Paco Hope #BLM

#Cloud #Security Consultant at #AWS. Based in #Virginia, USA. Opinions are my own, etc. Moderator at infosec.exchange

  • 0 Posts
  • 15 Comments
Joined 6 years ago
cake
Cake day: September 27th, 2018

help-circle

  • @araquen @TheBaldness This only makes sense when the ratio of computers to users is exactly one. If more than one person uses the same computer, you don’t want person A’s favourite settings interfering with person B. On the flip side, a person who uses more than one computer wants to easily bring their settings with them from one computer to the next. The bits that personalise the experience should be stored in the person’s personal space.

    There is no good answer. Put the configs in the app’s location, now every ordinary user needs write access to where programs are stored, just to store their preferences. Virus-writer’s paradise. Put them in the personal folders and now you have all this cruft and crap leftover from programs long since forgotten and uninstalled. It’s neither sloppy note careless. It’s a hard problem that doesn’t have a simple elegant answer that’s perfect for everyone.








  • @tinselpar @sdx I disagree. I’ve been self-hosting my email since 1998. I routinely end up on blacklists and low-reputation IP lists and other situations that limit my email from reaching people.

    The big players like gmail, outlook, yahoo have absolutely no method of appeal or explanation. You can submit to an opaque form and maybe email starts getting delivered again. But you’ll never get a reason or even a notification that they made a change. It is a constant labour: So much so that I pay a monitoring service to alert me if my server ends up on a list somewhere.

    Look at paco.to and look for issues. It’s “right” in terms of SMTP standards and compliance. This stuff happens to me ALL THE TIME.

    I was emailing my local government office and had to call them to find out why they weren’t replying. All my mail was going into a junk folder for no reason that I could see or control.

    When big players adopt something, small players must also, or we lose the ability to send email to massive numbers of people.

    So while it is “possible” to run your own small email server, the dominance of a few absolutely massive players makes it a lot of work for the small operator.


  • @hedge doing the math is one thing. Deciding on the semantics of what it MEANS is something else. If it verifies, what does that mean? Does it mean the contents of a file are “good” (valid, trustworthy, not malicious, complete, etc)? Does it mean you know WHO signed it? And what does that WHO really mean? A person, an organisation? Was the user that caused the signature authorised to do so? What do you believe about the identity, knowing that the certificate validated?

    And if the certificate DOESNT verify…what does it mean? Does it mean the contents were modified? Does it mean the contents are invalid? And HOW does it fail to verify? Was the signature made before the NotBefore date? Was the signature made after the NotAfter Date? Is the certificate fine and the signature valid, but the certificate who signed the certificate who made the signature somehow untrustworthy? Or maybe the certificate you have is a tampered certificate where the identity has been modified, but the cryptographic math of the signature on your file checks out. So the contents of the file are probably fine.

    We don’t ask these questions. And we definitely don’t answer them. As James Mickens says in his talk about computer science, “The stuff is what the stuff is, man.”