calvins
Joined 18 years ago
Karma
104
Submissions
69
Member since
May 31
Recent submissions
Comment · 2 years ago
The paper itself: https://bmcmedicine.biomedcentral.com/articles/10.1186/s1291...
Comment · 9 years ago
What do you mean by 'out of the box'? jsonschema needs to be installed. It's not in the stdlib.
Comment · 9 years ago
It seems no security audit has been performed, but they plan on it at some point: https://discussion.enpass.io/index.php?/topic/404-security-a...
Their responses in that thread do not inspire confidence in the product for me, to put it mildly.
Comment · 9 years ago
I think you should put the disclaimer at the top of the github page, and clearly state that it is not secure.
The disclaimer currently is near the end of the document and says only "Purely experimental project. Designed for learning purposes not production use.".
Some people will miss that at the bottom of the page (after how to install, how to use, etc.), or might not realize that textbook RSA is insecure (https://crypto.stanford.edu/~dabo/courses/cs255_winter00/RSA...).
Comment · 9 years ago
https.cio.gov SSL Labs test result: https://www.ssllabs.com/ssltest/analyze.html?d=https.cio.gov
Of note is that they're using a Let's Encrypt cert and running in AWS.
Comment · 10 years ago
Not the OP, but I'd really like to be able to run containers with all unnecessary capabilities dropped:
Comment · 10 years ago
But doing a 360 doesn't mean doing a 180, and then sometime much later, doing another 180.
Comment · 10 years ago
Pip has a constraints file now. Running
$ pip freeze -r requirements.txt > constraints.txt
$ pip install -r requirements.txt -c constraints.txtComment · 10 years ago
It's easier to disambiguate shapes and colors than just shapes or just colors -- something like a checkmark of one color, and an X of a different color.
Comment · 10 years ago
> if it's _truly_ agent-less why do they care about the python version on the target, I feel that python target code is the agent?
"Agentless" means that it works by pushing to the machine and that there isn't an agent process already running on the target. It doesn't mean that there aren't any requirements on what needs to be installed on the target already.
Comment · 10 years ago
> it should hopefully reduce the FUD around alternatives with better type systems (Scala), if the type system is turing-complete in any case.
Beware of the Turing tar-pit in which everything is possible but nothing of interest is easy.
Alan Perlis
Comment · 10 years ago
I'm also a happy user of SSL Labs and reader of Bulletproof SSL and TLS. One very cool thing about the book is that if you purchase the hard copy (I got it from Amazon, for example), they'll email you epub, PDF, and web versions for free. The web version is perfect for reference at work. And the book gets updates too (http://blog.ivanristic.com/2015/08/bulletproof-maintenance.h...).
Thanks Ivan!
Comment · 10 years ago
> Either you verify from the bottom or you can't verify at all.
So 'curl ... | sudo -' is just fine now because we can't verify from the bottom, so there's no sense in verifying what we're piping to sudo?
Comment · 10 years ago
There is spamgourmet (https://www.spamgourmet.com/index.pl). It doesn't satisfy 4 exactly, but it's pretty close. If you give out an email like '[email protected]' (there are other domains too), then it'll forward 20 emails to the configured email for your account, but you can always log in and set it to 0 remaining at any point, regardless of how many emails have been received.