dadrian

Yes, it started that way, but complaining about the current auto-update behavior of the software (not the ACME protocol), is completely unrelated to Let's Encrypt and is instead an arbitrary design decision by someone at EFF.

Add a /, e.g. `shortname/`

Let's Encrypt does not write or maintain certbot

Non-unique hostnames, which are RFC 1918 space, single-label hostnames, and addresses assigned to mDNS (.local).

Chrome has shown the HTTP warning in Incognito mode for about a year, and has shown the warning if you're in Advanced Protection mode for about 2-3 years.

Web browsers and operating systems are full of memory safety bugs, and are not written by engineers in crunch these days.

Not clear to me there's a correlation between hours worked and number of memory safety vulnerabilities

I like Zig, although the Bun Github tracker is full of segfaults in Zig that are presumably quite exploitable. Unclear what to draw from this, though.

[1]: https://github.com/oven-sh/bun/issues?q=is%3Aissue%20state%3...

Yes, because this is not a security-relevant revocation.

OCSP stapling, when done correctly with fallback issuance, is just a worse solution than short-lived certificates. OCSP lifetimes are 10 days. I wrote about this some here [1].

[1]: https://dadrian.io/blog/posts/revocation-aint-no-thang/

Yeah, I assume this means there’s a lot of fraud

This is an unserious article.

1) If you're counting investment, you should count it in dollars, not number of investors or corporate entity locations.

2) This is missing at least two extremely well-known CNE vendors, which makes me doubt its accuracy.

3) The takeaway from the graph on Mythical Beasts [1] should be that the industry is _very small_, not that it's very big.

4) Americans should be happy that the US government is the biggest player. Would you prefer to have China or Russia or the Middle East be the biggest player? Get a warrant -> own a phone is a very straightforward process that fits into existing models of civil liberties in the US.

[1]: https://mythicalbeasts.atlanticcouncil.org/

No, that is also illegal.

It is illegal for an employer to hack your phone.

I saw someone joke that "once Mistral gets back from their European summer, they'll really be in it", and damn, it does feel like that happened.

Oh nice! That's probably reasonable, although I am pro keeping the accredited investor requirement.

The most basic SaaS companies are not raising $10MM at pre-seed, they’re raising $1-3MM at $10-30MM post.

Most Fund I’s are going to be smaller funds, often $9.99MM to allow for a larger number of smaller LPs due to the $10MM threshold from the SEC. Whereas Fund II-IV are going to be considerably bigger, often hundreds of millions of dollars. So a large number of smaller funds falling off won’t make that big of a dent in the total dollars available, but may make it harder to get the smaller initial checks.

Are there any good LLM plugins for Obsidian, beyond just throwing Claude Code / Codex at your markdown folder?

It's because GenZ is addicted to nicotine and millennials are all using legal weed. We've just replaced one substance with some others, rather than started abstaining.

You still have to pay taxes on income from non-bug bounty vulnerability markets, be it to law enforcement, brokers, or criminals.

I don't take Gutmann seriously.

hey now

There's a difference between FIPS validation and FIPS-approved algorithms. We can say "you have to use the FIPS-approved algorithms", but skip the useless validation step.

If DOGE had done nothing other than get rid of FIPS validation, the GDP unlock alone would have solved the debt problem.

That is literally what this proposal is suggesting.

You should absolutely buy a Miata. I have a 2021 Miata and it's one of the best decisions I ever made.

I think people are glossing over the fact that Usenix ATC wasn’t even a good academic conference. If you’re submitting high-quality academic work to Usenix, you’re sending it to one of the higher prestige Usenix conferences in a specific subfield, such as Usenix Security or NSDI.

Dave’s riffs are also stolen from disco. Which again, is fine! I love them!

Source: https://youtu.be/dZCrdSC2-1I