ryan-c

It's _way_ higher quality than that.

It didn't get much attention when I posted it earlier this week, but I made an SSH movie player:

ssh ansi.rya.nc

(currently shows Sneakers, complete with subtitles)

Did I inspire posting this?

https://infosec.exchange/@ryanc/114386921335051196

Kinda curious what site this was - I assumed United Nuclear (which I have ordered non-radioactive items from), but they don't sell Pu.

of stands for obliterated file

He was a good friend of mine, and I joined his last company very early. I found out from the defcon twitter account. I miss talking to him.

As someone with a domain name on a ccTLD for a country most people have never heard of, I can only say "lolsob". It's managed by a guy who works for the post office, things take a few weeks to process, and there's a holding company involved.

As the other poster told you, they filter it out.

You can turn on the referrer header for same site, however I suspect the author would argue that this would be contrary to GDPR. There is also the ping attribute on links, but again, if we accept the author's premise...

I'm sorry, what? Is this actually arguing that consent is needed to log the user agent string?

Has this person studied law?

I do that, plus a little more (page being closed), with an identifier in session storage. If doNotTrack is turned on, the session storage is skipped.

I do not have a consent banner, and I do not believe that I need one.

With i < 71, the compiler will just turn it into a constant value of 36. Switches to SIMD at 72, idk why.

> you don't need a verifiable DKIM signature to know if the message had a valid DKIM signature when it was sent.

You seem to be trying to say that "the fact that it was delivered proves it had a valid signature when it was sent".

That presupposes that the headers indicating when it was delivered are correct, or that it was delivered at all in the first place.

I don't think you understand the attack.

I sent Thomas an email admitting to something scandalous.

A few months later, Mallory pops the server Thomas's email is stored on, and extracts his mail spool.

Mallory wants to prove to a third party that the email is authentic and not a fabrication.

I know it's real.

Thomas knows it's real.

Mallory is pretty sure it's real.

Alice, a reporter for the Daily Bugle cannot verify it is real, rather than Mallory's forgery.

I can claim it's a forgery, and point out that Mallory could have made it up and generated the signature with the published key.

Now, I may have a problem if it were a crime rather than something merely scandalous because then Bob, an FBI agent, decides to subpoena some logs and maybe prove when it was sent, but even so, logs typically don't have message content or even a hash of the message content.

I'm pretty sure I can do it in two hours.

Repudiation is the goal.

I've been doing this since around 2018, and have seen a few others implement it.

https://rya.nc/dkim-privates.html

It's being rewritten for content licensing reasons.

For TCP services, it won't send a large packet until the "client" provides a correct ACK packet to complete the three way handshake.

This would indeed be pants-on-head for UDP.

The objective here is to give script kiddies and other spray-and-pray attackers the finger.

I use vim, and program mostly in Python, Rust, TypeScript, JavaScript, C, and Bash. There are about a dozen other languages I use on occasion.

My vim configuration is moderately customized, and I regularly write code on systems I SSH into since my personal laptop is a Pixelbook.

The main things I rely on are syntax checking plugins.

I use ripgrep to find stuff in codebases, and when I'm working seriously I use an ultrawide monitor with plenty of screen space to have documentation I can glance at open.

I have a significant collection of small libraries I've written for common tasks, and often refer back to my own code across projects to figure out how to do things. Metaprogramming is something I do often too.

As another person said, thinking is my main constraint when working, not actually writing the code.

It should also be noted that I'm not primarily a "Software Engineer". I'm a Principal Security Engineer at a big tech company. If I'm working on actual code, it's generally "interesting", either a hard problem at work, or a personal side project. There tends not to be much boilerplate.

For TypeScript/JavaScript in particular, something like copilot would get in my way, as my style for this languages is extremely non-standard.

I'm not sure how much any of my coding habits have to do with it, but I regularly tear into unfamiliar codebases to fix bugs and add features, and I'm pretty good at orienting myself quickly, even in languages I haven't used before.

The first thing I did with Rust was add features to a data compression library without any prior exposure to the language...

I don't really care about these things that much, but I care about inequitable power.

A wealthy person should not be able to decide that they don't like some small minority and then influence public policy to enact policies which make them so miserable that some of them are driven to suicide.

I have to open two windows in my home office, otherwise the co2 just hangs around.

feels like i'm on reddit circa 2010

I wish you could see your comment as most people see it.

When you refer to "males" and "females", and especially use terms like "low-quality female" you sound absolutely unhinged.

Really weird for me to see someone talk about 2015 like it was "early days" at Palantir, having been there mid 2009 to early 2014.

#8 is wrong, T should be crossed out because it's the first letter of "the alphabet".

#18 is wrong, after the 15 comes 18, so 18 should be written in the blank space.

Bastards.

I have been doing a daily rotate/revoke/publish routine with my DKIM keys for years, though I do not use the standard private key format for size reasons.

No problems with it, but critically I revoke the public key a few days before publishing the private key.

https://rya.nc/dkim-privates.html

Like WiFi?

They probably can if you ask, but most people don't use wired networks at home.

Mine definitely supports Ethernet and WiFi with password, both what it connects to and the SSID it broadcast, though I had to change some settings on my AP (running OpenWRT) to get it to work.