Readit News logoReadit News
wiktor-k commented on Getting ready to issue IP address certificates   community.letsencrypt.org... · Posted by u/Bogdanp
Tepix · 8 months ago
I think certificates for IP addresses can be useful.

However, if Let‘s encrypt were to support S/MIME certificates, it would have a far greater impact. Since a few years, we have an almost comical situation with email encryption: Finally, most important mail user agents (aka mail clients) support S/MIME encryption out of the box. But you need a certificate from a CA to have a smooth user experience, just like with the web. However, all CAs that offer free trustworthy¹ S/MIME certificates with a duration of a year or more² have disappeared. The result: No private entities are using email encryption.

(PGP remains unused outside of geek circles because it is too awkward to use.)

Let‘s encrypt our emails!

¹ A certificate isn‘t trustworthy if the CA generates the secret key for you.

² With S/MIME you need to keep your old certificates around to decrypt old mails, so having a new one frequently is not practical

wiktor-k · 8 months ago
> ² With S/MIME you need to keep your old certificates around to decrypt old mails, so having a new one frequently is not practical

You don't need to change your decryption key - the new certificate can use the same decryption keys as the old one (certbot even has a flag: --reuse-key). Whether this is a good idea or not is a separate question.

I think the biggest benefit would be ACME-like automatic certificate issuance. Currently getting a new certificate is just too much friction.

wiktor-k commented on Git Notes: Git's coolest, most unloved­ feature (2022)   tylercipriani.com/blog/20... · Posted by u/Delgan
stephenlf · 8 months ago
Yeah I wish GitHub supported these
wiktor-k · 8 months ago
As described in the post they did in the past: https://github.blog/news-insights/git-notes-display/
wiktor-k commented on Git Notes: Git's coolest, most unloved­ feature (2022)   tylercipriani.com/blog/20... · Posted by u/Delgan
imiric · 8 months ago
Interesting, I wasn't familiar with this feature.

I'm a big fan of conventional commits, and trailers seem like a better way of adding such metadata.

Is adding them manually to the commit message functionally equivalent to using the `--trailer` flag?

wiktor-k · 8 months ago
> Is adding them manually to the commit message functionally equivalent to using the `--trailer` flag?

Yes. The flag is perfect for scripts but it's exactly equivalent to adding the text manually.

wiktor-k commented on Using unwrap() in Rust is Okay (2022)   burntsushi.net/unwrap/... · Posted by u/pierremenard
skohan · 9 months ago
I always felt unwrap is preferable for diagnosing issues, which makes it useful in tests. A failed unwrap will point you directly to the line of code which panics, which is much simpler than trying to trace an issue through many layers of Results.

If you use `assert` in tests, I don't understand why you wouldn't also prefer unwrap in this context.

I think it's also perfectly reasonable to use in a context like binary you run locally for private consumption, or for instance a serverless function which allows you to pinpoint the source of errors more easily in the logs.

It's not a good fit for cases where you do expect cases where the unwrap will fail, but it's a great fit for cases where you believe the unwrap should always succeed, as it allows you to pinpoint the cases where it fails.

wiktor-k · 9 months ago
> I always felt unwrap is preferable for diagnosing issues, which makes it useful in tests. A failed unwrap will point you directly to the line of code which panics, which is much simpler than trying to trace an issue through many layers of Results.

Take a closer look at testresult since it also points directly at the exact line of failure (due to panics being used under hood) but looks nicer.

wiktor-k commented on The Red Programming Language   red-lang.org/p/about.html... · Posted by u/hotpocket777
TOGoS · 9 months ago
I wrote a paper on REBOL back in college. It is very interesting, but the syntax is definitely weird. You might think of the function call syntax as being sort of Forth-like, but with the tokens in reverse order. So like a Lisp, but without required parentheses. e.g. in the example

  send friend@rebol.com read http://www.cnn.com
`read` knows that it takes one argument, and `send` knows that it takes two, so this ends up being grouped like

  (send friend@rebol.com (read http://www.cnn.com))
(which I think is valid syntax; that AST node is called a 'paren').

Weirdly, the language also has some infix operators, which seem a bit out-of-place to me. I have no idea how the 'parser'[1] works.

[1] 'parsing' happens so late that it feels funny to call it that. The thing that knows how to treat an array as a representation of an evaluatable expression and evaluate it.

wiktor-k · 9 months ago
> I have no idea how the 'parser'[1] works

I think parsing there depends on the actual value of the current token. So if you assign send to another variable and use that the "parser" will still recognize that it takes 2 parameters.

It's an interesting design, definitely not something one sees frequently.

wiktor-k commented on Using unwrap() in Rust is Okay (2022)   burntsushi.net/unwrap/... · Posted by u/pierremenard
wiktor-k · 9 months ago
> That section briefly described that, broadly speaking, using unwrap() is okay if it’s in test/example code or when panicking indicates a bug.

I've come to the conclusion that even in tests unwraps look ugly. Especially in doc tests which serve as examples the code is better off using regular "?" that one would see in other parts of code. (that is: don't treat test code as a "worse" kind of code)

In Signstar we're using testresult which still panics under the hood (which is OK for tests) https://gitlab.archlinux.org/archlinux/signstar/-/blob/main/... but the rendered example looks a lot better: https://docs.rs/nethsm/latest/nethsm/enum.OpenPgpVersion.htm...

Note that I'm currently maintaining that crate but the design is described at https://www.bluxte.net/musings/2023/01/08/improving_failure_...

wiktor-k commented on WireGuard vanity keygen   github.com/axllent/wiregu... · Posted by u/simonpure
burnt-resistor · 9 months ago
Reminds me of people where I worked having vanity GPG key ids. I'm wondering how much CPU time and on what machines it took to find them.
wiktor-k · 9 months ago
Key IDs are based on fingerprints and fingerprints are calculated by SHA-1 hashing the primary key's public key and the creation timestamp. A computationally easy way to influence the fingerprint is to tweak the creation timestamp which is a 32 bit Unix epoch value. Of course it needs to be in the past so the range is limited but it's faster to do it this way instead of recomputing the cryptographic key.
wiktor-k commented on Google is building its own DeX: First look at Android's Desktop Mode   androidauthority.com/andr... · Posted by u/logic_node
assassinator42 · 9 months ago
Rumor is Samsung won't support Google's Linux Terminal (at least for their existing phones) since their Knox conflicts with the Android Virtualization Framework :-(.

Honestly I'd like to see Windows 11 running under this as well, but that seems incredibly unlikely.

wiktor-k · 9 months ago
It's interesting to hear because Samsung had a Linux feature previously: https://developer.samsung.com/sdp/blog/en/2017/10/18/samsung...
wiktor-k commented on Judge rules Apple executive lied under oath, makes criminal contempt referral   thebignewsletter.com/p/ju... · Posted by u/connor11528
Osiris · 9 months ago
Given that the CFO encouraged Cook to violate the court order tells me that they calculated that

1. Any fines for not complying would be less than what they would lose by complying

2. That no individual would suffer any consequences for blatantly disobeying a court order.

In my opinion, the whole concept that a company can break the law but no human can be held responsible is insane.

I really hope that criminal charges are brought against those involved in making a conscious choice to both lie to the court and ignore the court order. Hopefully that will make other executives think twice when put in the same situation.

wiktor-k · 9 months ago
> In my opinion, the whole concept that a company can break the law but no human can be held responsible is insane.

Wait, isn't the board personally liable for their decisions? I'm not a lawyer, obviously.

u/wiktor-k

KarmaCake day184May 13, 2019
About
I work on cryptographic software and integration with hardware security modules (TPMs, PKCS#11...)

aspe:metacode.biz:CK7LM6VO32K2AGIDXC7LYFRBSA

https://github.com/wiktor-k

View Original