sansnom · HackerTrans

il y a 3 ansdiscuss

It's a very good news for security and also for 99.99% of the Android users. But get me wrong, it would be nice to support power user, they just need to add a feature to easily add a chosen CA and it would be perfect.

Currently CA management was very dangerous because it was not updated (as stated in the article).

New CA were not added so if you kept your phone long enough you would see insecure warning popping up. People would take the habits of accepting without thinking: very problematic behaviour. One solution is to used Firefox which doesn't use the system CA unlike Chrome.

Another more problematic one: untrusted CA were not removed (the author give the example of TrustCor but they were other examples in the past like DigiNotar). Who knows what happens to private key of old untrusted CA ? If they end up in the wrong hands people could get MITM. (Personally, I had to remove DigiNotar for my old phone.)

And of course as the author said: it's also problematic for new certificate authority like Let's Encrypt which at a time needed the complex cross sign certificate to ensure the certificates work for everyone. [1][2]

[1] https://letsencrypt.org/2020/11/06/own-two-feet.html [2] https://letsencrypt.org/2020/09/17/new-root-and-intermediate...

sansnom

il y a 3 ansdiscuss

The problem is "client credential" flow is not always available... And even if it were it might not as easy as you claim. In particular if you want to have an access token working on several instances. Most implementation allows only one access token at once so you need to have a shared storage and synchronization just for that...

If you are developing an API please have mercy: provide something other than OAuth. For me, avoid OAuth unless there is 3 distinct parties.

sansnom

il y a 5 ansdiscuss

Didn't know about Syncthing but it reminds me about Infinit, it had the exact same features 7 years ago (P2P sync with simple ID for registration). It was bought by Docker [1] and pretty much disappear I think.

I just checked Syncthing, seems pretty old also (8 year for 0.1) !

[1] https://www.docker.com/blog/docker-acquires-infinit/

sansnom

il y a 6 ansdiscuss

The 1/2000 could be valid for your age group (we will need to check the real number of people who caught it be sure of the IFR) but is not necessary accurate for you (could be more or less).

In France, in Marseilles, they studied all people who died from covid in the hopsital during the first episode. They calculated the Charlson score for each patient. What they found is that very large majority of people who died have a low life expectancy and all expect 2 patients have one or more co-morbidities (cancer, diabetes, etc).

So if you are healthy then you real risk is below the average of the same age group.

sansnom

il y a 6 ansdiscuss

Nice tool.

I think we could improve it a bit. For example, Spring boot should have a very low score for me. It's backed by a large company Pivotal. They don't need any support I think. Same thing for elasticsearch.

For me:

    - backed by a large company ? 
 
    - number of contributor doing 80% of the work ? or active in the last 12 months ? commits breakdown (99% is done by one guy) ?  

    - issues created/closed ratio  

    - PR created/merged ratio  

    - use critical projects ?  

    - other from your original score

A nice bonus: if we could use the tool to assess critical score for our project (not globally). For local dependency, we could increase the critical value if dependents count is low. Very few person is using it: that's a bad sign. With this, we could find those dependencies.

We could also create a global score (like you did) by using the previous score and scaling it using the dependency usage (dependents_count like you did).

With this calculation, I think it's more likely to find relevant projects.

How to find it's backed by a large company ? Not sure about this, we can check if the project is part of an organization, if contributor have a company or if they have a pro account. For example, if the top 5 contributors are from Google, it's likely it's sponsored by it(could be done during their free time but less likely).

Note: check what happens with a stable project (no new issue and PR).

sansnom

il y a 6 ansdiscuss

So true. I hope we could listen to real expert (like Pr Didier Raoult) instead of so called expert like this Derek Lowe (PhD in organic chemistry, he is no expert in infectious disease at all).

In France, when Pr Didier Raoult in 25th of February [0] said that the chinese found that chloroquine was effective like it is effective against SARS-CoV (2003) [1], it was considered a fake news by "Le Monde" one of the most read journal in France...

Only now, because he has published a study [2], people are starting to say: "may be we need to check further"...

Everybody was saying: "Yeah, but there is side effect". Their team has used this drug for decade and know exactly how it works and how to use it...

So people, please, please, let's the real expert do the talking.

[0] https://www.mediterranee-infection.com/coronavirus-vers-une-... [1] https://virologyj.biomedcentral.com/articles/10.1186/1743-42... [2] https://www.mediterranee-infection.com/hydroxychloroquine-an...

comments