micahflee

Secure enclaves

I was skeptical about this too. I used to have the $100/month Claude subscription. I'm still on my first month of just using open weight models, but so far I think the costs will be comparable. Maybe even less some months. But obviously it depends on your actual usage. I think it's worth trying it out instead of just assuming it will cost much more.

Read End Times Fascism and the Fight for the Living World.

It says "Verify your TM SGNL PIN" instead of "Verify your Signal PIN". That's the only difference.

Hacks, Leaks, and Revelations: The Art of Analyzing Hacked and Leaked Data is available for sale today, and also it's free under a Creative Commons license

Hydroxychloroquine has dangerous side effects for people with heart abnormalities, and shouldn't be prescribed without first determining if it's safe. The FDA warned about this in 2020, and also warned doctors to not prescribe it for COVID-19 since it's shown to be ineffective at treating it: https://www.fda.gov/drugs/drug-safety-and-availability/fda-c...

The doctor never should have prescribed hydroxychloroquine for COVID-19 because it was ineffective and the medical community already knew it at the time, and if they were going to they should have done a physical exam or taken labs to determine if it was safe first, and they didn't.

I was suspended for posting this https://infosec.exchange/@micahflee/109520648205436407

I have doubts that a timing attack would even be exploitable here since it's a hidden service, but I just made the string comparison constant-time to be safe: https://github.com/micahflee/onionshare/issues/3

Keep in mind that the username/password are just hex-encoded 128 bits from /dev/urandom, so they're not guessable at all without some sort of leakage attack, like a timing attack. And if anyone attempts to do a timing attack the person hosting the file will see all the requests scrolling down their terminal in real-time and can always hit ctrl-c.

There's also the bit about knowing the hidden service .onion to attack in the first place, which wouldn't be trivial to discover, especially since I envision these to mostly be very short-lived.

But all that said, this is great feedback. Keep it coming and feel free to open security issues on github.

Is 12.04 pre-Unity and Amazon ads? These start when the ads started.

It doesn't particularly matter if people trust StartSSL, it matters if browsers trust them (which they do).

There are about 100 root CAs, and something like 1000 CAs if you include intermediates (controlled by ~650 different organizations - https://www.eff.org/observatory), and browsers trust ALL of them. All it takes is one to issue a malicious cert, or to get hacked, to do a MITM attack on ANY domain without showing a browser warning.

The trustworthyness of a single CA doesn't make a difference, because if any CA isn't trustworthy then an attacker can use them instead the other ones. This is the problem with CAs, and the problem with centralized trust systems in general. There are hundreds of weak points.

But also, StartSSL does fairly thorough identity verification. I've had to send them photos of my passport and talk to them on the phone to do identity verification. It's also worth noting that it's the CA that both https://www.eff.org/ and https://pressfreedomfoundation.org/ use.

As long as there's a broken CA system, the choice of CA does not matter in the slightest as long as it's trusted by browsers. Users only care if it breaks a website with a scary warning, but if it doesn't, it doesn't matter. There's no need to spend money.

StartSSL does charge if you have more than very basic needs, like if you want multiple alt names, or if you want a wildcard. But it's still cheaper than the competition.

If you offer software to download HTTPS is a must. Otherwise any active attacker, from a kid at a coffee shop to the NSA at the ISPs, can make it so when people download your software they're also downloading your software with malware attached. Software downloads are one of the most important things to protect, and it saddens me that some websites still exist that offer software downloads that don't use HTTPS.

Hey, I'm the maintainer of HTTPS Everywhere.

Last night we released a Chromium update that had a critical bug that broke the browser. As soon as we discovered this we removed it from the Chrome store temporarily until we could release an update.

We just released an update that fixes this bug, and it's back in the store again: https://chrome.google.com/webstore/detail/https-everywhere/g...