Brian Warner

Programmer. Mozillian. Creator of Buildbot. Co-founder of @Agoric and @TahoeLAFS. Crypto and security.

[Agoric @agoric]

Join @chainlink and @Agoric for Hack The Orb hackathon from Nov 6 to Nov 21. Using Agoric's #JavaScript smart contract platform and Chainlink's oracles, build #DeFi dapps and compete for your share of $10,000+ in prizes. Register Now 👇
https://t.co/ByShor1LmW

[@[email protected] kriskowal.bsky.social 🧙‍♂️ @kriskowal]

We @Agoric, including me and your former Mozillian @lotharrr, are saddened by the layoffs at Mozilla. Consider joining us to build open source solutions for a more secure JavaScript ecosystem, particularly around smart contracts. https://t.co/YqGpUxwvk2 #MozillaLifeboat

[Brian Warner @lotharrr]

@least_nathan We determined that the snap-packaged version only lets you touch files in your own home directory, and only if they're not dotfiles of $HOME itself (even if you're root). Kinda makes sense POLA-wise, but still pretty surprising.. still looking for a satisfying answer.

[Brian Warner @lotharrr]

@least_nathan Could you paste that into the ticket? Also mention how you built/got the lxc image? I think my failures were on a new VPS at some hosting company, which might influence the snapd configuration (whether sandboxing is enabled or not). Thanks!

[Brian Warner @lotharrr]

@ThisIsMissEm @mozilla Yeah, we built it in 2014 for a Firefox Accounts protocol which then got abandoned for a simpler scheme (see slide 18 in "my presentation" linked from https://t.co/qb91rO6zQb). If I did it again today, I'd use SPAKE2 or cPace, both are way better specified+proven than SRP.

[Brian Warner @lotharrr]

@veorq We used PAKE in Firefox Sync (2011-2014) to protect/transfer encrypted profile data between your browsers. We removed it because users were badly surprised during recovery flows (https://t.co/oYY8FjCo8u). I'd love to see it go back in some day but would need deep UX consideration

[Brian Warner @lotharrr]

@veorq No disasters yet (fingers crossed) but early in development I was pretty confused about "arbitrary elements" (M/N generators for the blinding points) and just used g^4. Seemed pretty arbitrary to me. Finally learned why they must be random (https://t.co/Dm7vYsOXuP) and fixed it.

[Brian Warner @lotharrr]

@veorq Magic-Wormhole uses SPAKE to let two previously unrelated computers find each other, generate a strong session key, then transfer an encrypted file. Without PAKE the transfer code would be too large for humans to easily speak/type.

[Brian Warner @lotharrr]

@bascule Maybe https://t.co/oQF3sAcXEq

[Agoric @agoric]

📢 Our next Speaker Series Talk has been announced! Join us on the 18th March to learn about #DistributedProgramming and the Agoric Blockchain OS Kernel 👀 https://t.co/1mei8iVq47

[Brian Warner @lotharrr]

@chrisquinnr @jimgbest @saltedbytes Thanks!

[Brian Warner @lotharrr]

@str4d Hmm, maybe it's time to dust off https://t.co/x2LpTRsM8r

[Nate ⓩ🛡 @nate_zec]

#rustlang Wishlist: `cargo depdoc` which is just like `cargo doc --open` except it *does not* try to build/doc the current crate, only dependencies. Motivation: frequently my crate fails to compile because I need to study dependency API docs, but `cargo doc` fails in this state.

[Brian Warner @lotharrr]

@feministPLT Done, let me know if you run into problems.

[Nicolas Wurtz @NicolasW_Tchoo]

Besoin de transférer un fichier d'un serveur/ordi à un autre derrière des NAT en sécurité ?https://t.co/vkeZJi1318 est une solution très simple et élégante #cli de transfert direct (avec un relais websocket pour le handshake, qu'on peut héberger soi).
Thx & great job @lotharrr !

[Agoric @agoric]

Here's a first glance at Zoe, a breakthrough #JavaScript library that enables developers to write safer, simpler #SmartContracts. @DeanTribble will be presenting it during his talk at #SFBW19 🎉
https://t.co/ZOBzGtchoh

[glyph @glyph]

definitely going to start calling the Catalina upgrade chsh prompt “the bourne ultimatum”

[Brian Warner @lotharrr]

@godsflaw @agoric Oh, wow, I hadn't thought of that. It's usually typed after an identifier: target~.method(args) . But yeah, wow that'd be annoying when you use the `target\n .meth1()\n. .meth2()\n` pattern, in an editor that auto-inserts the spaces for you, over SSH.

[Brian Warner @lotharrr]

@web3jp @agoric It's meant to read like method invocation: "x.methodname(args)" invokes a method on x *now*, "x~.methodname(args)" invokes a method on x in some future turn (and x can be a regular object or a Promise). https://t.co/ghmuwOtunN has some more details.