irl_ · HackerTrans

vor 21 Tagendiscuss

At any moment some change outside my control could occur and my place in society would change. Right now I'm pretty self sufficient and don't really need the support of others in day to day life, but that can change, and there's nothing I can do about it. Seems like a good idea to use this opportunity to try and improve things for everyone, even if you don't care about others, just in case your place in society changes. (I actually think it's neat if we try to improve things for everyone for everyone's sake tbh but I get there are people that do not have such empathy)

irl_

vor 21 Tagendiscuss

I think this may be a US thing, in the UK at least unions work to promote solidarity.

irl_

vor 21 Tagendiscuss

I'm a director of my small company, and a member of UTAW. The union doesn't just help with employment disputes but also campaigns generally on improving working conditions for all, through things like health and safety and setting reasonable expectations for how work will be done.

irl_

vor 3 Jahrendiscuss

When I read this through 25 years ago I learned more about networking than I think I knew in total up until that point, and that was nearing the end of an A level (English further education) Computing course. It's a really comprehensive guide that laid it out exactly the way I needed it for me to absorb it. I still recommend it to people that might be new to network programming as the sockets API really doesn't change that much whether you're using C or Python or some other language.

irl_

vor 3 Jahrendiscuss

It's pretty upsetting that we've got India's UPI and China's UPI (UnionPay International) and they're both doing exactly the same thing and without geographical context you don't know which one it is.

irl_

vor 3 Jahrendiscuss

Like QuickBooks Online?

irl_

vor 4 Jahrendiscuss

That's nonsense. There are somewhere between 2 and 8 million users of Tor every day. The vast majority of Tor users are ordinary people that want a little more privacy. What a waste of resources it would be to try to identify and track each of them.

irl_

vor 4 Jahrendiscuss

If you need a primer for the primer: https://web.archive.org/web/20140118063258/http://notabug.co... (unfortunately it wasn't finished)

irl_

vor 4 Jahrendiscuss

China and Chinese Red Cross are different things.

irl_

vor 4 Jahrendiscuss

I know the title is the title on the actual article, but it's the Chinese Red Cross, not China itself. National Red Cross Societies are independent of the country's government. They may receive government funding but they decide what they do with the money themselves.

From https://www.ifrc.org/fundamental-principles

"The Movement is independent. The National Societies, while auxiliaries in the humanitarian services of their governments and subject to the laws of their respective countries, must always maintain their autonomy so that they may be able at all times to act in accordance with the principles of the Movement."

irl_

vor 4 Jahrendiscuss

SSH keys authenticate you. They are an identity. You probably don't need more than one or two identities (maybe personal and work). You can just get a couple of YubiKeys and configure the OpenPGP applet, or the PIV applet, with an authentication key/certificate and use that for SSH. Take the token with you and you've got some pretty strong authentication.

More modern SSH servers will let you use U2F security keys in the same way, which are cheaper than the full YubiKey.

I've learned recently that YubiKey has really good documentation for how to set up their tokens to achieve different goals, it would be worth reading their docs if you're considering getting a hardware token for your keys.

irl_

vor 4 Jahrendiscuss

I see. They didn't mention it on the two factor authentication page I was reading because they've split the security key and TOTP documentation and not made it obvious (enough for me to see it while skimming) how to find the former from the latter.

irl_

vor 4 Jahrendiscuss

Ok, I assume that's with FIDO/U2F, so that's not so bad.

At that point though, you already have a hardware token capable of holding SSH keys, so I'm still not convinced of the benefit.

irl_

vor 4 Jahrendiscuss

It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone.

This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single-factor + TOTP, where you previously had a phishing-resistant cryptographic protocol.

Is this really an improvement for security, or is it just a usability improvement (i.e. sync of keys) intended to work around policies trying to improve security (i.e. required use of keys)?

(The other option is I skimmed the docs badly and maybe I've misunderstood something, it's possible.)

Edit: I did skim the docs badly, it is possible to use a FIDO2/WebAuthN key for 2FA. https://support.1password.com/security-key/

irl_

vor 5 Jahrendiscuss

In modern TLS this just doesn't work, because you generate a shared key. You can verify what you've received from the server because you know you didn't generate it, but someone else cannot verify if any content was generated by you or the server, only that it was part of an exchange between you and the server.

irl_

vor 5 Jahrendiscuss

Missing from almost every calendar hosting thing I've used is the ability to publish free/busy information to allow others to schedule me into meetings without needing to be on the same system.

I'm pretty sure vCalendar supports this, just no one has implemented it.

If I could host a lightweight javascript app that let you browse the information until your client supports it properly that'd be cool.

irl_

vor 5 Jahrendiscuss

I have a TI-83 and an HP 19B II and both see regular enough use that they live on my desks (one at home, one in the office) rather than in the drawer. The calculator on my phone sucks (no history, difficult to enter anything more complex than adding up a few numbers) and I don't even know how to calculator on my Mac (because I never had a need to).

I use the calculator as an extension to my brain, it has a little memory and a lot of quick compute available, I know how it works well enough that it's all muscle memory and invisible to my conscious processing.

If quality scientific/business calculators ever go away I'll be sad.

comments