y0ghur7_xxx

Just put apache or nginx in front of it and let that handle auth.

I used this one a few months ago: https://github.com/Smile-SA/node-pushserver

Works for android as well, and has a nice web interface too.

and ... you have to wonder if the rest of the post can recover its credibility, or whether it will continue as an unreasoned rant.

and then goes on a rant that lasts half the blog post.

Yes, but TACK, even if it's a big step forward, does not address the main problem: we need to get rid of a central authority we have to trust. And TACK does nothing to address that. And neither does Certificate Transparency as proposed by Google.

I really feel the correct step forward is Convergence or Perspectives. If just browser vendors would jump in, we could use it right away. Mozilla/Google could set up a few notaries and set them as trusted by default in the browser. They choose the CAs they put in our browsers anyway, so we trust them already. That trust could be implemented with notaries instead of the CA model, so if someone wants to setup their own notaries they can.

What's your take on this? I value your opinion on security matters.

I don't understand this. Can someone weight in with an explanation? Convergence works just fine without TACK: I can set up two or more notaries on some VPS somewhere, and my browser would check if the notaries see the same certificate on that server I am trying to connect to as my browser. Seems secure to me: no external CA involved, the certificate on the web server can be self signed, and a MITM attack would need to hack two or more external servers to be successful. How does TACK fit in all of this?

> certificate pinning as implemented in Chrome doesn't depend directly on key continuity.

But it's unsuitable for the entirety of the web. You can't hardcode all certificate fingerprints of the whole internet inside the browser.

>> The migration away from the CA model is called "certificate pinning".

> key continuity destroys the incentive to attack sites by compromising CAs

We need to ELIMINATE CAs (CA as in some third party (google, Verysign, GoDaddy, ...) who you have to trust). The whole concept of trusting a CA is broken, and pinning does nothing to address that, at least not in the proposed TACK implementation.

Some say it's not dead¹. But it doesn't seem to have any traction, which is a shame.

Perspectives is a similar project and seems more alive with a release in February: http://perspectives-project.org/2014/02/15/perspectives-4-4-...

¹https://twitter.com/ivanristic/status/400624593515192320

The only problem I see with https everywhere is the current CA system. I don't trust CAs, and I don't want to pay them. If we can get rid of them somehow there is nothing in the way of https everywhere anymore. I really like the http://convergence.io/ approach, but anything else that gets rid of a central authority I have to trust will do for me.

> What about those with disabilities and use screen readers or braille displays?

Screen readers work just fine with js generated content¹². I don't know about braille displays, but I guess they work the same.

¹http://stackoverflow.com/a/18861097

²http://www.brucelawson.co.uk/2011/javascript-and-screenreade...

Because who made it decided he liked to do it with js instead of serving static html. There is nothing wrong with that. It's not an api, it's designed to be consumed by browsers. And browsers have js enabled by default and make it very difficult to disable it. It's a problem only for you because you willingly decided to browse in crippled mode.

Mozilla Persona authenticates you using your email without the need to check your email every time (and without the need to enter your email password if you are already logged in).

Persona is awesome for that, and for the "no central authority" thing. To bad it lost momentum and seems an awesome relict inside of Mozilla.

> Ideally you'd want your TLS keys to be stored in an HSM

Does an open spec HSM module exist? I can be somehow sure that linux and apache/nginx don't have backdoors as the source is audited by many people, but I need to be "sure" of my HSM too.

Yes. Here is a PoC in Python:

https://gist.github.com/takeshixx/10107280

On line 42 is the heartbeat request payload. 40 is the length of the message in hex = 64 bytes.

> But it's much simpler than HTML.

I don't know. Everybody knows HTML. It's pretty easy.

> If people input with HTML then you're going to need to filter which tags you do and don't want to pass through.

That's a solved problem¹²³.

> Markdown just gets rid of stuff like that.

And you can only use a subset of HTML. I guess there are pros and cons.

> Not to mention automatic paragraphing.

   <p>...</p>

¹https://code.google.com/p/owasp-java-html-sanitizer/

²https://github.com/rgrove/sanitize

³http://code.google.com/p/google-caja/wiki/JsHtmlSanitizer

TACK needs Browser support ASAP. It's around since over a year and it seems dead... I hope Chrome and Firefox pick it up soon.

> While I like eclipse for java, are you sure it is great js editor?

For me, for now, yes. Like you I keep an eye on Brackets (and on LightTable as well).

I like eclipse too. It's the only editor that I know of that

- I can configure to handle spaces/tabs/line endings the way I like (for example: I use tabs, but when I open a file that someone else made that uses spaces to indent code, the editor should understand this and use spaces instead)

- works great with git

- the package explorer is functional and gives a lot of info about the files I am working on

- works great as js editor

- works great as java editor (refactor/rename stuff, generate getters and setters/override methods, ...)

- the outline view is really useful

What makes me angry every time with eclipse tho, is that it is so awkwardly slow to startup, and the pauses it makes when building stuff in the background.

If someone knows of a better editor that can do the things above, is quicker and mybe uses less memory too, I am sold.

Thank you

> http://whatsmyresolver.stdlib.net/

I didn't know this could be done. I am using powerdns on my own server at home, and it displays correctly my ip address. Can you give me some pointers to understand how this works?

> If what you're using it for is HTTP traffic, HAproxy seems to be the most mature tool out there for HTTP load balancing and failover.

HAproxy is a reverse proxy, it can do load balancing, but it's not useful if you need a HA cluster, as HAproxy becomes the single point of failure in your architecture. You still need something like wackamole, vippy or ucarp to activate the switch from a failed machine to a standby box.

And there is also vippy, that is written in node.js and looks really good, but I didn't have the pleasure to try yet:

https://github.com/postwait/vippy

No mention of Wackamole¹ in the article, and I feel really compelled to mention it here, as it is really simple to set up a HA cluster using it. I followed this howto² a few months ago. It was really easy to configure and it runs stable since.

¹http://www.backhand.org/wackamole/

²http://www.howtoforge.com/setting-up-a-high-availability-loa...

> Google is already executing js

Any idea then why people keep saying¹ that "Serving HTML from the server is great for search engines"?

And why should we use this² when google is perfectly capable of executing the js and get the html output all by itself?

¹[citation needed]

²https://developers.google.com/webmasters/ajax-crawling/docs/...

> Serving HTML from the server is great for search engines.

Google and the other search engines should go with the times and start to render and index single page js applications just like they index html pages. Executing js on the server and get the resulting output is a solved problem. JS is enabled by default on all browsers that matter (and very difficult to disable), I don't understand why we still have to play nice with search engines and render the html on the server as well just for them.

> Wouldn't editing source like this make your mobile software difficult to patch?

Why? Looks pretty easy to me.

> If so, it seems like it would be a security risk.

How?

> Respect for your privacy is coded into our DNA

I believe you, but I don't believe that Facebook shares your principles.

> Despite having no real UI it requires jQuery UI

Where?

    $ git clone https://github.com/OscarGodson/EpicEditor.git
    Cloning into 'EpicEditor'...
    remote: Reusing existing pack: 2951, done.
    remote: Total 2951 (delta 0), reused 0 (delta 0)
    Receiving objects: 100% (2951/2951), 1.53 MiB | 192.00 KiB/s, done.
    Resolving deltas: 100% (1392/1392), done.
    Checking connectivity... done.
    $ grep -ir jqueryui EpicEditor/|wc -l
    0
    $

remids me of this: http://www.sorting-algorithms.com/

not as nice, but shows different algorithms and their speed

The title is wrong. A correct translation from German would be "Germany plans to to defend against USA spying."

I hate it when people mix tabs and spaces

https://github.com/ellisonleao/clumsy-bird/blob/master/js/ga...