thusoy
Laim: A Mail Transformer
Log sampling with Papertrail
Resistance-era password storage
Re:Ask HN: Mailing lists that HN readers ought to know about?
on Tuesday April 11, 2017 @11:25AM (#14088781)
I recommend Weekend Reading by Assaf Arkin to everyone, covers several topics from design and front-end to security, tooling and peopleware. More than just a collection of links, includes a bit of commentary which makes it feel much more personal.
Re:MitM-ing Postgres
on Tuesday June 14, 2016 @03:57PM (#11904855)
Yes, self-signed certificates without a CA is MitM-prone, but that's the only thing Heroku enables. You're only given a username and password and have to do with whatever configuration they've done, thus the problems.
Re:MitM-ing Postgres
on Tuesday June 14, 2016 @02:47PM (#11904303)
Thanks, glad you liked it!
Re:MitM-ing Postgres
on Tuesday June 14, 2016 @02:31PM (#11904177)
OP here. That's entirely correct, Postgres deployed correctly is secure against a MitM, but since Heroku has not issued a trust root, they are not.
Edited to add: As a user of Heroku Postgres you can't configure Postgres correctly, Heroku is supposed to do that for you.
MitM-ing Postgres
Re:When Hashing Isn't Hashing (Cryptography)
on Monday May 23, 2016 @02:32PM (#11755816)
I think the word you're looking for is key stretching.
Re:GitHub Outage
on Friday February 05, 2016 @12:43AM (#11039756)
This close enough? https://teespring.com/human-chaos-monkey
Re:GitHub Outage
on Friday February 05, 2016 @12:43AM (#11039753)
For anyone that feel they might fall under the same category (I do!), represent: https://teespring.com/human-chaos-monkey
Re:Mozilla Launches a New Firefox Version Without DRM Support
on Wednesday May 13, 2015 @06:02AM (#9537842)
Sadly, it doesn't. I was hoping for this as well, so I tested it, and it turns out that the user agent of the two browsers are identical.
EME: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
EME-free: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
Re:“RNG broken for last 4 months”
on Tuesday February 17, 2015 @01:59PM (#9064227)
I would guess so, yes. You can never prove that something is random, merely that it behaves randomly "enough". There are lots of testsuites[1][2] you can run that will test that a generator is uniform and doesn't follow any patterns or has any other statistical weaknesses, but you can never prove that something is fully random without knowing the process that generates those numbers. A statistically sound RNG might just output the digits of pi, which would be non-repeating, uniform and pass any randomness test, but if you knew which digit the RNG started from and how many it has output so far you can easily predict the next one. Likewise if you're given a large enough sample you can search the digits to figure out the state of the RNG.
[1]: dieharder: http://www.phy.duke.edu/~rgb/General/dieharder.php
[2]: http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/SP80...
Re:Python 2.x vs. 3.x use survey
on Wednesday December 10, 2014 @03:54PM (#8731622)
The easiest version is the most portable and easy to read in this case:
os.urandom(20)
Saves you from having to manage files at all, and works cross-platform.