of TLS serving as an individual user service before (though the Baseline Requirements do) and are having to work out the kinks of that." covers what you're trying to get at here.

There are equivalent attacks on both the DNS and HTTP challenges as described in the Baseline Requirements and ACME, and those are expected to be mitigated (and are) by hosting providers. Let's Encrypt isn't bound by the Baseline Requirements to mitigate this for these hosting providers, but is doing so out of a esprit-de-corps while the web figures out how it wants to handle this.

Hosting providers haven't, previously, thought of TLS serving as an individual user service before (though the Baseline Requirements do) and are having to work out the kinks of that.

You add multiple domains to the Server Alternative Names of your CSR.

To be clear, the challenge types in question where removed from Let's Encrypt production config during the private beta period (when we had a strict whitelist of domains allowed to be issued for), had mitigations for them in while they were out, and we deleted the code for them entirely the other day (in https://github.com/letsencrypt/boulder/pull/1247 )

FYI, using TLS compression makes you susceptible to the CRIME attack. I think I have a ticket with OpenSSL for them to turn that off by default, but I don't think they've done it, yet. Glad you got there accidentally!

This really did happen. And we're totally cool.

I refer to that as the Night of a Thousand Australians. Good times.

You didn't read the post, did you?

That is, as far as the archive goes, the very first public tweet.

Mostly, though, we think it's just adorable.

We go by bytes, not chars.

Okay, really, I want you to apply for Systems. We're building horizontally scalable, distributed, big data systems that can take unprecedented growth. The company is only a 134 people right now, and your impact as a developer would be huge.

http://twitter.com/job.html?jvi=oAPbVfwf,Job

Twitter is hiring for systems, frontend, etc. We're pretty polyglot but the majority of integration with the web app is ruby, a good deal of the backend is Scala and the rest is whatever works best.

http://twitter.com/jobs

For those who were confused by the contradiction of this comment and the actual post, it looks like "less attention from men" was probably supposed to be "more attention from men".

For instance:

"So basically, guys are fighting each other 2-for-1 for the absolute best-rated females, while plenty of potentially charming, even cute, girls go unwritten."

(And it's doubly confusing because patio11 refers to it as an "old wive's tale".)

I am completely surprised no one has linked to technomancy's emacs-start-kit: https://github.com/technomancy/emacs-starter-kit

Clone that as your emacs.d, add a .el file named the same as your logged in user, and add your specific preferences there. (I like to have it include stuff in a jmhodges directory in emacs.d, of course.)

On that note, my own fork of it with very minor personal changes: https://github.com/jmhodges/emacs-starter-kit

Joker.com has a horrible UI, but does the job just fine.

If you've got MacPorts installed (if you don't, you should), grab a copy of my ports repo from github and use the emacs-app Portfile there.

http://github.com/jmhodges/ports/tree/master

Sorry, not 64-bit integers but you get my drift.

Yes, and those "k = m" lines are the problem! Those assume unsigned* types! And 64-bit integers! Those multiplications and other operations are all wrong!

You didn't port this to Java, you ported a broken algorithm to Java. Way to go, though.

I think I enjoyed this the most:

"I’m sure you’re asking yourself, 'how much does this enterprise solution cost me?'. Well, like any good enterprise system, it is insanely expensive. This gem will cost you eleventy billion dollars payable to me, now."

Looks like the new url is:

http://www.washingtontimes.com/news/2009/jun/17/state-asks-t...

The day seems to have changed. (Perhaps their CMS updates the url as a side effect of saving an update that happens on a new day?)

Actually, you can install it just from the tarball. It's pretty easy. (Check the Without RubyGems section of the install page.)

If someone manages to port the 64-bit version to Java (which probably requires some JNI or JNA work), I would be very happy.

Not a joke.

Don't forget the balanced budget attempt in '37.

(Psst.. check out rfeedparser.)