calvins

vor 2 Jahrendiscuss

The paper itself: https://bmcmedicine.biomedcentral.com/articles/10.1186/s1291...

vor 9 Jahrendiscuss

What do you mean by 'out of the box'? jsonschema needs to be installed. It's not in the stdlib.

vor 9 Jahrendiscuss

It seems no security audit has been performed, but they plan on it at some point: https://discussion.enpass.io/index.php?/topic/404-security-a...

Their responses in that thread do not inspire confidence in the product for me, to put it mildly.

calvins

vor 10 Jahrendiscuss

I think you should put the disclaimer at the top of the github page, and clearly state that it is not secure.

The disclaimer currently is near the end of the document and says only "Purely experimental project. Designed for learning purposes not production use.".

Some people will miss that at the bottom of the page (after how to install, how to use, etc.), or might not realize that textbook RSA is insecure (https://crypto.stanford.edu/~dabo/courses/cs255_winter00/RSA...).

calvins

vor 10 Jahrendiscuss

https.cio.gov SSL Labs test result: https://www.ssllabs.com/ssltest/analyze.html?d=https.cio.gov

Of note is that they're using a Let's Encrypt cert and running in AWS.

calvins

vor 10 Jahrendiscuss

Not the OP, but I'd really like to be able to run containers with all unnecessary capabilities dropped:

https://github.com/aws/amazon-ecs-agent/issues/223

calvins

vor 10 Jahrendiscuss

But doing a 360 doesn't mean doing a 180, and then sometime much later, doing another 180.

calvins

vor 10 Jahrendiscuss

Pip has a constraints file now. Running

  $ pip freeze -r requirements.txt > constraints.txt

after you've installed all your packages gives you a constraints file that can be used to reinstall exactly the same versions:

  $ pip install -r requirements.txt -c constraints.txt

calvins

vor 10 Jahrendiscuss

It's easier to disambiguate shapes and colors than just shapes or just colors -- something like a checkmark of one color, and an X of a different color.

calvins

vor 10 Jahrendiscuss

> if it's _truly_ agent-less why do they care about the python version on the target, I feel that python target code is the agent?

"Agentless" means that it works by pushing to the machine and that there isn't an agent process already running on the target. It doesn't mean that there aren't any requirements on what needs to be installed on the target already.

calvins

vor 10 Jahrendiscuss

> it should hopefully reduce the FUD around alternatives with better type systems (Scala), if the type system is turing-complete in any case.

Beware of the Turing tar-pit in which everything is possible but nothing of interest is easy.

Alan Perlis

https://en.wikipedia.org/wiki/Turing_tarpit

calvins

vor 10 Jahrendiscuss

I'm also a happy user of SSL Labs and reader of Bulletproof SSL and TLS. One very cool thing about the book is that if you purchase the hard copy (I got it from Amazon, for example), they'll email you epub, PDF, and web versions for free. The web version is perfect for reference at work. And the book gets updates too (http://blog.ivanristic.com/2015/08/bulletproof-maintenance.h...).

Thanks Ivan!

calvins

vor 10 Jahrendiscuss

> Either you verify from the bottom or you can't verify at all.

So 'curl ... | sudo -' is just fine now because we can't verify from the bottom, so there's no sense in verifying what we're piping to sudo?

calvins

vor 10 Jahrendiscuss

There is spamgourmet (https://www.spamgourmet.com/index.pl). It doesn't satisfy 4 exactly, but it's pretty close. If you give out an email like '[email protected]' (there are other domains too), then it'll forward 20 emails to the configured email for your account, but you can always log in and set it to 0 remaining at any point, regardless of how many emails have been received.

calvins

vor 10 Jahrendiscuss

If we were in a simulation and the simulation would fail to realize its purpose if a sufficiently large number of beings in the simulation became aware of the simulation and changed their behavior, how smart would it be to try to get more and more people interested in the issue and look for "smoking gun" evidence? ;=-)

calvins

vor 10 Jahrendiscuss

> You need to allocate at least 30 minutes per day (1 hour is better) just talking (averaged over the week) and not micromanaging.

What do you talk about for an hour a day, every day, that is so important that it justifies allocating 16% of all development hours to communication? I don't see how this much communication could ever be a net win (or even come close to breaking even).

calvins

vor 10 Jahrendiscuss

"It is better to be a human being dissatisfied than a pig satisfied; better to be Socrates dissatisfied than a fool satisfied. And if the fool, or the pig, are of a different opinion, it is because they only know their own side of the question. The other party to the comparison knows both sides."

- John Stuart Mill

calvins

vor 10 Jahrendiscuss

Yes, us-west-1 has always seemed a bit of a second-class citizen. For years it has just been two availability zones, but they're named '1b' and '1c', as if there was once a third.

calvins

vor 10 Jahrendiscuss

Shane Legg (a DeepMind founder) and Marcus Hutter collected and categorized 70 different definitions of intelligence: http://arxiv.org/abs/0706.3639

Their attempt at a definition that synthesizes all the others is:

> Intelligence measures an agent's ability to achieve goals in a wide range of environments. - S. Legg and M. Hutter

calvins

vor 10 Jahrendiscuss

Errors when already lost don't mean much.

Submissions

Transport Layer Security (TLS) Extension to Support Code Execution

Dan Boneh's Crypto II Course Starts Jan. 11

Cryptographic Module Standards at a Crossroads After Snowden's Revelations

comments