reaperhulk

Name collisions are unfortunate but inevitable. This name makes me think of ristretto255 (https://ristretto.group/), but that’s the world I live in. I suspect this project is likely to see more name recognition over time than either of our examples.

The specific tone of this post is purposefully bombastic to call attention to the fact that RSA is uniquely difficult to implement and utilize correctly. Newer cryptographic constructs use various methods to reduce the probability of incorrect implementation and improve misuse resistance. Are they perfect? Of course not! But we're improving all the time with signature algorithms like ed25519, NMR constructions like SIV, etc.

That's a shame (for them).

Your URL structure suggests you may be planning to do this for other Apollo missions, is that in the cards?

Edit: I see you've done this for Apollo 17 already on a different URL: https://apollo17.org/

This site is almost unbelievably great. Have you considered trying to contact the Smithsonian to see if they'd be interested in using it? I've never seen a more impressive interactive exhibit.

FWIW, the built-in VPN isn't actually what matters for why the internet is unblocked in China when on a foreign SIM. Instead, the way cellular data networks works is such that your traffic is tunneled back to the provider first.

As others have already noted, JIT codegen bugs leading to exploits do indeed happen and your intuition is mistaken. Here's one from Firefox's JS JIT from just a few months ago: https://bugzilla.mozilla.org/show_bug.cgi?id=1493900

The requirement in question is "Effective September 30, 2016, CAs SHALL generate non-sequential Certificate serial numbers greater than zero (0) containing at least 64 bits of output from a CSPRNG".

This has been generally accepted (via discussions on MDSP and in the CABForum itself) to mean that the serial must contain at least 64-bits of entropy. Not that the generation process consumes 64-bits. If it was the latter then `head -c 8 /dev/urandom | head -c 1` (and clamping the top bit to 0) would be a permissible method of generating a serial since it consumes 64-bits of CSPRNG output to generate the serial number.

CAs are given enormous power in the ecosystem and we judge them based on their incident response and process improvement. The barrier to entry should be very high for new entrants as we strive to improve the state of the industry. This incident alone is not a disqualifier for DM's inclusion but should be considered in the context of the other issues (both technical and otherwise) raised during review of the application process.

Regarding your claim that all certificates with 64-bit serial numbers are guaranteed invalid: A certificate with a 64-bit serial MAY be valid under the standard because a CA might choose to implement the spec such that they generate a serial and prepend a null byte if and only if the high bit is 1. To determine whether or not a CA is doing that experimentally you could use services like crt.sh or censys to find all CAs with valid 64-bit serial number certificates and see if they also issue 72-bit serial numbers. If you don't see any >64-bit they're likely violating the BRs and you should submit a report to them (Mozilla maintains a contact list for CAs on their wiki) and also send an email to MDSP. Independent researchers are the lifeblood of the current wave of enforcement across the industry!

The project accepts donations: https://www.wireguard.com/donations/

You need to enable it in Develop->Experimental Features, but also you need to be sure you have a CTAP2 key. "U2F" keys are all CTAP1, which is not supported yet. Yubi's 5 series are CTAP2, as are the blue keys with a 2 printed on them.

VPN fingerprinting is simple in most cases. The preamble to stateful VPN session initiation is generally trivial to detect. WireGuard does not (at this time) attempt to obfuscate itself, but it’s more resistant to that particular type of detection since it does not do such negotiation. So yes, this behavior could be potentially used as a heuristic distinguisher for a deep packet inspection tool.

I use WireGuard (including WireGuard iOS) every day in Shanghai. It’s mostly fast and performant but nothing escapes the occasional “drop all UDP to your endpoint”. Typically this manifests as windows of time (typically a few minutes) where no traffic to the VPN gets through. However, unlike an openVPN solution WireGuard recovers without having to bounce the tunnel or constantly reconnect.

The GFW is not a monolithic entity though so be aware that performance and blocking characteristics can vary widely between cities, ISPs, and sometimes even between cell towers.

VPN on demand features are on the iOS todo list. iOS supports the idea of making a VPN on demand for cellular or WiFi so it will be able to do what you want once that feature is merged.

Gameplay trailer states 4k resolution (55 seconds in) https://youtu.be/Q2zfx5hQ3CE

It's a remaster in the same spirit as Starcraft Remastered. Higher resolution textures, higher polygon counts, better animation, higher resolution options. Same game.

Yes, this restriction applies only to public CAs. The purpose is to prevent someone from getting, for example, a 192.168.1.1 cert and then using it on another network in a mitm attack.

That’s not the way the fraud is alleged to have worked. The article claims that fraudsters swapped fake parts into legitimate iPhones and then took them to Apple for repair. Apple would then put legitimate parts into the “broken” iPhone.

Very few people were demanding Python 3 support 10 years ago. Prior to 3.4 uptake was limited so we’re really talking about 4 years.

Also, old appengine was built with nacl (remember that?) sandboxing. Anything that couldn’t be built under the nacl sandbox couldn’t run in app engine. Google realized this was a problem long ago but it takes time to rebuild your whole platform to eliminate such a fundamental dependency. That may have taken most of their focus, leaving little for other projects. and of course their new arch makes python 3 free so it’s difficult to have a parallel engineering effort that will be rapidly deprecated.

That’s an accurate summary, but CDNs are important because they terminate huge numbers of sites. In your example censorship is relatively easy since network operators who want to block a site won’t have very much collateral damage by blocking your entire server just to deny access to that single site. CDNs, terminating millions of sites, make that far more challenging.

Yep, I’ll add the URL in my comment, sorry about that.

As noted in the PEP data classes is a less fully-featured stdlib implementation of what attrs already provides. Unless you’re constrained to the stdlib (as those who write CPython itself of course are) you should consider taking a look at attrs first.

http://www.attrs.org/en/stable/

They used Skylake in late 2016 MBPs and Kaby in the 2017 models.

Please don't commit suicide. You and the world will both be worse off. If you need to talk to someone about it 1-800-273-8255 is available 24 hours a day.

Apple pays devs 70% (and more on long-lived app subscriptions now). So that's $100B, not $233B.

An affordable car with good gas mileage is a status symbol? A Prius was an environmental status symbol 10 years ago, but now it's just a practical choice for people who want a reliable and (relatively) cheap car.

Agreed. I love my AirPods (they're amazing for when I want quick headphones and care less about sound quality) but they'd be a significantly better product if I could control the volume and go back/forward in songs without Siri.

I've also never downloaded the app and, in fact, didn't even know it existed. I've never been notified about it in any fashion on iOS?

I broke my 6s+ the 2nd day after release and got it replaced the same day. They have separate replacement stock even at launch.

https://github.com/Homebrew/homebrew-core/blob/master/.githu... Is a better link. It would just be a new formula in homebrew-core

As of iOS 10 autoplay and playsinline on a video element will do what you want as long as the video has no audio track or is muted. No webm of course

xcode-select --install on the CLI has been available since Mavericks (I think) and will install the CLI build tools without need to install the multi-gigabyte Xcode. I don't personally use macports, but that command should pretty much solve your issue.