y0ghur7_xxx

Sorry I have to chime in, because there is also my very own nntp server with also a web interface for people who don't want to download a client: https://in.memory.of.e.tern.al/comp.misc/

There are still some people there, and talking about stuff. It's very much like hacker news, but with much less people :)

> They fail because of severe checklist fatigue

> checklists often leaves a lot to be desired.

You say yourself that checklists are great, and it is proven that they save lives. So if there is fatigue in using them over and over, and they are not perfect, well... get over it? Sure i can understand that it's boring to go through the same checklist 5 times a day, but come on, there are lives at stake here. If one of your wife patients gets an infection and dies because she forgot some important, simple, step because of "checklist fatigue" how would she feel?

> Certificates which are perfectly good for communication and do not pose any significant security risk.

Is it so? I remember that in 2008 someone was able to create a rouge CA certificate because of the predictability of serial numbers[1]. It was a different time: we still used md5, but are you sure the limited entropy used to generate serial numbers does not pose any security risk?

[1]https://www.win.tue.nl/hashclash/rogue-ca/

Actalis is a major Italian CA that works mainly with big banks and the public sector, like (from the bug report)

- the Tuscany Region (e.g. O=Rete Telematica Regionale Toscana, etc.)

- the Piedmont Region (e.g. O=CSI Piemonte, etc.)

- central public government (eg. O=Bank of Italy, Ministry of Transports, etc.)

- major banks (e.g. O=Unicredit S.p.A., FinecoBank, etc.)

- large private companies (e.g. O=SNAM, Terna, Wind, etc.)

- chambers of commerce

It has to be baked into the CA, so that a browser vendor can check it before inclusion. If the CA specifies domains it is not allowed to sign certificates for, it will not be included.

There is a Name Constraints extension in X.509[1] that does exactly that, but to my knowledge no browser implements it.

[1] https://tools.ietf.org/html/rfc5280#section-4.2.1.10

The referrer header is in no way a tool to differentiate real users from a ddos attack.

> but is this a common sentiment

It is. One more statistical point: I started reading, saw that phrase, closed the tab and came here for the comments.

It's not scanning only port 3000:

    const portsToTry = [
      80, 81, 88,
      3000, 3001, 3030, 3031, 3333,
      4000, 4001, 4040, 4041, 4444,
      5000, 5001, 5050, 5051, 5555,
      6000, 6001, 6060, 6061, 6666,
      7000, 7001, 7070, 7071, 7777,
      8000, 8001, 8080, 8081, 8888,
      9000, 9001, 9090, 9091, 9999,
    ];

view-source:http://http.jameshfisher.com/2019/05/26/i-can-see-your-local... :125

That's awesome. I hope that all asian phone manufacturers like xiaomi, sony, samsung, and others get together and make an alternative to ios and android. They are big, and they can pull it of. Android apps compatibility is a big plus. Finally some movement in the market.

I don't think so: neither of those tools sign the message with the same RSA keypair. sshenc.sh for example does not sign the message whatsoever. An attacker could just intercept a ciphertext, drop it, encrypt a different message and send that.

Those tools are not meant for sender authentication. If you want that you would have to first share the senders pubkey with the recipient, and sign your message with the corresponding privkey.

> @Benjojo12 and I are building an encryption tool that will also support SSH keys as recipients, because everyone effectively already publishes their SSH public keys on GitHub.

Is this not already possible with tools like https://ssh-vault.com/ and (shameless plug) https://sshenc.sh/?

Those tools use the RSA keys to encrypt a symmetric key that is then used to encrypt the data, but the outcome is effectively the same. No?

I agree with you. Germany did not accomplish it's goal of CO2 emissions reduction, but in the process of trying it did a whole lot of other great things. And I hope we will all learn from the experience Germany made and it will contribute to all of our next efforts.

> I don't see why we shouldn't transition to renewable energy asap anyway

I am no expert, and I think neither are you, so we are just making some small talk here, but: I think we don't have the tech to go all in on renewable. Solar is cool and all, but where do we store the energy? Batteries don't scale at a global level (for now). I mean look at Germany: they tried. They got off nuclear and now they emit more CO2 than when they started because they had to revert back to coal.

I see no easy solution to this. Not for now. And for sure it's not something like "let's just switch to wind and solar and we are good".

> Particularly in the case of families, the notion that food delivery will ever become cheap enough to be a default relies on negating delivery costs.

I live in Italy and delivery cost is like 2,50€. And it's the same if I order food just for myself or for 4 people. So I would say that the delivery cost is cheaper per person for families than for a single person.

> especially when the metrics being optimized for usually aren't in the users' best interests

I don't think so. Mozilla is not google, and apart from the mr. Robot error, that they apologized for, I am sure Mozilla is using it for making the browser better, and not to use you for targeted ads like the other browser maker does.

I agree about the settings. I really hope the plasma mobile guys get something ready for when the phone starts to ship.

I really like thunderbird. Because it is the only client I know of that has all the features I use:

- multiple identities

- multiple accounts

- a very good search

- imap idle support

- nntp client

It could be better on a lot of aspects, like the ui looks a bit outdated (I use it on kde, so it does not integrate very well with the rest of the de), the search could use some more filters, and I can not sort folders in the left pane. But apart from that, it has all the bells and whistles a real email client needs to have to make it really useful.

Works fine on Firefox 66.0.3 (64-bit) on Linux.

> The whole point of semver is that it allows people to know if they can upgrade version without hitting incompatibilities. So yes, this would be a 2.2 and those on 2.1 would know that they could upgrade to it without worrying about fixing their own integrations.

No. Semver states quite clearly that "Major version MUST be incremented if any backwards incompatible changes are introduced to the public API.".

It does NOT state that the Major verson MUST NOT be incremented if the api has no backwards incompatible changes.

You can increment the MAJOR component of the version number at your will. So this is quit clearly a 3.0.0 release. Or it could be a 40.0.0 release and it would still be valid semver.

It will start to ship in Q3 this year.

My honor already does this: https://vgy.me/mSUFiV.jpg

Is this feature only found on honor/huawei phones?

This looks really nice. Can't wait to try it out later today. Anyone with a gmail account can use it, and there is no need to install the app if you don't want to.

maybe there is a * missing:

Roaming is the new normal*

*in Europe[1]

[1]https://europa.eu/youreurope/citizens/consumers/internet-tel...

They can just buy an other phone. It's not like you HAVE to buy an iPhone.

> When someone shows me an: open sourced, graphical, log based, spam ip filtering, self hosted, server alternative to GA that I can set up in < 10x the time I will happily switch to it.

If privacy is your core business you make compromises, and you should be prepared to spend some time to set up something like a self hosted piwik instead of using GA.

This should be obvious.

Of course if your site is about your new facebook app, just go ahead and use GA, nobody will bother you about it.

What is the alternative? What do you propose?

> Public & untrusted != Unencrypted

This is exactly my point.

> By that logic, we shouldn't bother securing wifi APs because everything's encrypted at the application layer anyways.

Sure. Why not? I do banking and I read my email on public, untrusted networks like airport and hotel wifi, Starbucks and the internet.

I see not problem with that.

> So it is a nice step in the right direction, but we are not there yet.

Even if it's not perfect, it's like a million times better than everything else around.

Perfection will come. Maybe.