reedloden
Joined 13 years ago
Karma
185
Submissions
41
Member since
Jun 16
[ my public key: https://keybase.io/reed; my proof: https://keybase.io/reed/sigs/Lty8JS0VpdMSR0MLoCbl-xDn6C74xbtJkt5prorBAHc ]
View on Hacker NewsRecent submissions
Comment · 5 years ago
Google only stopped scanning the emails for advertising purposes, as the article states. Google definitely actively scans emails for malicious content (see https://support.google.com/mail/answer/25760?hl=en and https://support.google.com/a/answer/7380368?hl=en).
Comment · 5 years ago
https://www.hackerone.com/company/open-source-community
HackerOne has a free offering for open source projects. ^^
Let me know if you have any questions (I manage it). :-)
Comment · 10 years ago
Now, that could be a valid issue, indeed, though not sure for how long I care about those devices continuing to work without any valid upgrade path... Using things like HSTS and CSP's `upgrade-insecure-requests` would help here for clients that do support it.
Comment · 10 years ago
> There are always practical limitations to site-wide technical changes, and HTTPS Everywhere is no different. Sites and content we consider ‘archival’ that involve no signing in or personalisation, such as the News Online archive on news.bbc.co.uk, will remain HTTP-only. This is due to the cost we’d incur processing tens of millions of old files to rewrite internal links to HTTPS when balanced against the benefit.
Not to be snarky, but haven't people written tools to help with this? This seems like a common issue. I mean, there's `sed` and similar tools, obviously, but something that could go, validate that the link works over https://, and update it. I don't see why that would need to be some monumental amount of work.
HTTPS is more than just privacy. See https://certsimple.com/blog/ssl-why-do-i-need-it and https://www.troyhunt.com/ssl-is-not-about-encryption/
Comment · 10 years ago
> Earlier in 2016, the Chromium development team decided to implement a change to Google Chrome, preventing access to certain in-browser features on ‘insecure’ (non-HTTPS) web pages. In practice, this meant that key features of certain products, such as the location-finding feature within the Homepage, Travel News and Weather sites, would stop working if we didn’t enable HTTPS for those services.
I think this shows how valuable it is to use incentives to get people to Do The Right Thing(tm). Perhaps more things should be changed to require HTTPS.
Comment · 10 years ago
Isn't this why projects such as Homebrew thrive? For me personally, I just `brew install git`, and I keep it updated that way (`brew update && brew upgrade`)...
Sure, Apple should ship a fix, but there are ways around it for now.
Comment · 10 years ago
https://developer.mozilla.org/en-US/docs/Web/API/RandomSourc... solves that. Just need to tweak the code.
I submitted https://github.com/arik-so/tsa/issues/4 about this issue.
Comment · 10 years ago
https://bugs.launchpad.net/ubuntu/+source/git/+bug/1557787 is the tracking bug for this issue. Seems like it's fixed on xenial but not yet in older releases.
Comment · 10 years ago
Note that Seafile seems to still be using a very old and EOL'd version of Django that has known security issues (currently v1.5.12, I believe).
Comment · 10 years ago
Just use Let's Encrypt. :)
Signed, The guy who marked that bug report invalid.
Comment · 11 years ago
Zenefits and ZenPayroll are two completely different companies. Don't let the "Zen" part confuse you. :)
Comment · 11 years ago
Ah, so this is why Facebook tries to load Flash on almost every page... Allows them to gather data like this. Always wondered why Flash was "needed".
(another reason to put Flash behind click-to-play and/or push for HTML5 video)
Comment · 12 years ago
Yes, Firefox has supported public key pinning for a while now.
You can check the latest status at https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...
Comment · 12 years ago
Yet another new crypto protocol... "Yay"
What about when HTTP/2 becomes popular? You'll still have to deal with TLS then unless you deal with TCP connections directly (and bypass HTTP).
Comment · 12 years ago